Difuse/luci
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

luci-mod-rpc: fix authentication via query string parameter

Browse source 
Localize the `authenticatior()` and `session_retrieve()` functions into the
`index()` function scope so that they're retained when extracting the
function into the dispatcher bytecode cache.

Also allow access to the global scope since upvalues do not work reliably
due to the out-of-context byte code caching of index functions.

Fixes https://github.com/openwrt/luci/issues/1300#issuecomment-381352765
Fixes feefc600e ("luci-mod-rpc: rework authentication and session handling")
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
This commit is contained in:
Jo-Philipp Wich 2018-05-05 19:51:20 +02:00
parent 9664fb3d81
commit 6a1cdca345
1 changed files with 33 additions and 41 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
modules/luci-mod-rpc/luasrc/controller/rpc.lua
View file

@ -2,18 +2,11 @@
-- Copyright 2008 Jo-Philipp Wich <jow@openwrt.org> -- Copyright 2008 Jo-Philipp Wich <jow@openwrt.org>
-- Licensed to the public under the Apache License 2.0. -- Licensed to the public under the Apache License 2.0.
local require = require module("luci.controller.rpc", package.seeall)
local pairs = pairs
local print = print
local pcall = pcall
local table = table
local type = type
local tonumber = tonumber
module "luci.controller.rpc"
local function session_retrieve(sid, allowed_users) function index()
local function session_retrieve(sid, allowed_users)
local util = require "luci.util" local util = require "luci.util"
local sdat = util.ubus("session", "get", { local sdat = util.ubus("session", "get", {
ubus_rpc_session = sid ubus_rpc_session = sid
@ -30,22 +23,21 @@ local function session_retrieve(sid, allowed_users)
end end
return nil return nil
end end
local function authenticator(validator, accs) local function authenticator(validator, accs)
local auth = luci.http.formvalue("auth", true) local http = require "luci.http"
or luci.http.getcookie("sysauth") local auth = http.formvalue("auth", true) or http.getcookie("sysauth")
if auth then -- if authentication token was given if auth then -- if authentication token was given
local sid, sdat = session_retrieve(auth, accs) local sid, sdat = session_retrieve(auth, accs)
if sdat then -- if given token is valid if sdat then -- if given token is valid
return sdat.username, sid return sdat.username, sid
end end
luci.http.status(403, "Forbidden") http.status(403, "Forbidden")
end
end end
end
function index()
local rpc = node("rpc") local rpc = node("rpc")
rpc.sysauth = "root" rpc.sysauth = "root"
rpc.sysauth_authenticator = authenticator rpc.sysauth_authenticator = authenticator