Introduce a new function luci.util.shellquote() which encloses the given
string argument in single quotes and escapes any embedded single quote
characters.
This function is intended to be used when interpolating untrusted input
into shell commands.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Due to the fact that luci.model.cbi reacts on any "cbi.submit" value while
the dispatcher only required POST for cbi.submit == 1, the CSRF token
protection could be bypassed.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Introduce a new template property FULL_REQUEST_URI which returns the full
canonicalized request URL built from SCRIPT_NAME, PATH_INFO and QUERY_STRING.
This new property is safer to use compared to using the raw REQUEST_URI CGI
environment variable directly as this value is essentially untrusted user
input which may contain embedded escaped slashes, double forward slashes and
other oddities allowing XSS exploitation or request redirection.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Some applications, e.g. dnsmasq, do not allow hostnames starting with an
underscore, therefor extend the existing hostname datatype validator with
a `strict` which disallows a leading underscore.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Switch luci.model.uci to use ubus uci calls instead of driving libuci-lua
directly.
This prepares support for more advanced features such as per-session change
isolation and configuration rollback on errors.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
On the material theme the "Collecting data" hint in the status pages
was still present on the page even though the command was sucessfull executed.
Remove the legend tag and move the info "Collecting data" to the
"diag-rc-output" tag will solve this issue.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* made the "ignore bssid" flag conditional to ease connection
to hidden networks:
* default for hidden networks "disabled"
* default for all others "enabled"
Signed-off-by: Dirk Brenken <dev@brenken.org>
Installing luci-app-wireguard should also install luci-proto-wireguard, to have it as an protocol for interface setup.
Signed-off-by: Sven Roederer <devel-sven@geroedel.de>
* Add missing css class danger
* Add missing css class success
* Update background color for css class warning
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* enhance the checklib function in util.lua to check the 'fullpathexe'
as well, e.g. this fixes runtime errors on the dhcp/dns template in
environments without dnsmasq
Signed-off-by: Dirk Brenken <dev@brenken.org>
* made qrencode support optional (remove hardcoded dependency)
* add a conditional QR Code button on overview page,
remove separate "QR Codes" tab
* move trigger timeout setting to extra section
Signed-off-by: Dirk Brenken <dev@brenken.org>
