summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)Author
2015-10-24Merge pull request #522 from LuttyYang/masterHannu Nyman
luci-theme-material: fix some style bugs
2015-10-24luci-theme-material: fix some style bugsLutty Yang
Signed-off-by: Lutty Yang <lutty@wcan.in>
2015-10-23Merge pull request #521 from LuttyYang/masterHannu Nyman
luci-theme-material: Synchronized to the LUCI version f9e590a
2015-10-23Revert "luci-theme-material: do not infer login state from url (#520)"Hannu Nyman
This reverts commit f9e590aa4741bf337029be3f374a33543cc3f37b in order to enable a clean merge of the PR #521 from the theme author. Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
2015-10-23luci-theme-material: try find current position by using lua codeLutty Yang
thanks for jow Signed-off-by: Lutty Yang <lutty@wcan.in>
2015-10-23luci-theme-material: Synchronized to the LUCI version f9e590aLutty Yang
Signed-off-by: Lutty Yang <lutty@wcan.in>
2015-10-22luci-theme-material: do not infer login state from url (#520)Jo-Philipp Wich
Checking for `;` in the url is no good indicator whether a user is logged in, instead query the dispatcher and set a `logged-in` CSS class on the `<body>` element if a session exists. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-22luci-mod-admin-full: fix invalid markup in packages.htm (#518)Jo-Philipp Wich
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-22luci-mod-admin-full: restructure and fix backup, restore and sysuprade (#517)Jo-Philipp Wich
Do not use standard post security checking for actions that require file upload since reading the token value will trigger parsing of the http message body before the file upload handler has been set, which causes LuCI to buffer the entire request body in memory. In order to simplify the code and logic flow, split action_flashops() into separate handlers for reset, backup, restore and sysupgrade. Let the backup restore and sysupgrade handlers use the new test_post_security() method in luci.dispatcher to perform token checking *after* setting the upload handler. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-22luci-base: dispatcher expose test_post_security()Jo-Philipp Wich
Allows external code to perform POST and token checking manually. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-21luci-base: ensure that base url is emitted with trailing slashJo-Philipp Wich
Now that we don't have an url token anymore, '/cgi-bin/luci' becomes a valid url while cookies are restricted to only '/cgi-bin/luci/' and below. In order to ensure that the first request after login refers to a path covered by the authentication cookie, change build_url() to always append a trailing slash if we're referring to the base url. This should fix the login problems mentioned in #516. While we're touching the dispatcher, also remove remaining url token code. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-21luci-mod-admin-full: do not access dispatcher.context.urltoken in logoutJo-Philipp Wich
The urltoken table is going to be removed. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-21luci-base: remove security token from urlsJo-Philipp Wich
Now that sensitive urls require post requests and only accept them if a valid security token is sent along the request, we can drop the global random url token to improve LuCI usability. The main improvement is the ability to use multiple tabs with the same login session, but also deep linking to specific urls without the need for another login becomes feasible, e.g. for documentation purposes. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-21luci-app-upnp: protect lease delete call with csrf tokenJo-Philipp Wich
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-21luci-app-splash: protect admin status call with csrf tokenJo-Philipp Wich
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-21luci-app-radicale: protect start/stop actions with csrf tokenJo-Philipp Wich
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-21luci-app-privoxy: protect start/stop actions with csrf tokenJo-Philipp Wich
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-21luci-app-ocserv: protect disconnect action with csrf tokenJo-Philipp Wich
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-20luci-app-ddns: protect start/stop actions with csrf tokenJo-Philipp Wich
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-20luci-mod-admin-full: protect iptables counter reset and restart with tokenJo-Philipp Wich
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-20luci-mod-admin-full: protect network post actions with csrf tokensJo-Philipp Wich
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-20luci-base: filter invalid opkg status linesJo-Philipp Wich
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-20luci-mod-admin-full: protect clock, flash and opkg ops with submit tokenJo-Philipp Wich
* Use post_on() target to require csrf token verification for modifying actions * Ensure that package and flash operation handlers guard modifying operations with parameter check Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-20luci-base: generalize post security token handlingJo-Philipp Wich
