luci-base: use native ubus-rpc authorization protocol
[oweals/luci.git] / modules / luci-base / luasrc / controller / admin / index.lua
1 -- Copyright 2008 Steven Barth <steven@midlink.org>
2 -- Licensed to the public under the Apache License 2.0.
3
4 module("luci.controller.admin.index", package.seeall)
5
6 function index()
7         function toplevel_page(page, preflookup, preftarget)
8                 if preflookup and preftarget then
9                         if lookup(preflookup) then
10                                 page.target = preftarget
11                         end
12                 end
13
14                 if not page.target then
15                         page.target = firstchild()
16                 end
17         end
18
19         local uci = require("luci.model.uci").cursor()
20
21         local root = node()
22         if not root.target then
23                 root.target = alias("admin")
24                 root.index = true
25         end
26
27         local page   = node("admin")
28
29         page.title   = _("Administration")
30         page.order   = 10
31         page.sysauth = "root"
32         page.sysauth_authenticator = "htmlauth"
33         page.ucidata = true
34         page.index = true
35         page.target = firstnode()
36
37         -- Empty menu tree to be populated by addons and modules
38
39         page = node("admin", "status")
40         page.title = _("Status")
41         page.order = 10
42         page.index = true
43         -- overview is from mod-admin-full
44         toplevel_page(page, "admin/status/overview", alias("admin", "status", "overview"))
45
46         page = node("admin", "system")
47         page.title = _("System")
48         page.order = 20
49         page.index = true
50         -- system/system is from mod-admin-full
51         toplevel_page(page, "admin/system/system", alias("admin", "system", "system"))
52
53         -- Only used if applications add items
54         page = node("admin", "vpn")
55         page.title = _("VPN")
56         page.order = 30
57         page.index = true
58         toplevel_page(page, false, false)
59
60         -- Only used if applications add items
61         page = node("admin", "services")
62         page.title = _("Services")
63         page.order = 40
64         page.index = true
65         toplevel_page(page, false, false)
66
67         -- Even for mod-admin-full network just uses first submenu item as landing
68         page = node("admin", "network")
69         page.title = _("Network")
70         page.order = 50
71         page.index = true
72         toplevel_page(page, false, false)
73
74         if nixio.fs.access("/etc/config/dhcp") then
75                 page = entry({"admin", "dhcplease_status"}, call("lease_status"), nil)
76                 page.leaf = true
77         end
78
79         local has_wifi = false
80
81         uci:foreach("wireless", "wifi-device",
82                 function(s)
83                         has_wifi = true
84                         return false
85                 end)
86
87         if has_wifi then
88                 page = entry({"admin", "wireless_assoclist"}, call("wifi_assoclist"), nil)
89                 page.leaf = true
90
91                 page = entry({"admin", "wireless_deauth"}, post("wifi_deauth"), nil)
92                 page.leaf = true
93         end
94
95         page = entry({"admin", "translations"}, call("action_translations"), nil)
96         page.leaf = true
97
98         page = entry({"admin", "ubus"}, call("action_ubus"), nil)
99         page.sysauth = false
100         page.leaf = true
101
102         -- Logout is last
103         entry({"admin", "logout"}, call("action_logout"), _("Logout"), 999)
104 end
105
106 function action_logout()
107         local dsp = require "luci.dispatcher"
108         local utl = require "luci.util"
109         local sid = dsp.context.authsession
110
111         if sid then
112                 utl.ubus("session", "destroy", { ubus_rpc_session = sid })
113
114                 luci.http.header("Set-Cookie", "sysauth=%s; expires=%s; path=%s" %{
115                         '', 'Thu, 01 Jan 1970 01:00:00 GMT', dsp.build_url()
116                 })
117         end
118
119         luci.http.redirect(dsp.build_url())
120 end
121
122 function action_translations(lang)
123         local i18n = require "luci.i18n"
124         local http = require "luci.http"
125         local fs = require "nixio".fs
126
127         if lang and #lang > 0 then
128                 lang = i18n.setlanguage(lang)
129                 if lang then
130                         local s = fs.stat("%s/base.%s.lmo" %{ i18n.i18ndir, lang })
131                         if s then
132                                 http.header("Cache-Control", "public, max-age=31536000")
133                                 http.header("ETag", "%x-%x-%x" %{ s["ino"], s["size"], s["mtime"] })
134                         end
135                 end
136         end
137
138         http.prepare_content("application/javascript; charset=utf-8")
139         http.write("window.TR=")
140         http.write_json(i18n.dump())
141 end
142
143 local function ubus_reply(id, data, code, errmsg)
144         local reply = { jsonrpc = "2.0", id = id }
145         if errmsg then
146                 reply.error = {
147                         code = code,
148                         message = errmsg
149                 }
150         else
151                 reply.result = { code, data }
152         end
153
154         return reply
155 end
156
157 local ubus_types = {
158         nil,
159         "array",
160         "object",
161         "string",
162         nil, -- INT64
163         "number",
164         nil, -- INT16,
