mirror of
https://github.com/openwrt/luci.git
synced 2026-10-12 07:17:33 +04:00
Dirk Brenken
649854fda2
rpcd e37ed9d8 ("file: re-authorize ACL against resolved path to close
symlink bypass", GHSA-q5gr-86pq-vvwr) re-resolves the requested path
with realpath() and re-runs the ACL check against the resolved target
for file.read, file.write, file.md5, file.list and file.stat.
On OpenWrt /var is a symlink to /tmp (or /var/run to /tmp/run with
CONFIG_TARGET_ROOTFS_PERSIST_VAR), so every "/var/run/banIP/*" grant
resolves to "/tmp/run/banIP/*", which is not covered by the ACL. The
second check therefore fails with EACCES.
Effects in the set report view: the banIP.report flag file can no
longer be written or polled, so every 'Refresh' run ends in the
report error handler after the retry limit, and the IP search dialog
fails the same way. Both errors stay invisible because the calls are
wrapped in L.resolveDefault(). Report generation itself is unaffected
since fs.exec_direct() goes through cgi-io, which does not resolve
symlinks.
Independently of that, rpcd authorizes file.stat with the "list"
permission while the ACL only granted "read", and
rpc_session_acl_allowed() matches the permission literally via
fnmatch(). The fs.stat() probes in overview.js, allowlist.js,
blocklist.js and feeds.js were therefore denied, so the runtime status
poll returned early and the list views fell back to an empty result.
- grant the resolved /tmp/run counterpart for every /var/run path
- keep the /var/run entries so the ACL stays valid on targets where
/var is a real directory
- grant "list" on the objects probed with fs.stat(); this does not
widen the path scope, the same objects are already readable
- bump PKG_RELEASE
Signed-off-by: Dirk Brenken <dev@brenken.org>
OpenWrt luci feed
Description
This is the OpenWrt "luci"-feed containing LuCI - OpenWrt Configuration Interface.
Usage
This feed is enabled by default. Your feeds.conf.default (or feeds.conf) should contain a line like:
src-git luci https://github.com/openwrt/luci.git
To install all its package definitions, run:
./scripts/feeds update luci
./scripts/feeds install -a -p luci
API Reference
You can browse the generated API documentation directly on Github.
Use ucode and rpcd for server side operations.
Development
Documentation for developing and extending LuCI can be found in the Wiki
License
See LICENSE file.
Package Guidelines
See CONTRIBUTING.md file.
Translation status
Use Weblate instead of direct editing of the *.po files.