* Add a generic helper function to check need for post / csrf token validation * Remove custom token verification in cbi targets * Support requiring post security depending on specific submit parameters, usable through post_on() action Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-13Merge pull request #513 from LuttyYang/masterHannu Nyman
luci-theme-material: PR from Version 0.2.11
2015-10-13luci-theme-material: PR from Version 0.2.11Lutty Yang
Signed-off-by: Lutty Yang <lutty@wcan.in>
2015-10-13i18n: Sync translationsHannu Nyman
Sync translations to the current strings. Changes in luci-app-ddns, luci-app-mjpg-streamer, luci-app-qos, luci-app-shadowsocks-libev, luci-app-statistics and luci-base Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
2015-10-13luci-base: update i18n base templateHannu Nyman
Update i18n base template to match the current strings. Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
2015-10-13luci.mk: correct SK language name to SlovakHannu Nyman
SK language code refers to Slovak, not Slovene. Native language name is correct. References: https://forum.openwrt.org/viewtopic.php?id=60235 https://en.wikipedia.org/wiki/Slovak_language Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
2015-10-12luci-app-ddns: fix typo in previous commitJo-Philipp Wich
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-12Timezone information: update to 2015gHannu Nyman
Changes in 2015g: http://mm.icann.org/pipermail/tz-announce/2015-October/000034.html Norfolk moves from +1130 to +1100 on 2015-10-04 at 02:00 local time. Fiji's 2016 fall-back transition is scheduled for January 17, not 24. Fort Nelson, British Columbia will not fall back on 2015-11-01. It has effectively been on MST (-0700) since it advanced its clocks on 2015-03-08. New zone America/Fort_Nelson. Note: the Turkey-related one-time rule change is not apparently catched by the zoneinfo2lua script, so that change is not included in this commit. (Turkey's 2015 fall-back transition is scheduled for Nov. 8, not Oct. 25.) Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
2015-10-12luci-app-ddns: remove title <a> hacksJo-Philipp Wich
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-08Merge pull request #505 from roger-/dump1090-latlonJo-Philipp Wich
dump1090: lat/lon should be floats
2015-10-07dump1090: lat/lon should be floatsRoger
Signed-off-by: Roger D <rogerdammit@gmail.com>
2015-10-08luci-base: prevent UCI changes in CBI if form is not in submit stateJo-Philipp Wich
Only process submitted data if the "cbi.submit" parameter is present as the dispatcher will verify the integrity of the CSRF token in this case. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-07Globally replace luci.dispatcher.build_url(...) with url(...) invocationsJo-Philipp Wich
Also concat multiple string arguments into one while we're at it. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-07luci-base: expose luci.dispatcher.build_url() as url() in templatesJo-Philipp Wich
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-07luci-base: protect simpleforms with CSRF tokensJo-Philipp Wich
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-07luci-mod-admin-full: switch to POST action for rebootJo-Philipp Wich
Also rework the reboot tmeplate a little bit. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-06luci-base: switch to POST action for service reloadJo-Philipp Wich
Switches the service reload calls to CSRF token protected POST action. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-06luci-mod-admin-full: switch to POST actions for UCI changesJo-Philipp Wich
Switches UCI apply/revert/save to CSRF token protected POST actions. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-06luci-theme-bootstrap: add redir parameter to uci change menuJo-Philipp Wich
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-06luci-theme-material: add redir parameter to uci change menuJo-Philipp Wich
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-06luci-base: protect CBI forms with CSRF tokensJo-Philipp Wich
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-06luci-base: add support for POST-only actions with CSRF token checkJo-Philipp Wich
Add the dispatcher infrastructure to restrict certain routes to POST requests only in conjunction with verification of CSRF tokens. This is the first step to get rid of the CSRF token in the url in favor to tokens embedded in forms. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-06Merge pull request #503 from LuttyYang/masterHannu Nyman
luci-theme-material: fix some style bug in LUCI newest version
2015-10-06luci-theme-material: fix some style bug in LUCI newest versionLutty Yang
Signed-off-by: Lutty Yang <lutty@wcan.in>
2015-10-06Globally convert headline anchors into name attributes.Jo-Philipp Wich
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
2015-10-05Merge pull request #501 from LuttyYang/masterJo-Philipp Wich
luci-theme-material: PR from version 0.2.6
2015-10-05luci-app-statistics: reorder interface, netlink and openvpn datasourcesJo-Philipp Wich
This aligns the order and grouping of RX and TX network datasources. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-23 20:19:21 +0000