Difuse/luci
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

luci-app-ddns: protect start/stop actions with csrf token

Browse source 
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
This commit is contained in:
Jo-Philipp Wich 2015-10-20 23:58:01 +02:00
parent d4666757b7
commit b9ed03c5a9
2 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
applications/luci-app-ddns/luasrc/controller/ddns.lua
View file

@ -38,7 +38,7 @@ function index()
{hideapplybtn=true, hidesavebtn=true, hideresetbtn=true}), nil ).leaf = true {hideapplybtn=true, hidesavebtn=true, hideresetbtn=true}), nil ).leaf = true
entry( {"admin", "services", "ddns", "global"}, cbi("ddns/global"), nil ).leaf = true entry( {"admin", "services", "ddns", "global"}, cbi("ddns/global"), nil ).leaf = true
entry( {"admin", "services", "ddns", "logview"}, call("logread") ).leaf = true entry( {"admin", "services", "ddns", "logview"}, call("logread") ).leaf = true
entry( {"admin", "services", "ddns", "startstop"}, call("startstop") ).leaf = true entry( {"admin", "services", "ddns", "startstop"}, post("startstop") ).leaf = true
entry( {"admin", "services", "ddns", "status"}, call("status") ).leaf = true entry( {"admin", "services", "ddns", "status"}, call("status") ).leaf = true
end end

2
applications/luci-app-ddns/luasrc/view/ddns/overview_status.htm
View file

@ -136,7 +136,7 @@
// do start/stop // do start/stop
var btnXHR = new XHR(); var btnXHR = new XHR();
btnXHR.get('<%=url('admin/services/ddns/startstop')%>/' + section + '/' + cbx.checked, null, btnXHR.post('<%=url('admin/services/ddns/startstop')%>/' + section + '/' + cbx.checked, { token: '<%=token%>' },
function(x, data) { function(x, data) {
if (x.responseText == "_uncommitted_") { if (x.responseText == "_uncommitted_") {
// we need a trick to display Ampersand "&" in stead of "&#38;" or "&amp;" // we need a trick to display Ampersand "&" in stead of "&#38;" or "&amp;"