luci/applications/luci-app-lxc/ucode/controller, branch master

luci-app-lxc: fix authenticated path traversal and ACL bypass (host root)

2026-05-27T11:21:12Z

* ucode fixes: - tighten `is_valid_lxc_name` regex to `^[A-Za-z0-9_][A-Za-z0-9_-]{0,63}$` - apply the validator in `lxc_configuration_get` and `lxc_configuration_set` before any filesystem access - reject the `'lxc error: …'` sentinel string returned by `lxc_get_config_path()` on failure, rather than concatenating it into a path. - shellquote `LXC_URL` in `lxc_get_downloadable` and `lxc_create` * ACL fix: add `depends.acl = ["luci-app-lxc"]` to each of the five backend entries, so the routes share the same authorization gate as the view Signed-off-by: Dirk Brenken

luci-app-lxc: add user input checks

2026-04-06T19:59:10Z

Checks the user inputs for the lxc_create endpoint. Pases these inputs through two regular expressions. Applies shell quoting to these user inputs. Signed-off-by: mdevolde

luci-app-lxc: convert to JS

2026-02-19T01:00:14Z

migrate away from the old luci-app lua control system. See: https://github.com/openwrt/luci/issues/7310 Signed-off-by: Paul Donald