projects / project / luci.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: aa2e0e2) | patch
luci-mod-system: prevent comment injection in mtdbackup endpoint
authorJo-Philipp Wich <jo@mein.io>
Wed, 14 Nov 2018 12:37:51 +0000 (13:37 +0100)
committerJo-Philipp Wich <jo@mein.io>
Wed, 14 Nov 2018 19:46:04 +0000 (20:46 +0100)
commit6f7736c436e1759098102859559f1313ad0669db
treee75ebe417e764c0b9220c2e76719f37e486393d5tree | snapshot
parentaa2e0e2488f52b2b0acd1746ee13c7f51377f757commit | diff
luci-mod-system: prevent comment injection in mtdbackup endpoint

Rework the parameter handling to both prevent a crash when no parameter is
given and to prevent root command injection through the mtd index part of
the parameter value.

Fixes: 9840d310e ("modules: add backup module for mtdblock devices")
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
modules/luci-mod-system/luasrc/controller/admin/system.lua diff | blob | history
Lua Configuration Interface (mirror)