165         "boolean",
166         "double"
167 }
168
169 local function ubus_access(sid, obj, fun)
170         local res, code = luci.util.ubus("session", "access", {
171                 ubus_rpc_session = sid,
172                 scope            = "ubus",
173                 object           = obj,
174                 ["function"]     = fun
175         })
176
177         return (type(res) == "table" and res.access == true)
178 end
179
180 local function ubus_request(req)
181         if type(req) ~= "table" or type(req.method) ~= "string" or type(req.params) ~= "table" or
182            #req.params < 2 or req.jsonrpc ~= "2.0" or req.id == nil then
183                 return ubus_reply(nil, nil, -32600, "Invalid request")
184
185         elseif req.method == "call" then
186                 local sid, obj, fun, arg =
187                         req.params[1], req.params[2], req.params[3], req.params[4] or {}
188                 if type(arg) ~= "table" or arg.ubus_rpc_session ~= nil then
189                         return ubus_reply(req.id, nil, -32602, "Invalid parameters")
190                 end
191
192                 if sid == "00000000000000000000000000000000" and luci.dispatcher.context.authsession then
193                         sid = luci.dispatcher.context.authsession
194                 end
195
196                 if not ubus_access(sid, obj, fun) then
197                         return ubus_reply(req.id, nil, -32002, "Access denied")
198                 end
199
200                 arg.ubus_rpc_session = sid
201
202                 local res, code = luci.util.ubus(obj, fun, arg)
203                 return ubus_reply(req.id, res, code or 0)
204
205         elseif req.method == "list" then
206                 if type(params) ~= "table" or #params == 0 then
207                         local objs = { luci.util.ubus() }
208                         return ubus_reply(req.id, objs, 0)
209                 else
210                         local n, rv = nil, {}
211                         for n = 1, #params do
212                                 if type(params[n]) ~= "string" then
213                                         return ubus_reply(req.id, nil, -32602, "Invalid parameters")
214                                 end
215
216                                 local sig = luci.util.ubus(params[n])
217                                 if sig and type(sig) == "table" then
218                                         rv[params[n]] = {}
219
220                                         local m, p
221                                         for m, p in pairs(sig) do
222                                                 if type(p) == "table" then
223                                                         rv[params[n]][m] = {}
224
225                                                         local pn, pt
226                                                         for pn, pt in pairs(p) do
227                                                                 rv[params[n]][m][pn] = ubus_types[pt] or "unknown"
228                                                         end
229                                                 end
230                                         end
231                                 end
232                         end
233                         return ubus_reply(req.id, rv, 0)
234                 end
235         end
236
237         return ubus_reply(req.id, nil, -32601, "Method not found")
238 end
239
240 function action_ubus()
241         local parser = require "luci.jsonc".new()
242
243         luci.http.context.request:setfilehandler(function(_, s)
244                 if not s then
245                         return nil
246                 end
247
248                 local ok, err = parser:parse(s)
249                 return (not err or nil)
250         end)
251
252         luci.http.context.request:content()
253
254         local json = parser:get()
255         if json == nil or type(json) ~= "table" then
256                 luci.http.prepare_content("application/json")
257                 luci.http.write_json(ubus_reply(nil, nil, -32700, "Parse error"))
258                 return
259         end
260
261         local response
262         if #json == 0 then
263                 response = ubus_request(json)
264         else
265                 response = {}
266
267                 local _, request
268                 for _, request in ipairs(json) do
269                         response[_] = ubus_request(request)
270                 end
271         end
272
273         luci.http.prepare_content("application/json")
274         luci.http.write_json(response)
275 end
276
277 function lease_status()
278         local s = require "luci.tools.status"
279
280         luci.http.prepare_content("application/json")
281         luci.http.write('[')
282         luci.http.write_json(s.dhcp_leases())
283         luci.http.write(',')
284         luci.http.write_json(s.dhcp6_leases())
285         luci.http.write(']')
286 end
287
288 function wifi_assoclist()
289         local s = require "luci.tools.status"
290
291         luci.http.prepare_content("application/json")
292         luci.http.write_json(s.wifi_assoclist())
293 end
294
295 function wifi_deauth()
296         local iface = luci.http.formvalue("iface")
297         local bssid = luci.http.formvalue("bssid")
298
299         if iface and bssid then
300                 luci.util.ubus("hostapd.%s" % iface, "del_client", {
301                         addr = bssid,
302                         deauth = true,
303                         reason = 5,
304                         ban_time = 60000
305                 })
306         end
307         luci.http.status(200, "OK")
308 end