summaryrefslogtreecommitdiffhomepage
path: root/modules/luci-mod-system/luasrc
diff options
context:
space:
mode:
Diffstat (limited to 'modules/luci-mod-system/luasrc')
-rw-r--r--modules/luci-mod-system/luasrc/controller/admin/system.lua10
1 files changed, 7 insertions, 3 deletions
diff --git a/modules/luci-mod-system/luasrc/controller/admin/system.lua b/modules/luci-mod-system/luasrc/controller/admin/system.lua
index 4e83769ee0..8d9305f4fd 100644
--- a/modules/luci-mod-system/luasrc/controller/admin/system.lua
+++ b/modules/luci-mod-system/luasrc/controller/admin/system.lua
@@ -319,9 +319,13 @@ function action_backup()
end
function action_backupmtdblock()
- local http = require "luci.http"
- local mv = http.formvalue("mtdblockname")
- local m, s, n = mv:match('^([^%s]+)/([^%s]+)/([^%s]+)')
+ local mv = luci.http.formvalue("mtdblockname") or ""
+ local m, n = mv:match('^([^%s%./"]+)/%d+/(%d+)$')
+
+ if not m and n then
+ luci.http.status(400, "Bad Request")
+ return
+ end
local reader = ltn12_popen("dd if=/dev/mtd%s conv=fsync,notrunc 2>/dev/null" % n)