RPC initial authentication API completed

[project/luci.git] / libs / web / luasrc / dispatcher.lua

diff --git a/libs/web/luasrc/dispatcher.lua b/libs/web/luasrc/dispatcher.lua
index b74c5bd..068f350 100644 (file)
--- a/libs/web/luasrc/dispatcher.lua
+++ b/libs/web/luasrc/dispatcher.lua
@@ -26,6 +26,7 @@ limitations under the License.
 
 --- LuCI web dispatcher.
 module("luci.dispatcher", package.seeall)
+require("luci.util")
 require("luci.init")
 require("luci.http")
 require("luci.sys")
@@ -78,7 +79,7 @@ function error500(message)
        return false
 end
 
-function authenticator.htmlauth(validator, default)
+function authenticator.htmlauth(validator, accs, default)
        local user = luci.http.formvalue("username")
        local pass = luci.http.formvalue("password")
        
@@ -124,18 +125,23 @@ function dispatch(request)
        local c = context.tree
        local track = {}
        local args = {}
+       context.args = args
        local n
 
        for i, s in ipairs(request) do
                c = c.nodes[s]
                n = i
-               if not c or c.leaf then
+               if not c then
                        break
                end
 
                for k, v in pairs(c) do
                        track[k] = v
                end
+               
+               if c.leaf then
+                       break
+               end
        end
 
        if c and c.leaf then
@@ -154,6 +160,7 @@ function dispatch(request)
        tpl.context.viewns = viewns
        viewns.write       = luci.http.write
        viewns.translate   = function(...) return require("luci.i18n").translate(...) end
+       viewns.striptags   = luci.util.striptags
        viewns.controller  = luci.http.getenv("SCRIPT_NAME")
        viewns.media       = luci.config.main.mediaurlbase
        viewns.resource    = luci.config.main.resourcebase
@@ -169,14 +176,18 @@ function dispatch(request)
        
        if track.sysauth then
                require("luci.sauth")
-               local authen = authenticator[track.sysauth_authenticator]
+               local authen = type(track.sysauth_authenticator) == "function"
+                and track.sysauth_authenticator
+                or authenticator[track.sysauth_authenticator]
                local def  = (type(track.sysauth) == "string") and track.sysauth
                local accs = def and {track.sysauth} or track.sysauth
-               local user = luci.sauth.read(luci.http.getcookie("sysauth"))
+               local sess = luci.http.getcookie("sysauth")
+               sess = sess and sess:match("^[A-F0-9]+$")
+               local user = luci.sauth.read(sess)
                
                if not luci.util.contains(accs, user) then
                        if authen then
-                               local user = authen(luci.sys.user.checkpasswd, def)
+                               local user = authen(luci.sys.user.checkpasswd, accs, def)
                                if not user or not luci.util.contains(accs, user) then
                                        return
                                else