Merge pull request #1339 from Umeaboy/patch-41

[project/luci.git] / modules / luci-base / luasrc / http.lua

diff --git a/modules/luci-base/luasrc/http.lua b/modules/luci-base/luasrc/http.lua
index 4b35731..9cc9857 100644 (file)
--- a/modules/luci-base/luasrc/http.lua
+++ b/modules/luci-base/luasrc/http.lua
@@ -89,6 +89,37 @@ end
 
 function Request.setfilehandler(self, callback)
        self.filehandler = callback
+
+       -- If input has already been parsed then any files are either in temporary files
+       -- or are in self.message.params[key]
+       if self.parsed_input then
+               for param, value in pairs(self.message.params) do
+               repeat
+                       -- We're only interested in files
+                       if (not value["file"]) then break end
+                       -- If we were able to write to temporary file
+                       if (value["fd"]) then 
+                               fd = value["fd"]
+                               local eof = false
+                               repeat  
+                                       filedata = fd:read(1024)
+                                       if (filedata:len() < 1024) then
+                                               eof = true
+                                       end
+                                       callback({ name=value["name"], file=value["file"] }, filedata, eof)
+                               until (eof)
+                               fd:close()
+                               value["fd"] = nil
+                       -- We had to read into memory
+                       else
+                               -- There should only be one numbered value in table - the data
+                               for k, v in ipairs(value) do
+                                       callback({ name=value["name"], file=value["file"] }, v, true)
+                               end
+                       end
+               until true
+               end
+       end
 end
 
 function Request._parse_input(self)
@@ -193,7 +224,15 @@ function write(content, src_err)
                                header("Cache-Control", "no-cache")
                                header("Expires", "0")
                        end
-
+                       if not context.headers["x-frame-options"] then
+                               header("X-Frame-Options", "SAMEORIGIN")
+                       end
+                       if not context.headers["x-xss-protection"] then
+                               header("X-XSS-Protection", "1; mode=block")
+                       end
+                       if not context.headers["x-content-type-options"] then
+                               header("X-Content-Type-Options", "nosniff")
+                       end
 
                        context.eoh = true
                        coroutine.yield(3)