Difuse/luci
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

treewide: improve handling of page redirections in uci change views

Browse source 
Instead of passing the full LuCI request url, pass the relative resolved
request path instead and filter the received value through the lookup()
dispatcher function to only allow paths to actual internal pages.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
This commit is contained in:
Jo-Philipp Wich 2018-04-05 22:37:37 +02:00
parent 7b04d0bbcf
commit 731ed77c0b
7 changed files with 14 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
modules/luci-mod-admin-full/luasrc/controller/admin/uci.lua
View file

@ -5,8 +5,7 @@
module("luci.controller.admin.uci", package.seeall)
function index()
local redir = luci.http.formvalue("redir", true) or
luci.dispatcher.build_url(unpack(luci.dispatcher.context.request))
local redir = luci.http.formvalue("redir", true) or table.concat(disp.context.request, "/")
entry({"admin", "uci"}, nil, _("Configuration"))
entry({"admin", "uci", "changes"}, call("action_changes"), _("Changes"), 40).query = {redir=redir}

4
modules/luci-mod-admin-full/luasrc/view/admin_uci/changes.htm
View file

@ -16,9 +16,9 @@
<% end %>
<div class="cbi-page-actions">
<% local r = luci.http.formvalue("redir"); if r and #r > 0 then %>
<% local node, url = luci.dispatcher.lookup(luci.http.formvalue("redir")); if url then %>
<div style="float:left">
<form class="inline" method="get" action="<%=luci.util.pcdata(r)%>">
<form class="inline" method="get" action="<%=luci.util.pcdata(url)%>">
<input class="cbi-button cbi-button-link" style="float:left; margin:0" type="submit" value="<%:Back%>" />
</form>
</div>

12
modules/luci-mod-admin-full/luasrc/view/admin_uci/revert.htm
View file

@ -18,10 +18,12 @@
<p><strong><%:There are no pending changes to revert!%></strong></p>
<% end %>
<div class="cbi-page-actions">
<form class="inline" method="get" action="<%=luci.util.pcdata(luci.http.formvalue("redir"))%>">
<input class="cbi-button cbi-button-link" style="margin:0" type="submit" value="<%:Back%>" />
</form>
</div>
<% local node, url = luci.dispatcher.lookup(luci.http.formvalue("redir")); if url then %>
<div class="cbi-page-actions">
<form class="inline" method="get" action="<%=luci.util.pcdata(url)%>">
<input class="cbi-button cbi-button-link" style="margin:0" type="submit" value="<%:Back%>" />
</form>
</div>
<% end %>
<%+footer%>

2
themes/luci-theme-bootstrap/luasrc/view/themes/bootstrap/header.htm
View file

@ -147,7 +147,7 @@
if ucichanges > 0 then
write('<a class="label notice" href="%s?redir=%s">%s: %d</a>' %{
url(category, 'uci/changes'),
http.urlencode(http.formvalue('redir') or REQUEST_URI),
http.urlencode(http.formvalue('redir') or table.concat(disp.context.request, "/")),
translate('Unsaved Changes'),
ucichanges
})

2
themes/luci-theme-freifunk-generic/luasrc/view/themes/freifunk-generic/header.htm
View file

@ -205,7 +205,7 @@ if tree.nodes[category] and tree.nodes[category].ucidata then
-%>
<div id="savemenu">
<% if ucic > 0 then %>
<a class="warning" href="<%=controller%>/<%=category%>/uci/changes/?redir=<%=http.urlencode(http.formvalue("redir") or REQUEST_URI)%>"><%:Unsaved Changes%>: <%=ucic%></a>
<a class="warning" href="<%=controller%>/<%=category%>/uci/changes/?redir=<%=http.urlencode(http.formvalue('redir') or table.concat(disp.context.request, "/"))%>"><%:Unsaved Changes%>: <%=ucic%></a>
<% end -%>
</div>
<% end %>

2
themes/luci-theme-material/luasrc/view/themes/material/header.htm
View file

@ -172,7 +172,7 @@
if ucichanges > 0 then
write('<a class="label notice" href="%s?redir=%s">%s: %d</a>' %{
url(category, 'uci/changes'),
http.urlencode(http.formvalue('redir') or REQUEST_URI),
http.urlencode(http.formvalue('redir') or table.concat(disp.context.request, "/")),
translate('Unsaved Changes'),
ucichanges
})

2
themes/luci-theme-openwrt/luasrc/view/themes/openwrt.org/header.htm
View file

@ -104,7 +104,7 @@
if ucic > 0 then
write('<a class="warning" href="%s?redir=%s">%s: %d</a>' %{
url(category, 'uci/changes'),
http.urlencode(http.formvalue('redir') or REQUEST_URI),
http.urlencode(http.formvalue('redir') or table.concat(disp.context.request, "/")),
translate('Unsaved Changes'),
ucic
})