mirror of
https://github.com/openwrt/luci.git
synced 2026-04-12 14:03:24 +04:00
122839294a
The ACL permissions were originally authored to support just a single set of modem interfaces, at the numbers 0-9. Eventually this was adjusted to support from 0 to 999 avoiding command injection. However, as new commands were added, this was reverted again unfortunately. Language like "regex" has been used in the commit history for this ACL, and likely the core of the issue is confusion on how these are parsed. These are all parsed [1] with fnmatch(...), and not regex(..). A future useful change could be for rpcd to set the FNM_EXTMATCH option for fnmatch(...) to simplify this particular match statement, but that's not considered here since that's a much broader change that needs a longer discussion. [1]a4a5a29858/session.c (L143-L147)Fixes:54aa70112c("luci-proto-modemmanager: add status page") Signed-off-by: Tim Nordell <tnordell@airgain.com>