luci-base: consider empty parameters as well when testing POST requirement
authorJo-Philipp Wich <jo@mein.io>
Mon, 9 Apr 2018 05:04:38 +0000 (07:04 +0200)
committerJo-Philipp Wich <jo@mein.io>
Mon, 9 Apr 2018 05:19:28 +0000 (07:19 +0200)
The cbi class will react on an empty "cbi.submit" parameter as well so we
must intercept GET requests using that too.

Fixes 186e690c0 ("luci-base: dispatcher: reject non-POST requests with any cbi.submit value")

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
modules/luci-base/luasrc/dispatcher.lua

index 4866727572e67f2bb87ad563e65b3f039aba1127..91b86679fd739bc5ba67deb47258a9c46c09d0c5 100644 (file)
@@ -136,8 +136,7 @@ local function require_post_security(target)
 
                                if (type(required_val) == "string" and
                                    request_val ~= required_val) or
-                                  (required_val == true and
-                                   (request_val == nil or request_val == ""))
+                                  (required_val == true and request_val == nil)
                                then
                                        return false
                                end