From b5826f1ffb19288b8bfdc63f4b77700cfabe1181 Mon Sep 17 00:00:00 2001 From: Jo-Philipp Wich Date: Tue, 20 Oct 2015 21:01:41 +0200 Subject: luci-mod-admin-full: protect clock, flash and opkg ops with submit token * Use post_on() target to require csrf token verification for modifying actions * Ensure that package and flash operation handlers guard modifying operations with parameter check Signed-off-by: Jo-Philipp Wich --- .../luasrc/view/admin_system/clock_status.htm | 4 +- .../luasrc/view/admin_system/flashops.htm | 10 +- .../luasrc/view/admin_system/packages.htm | 192 +++++++++++---------- 3 files changed, 113 insertions(+), 93 deletions(-) (limited to 'modules/luci-mod-admin-full/luasrc/view') diff --git a/modules/luci-mod-admin-full/luasrc/view/admin_system/clock_status.htm b/modules/luci-mod-admin-full/luasrc/view/admin_system/clock_status.htm index 19be072fe..37d8ae0e8 100644 --- a/modules/luci-mod-admin-full/luasrc/view/admin_system/clock_status.htm +++ b/modules/luci-mod-admin-full/luasrc/view/admin_system/clock_status.htm @@ -17,8 +17,8 @@ btn.disabled = true; btn.value = '<%:Synchronizing...%>'; - XHR.get('<%=url('admin/system/clock_status')%>', - { set: Math.floor((new Date()).getTime() / 1000) }, + (new XHR()).post('<%=url('admin/system/clock_status')%>', + { token: '<%=token%>', set: Math.floor((new Date()).getTime() / 1000) }, function() { btn.disabled = false; diff --git a/modules/luci-mod-admin-full/luasrc/view/admin_system/flashops.htm b/modules/luci-mod-admin-full/luasrc/view/admin_system/flashops.htm index bc8bcf488..8bf199294 100644 --- a/modules/luci-mod-admin-full/luasrc/view/admin_system/flashops.htm +++ b/modules/luci-mod-admin-full/luasrc/view/admin_system/flashops.htm @@ -1,6 +1,6 @@ <%# Copyright 2008 Steven Barth - Copyright 2008 Jo-Philipp Wich + Copyright 2008-2015 Jo-Philipp Wich Licensed to the public under the Apache License 2.0. -%> @@ -17,7 +17,9 @@
<%:Backup / Restore%> -
+ + +
<%:Click "Generate archive" to download a tar archive of the current configuration files. To reset the firmware to its initial state, click "Perform reset" (only possible with squashfs images).%>
@@ -54,7 +56,9 @@
<%:Flash new firmware image%> <% if upgrade_avail then %> - + + +
<%:Upload a sysupgrade-compatible image here to replace the running firmware. Check "Keep settings" to retain the current configuration (requires an OpenWrt compatible firmware image).%>
diff --git a/modules/luci-mod-admin-full/luasrc/view/admin_system/packages.htm b/modules/luci-mod-admin-full/luasrc/view/admin_system/packages.htm index ef9591990..fbb8235ec 100644 --- a/modules/luci-mod-admin-full/luasrc/view/admin_system/packages.htm +++ b/modules/luci-mod-admin-full/luasrc/view/admin_system/packages.htm @@ -46,17 +46,18 @@ end

<%:Software%>

- -
+
- - -
+ + + + +
<% if (install and next(install)) or (remove and next(remove)) or update or upgrade then %>
@@ -80,7 +81,7 @@ end <% else %> <%:No package lists available%> <% end %> - +
<% end %> @@ -101,7 +102,7 @@ end
- +
@@ -114,83 +115,98 @@ end
-
- -

<%:Status%>

- - - - - <% if display ~= "available" then %> -
- - - - - - - <% local empty = true; luci.model.ipkg.list_installed(querypat, function(n, v, s, d) empty = false; filter[n] = true %> - - - - - - <% end) %> - <% if empty then %> - - - - - - <% end %> -
 <%:Package name%><%:Version%>
<%:Remove%><%=luci.util.pcdata(n)%><%=luci.util.pcdata(v)%>
 <%:none%><%:none%>
-
- <% else %> -
- <% if not querypat then %> - -
- <% end %> - - - - - - - - - <% local empty = true; opkg_list(querypat or letterpat, function(n, v, s, d) if filter[n] then return end; empty = false %> - - - - - - - - <% end) %> - <% if empty then %> - - - - - - - - <% end %> -
 <%:Package name%><%:Version%><%:Size (.ipk)%><%:Description%>
<%:Install%><%=luci.util.pcdata(n)%><%=luci.util.pcdata(v)%><%=luci.util.pcdata(s)%><%=luci.util.pcdata(d)%>
 <%:none%><%:none%><%:none%><%:none%>
- <% if not querypat then %> -
- <% end %> -
+ + + +

<%:Status%>

+ + + + + <% if display ~= "available" then %> +
+ + + + + + + <% local empty = true; luci.model.ipkg.list_installed(querypat, function(n, v, s, d) empty = false; filter[n] = true %> + + + + + + <% end) %> + <% if empty then %> + + + + + + <% end %> +
 <%:Package name%><%:Version%>
+
+ + + + <%:Remove%> +
+ 		<%=luci.util.pcdata(n)%><%=luci.util.pcdata(v)%>
 <%:none%><%:none%>
+
+ <% else %> +
+ <% if not querypat then %> + +
+ <% end %> + + + + + + + + + <% local empty = true; opkg_list(querypat or letterpat, function(n, v, s, d) if filter[n] then return end; empty = false %> + + + + + + + + <% end) %> + <% if empty then %> + + + + + + + + <% end %> +
 <%:Package name%><%:Version%><%:Size (.ipk)%><%:Description%>
+
+ + + + <%:Install%> +
+ 		<%=luci.util.pcdata(n)%><%=luci.util.pcdata(v)%><%=luci.util.pcdata(s)%><%=luci.util.pcdata(d)%>
 <%:none%><%:none%><%:none%><%:none%>
+ <% if not querypat then %> +
<% end %> - - +
+ <% end %> + + <%+footer%> -- cgit v1.2.3