luci-mod-system: prevent comment injection in mtdbackup endpoint
[oweals/luci.git] / modules / luci-mod-system / luasrc / controller / admin / system.lua
1 -- Copyright 2008 Steven Barth <steven@midlink.org>
2 -- Copyright 2008-2011 Jo-Philipp Wich <jow@openwrt.org>
3 -- Licensed to the public under the Apache License 2.0.
4
5 module("luci.controller.admin.system", package.seeall)
6
7 function index()
8         local fs = require "nixio.fs"
9
10         entry({"admin", "system", "system"}, cbi("admin_system/system"), _("System"), 1)
11         entry({"admin", "system", "clock_status"}, post_on({ set = true }, "action_clock_status"))
12
13         entry({"admin", "system", "admin"}, cbi("admin_system/admin"), _("Administration"), 2)
14
15         if fs.access("/bin/opkg") then
16                 entry({"admin", "system", "packages"}, post_on({ exec = "1" }, "action_packages"), _("Software"), 10)
17                 entry({"admin", "system", "packages", "ipkg"}, form("admin_system/ipkg"))
18         end
19
20         entry({"admin", "system", "startup"}, form("admin_system/startup"), _("Startup"), 45)
21         entry({"admin", "system", "crontab"}, form("admin_system/crontab"), _("Scheduled Tasks"), 46)
22
23         if fs.access("/sbin/block") and fs.access("/etc/config/fstab") then
24                 entry({"admin", "system", "fstab"}, cbi("admin_system/fstab"), _("Mount Points"), 50)
25                 entry({"admin", "system", "fstab", "mount"}, cbi("admin_system/fstab/mount"), nil).leaf = true
26                 entry({"admin", "system", "fstab", "swap"},  cbi("admin_system/fstab/swap"),  nil).leaf = true
27         end
28
29         local nodes, number = fs.glob("/sys/class/leds/*")
30         if number > 0 then
31                 entry({"admin", "system", "leds"}, cbi("admin_system/leds"), _("<abbr title=\"Light Emitting Diode\">LED</abbr> Configuration"), 60)
32         end
33
34         entry({"admin", "system", "flashops"}, call("action_flashops"), _("Backup / Flash Firmware"), 70)
35         entry({"admin", "system", "flashops", "reset"}, post("action_reset"))
36         entry({"admin", "system", "flashops", "backup"}, post("action_backup"))
37         entry({"admin", "system", "flashops", "backupmtdblock"}, post("action_backupmtdblock"))
38         entry({"admin", "system", "flashops", "backupfiles"}, form("admin_system/backupfiles"))
39
40         -- call() instead of post() due to upload handling!
41         entry({"admin", "system", "flashops", "restore"}, call("action_restore"))
42         entry({"admin", "system", "flashops", "sysupgrade"}, call("action_sysupgrade"))
43
44         entry({"admin", "system", "reboot"}, template("admin_system/reboot"), _("Reboot"), 90)
45         entry({"admin", "system", "reboot", "call"}, post("action_reboot"))
46 end
47
48 function action_clock_status()
49         local set = tonumber(luci.http.formvalue("set"))
50         if set ~= nil and set > 0 then
51                 local date = os.date("*t", set)
52                 if date then
53                         luci.sys.call("date -s '%04d-%02d-%02d %02d:%02d:%02d'" %{
54                                 date.year, date.month, date.day, date.hour, date.min, date.sec
55                         })
56                         luci.sys.call("/etc/init.d/sysfixtime restart")
57                 end
58         end
59
60         luci.http.prepare_content("application/json")
61         luci.http.write_json({ timestring = os.date("%c") })
62 end
63
64 function action_packages()
65         local fs = require "nixio.fs"
66         local ipkg = require "luci.model.ipkg"
67         local submit = (luci.http.formvalue("exec") == "1")
68         local update, upgrade
69         local changes = false
70         local install = { }
71         local remove  = { }
72         local stdout  = { "" }
73         local stderr  = { "" }
74         local out, err
75
76         -- Display
77         local display = luci.http.formvalue("display") or "available"
78
79         -- Letter
80         local letter = string.byte(luci.http.formvalue("letter") or "A", 1)
81         letter = (letter == 35 or (letter >= 65 and letter <= 90)) and letter or 65
82
83         -- Search query
84         local query = luci.http.formvalue("query")
85         query = (query ~= '') and query or nil
86
87
88         -- Modifying actions
89         if submit then
90                 -- Packets to be installed
91                 local ninst = luci.http.formvalue("install")
92                 local uinst = nil
93
94                 -- Install from URL
95                 local url = luci.http.formvalue("url")
96                 if url and url ~= '' then
97                         uinst = url
98                 end
99
100                 -- Do install
101                 if ninst then
102                         install[ninst], out, err = ipkg.install(ninst)
103                         stdout[#stdout+1] = out
104                         stderr[#stderr+1] = err
105                         changes = true
106                 end
107
108                 if uinst then
109                         local pkg
110                         for pkg in luci.util.imatch(uinst) do
111                                 install[uinst], out, err = ipkg.install(pkg)
112                                 stdout[#stdout+1] = out
