From 5c4e7afe71e9cd353a44427614aaee86c67d498f Mon Sep 17 00:00:00 2001 From: Fuad Hasan Date: Sun, 23 Aug 2026 23:46:03 +0600 Subject: [PATCH] luci-base: fix auth plugin asset loading normalize_assets() passes a string to match(), which requires a regexp and returns null for anything else. The path check therefore fails for every asset and each one is dropped by the following continue, so an auth plugin's scripts are never rendered on the login page. The failure is silent. The html returned by the same check() call is unaffected, so a plugin's login UI appears without the script that drives it and nothing is logged. plugins/luci-plugin-auth-example is affected as well. The check is a plain prefix test, so use index() rather than compiling a regexp per asset. It returns the offset of the first occurrence or -1, making != 0 the equivalent of the anchored ^, and comparing two plain strings keeps the check independent of how uuid is validated. Signed-off-by: Fuad Hasan --- modules/luci-base/ucode/authplugins.uc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/luci-base/ucode/authplugins.uc b/modules/luci-base/ucode/authplugins.uc index f81a221fe4..dee6c98f9b 100644 --- a/modules/luci-base/ucode/authplugins.uc +++ b/modules/luci-base/ucode/authplugins.uc @@ -157,7 +157,7 @@ function normalize_assets(uuid, assets) { if (type(src) != 'string') continue; - if (!match(src, sprintf("^/luci-static/plugins/%s/", uuid))) + if (index(src, sprintf("/luci-static/plugins/%s/", uuid)) != 0) continue; if (match(src, /\.\.|[\r\n\t ]/))