Difuse/luci
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

luci-app-upnp: protect lease delete call with csrf token

Browse source 
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
This commit is contained in:
Jo-Philipp Wich 2015-10-21 00:11:28 +02:00
parent c1278f967e
commit f23f7b8751
2 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
applications/luci-app-upnp/luasrc/controller/upnp.lua
View file

@ -15,7 +15,7 @@ function index()
page.dependent = true page.dependent = true
entry({"admin", "services", "upnp", "status"}, call("act_status")).leaf = true entry({"admin", "services", "upnp", "status"}, call("act_status")).leaf = true
entry({"admin", "services", "upnp", "delete"}, call("act_delete")).leaf = true entry({"admin", "services", "upnp", "delete"}, post("act_delete")).leaf = true
end end
function act_status() function act_status()

2
applications/luci-app-upnp/luasrc/view/upnp_status.htm
View file

@ -1,6 +1,6 @@
<script type="text/javascript">//<![CDATA[ <script type="text/javascript">//<![CDATA[
function upnp_delete_fwd(idx) { function upnp_delete_fwd(idx) {
XHR.get('<%=url('admin/services/upnp/delete')%>/' + idx, null, (new XHR()).post('<%=url('admin/services/upnp/delete')%>/' + idx, { token: '<%=token%>' },
function(x) function(x)
{ {
var tb = document.getElementById('upnp_status_table'); var tb = document.getElementById('upnp_status_table');