luci/applications/luci-app-lxc/root/usr, branch master

luci-app-lxc: fix authenticated path traversal and ACL bypass (host root)

2026-05-27T11:21:12Z

* ucode fixes: - tighten `is_valid_lxc_name` regex to `^[A-Za-z0-9_][A-Za-z0-9_-]{0,63}$` - apply the validator in `lxc_configuration_get` and `lxc_configuration_set` before any filesystem access - reject the `'lxc error: …'` sentinel string returned by `lxc_get_config_path()` on failure, rather than concatenating it into a path. - shellquote `LXC_URL` in `lxc_get_downloadable` and `lxc_create` * ACL fix: add `depends.acl = ["luci-app-lxc"]` to each of the five backend entries, so the routes share the same authorization gate as the view Signed-off-by: Dirk Brenken

luci-app-lxc: add permission to set lxc options

2026-04-09T16:48:09Z

Add set permission in acl.d file for luci-app-lxc to allow users to set lxc options in luci-app-lxc. (considering that user has write permission for this app) Signed-off-by: mdevolde

luci-app-lxc: convert to JS

2026-02-19T01:00:14Z

migrate away from the old luci-app lua control system. See: https://github.com/openwrt/luci/issues/7310 Signed-off-by: Paul Donald

treewide: stage ACL rules for legacy applications

2020-04-10T21:21:35Z

Fixes: #3866 Signed-off-by: Jo-Philipp Wich