Tim Nordell 122839294a luci-proto-modemmanager: fix ACL command injection
The ACL permissions were originally authored to support just a single
set of modem interfaces, at the numbers 0-9.  Eventually this was
adjusted to support from 0 to 999 avoiding command injection.

However, as new commands were added, this was reverted again
unfortunately. Language like "regex" has been used in the commit history
for this ACL, and likely the core of the issue is confusion on how these
are parsed.  These are all parsed [1] with fnmatch(...), and not regex(..).

A future useful change could be for rpcd to set the FNM_EXTMATCH option
for fnmatch(...) to simplify this particular match statement, but that's
not considered here since that's a much broader change that needs a
longer discussion.

[1] a4a5a29858/session.c (L143-L147)

Fixes: 54aa70112c ("luci-proto-modemmanager: add status page")
Signed-off-by: Tim Nordell <tnordell@airgain.com>
2026-03-17 08:34:07 +01:00
2026-02-22 16:51:25 +01:00
2026-02-22 16:51:25 +01:00
2026-02-17 00:26:47 +01:00
2026-02-22 16:51:25 +01:00

OpenWrt luci feed

Translation status

Description

This is the OpenWrt "luci"-feed containing LuCI - OpenWrt Configuration Interface.

Usage

This feed is enabled by default. Your feeds.conf.default (or feeds.conf) should contain a line like:

src-git luci https://github.com/openwrt/luci.git

To install all its package definitions, run:

./scripts/feeds update luci
./scripts/feeds install -a -p luci

API Reference

You can browse the generated API documentation directly on Github.

Use ucode and rpcd for server side operations.

Development

Documentation for developing and extending LuCI can be found in the Wiki

License

See LICENSE file.

Package Guidelines

See CONTRIBUTING.md file.

Translation status

Use Weblate instead of direct editing of the *.po files.

Translation status

Description
LuCI - OpenWrt Configuration Interface
Readme Apache-2.0 538 MiB
Languages
JavaScript 65.1%
C 17.3%
Lua 6.6%
CSS 3.7%
UnrealScript 3%
Other 4.2%