treewide: filter shell arguments through shellquote() where applicable

[project/luci.git] / modules / luci-base / luasrc / sys.lua

diff --git a/modules/luci-base/luasrc/sys.lua b/modules/luci-base/luasrc/sys.lua
index 115c54d..823e207 100644 (file)
--- a/modules/luci-base/luasrc/sys.lua
+++ b/modules/luci-base/luasrc/sys.lua
@@ -7,6 +7,7 @@ local table  = require "table"
 local nixio  = require "nixio"
 local fs     = require "nixio.fs"
 local uci    = require "luci.model.uci"
+local ntm    = require "luci.model.network"
 
 local luci  = {}
 luci.util   = require "luci.util"
@@ -86,10 +87,10 @@ end
 function httpget(url, stream, target)
        if not target then
                local source = stream and io.popen or luci.util.exec
-               return source("wget -qO- '"..url:gsub("'", "").."'")
+               return source("wget -qO- %s" % luci.util.shellquote(url))
        else
-               return os.execute("wget -qO '%s' '%s'" %
-                       {target:gsub("'", ""), url:gsub("'", "")})
+               return os.execute("wget -qO %s %s" %
+                       {luci.util.shellquote(target), luci.util.shellquote(url)})
        end
 end
 
@@ -137,17 +138,22 @@ local function _nethints(what, callback)
 
        luci.ip.neighbors(nil, function(neigh)
                if neigh.mac and neigh.family == 4 then
-                       _add(what, neigh.mac:upper(), neigh.dest:string(), nil, nil)
+                       _add(what, neigh.mac:string(), neigh.dest:string(), nil, nil)
                elseif neigh.mac and neigh.family == 6 then
-                       _add(what, neigh.mac:upper(), nil, neigh.dest:string(), nil)
+                       _add(what, neigh.mac:string(), nil, neigh.dest:string(), nil)
                end
        end)
 
        if fs.access("/etc/ethers") then
                for e in io.lines("/etc/ethers") do
-                       mac, ip = e:match("^([a-f0-9]%S+) (%S+)")
-                       if mac and ip then
-                               _add(what, mac:upper(), ip, nil, nil)
+                       mac, name = e:match("^([a-fA-F0-9:-]+)%s+(%S+)")
+                       mac = luci.ip.checkmac(mac)
+                       if mac and name then
+                               if luci.ip.checkip4(name) then
+                                       _add(what, mac, name, nil, nil)
+                               else
+                                       _add(what, mac, nil, nil, name)
+                               end
                        end
                end
        end
@@ -157,8 +163,9 @@ local function _nethints(what, callback)
                        if s.leasefile and fs.access(s.leasefile) then
                                for e in io.lines(s.leasefile) do
                                        mac, ip, name = e:match("^%d+ (%S+) (%S+) (%S+)")
+                                       mac = luci.ip.checkmac(mac)
                                        if mac and ip then
-                                               _add(what, mac:upper(), ip, nil, name ~= "*" and name)
+                                               _add(what, mac, ip, nil, name ~= "*" and name)
                                        end
                                end
                        end
@@ -168,7 +175,10 @@ local function _nethints(what, callback)
        cur:foreach("dhcp", "host",
                function(s)
                        for mac in luci.util.imatch(s.mac) do
-                               _add(what, mac:upper(), s.ip, nil, s.name)
+                               mac = luci.ip.checkmac(mac)
+                               if mac then
+                                       _add(what, mac, s.ip, nil, s.name)
+                               end
                        end
                end)
 
@@ -433,55 +443,30 @@ function user.checkpasswd(username, pass)
 end
 
 function user.setpasswd(username, password)
-       if password then
-               password = password:gsub("'", [['"'"']])
-       end
-
-       if username then
-               username = username:gsub("'", [['"'"']])
-       end
-
-       return os.execute(
-               "(echo '" .. password .. "'; sleep 1; echo '" .. password .. "') | " ..
-               "passwd '" .. username .. "' >/dev/null 2>&1"
-       )
+       return os.execute("(echo %s; sleep 1; echo %s) | passwd %s >/dev/null 2>&1" %{
+               luci.util.shellquote(password),
+               luci.util.shellquote(password),
+               luci.util.shellquote(username)
+       })
 end
 
 
 wifi = {}
 
 function wifi.getiwinfo(ifname)
-       local stat, iwinfo = pcall(require, "iwinfo")
-
-       if ifname then
-               local d, n = ifname:match("^(%w+)%.network(%d+)")
-               local wstate = luci.util.ubus("network.wireless", "status") or { }
-
-               d = d or ifname
-               n = n and tonumber(n) or 1
-
-               if type(wstate[d]) == "table" and
-                  type(wstate[d].interfaces) == "table" and
-                  type(wstate[d].interfaces[n]) == "table" and
-                  type(wstate[d].interfaces[n].ifname) == "string"
-               then
-                       ifname = wstate[d].interfaces[n].ifname
-               else
-                       ifname = d
-               end
+       ntm.init()
 
-               local t = stat and iwinfo.type(ifname)
-               local x = t and iwinfo[t] or { }
-               return setmetatable({}, {
-                       __index = function(t, k)
-                               if k == "ifname" then
-                                       return ifname
-                               elseif x[k] then
-                                       return x[k](ifname)
-                               end
-                       end
-               })
+       local wnet = ntm:get_wifinet(ifname)
+       if wnet and wnet.iwinfo then
+               return wnet.iwinfo
        end
+
+       local wdev = ntm:get_wifidev(ifname)
+       if wdev and wdev.iwinfo then
+               return wdev.iwinfo
+       end
+
+       return { ifname = ifname }
 end