luci-base: fix auth plugin asset loading

normalize_assets() passes a string to match(), which requires a regexp
and returns null for anything else. The path check therefore fails for
every asset and each one is dropped by the following continue, so an
auth plugin's scripts are never rendered on the login page.

The failure is silent. The html returned by the same check() call is
unaffected, so a plugin's login UI appears without the script that
drives it and nothing is logged. plugins/luci-plugin-auth-example is
affected as well.

The check is a plain prefix test, so use index() rather than compiling a
regexp per asset. It returns the offset of the first occurrence or -1,
making != 0 the equivalent of the anchored ^, and comparing two plain
strings keeps the check independent of how uuid is validated.

Signed-off-by: Fuad Hasan <fuad.antor@gmail.com>
This commit is contained in:
Fuad Hasan authored and Paul Donald committed 2026-09-18 20:18:17 +02:00
1 parent aef4a82632
commit 5c4e7afe71
1 file changed
+1 -1
+1 -1
View File
@@ -157,7 +157,7 @@ function normalize_assets(uuid, assets) {
if (type(src) != 'string')
continue;
if (!match(src, sprintf("^/luci-static/plugins/%s/", uuid)))
if (index(src, sprintf("/luci-static/plugins/%s/", uuid)) != 0)
continue;
if (match(src, /\.\.|[\r\n\t ]/))