Difuse/luci
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

luci-base: consider empty parameters as well when testing POST requirement

Browse source 
The cbi class will react on an empty "cbi.submit" parameter as well so we
must intercept GET requests using that too.

Fixes 186e690c0 ("luci-base: dispatcher: reject non-POST requests with any cbi.submit value")

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
This commit is contained in:
Jo-Philipp Wich 2018-04-09 07:04:38 +02:00
parent 0ab0303527
commit b1b5723516
1 changed files with 1 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
modules/luci-base/luasrc/dispatcher.lua
View file

@ -136,8 +136,7 @@ local function require_post_security(target)
if (type(required_val) == "string" and if (type(required_val) == "string" and
request_val ~= required_val) or request_val ~= required_val) or
(required_val == true and (required_val == true and request_val == nil)
(request_val == nil or request_val == ""))
then then
return false return false
end end