mirror of
https://github.com/openwrt/luci.git
synced 2026-10-12 05:07:26 +04:00
Dirk Brenken
7647aa9913
Three related ACL defects: * The frontend reads the feed, category and list files as well as the runtime information via fs.read_direct(), which is served by cgi-io's download handler. That handler requires the "cgi-io"/"download" scope, which was not granted, so all of these requests failed with a 403 for non-root sessions. * The custom feed import uses ui.uploadFile(), which is served by cgi-io's upload handler and requires the "cgi-io"/"upload" scope in the write section. It was missing as well. * All file entries lived in the write section, including the read-only ones. Since rpcd pulls a section in via the matching list in /etc/config/rpcd, a session holding only "list read luci-app-banip" had no read access to any of the files at all. Move the read permissions to the read section and keep only the write permissions in the write section. The effective permission set of a session holding both lists is unchanged. Signed-off-by: Dirk Brenken <dev@brenken.org>
OpenWrt luci feed
Description
This is the OpenWrt "luci"-feed containing LuCI - OpenWrt Configuration Interface.
Usage
This feed is enabled by default. Your feeds.conf.default (or feeds.conf) should contain a line like:
src-git luci https://github.com/openwrt/luci.git
To install all its package definitions, run:
./scripts/feeds update luci
./scripts/feeds install -a -p luci
API Reference
You can browse the generated API documentation directly on Github.
Use ucode and rpcd for server side operations.
Development
Documentation for developing and extending LuCI can be found in the Wiki
License
See LICENSE file.
Package Guidelines
See CONTRIBUTING.md file.
Translation status
Use Weblate instead of direct editing of the *.po files.
