<feed xmlns='http://www.w3.org/2005/Atom'>
<title>luci/modules/rpc/luasrc/controller, branch 0.11.1</title>
<subtitle>Lua Configuration Interface (mirror)</subtitle>
<id>https://git.openwrt.org/project/luci/atom?h=0.11.1</id>
<link rel='self' href='https://git.openwrt.org/project/luci/atom?h=0.11.1'/>
<link rel='alternate' type='text/html' href='https://git.openwrt.org/project/luci/'/>
<updated>2012-08-08T09:48:53Z</updated>
<entry>
<title>modules/rpc: adapt rpc controller to sauth api changes</title>
<updated>2012-08-08T09:48:53Z</updated>
<author>
<name>Jo-Philipp Wich</name>
</author>
<published>2012-08-08T09:48:53Z</published>
<link rel='alternate' type='text/html' href='https://git.openwrt.org/project/luci/commit/?id=c8ffc897e312355ce2cebdb7446529d0fb41bb08'/>
<id>urn:sha1:c8ffc897e312355ce2cebdb7446529d0fb41bb08</id>
<content type='text'>
</content>
</entry>
<entry>
<title>Rework authentication system</title>
<updated>2012-08-07T19:11:56Z</updated>
<author>
<name>Jo-Philipp Wich</name>
</author>
<published>2012-08-07T19:11:56Z</published>
<link rel='alternate' type='text/html' href='https://git.openwrt.org/project/luci/commit/?id=a58370ab74aebca6871b1524a655f7bb5086e0a6'/>
<id>urn:sha1:a58370ab74aebca6871b1524a655f7bb5086e0a6</id>
<content type='text'>
The validity of authentication tokens was determined by the
mtime of respective authentication tokens on filesystem
stored in $sessionpath.
Talking about hardware without RTC or without a prior
connection to a time server, date/time usually around 1970 -
so is the mtime of the authentication token file in
$sessionpath.

When now configuring an internet connection via LuCI, the
system might fetch the current date/time (e.g. via ntp)
which invalidates the token, returns "403 Forbidden" and
kicks the user out of the interface.

This patch changes the authentication system to use time values
based on the uptime of the machine - rather than values based upon
gettimeofday() and {a|m}time values - and save them inside the token.
That way can always determine the difference between login
(last interaction respectively) and the current time, in-
dependant of the system clock jumping backwards/forwards.

Warning: This patch removes the clean() function and respective calls.
This means, invalid tokens will NOT be determined and removed from
filesystem automatically anymore.
Before, every HTTP-call caused a scan for invalid tokens,
which is quite expensive. Instead consider using a cron job
deleting all stalled files periodically.

Contributed by T-Labs, Deutsche Telekom Innovation Laboratories

Signed-off-by: Mirko Vogt &lt;mirko@openwrt.org&gt;
</content>
</entry>
<entry>
<title>return "403 Forbidden" if authentication token was given, however is invalid</title>
<updated>2012-08-07T19:11:52Z</updated>
<author>
<name>Jo-Philipp Wich</name>
</author>
<published>2012-08-07T19:11:52Z</published>
<link rel='alternate' type='text/html' href='https://git.openwrt.org/project/luci/commit/?id=69aa218335330e1e8c623fdc2e5e336b2b78056f'/>
<id>urn:sha1:69aa218335330e1e8c623fdc2e5e336b2b78056f</id>
<content type='text'>
Contributed by T-Labs, Deutsche Telekom Innovation Laboratories

Signed-off-by: Mirko Vogt &lt;mirko@openwrt.org&gt;
</content>
</entry>
<entry>
<title>modules/rpc: remove uvl bindings</title>
<updated>2011-01-02T19:55:21Z</updated>
<author>
<name>Jo-Philipp Wich</name>
</author>
<published>2011-01-02T19:55:21Z</published>
<link rel='alternate' type='text/html' href='https://git.openwrt.org/project/luci/commit/?id=c4f70ce38a049acdfefb632f7778806192dcfe01'/>
<id>urn:sha1:c4f70ce38a049acdfefb632f7778806192dcfe01</id>
<content type='text'>
</content>
</entry>
<entry>
<title>convert luci.fs users to nixio.fs api</title>
<updated>2009-07-19T00:24:58Z</updated>
<author>
<name>Jo-Philipp Wich</name>
</author>
<published>2009-07-19T00:24:58Z</published>
<link rel='alternate' type='text/html' href='https://git.openwrt.org/project/luci/commit/?id=8fcd841aa9af96c8a4a4d3c1a555d2d1ed42332c'/>
<id>urn:sha1:8fcd841aa9af96c8a4a4d3c1a555d2d1ed42332c</id>
<content type='text'>
</content>
</entry>
<entry>
<title>Refined urltokens and XSRF protection</title>
<updated>2008-12-15T10:40:45Z</updated>
<author>
<name>Steven Barth</name>
</author>
<published>2008-12-15T10:40:45Z</published>
<link rel='alternate' type='text/html' href='https://git.openwrt.org/project/luci/commit/?id=1ee5ba632ab52b5d3af5c88803fee89c8eaf6fe1'/>
<id>urn:sha1:1ee5ba632ab52b5d3af5c88803fee89c8eaf6fe1</id>
<content type='text'>
</content>
</entry>
<entry>
<title>Implement URL tokens</title>
<updated>2008-12-14T21:43:10Z</updated>
<author>
<name>Steven Barth</name>
</author>
<published>2008-12-14T21:43:10Z</published>
<link rel='alternate' type='text/html' href='https://git.openwrt.org/project/luci/commit/?id=271c53a4af7a79414a440b3a4d90ef7dbc48fd77'/>
<id>urn:sha1:271c53a4af7a79414a440b3a4d90ef7dbc48fd77</id>
<content type='text'>
Add basic XSRF protection
</content>
</entry>
<entry>
<title>Move RPC-bidnings out of the way to prevent the indexer to require them</title>
<updated>2008-09-05T19:25:57Z</updated>
<author>
<name>Steven Barth</name>
</author>
<published>2008-09-05T19:25:57Z</published>
<link rel='alternate' type='text/html' href='https://git.openwrt.org/project/luci/commit/?id=cd53740e0f117885dddcd9781b2209ead7170ae5'/>
<id>urn:sha1:cd53740e0f117885dddcd9781b2209ead7170ae5</id>
<content type='text'>
</content>
</entry>
<entry>
<title>Fix UVL RPC-API</title>
<updated>2008-09-05T19:09:11Z</updated>
<author>
<name>Steven Barth</name>
</author>
<published>2008-09-05T19:09:11Z</published>
<link rel='alternate' type='text/html' href='https://git.openwrt.org/project/luci/commit/?id=13579a4e211de5220c653fb97c211d6ef43dfa27'/>
<id>urn:sha1:13579a4e211de5220c653fb97c211d6ef43dfa27</id>
<content type='text'>
</content>
</entry>
<entry>
<title>Fixed UVL bindings</title>
<updated>2008-09-05T15:43:57Z</updated>
<author>
<name>Steven Barth</name>
</author>
<published>2008-09-05T15:43:57Z</published>
<link rel='alternate' type='text/html' href='https://git.openwrt.org/project/luci/commit/?id=b02fe4b480faed9fdea58bb346c5c839f202d9a0'/>
<id>urn:sha1:b02fe4b480faed9fdea58bb346c5c839f202d9a0</id>
<content type='text'>
</content>
</entry>
</feed>
