summaryrefslogtreecommitdiffhomepage
path: root/modules/luci-base
AgeCommit message (Collapse)Author
2018-04-26luci-base: handle bodies of non-POST requests as wellJo-Philipp Wich
Decode the HTTP message bodies of any request carrying a Content-Length header, not just those in POST requests. This allows handling parameters in other methods, OPTIONS in particular. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-26luci-base: update japanese translationINAGAKI Hiroshi
Updated japanese translations. Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
2018-04-24luci-base: additionally return error code strings in luci.util.ubus()Jo-Philipp Wich
Add a 3rd return value to luci.util.ubus() containing the string value of the error return value. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-24luci-base: ensure that file upload values have lengthJo-Philipp Wich
Ensure that the (table) length of a file upload value has nonzero length by initializing the first table index with the file name. This fixes tests in the form x = luci.http.formvalue(...) if x and #x > 0 then ... end Fixes #1763. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-22luci-base: decode plus signs in x-www-form-urlencoded POST dataJo-Philipp Wich
Depends on 5ef51b2ab ("lucihttp: update to latest HEAD"). Fixes #1755. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-21luci-base: ship rpcd uci access ACLJo-Philipp Wich
Ship an ACL definition for granting full read/write access to uci configuration files via ubus rpc. This is a precondition for enabling uci session isolation later on. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-19luci-base: properly handle repeated POST parametersJo-Philipp Wich
Restore the old luci.http behaviour of converting repeated POST params into single tables holding all values instead of letting each repeated parameter overwrite the value of the preceeding one. Fixes, among other things, the handling of CBI dynamic list values. Fixes #1752 Fixes 59dea0230 ("luci-base: switch to lucihttp based POST data processing") Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-19luci-base: implement session handling in luci.model.uciJo-Philipp Wich
Introduce luci.model.uci.set_session_id() and luci.model.uci.get_session_id() to set and get the effective session ID respectively. When a session ID is set, it is sent as `ubus_rpc_session` attribute to rpcd, causing it to use per-session change directories, isolating LuCI changes from the global system uci state. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-18luci-base: drop dependency on libuci-luaJo-Philipp Wich
LuCI itself now uses ubus calls to interact with uci configuration while the remaining direct libuci-lua users have been updated to either depend on the binding library or to use luci.model.uci. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-18libs: move http.protocol.{date,mime,conditionals} to luci-lib-httpprotoutilsJo-Philipp Wich
Also adjust the dependencies of components depending on these classes and flatten the namespace from luci.http.protocol.* to luci.http.* Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-18luci-base: fold luci.http.protocol into luci.httpJo-Philipp Wich
With only the decoder routines remaining in luci.http.protocol, it makes no sense to keep the low level protocol class around, so fold the remaining code into the central luci.http class. Also adjust the few direct users of luci.http.protocol accordingly. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-18luci-base: refactor luci.httpJo-Philipp Wich
- Rewrite getcookie() to use liblucihttp header value parsing - Rewrite setfilehandler() to use local variables and have cleaner code - Fix build_querystring() to actually *en*code the given params Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-18luci-base: drop luci.util.dtable()Jo-Philipp Wich
The dtable() function has no user in the entire LuCI repo, so drop it. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-18Revert "luci-base: add urldecode() and urlencode() C implementations"Jo-Philipp Wich
This reverts commit ad7dc4a4928e77ae142d0fe040f9e9e64b530e82. Since we're using liblucihttp now, that library is the appropriate place to add such decoding helper functions. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-18luci-base: switch to lucihttp based POST data processingJo-Philipp Wich
Use the liblucihttp provided multipart and x-www-urlencoded body parsers and drop the old Lua parsing code. The C based data parsers are way faster than their old Lua counterparts while producing less string garbage and more correct results. While refactoring the luci.http.protocol code, also drop unused functions and dead code, heavily reducing the module size. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-18luci-base: switch to lucihttp.urldecode() and lucihttp.urlencode()Jo-Philipp Wich
Drop the Lua implementation in luci.http.protocol and use the optimized C variants of liblucihttp instead. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-18luci-base: zh_CN: update Simplified Chinese translationQian Zheng
Signed-off-by: Zheng Qian <sotux82@gmail.com>
2018-04-10i18n: sync translations, cleanupHannu Nyman
* sync translations * clean-up old strings from adblock Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
2018-04-10luci-base: fix rendering of 404 HTML error templateJo-Philipp Wich
This 404 error template rendering has been broken for a long time due to bad function environment level in luci.template when invoking the rendering from the toplevel dispatcher context. Fix this issue by adding a local function indirection, essentially adding an additional stack frame. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-10luci-base: error404: do not access request env directlyJo-Philipp Wich
Instead of attempting to access the request environment directly (which does not work anyway using the CGI SGI), use the already sanitized dispatcher.context.request property to print out the not found url. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-10luci-base: don't propagate null bytes in path informationJo-Philipp Wich
It is possible to inject unescaped markup using a double encoded null byte via PATH_INFO on certain leaf nodes. Since there is no legitimate reason to handle null bytes in any part of the requested url, simply skip over such bytes when parsing the PATH_INFO value. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-10luci-base: add urldecode() and urlencode() C implementationsJo-Philipp Wich
