Lua Configuration Interface (mirror) https://git.openwrt.org/project/luci/atom?h=master 2026-10-05T17:46:12Z 2026-10-05T17:46:12Z Hannu Nyman 2026-10-05T17:46:12Z urn:sha1:dc37ec7e330a6715be4019603eca27613786b3a8 Update timezone data to 2026e. * Manitoba moves to permanent -05 on 2026-10-31. Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi> 2026-09-18T18:18:17Z Fuad Hasan 2026-08-24T04:46:34Z urn:sha1:76a76146202f6d6a51294e2b65a2783fe89fdac5 normalize_assets() rejects .. and whitespace but not quotes or angle brackets, and every sysauth template interpolates the surviving src straight into an attribute without escaping: <script src="{{ asset.src }}"></script> A src of /luci-static/plugins/<uuid>/x.js"></script><script>... passes both existing checks and closes the attribute. It needs no whitespace, so the existing character class does not stop it. The three in-tree templates could entityencode() instead, but normalize_assets() is the single point every theme goes through, so filtering here also covers out-of-tree themes carrying the same markup. src comes from a plugin's own check(), which is server-side ucode able to emit script through the html field regardless, so this is not a privilege boundary. It matters for a plugin deriving src from request input, and it keeps the filter consistent with what it already tries to do. Signed-off-by: Fuad Hasan <fuad.antor@gmail.com> 2026-09-18T18:18:17Z Fuad Hasan 2026-08-23T17:46:03Z urn:sha1:5c4e7afe71e9cd353a44427614aaee86c67d498f normalize_assets() passes a string to match(), which requires a regexp and returns null for anything else. The path check therefore fails for every asset and each one is dropped by the following continue, so an auth plugin's scripts are never rendered on the login page. The failure is silent. The html returned by the same check() call is unaffected, so a plugin's login UI appears without the script that drives it and nothing is logged. plugins/luci-plugin-auth-example is affected as well. The check is a plain prefix test, so use index() rather than compiling a regexp per asset. It returns the offset of the first occurrence or -1, making != 0 the equivalent of the anchored ^, and comparing two plain strings keeps the check independent of how uuid is validated. Signed-off-by: Fuad Hasan <fuad.antor@gmail.com> 2026-09-16T09:54:45Z Andy Chiang 2026-09-16T07:31:17Z urn:sha1:748e5c180123dd7f451e347fcef6db78c0b419da Update timezone data to 2026d. Northwest Territories moved to permanent -06 on 2026-08-21. Signed-off-by: Andy Chiang <AndyChiang_git@outlook.com> 2026-08-08T01:29:57Z Packet Please 2026-08-05T23:28:07Z urn:sha1:f35e6f6b7c78d62c1c3fe5584e65f6967df93861 This surfaced when I tried developing based purely on luci-base, without any of the status, system, or network modules. The menu entries for these modules live in luci-base, while the actions (templates/views) live in the respective modules. The header.ut template renders links to these menu entries, which fails because lookup() expects them to be present in the menu_json structure, which they are not. The template already anticipates that lookup() might fail, just lookup() itself didn't seem to yet. The resulting exception: Reference error Unhandled exception during request dispatching left-hand side expression is null In lookup(), file /usr/share/ucode/luci/dispatcher.uc, line 762, byte 24: called from function main (/usr/share/ucode/luci/template/themes/bootstrap/header.ut:61:51) called from function call ([C]) called from function [anonymous function] (/usr/share/ucode/luci/runtime.uc:80:36) called from function [anonymous function] (/usr/share/ucode/luci/runtime.uc:127:40) called from function [arrow function] (/usr/share/ucode/luci/runtime.uc:183:57) called from function main (/usr/share/ucode/luci/template/header.ut:7:34) called from function call ([C]) called from function [anonymous function] (/usr/share/ucode/luci/runtime.uc:80:36) called from function [anonymous function] (/usr/share/ucode/luci/runtime.uc:127:40) called from function [arrow function] (/usr/share/ucode/luci/runtime.uc:183:57) called from function main (/usr/share/ucode/luci/template/view.ut:1:20) called from function call ([C]) called from function [anonymous function] (/usr/share/ucode/luci/runtime.uc:80:36) called from function [anonymous function] (/usr/share/ucode/luci/runtime.uc:127:40) called from function [arrow function] (/usr/share/ucode/luci/runtime.uc:141:63) called