luci/modules/luci-base/ucode, branch master

luci-base: fix lookup of non-present menu nodes

2026-08-08T01:29:57Z

This surfaced when I tried developing based purely on luci-base, without any of the status, system, or network modules. The menu entries for these modules live in luci-base, while the actions (templates/views) live in the respective modules. The header.ut template renders links to these menu entries, which fails because lookup() expects them to be present in the menu_json structure, which they are not. The template already anticipates that lookup() might fail, just lookup() itself didn't seem to yet. The resulting exception: Reference error Unhandled exception during request dispatching left-hand side expression is null In lookup(), file /usr/share/ucode/luci/dispatcher.uc, line 762, byte 24: called from function main (/usr/share/ucode/luci/template/themes/bootstrap/header.ut:61:51) called from function call ([C]) called from function [anonymous function] (/usr/share/ucode/luci/runtime.uc:80:36) called from function [anonymous function] (/usr/share/ucode/luci/runtime.uc:127:40) called from function [arrow function] (/usr/share/ucode/luci/runtime.uc:183:57) called from function main (/usr/share/ucode/luci/template/header.ut:7:34) called from function call ([C]) called from function [anonymous function] (/usr/share/ucode/luci/runtime.uc:80:36) called from function [anonymous function] (/usr/share/ucode/luci/runtime.uc:127:40) called from function [arrow function] (/usr/share/ucode/luci/runtime.uc:183:57) called from function main (/usr/share/ucode/luci/template/view.ut:1:20) called from function call ([C]) called from function [anonymous function] (/usr/share/ucode/luci/runtime.uc:80:36) called from function [anonymous function] (/usr/share/ucode/luci/runtime.uc:127:40) called from function [arrow function] (/usr/share/ucode/luci/runtime.uc:141:63) called from function render ([C]) called from function [anonymous function] (/usr/share/ucode/luci/runtime.uc:141:64) called from function run_action (/usr/share/ucode/luci/dispatcher.uc:815:47) called from function [anonymous function] (/usr/share/ucode/luci/dispatcher.uc:1107:48) called from anonymous function (/usr/share/ucode/walter/web/index.uc:47:15) node = node.children[name]; Near here -------------------^ Signed-off-by: Packet Please

themes: fix custom CSS via menu.d node

2026-08-07T23:33:25Z

The themes have supported custom CSS via menu.d nodes since they were first ported to ucode. There were two little problems though: - The css property wasn't added to the node schema in luci.dispatcher. - The themes used the wrong variable name. The advantage is that the client will load the custom CSS right away, instead of later when the view initializes. In my local development, it has prevented visual flickering on page load. Example menu.d entry: "falter": { "title": "Settings", "order": 5, "action": { "type": "view", "path": "falter/settings" }, "css": "view/falter/falter.css" } There are lots of potential users for this, since many Luci applications inject their CSS via client-side JS. Even luci-mod-network does. Signed-off-by: Packet Please

luci-base: drop init_action() and the luci.setInitAction ubus method

2026-08-03T09:58:22Z

Both duplicate rpcd's rc ubus namespace, which exposes the same enable/disable/start/stop/restart/reload set through rc.init and is what downstream code wishing to control services should be using. The duplicate was also the weaker of the two. init_action() interpolated both of its arguments into a shell command run as root: system(`env -i /etc/init.d/${basename(name)} ${action} >/dev/null`); basename() kept name inside /etc/init.d, but it strips directory components only - `;`, backticks, `$(`, `|` and newlines survive it - and action reached the shell with nothing checking it at all. Nothing untrusted got there: setInitAction switched on a fixed action list, and for name the stat() gate required the interpolated string to exist as a file under /etc/init.d, an existence check rather than a validation. But init_action() was exported from luci-base, so any future caller forwarding an RPC argument straight through inherited root command execution. rc.init has no shell to escape from - it execs the script - and it additionally refuses scripts that are not root-owned or that are world-writable. The in-tree users are ported in the preceding commits. Assisted-by: Claude:claude-opus-5 Signed-off-by: Julius Bairaktaris

luci-base: dispatcher: derive session token from /dev/urandom

2026-08-01T15:19:39Z

randomid() built the session token from math.rand(). ucode seeds that generator on first use with the wall-clock time in milliseconds and then uses libc rand(): if (!ucv_boolean_get(uc_vm_registry_get(vm, "math.srand_called"))) { gettimeofday(&tv, NULL); srand((tv.tv_sec * 1000) + (tv.tv_usec / 1000)); Each request is served by a fresh process, so the seed is the millisecond the request was handled, and randomid() is the first consumer of the generator in that process. The resulting token is predictable to anyone who knows the approximate time it was issued. Read the bytes from /dev/urandom instead, via readfile() + hexenc() - the same shape luci.sys.uniqueid() already uses. readfile() switches the stream to _IONBF for a limit below BUFSIZ, so it issues a single 16-byte read rather than draining a 4096-byte stdio buffer out of the pool. Return null on a short or failed read so callers fail closed rather than fall back to a weak value: session_retrieve() requires a string token, so a session created without one is rejected. Assisted-by: Claude:claude-opus-5 Signed-off-by: Julius Bairaktaris

luci-base: update timezone data to 2026c

2026-07-28T20:27:58Z

Update timezone data to 2026c. Alberta moved to permanent -06 on 2026-06-18. Morocco moves to permanent +00 on 2026-09-20. Signed-off-by: Hannu Nyman

luci-base: dispatcher.uc: escape URL path and username when logging

2026-07-20T19:24:28Z

Prevent maliciously crafted login requests from polluting the logs. Signed-off-by: Liangbin Lian

luci-base: fix redirect after login when request path is empty

2026-06-27T23:17:20Z

When accessing LuCI via /cgi-bin/luci/ without a full path, ctx.request_path is empty and login redirects back to the root URL instead of the resolved page. Fall back to ctx.path which holds the resolved firstchild route. Fixes openwrt/luci#8534. Signed-off-by: Maxim Skokov

luci-base: update timezone data to 2026b

2026-06-04T18:36:06Z

Update timezone data to 2026b. * British Columbia moved to permanent -07 on 2026-03-09. Signed-off-by: Hannu Nyman

luci-base: add authentication plugin mechanism

2026-04-09T12:26:09Z

This commit introduces a generic authentication plugin mechanism to the LuCI dispatcher, enabling multi-factor authentication (MFA/2FA) and other custom verification methods without modifying core files. This implementation integrates with the new plugin UI architecture introduced in commit 617f364 (luci-mod-system: implement plugin UI architecture), allowing authentication plugins to be managed through the unified System > Plugins interface. Signed-off-by: Han Yiming

luci-base: implement http header plugins

2026-03-30T22:13:54Z

This implements the injection of custom http headers via the new plugin architecture. Signed-off-by: Paul Donald