From b1b5723516a5ad11174c531c1c792dec5b753303 Mon Sep 17 00:00:00 2001 From: Jo-Philipp Wich Date: Mon, 9 Apr 2018 07:04:38 +0200 Subject: [PATCH] luci-base: consider empty parameters as well when testing POST requirement The cbi class will react on an empty "cbi.submit" parameter as well so we must intercept GET requests using that too. Fixes 186e690c0 ("luci-base: dispatcher: reject non-POST requests with any cbi.submit value") Signed-off-by: Jo-Philipp Wich --- modules/luci-base/luasrc/dispatcher.lua | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/modules/luci-base/luasrc/dispatcher.lua b/modules/luci-base/luasrc/dispatcher.lua index 486672757..91b86679f 100644 --- a/modules/luci-base/luasrc/dispatcher.lua +++ b/modules/luci-base/luasrc/dispatcher.lua @@ -136,8 +136,7 @@ local function require_post_security(target) if (type(required_val) == "string" and request_val ~= required_val) or - (required_val == true and - (request_val == nil or request_val == "")) + (required_val == true and request_val == nil) then return false end -- 2.11.0