treewide: filter shell arguments through shellquote() where applicable

[project/luci.git] / applications / luci-app-upnp / luasrc / controller / upnp.lua

diff --git a/applications/luci-app-upnp/luasrc/controller/upnp.lua b/applications/luci-app-upnp/luasrc/controller/upnp.lua
index c60b7c4..95a0ef4 100644 (file)
--- a/applications/luci-app-upnp/luasrc/controller/upnp.lua
+++ b/applications/luci-app-upnp/luasrc/controller/upnp.lua
@@ -19,8 +19,12 @@ function index()
 end
 
 function act_status()
+       local uci = luci.model.uci.cursor()
+       local lease_file = uci:get("upnpd", "config", "upnp_lease_file")
+
        local ipt = io.popen("iptables --line-numbers -t nat -xnvL MINIUPNPD 2>/dev/null")
        if ipt then
+               local upnpf = lease_file and io.open(lease_file, "r")
                local fwd = { }
                while true do
                        local ln = ipt:read("*l")
@@ -29,23 +33,32 @@ function act_status()
                        elseif ln:match("^%d+") then
                                local num, proto, extport, intaddr, intport =
                                        ln:match("^(%d+).-([a-z]+).-dpt:(%d+) to:(%S-):(%d+)")
+                               local descr = ""
 
                                if num and proto and extport and intaddr and intport then
                                        num     = tonumber(num)
                                        extport = tonumber(extport)
                                        intport = tonumber(intport)
 
+                                       if upnpf then
+                                               local uln = upnpf:read("*l")
+                                               if uln then descr = uln:match(string.format("^%s:%d:%s:%d:%%d*:(.*)$", proto:upper(), extport, intaddr, intport)) end
+                                               if not descr then descr = "" end
+                                       end
+
                                        fwd[#fwd+1] = {
                                                num     = num,
                                                proto   = proto:upper(),
                                                extport = extport,
                                                intaddr = intaddr,
-                                               intport = intport
+                                               intport = intport,
+                                               descr = descr
                                        }
                                end
                        end
                end
 
+               if upnpf then upnpf:close() end
                ipt:close()
 
                luci.http.prepare_content("application/json")
@@ -63,7 +76,7 @@ function act_delete(num)
 
                local lease_file = uci:get("upnpd", "config", "upnp_lease_file")
                if lease_file and nixio.fs.access(lease_file) then
-                       luci.sys.call("sed -i -e '%dd' %q" %{ idx, lease_file })
+                       luci.sys.call("sed -i -e '%dd' %s" %{ idx, luci.util.shellquote(lease_file) })
                end
 
                luci.http.status(200, "OK")