cgi-io: require whitelisting upload locations

mirror of https://github.com/novatiq/packages.git synced 2026-04-30 07:28:39 +01:00

Introduce further ACL checks to verify that the request-supplied
upload location may be written to. This prevents overwriting things
like /bin/busybox and allows to confine uploads to specific directories.

To setup the required ACLs, the following ubus command may be used
on the command line:

ubus call session grant '{
  "ubus_rpc_session": "d41d8cd98f00b204e9800998ecf8427e",
  "scope": "cgi-io",
  "objects": [
    [ "/etc/certificates/*", "write" ],
    [ "/var/uploads/*", "write" ]
  ]
}'

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

This commit is contained in:

Jo-Philipp Wich

2019-08-30 07:50:43 +02:00

committed by

John Crispin

parent 4f43e9b388

commit 22be9a1c01

2 changed files with 63 additions and 2 deletions

									
										net/cgi-io/Makefile
									
		+1
		-1
	
												View File
												
				@@ -8,7 +8,7 @@

				include $(TOPDIR)/rules.mk

				PKG_NAME:=cgi-io

				PKG_RELEASE:=6

				PKG_RELEASE:=7

				PKG_LICENSE:=GPL-2.0+