from function render ([C]) called from function [anonymous function] (/usr/share/ucode/luci/runtime.uc:141:64) called from function run_action (/usr/share/ucode/luci/dispatcher.uc:815:47) called from function [anonymous function] (/usr/share/ucode/luci/dispatcher.uc:1107:48) called from anonymous function (/usr/share/ucode/walter/web/index.uc:47:15) node = node.children[name]; Near here -------------------^ Signed-off-by: Packet Please <pktpls@systemli.org> 2026-08-07T23:33:25Z Packet Please 2026-08-07T16:27:26Z urn:sha1:7c6d8ff7f8b894d1c8c3382af4b79b7cea68c709 The themes have supported custom CSS via menu.d nodes since they were first ported to ucode. There were two little problems though: - The css property wasn't added to the node schema in luci.dispatcher. - The themes used the wrong variable name. The advantage is that the client will load the custom CSS right away, instead of later when the view initializes. In my local development, it has prevented visual flickering on page load. Example menu.d entry: "falter": { "title": "Settings", "order": 5, "action": { "type": "view", "path": "falter/settings" }, "css": "view/falter/falter.css" } There are lots of potential users for this, since many Luci applications inject their CSS via client-side JS. Even luci-mod-network does. Signed-off-by: Packet Please <pktpls@systemli.org> 2026-08-03T09:58:22Z Julius Bairaktaris 2026-08-02T00:41:03Z urn:sha1:4440b267ddef05b13b09c7c31ef7eba2401d2651 Both duplicate rpcd's rc ubus namespace, which exposes the same enable/disable/start/stop/restart/reload set through rc.init and is what downstream code wishing to control services should be using. The duplicate was also the weaker of the two. init_action() interpolated both of its arguments into a shell command run as root: system(`env -i /etc/init.d/${basename(name)} ${action} >/dev/null`); basename() kept name inside /etc/init.d, but it strips directory components only - `;`, backticks, `$(`, `|` and newlines survive it - and action reached the shell with nothing checking it at all. Nothing untrusted got there: setInitAction switched on a fixed action list, and for name the stat() gate required the interpolated string to exist as a file under /etc/init.d, an existence check rather than a validation. But init_action() was exported from luci-base, so any future caller forwarding an RPC argument straight through inherited root command execution. rc.init has no shell to escape from - it execs the script - and it additionally refuses scripts that are not root-owned or that are world-writable. The in-tree users are ported in the preceding commits. Assisted-by: Claude:claude-opus-5 Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> 2026-08-01T15:19:39Z Julius Bairaktaris 2026-08-01T02:27:18Z urn:sha1:df71c660192bae5d4d0c2102bba121f3c916b6a5 randomid() built the session token from math.rand(). ucode seeds that generator on first use with the wall-clock time in milliseconds and then uses libc rand(): if (!ucv_boolean_get(uc_vm_registry_get(vm, "math.srand_called"))) { gettimeofday(&tv, NULL); srand((tv.tv_sec * 1000) + (tv.tv_usec / 1000)); Each request is served by a fresh process, so the seed is the millisecond the request was handled, and randomid() is the first consumer of the generator in that process. The resulting token is predictable to anyone who knows the approximate time it was issued. Read the bytes from /dev/urandom instead, via readfile() + hexenc() - the same shape luci.sys.uniqueid() already uses. readfile() switches the stream to _IONBF for a limit below BUFSIZ, so it issues a single 16-byte read rather than draining a 4096-byte stdio buffer out of the pool. Return null on a short or failed read so callers fail closed rather than fall back to a weak value: session_retrieve() requires a string token, so a session created without one is rejected. Assisted-by: Claude:claude-opus-5 Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> 2026-07-28T20:27:58Z Hannu Nyman 2026-07-28T20:25:41Z urn:sha1:77046b7d002ee3c4dcc10548e6ae10fce3115757 Update timezone data to 2026c. Alberta moved to permanent -06 on 2026-06-18. Morocco moves to permanent +00 on 2026-09-20. Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi> 2026-07-20T19:24:28Z Liangbin Lian 2026-07-01T13:14:09Z urn:sha1:4021b549d77bf197923aecb6329381304c99d34d Prevent maliciously crafted login requests from polluting the logs. Signed-off-by: Liangbin Lian <jjm2473@gmail.com>