luci/applications/luci-app-adblock/root/usr/share, branch master

luci-app-adblock: fix rpcd file access on symlinked /var/run

2026-07-31T12:58:42Z

rpcd e37ed9d8 ("file: re-authorize ACL against resolved path to close symlink bypass", GHSA-q5gr-86pq-vvwr) re-resolves the requested path with realpath() and re-runs the ACL check against the resolved target for file.read, file.write, file.md5, file.list and file.stat. On OpenWrt /var is a symlink to /tmp (or /var/run to /tmp/run with CONFIG_TARGET_ROOTFS_PERSIST_VAR), so every "/var/run/adblock/*" grant resolves to "/tmp/run/adblock/*", which is not covered by the ACL. The second check therefore fails with EACCES. Effects in the DNS report view: the adblock.report flag file can no longer be written or polled, so every 'Refresh...' run ends in "Failed to generate adblock report!" after the retry limit. The 'Blocklist Search...' dialog fails the same way. Both errors stay invisible because the calls are wrapped in L.resolveDefault(). Report generation itself is unaffected since fs.exec_direct() goes through cgi-io, which does not resolve symlinks. Independently of that, the runtime status polling in overview.js gates on fs.stat(), and rpcd authorizes file.stat with the "list" permission while the ACL only granted "read". rpc_session_acl_allowed() matches the permission literally via fnmatch(), so the call was denied and the poll callback returned early without updating the status. - grant the resolved /tmp/run counterpart for every /var/run path - keep the /var/run entries so the ACL stays valid on targets where /var is a real directory - grant "list" on adblock.runtime.json for the fs.stat() probe - bump PKG_RELEASE Signed-off-by: Dirk Brenken

luci-app-adblock: grant the ubus file methods used by the frontend

2026-07-20T16:05:22Z

The frontend calls fs.stat(), fs.read() and fs.write(), which are ubus calls on the "file" object and require the corresponding ubus ACL in addition to the already existing path ACLs. Only "list" and "remove" are granted by luci-base, so for non-root sessions every stat resolved to null and saving the allow-/blocklist and the custom feeds failed. Signed-off-by: Dirk Brenken

luci-app-adblock: fix ACL for non-root users

2026-07-19T16:20:15Z

Three related ACL defects: * The frontend reads the feed, category and list files as well as the runtime information via fs.read_direct(), which is served by cgi-io's download handler. That handler requires the "cgi-io"/"download" scope, which was not granted, so all of these requests failed with a 403 for non-root sessions. * The custom feed import uses ui.uploadFile(), which is served by cgi-io's upload handler and requires the "cgi-io"/"upload" scope in the write section. It was missing as well. * All file entries lived in the write section, including the read-only ones. Since rpcd pulls a section in via the matching list in /etc/config/rpcd, a session holding only "list read luci-app-adblock" had no read access to any of the files at all. Move the read permissions to the read section and keep only the write permissions in the write section. The effective permission set of a session holding both lists is unchanged. Also drop the stale adblock.pid entry, it has no consumer in the frontend anymore. Signed-off-by: Dirk Brenken

luci-app-adblock: release 4.5.5-1

2026-04-17T07:59:11Z

* sync with base package Signed-off-by: Dirk Brenken

luci-app-adblock: update 4.5.3-3

2026-03-22T19:01:12Z

* sync with base package Signed-off-by: Dirk Brenken

luci-app-adblock: remove obsolete ACLs

2025-11-21T20:55:05Z

* the app now uses rpc / the ubus log object and no longer requires logread ACLs Signed-off-by: Dirk Brenken

luci-app-adblock: sync with adblock 4.4.4-1

2025-11-21T18:05:36Z

Signed-off-by: Dirk Brenken

luci-app-adblock: use separate log viewer template

2025-10-26T18:43:48Z

Signed-off-by: Dirk Brenken

luci-app-*: migrate LogreadBox consumers to use new permission ACLs

2025-10-20T19:11:11Z

"ubus": { "log": [ "read" ] } Signed-off-by: Paul Donald

luci-app-adblock: sync with update 4.4.2-1

2025-05-30T16:42:37Z

Various fixes, a new modal reporting GeoIP map of blocked domains. Signed-off-by: Dirk Brenken