The C implementations of urlencode and urldecode are considerably faster than their current Lua counterparts. On an AMD Geode system, the C variant is up to ten times faster when decoding strings and up to four times faster when encoding them. The functions are also designed to only allocate new strings when any actual changes are required, otherwise they reuse the existing input strings, reducing the overal memory usage somewhat. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-09luci-base: consider empty parameters as well when testing POST requirementJo-Philipp Wich
The cbi class will react on an empty "cbi.submit" parameter as well so we must intercept GET requests using that too. Fixes 186e690c0 ("luci-base: dispatcher: reject non-POST requests with any cbi.submit value") Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-08i18n: sync translationsHannu Nyman
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
2018-04-07timezone data: update to 2018dHannu Nyman
Update timezone data to 2018d http://mm.icann.org/pipermail/tz-announce/2018-March/000049.html In 2018, Palestine starts DST on March 24, not March 31. Adjust future predictions accordingly. Casey Station in Antarctica changed from +11 to +08 Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
2018-04-07luci-base: fix luci.model.uci.get_first()Jo-Philipp Wich
Properly propagate the config parameter to the foreach iterator in order to fix get_first() lookups. Fixes #1734. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-07luci-base: escape path strings and field parameterJo-Philipp Wich
Prevent various XSS vectors by not interpolating field and path values verbatim into script and html contexts. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-06luci-base: properly initialize cbi.js on SimpleFormsJo-Philipp Wich
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-06luci-base: emit a warning if cbi() delegates a SimpleForm instanceJo-Philipp Wich
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-06luci-base: implement luci.model.uci.get_state()Jo-Philipp Wich
Introduce a get_state() function which can be used to access legacy uci state variables. This is usually not needed anymore but some packages (mainly mwan3) still rely on this. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-06luci-proto-ipv6: clarify 6in4 local address hintJo-Philipp Wich
Make the hint message more explicit to tell users that the prefix size needs to be specified as well. Fixes #1559. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-05luci-base: introduce luci.dispatcher.lookup()Jo-Philipp Wich
The lookup function takes multiple, possibly malformed path fragments, splits them on slashes, constructs a temporary path and looks up the result in the dispatch tree. If a matching node has been found, the function will return both the node reference and the canonical url to it. If no corresponding node is found, the function returns nil. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-05Merge pull request #1709 from dibdot/get_interface-fixJo-Philipp Wich
luci-base/network.lua: fix get_interface function
2018-04-05treewide: filter shell arguments through shellquote() where applicableJo-Philipp Wich
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-05luci-base: introduce luci.util.shellquote()Jo-Philipp Wich
Introduce a new function luci.util.shellquote() which encloses the given string argument in single quotes and escapes any embedded single quote characters. This function is intended to be used when interpolating untrusted input into shell commands. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-05luci-base: fix possible shell injection in luci.tools.status.switch_status()Jo-Philipp Wich
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-05luci-base: dispatcher: reject non-POST requests with any cbi.submit valueJo-Philipp Wich
Due to the fact that luci.model.cbi reacts on any "cbi.submit" value while the dispatcher only required POST for cbi.submit == 1, the CSRF token protection could be bypassed. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-04luci-base: use FULL_REQUEST_URI on login form templatesJo-Philipp Wich
Switch from using the REQUEST_URI CGI variable directly to the canonicalized FULL_REQUEST_URI property. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-04luci-base: add FULL_REQUEST_URI template propertyJo-Philipp Wich
Introduce a new template property FULL_REQUEST_URI which returns the full canonicalized request URL built from SCRIPT_NAME, PATH_INFO and QUERY_STRING. This new property is safer to use compared to using the raw REQUEST_URI CGI environment variable directly as this value is essentially untrusted user input which may contain embedded escaped slashes, double forward slashes and other oddities allowing XSS exploitation or request redirection. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-04luci-base: add a strict flag to the hostname validatorJo-Philipp Wich
Some applications, e.g. dnsmasq, do not allow hostnames starting with an underscore, therefor extend the existing hostname datatype validator with a `strict` which disallows a leading underscore. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-04luci-base: switch to ubus uci operationsJo-Philipp Wich
Switch luci.model.uci to use ubus uci calls instead of driving libuci-lua directly. This prepares support for more advanced features such as per-session change isolation and configuration rollback on errors. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-04-02luci-base: zh_CN: update Simplified Chinese translationQian Zheng
Signed-off-by: Qian Zheng <sotux82@gmail.com>
2018-03-31luci-base/network.lua: fix get_interface functionDirk Brenken
* fix wrong private function call to handle section id as parameter (fix for #1687) Signed-off-by: Dirk Brenken <dev@brenken.org>
2018-03-29i18n: sync translationsINAGAKI Hiroshi
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
2018-03-27luci-base: fix colspans calculation in tblsectionFlorian Eckert
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2018-03-22luci-base/util.lua: enhance checklib functionDirk Brenken
* enhance the checklib function in util.lua to check the 'fullpathexe' as well, e.g. this fixes runtime errors on the dhcp/dns template in environments without dnsmasq Signed-off-by: Dirk Brenken <dev@brenken.org>
2018-03-15Merge pull request #1654 from TDT-AG/pr/20180301-luci-several-fixesJo-Philipp Wich
luci-app-firewall/luci-base/luci-mod-admin-full: some fixes and improvements
2018-03-12treewide: unify mac address handlingJo-Philipp Wich
Use the new luci.ip MAC address facilities to parse and verify MAC addresses in a common way, instead of relying on various ad-hoc solutions. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-03-12luci-base: fix documentation spelling mistakes in luci.http.protocolJo-Philipp Wich
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2018-03-12luci-base: fix documentation spelling mistakes in luci.utilJo-Philipp Wich
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-25 02:37:23 +0000