I've noticed that there is nothing in my /tmp/luci-modulecache
directory. Digging into it it looks like because both the expected uid
and mode of the files doesn't match, so for security reasons they're
long being loaded or saved by ccache.lua (from the luci-lib-core
package). I'm not sure how far back this has been broken but I it
appears to have been quite some time, possibly years?
I've included a patch which updates the checks to use the right newer
function name / structure name. It decreases page load times by about
10-15% on my bcm2708 (raspberrypi). I can create a ticket if you'd
prefer. The patch is against the luci-0.11 branch but should apply to
trunk as well.
Signed-off-by: Bryan Mayland <bmayland@leoninedev.com>
The nixio library can mistakenly build without shadow password support due to the
compile-time test failing.
Because the test for HAS_SHADOW in the nixio Makefile uses the default CC flags,
the test may attempt to cross-compile with different VFP abi than libc does and
will therefore not link. Passing CCFLAGS on the command line builds the test
correctly and will enable HAS_SHADOW if available.
The validity of authentication tokens was determined by the
mtime of respective authentication tokens on filesystem
stored in $sessionpath.
Talking about hardware without RTC or without a prior
connection to a time server, date/time usually around 1970 -
so is the mtime of the authentication token file in
$sessionpath.
When now configuring an internet connection via LuCI, the
system might fetch the current date/time (e.g. via ntp)
which invalidates the token, returns "403 Forbidden" and
kicks the user out of the interface.
This patch changes the authentication system to use time values
based on the uptime of the machine - rather than values based upon
gettimeofday() and {a|m}time values - and save them inside the token.
That way can always determine the difference between login
(last interaction respectively) and the current time, in-
dependant of the system clock jumping backwards/forwards.
Warning: This patch removes the clean() function and respective calls.
This means, invalid tokens will NOT be determined and removed from
filesystem automatically anymore.
Before, every HTTP-call caused a scan for invalid tokens,
which is quite expensive. Instead consider using a cron job
deleting all stalled files periodically.
Contributed by T-Labs, Deutsche Telekom Innovation Laboratories
Signed-off-by: Mirko Vogt <mirko@openwrt.org>
