X-Git-Url: http://git.archive.openwrt.org/?p=project%2Fluci.git;a=blobdiff_plain;f=modules%2Fluci-base%2Fluasrc%2Fhttp.lua;h=9cc9857867a430d00c67be669249685fa483daf2;hp=a92d8affb65628505751ab80f705aa58e966de7a;hb=7fd4f84aa95e81c4b021498f57d8b57c8cc20db5;hpb=76dfdc1b1e7a62b363954f01f71f5a1e77d5249a

diff --git a/modules/luci-base/luasrc/http.lua b/modules/luci-base/luasrc/http.lua
index a92d8affb..9cc985786 100644
--- a/modules/luci-base/luasrc/http.lua
+++ b/modules/luci-base/luasrc/http.lua
@@ -89,6 +89,37 @@ end
 
 function Request.setfilehandler(self, callback)
 	self.filehandler = callback
+
+	-- If input has already been parsed then any files are either in temporary files
+	-- or are in self.message.params[key]
+	if self.parsed_input then
+		for param, value in pairs(self.message.params) do
+		repeat
+			-- We're only interested in files
+			if (not value["file"]) then break end
+			-- If we were able to write to temporary file
+			if (value["fd"]) then 
+				fd = value["fd"]
+				local eof = false
+				repeat	
+					filedata = fd:read(1024)
+					if (filedata:len() < 1024) then
+						eof = true
+					end
+					callback({ name=value["name"], file=value["file"] }, filedata, eof)
+				until (eof)
+				fd:close()
+				value["fd"] = nil
+			-- We had to read into memory
+			else
+				-- There should only be one numbered value in table - the data
+				for k, v in ipairs(value) do
+					callback({ name=value["name"], file=value["file"] }, v, true)
+				end
+			end
+		until true
+		end
+	end
 end
 
 function Request._parse_input(self)
@@ -193,7 +224,15 @@ function write(content, src_err)
 				header("Cache-Control", "no-cache")
 				header("Expires", "0")
 			end
-
+			if not context.headers["x-frame-options"] then
+				header("X-Frame-Options", "SAMEORIGIN")
+			end
+			if not context.headers["x-xss-protection"] then
+				header("X-XSS-Protection", "1; mode=block")
+			end
+			if not context.headers["x-content-type-options"] then
+				header("X-Content-Type-Options", "nosniff")
+			end
 
 			context.eoh = true
 			coroutine.yield(3)
@@ -208,6 +247,7 @@ function splice(fd, size)
 end
 
 function redirect(url)
+	if url == "" then url = "/" end
 	status(302, "Found")
 	header("Location", url)
 	close()