113                                 stderr[#stderr+1] = err
114                                 changes = true
115                         end
116                 end
117
118                 -- Remove packets
119                 local rem = luci.http.formvalue("remove")
120                 if rem then
121                         remove[rem], out, err = ipkg.remove(rem)
122                         stdout[#stdout+1] = out
123                         stderr[#stderr+1] = err
124                         changes = true
125                 end
126
127
128                 -- Update all packets
129                 update = luci.http.formvalue("update")
130                 if update then
131                         update, out, err = ipkg.update()
132                         stdout[#stdout+1] = out
133                         stderr[#stderr+1] = err
134                 end
135
136
137                 -- Upgrade all packets
138                 upgrade = luci.http.formvalue("upgrade")
139                 if upgrade then
140                         upgrade, out, err = ipkg.upgrade()
141                         stdout[#stdout+1] = out
142                         stderr[#stderr+1] = err
143                 end
144         end
145
146
147         -- List state
148         local no_lists = true
149         local old_lists = false
150         if fs.access("/var/opkg-lists/") then
151                 local list
152                 for list in fs.dir("/var/opkg-lists/") do
153                         no_lists = false
154                         if (fs.stat("/var/opkg-lists/"..list, "mtime") or 0) < (os.time() - (24 * 60 * 60)) then
155                                 old_lists = true
156                                 break
157                         end
158                 end
159         end
160
161
162         luci.template.render("admin_system/packages", {
163                 display   = display,
164                 letter    = letter,
165                 query     = query,
166                 install   = install,
167                 remove    = remove,
168                 update    = update,
169                 upgrade   = upgrade,
170                 no_lists  = no_lists,
171                 old_lists = old_lists,
172                 stdout    = table.concat(stdout, ""),
173                 stderr    = table.concat(stderr, "")
174         })
175
176         -- Remove index cache
177         if changes then
178                 fs.unlink("/tmp/luci-indexcache")
179         end
180 end
181
182 local function image_supported(image)
183         return (os.execute("sysupgrade -T %q >/dev/null" % image) == 0)
184 end
185
186 local function image_checksum(image)
187         return (luci.sys.exec("md5sum %q" % image):match("^([^%s]+)"))
188 end
189
190 local function image_sha256_checksum(image)
191         return (luci.sys.exec("sha256sum %q" % image):match("^([^%s]+)"))
192 end
193
194 local function supports_sysupgrade()
195         return nixio.fs.access("/lib/upgrade/platform.sh")
196 end
197
198 local function supports_reset()
199         return (os.execute([[grep -sq "^overlayfs:/overlay / overlay " /proc/mounts]]) == 0)
200 end
201
202 local function storage_size()
203         local size = 0
204         if nixio.fs.access("/proc/mtd") then
205                 for l in io.lines("/proc/mtd") do
206                         local d, s, e, n = l:match('^([^%s]+)%s+([^%s]+)%s+([^%s]+)%s+"([^%s]+)"')
207                         if n == "linux" or n == "firmware" then
208                                 size = tonumber(s, 16)
209                                 break
210                         end
211                 end
212         elseif nixio.fs.access("/proc/partitions") then
213                 for l in io.lines("/proc/partitions") do
214                         local x, y, b, n = l:match('^%s*(%d+)%s+(%d+)%s+([^%s]+)%s+([^%s]+)')
215                         if b and n and not n:match('[0-9]') then
216                                 size = tonumber(b) * 1024
217                                 break
218                         end
219                 end
220         end
221         return size
222 end
223
224
225 function action_flashops()
226         --
227         -- Overview
228         --
229         luci.template.render("admin_system/flashops", {
230                 reset_avail   = supports_reset(),
231                 upgrade_avail = supports_sysupgrade()
232         })
233 end
234
235 function action_sysupgrade()
236         local fs = require "nixio.fs"
237         local http = require "luci.http"
238         local image_tmp = "/tmp/firmware.img"
239
240         local fp
241         http.setfilehandler(
242                 function(meta, chunk, eof)
243                         if not fp and meta and meta.name == "image" then
244                                 fp = io.open(image_tmp, "w")
245                         end
246                         if fp and chunk then
247                                 fp:write(chunk)
248                         end
249                         if fp and eof then
250                                 fp:close()
251                         end
252                 end
253         )
254
255         if not luci.dispatcher.test_post_security() then
256                 fs.unlink(image_tmp)
257                 return
258         end
259
260         --
261         -- Cancel firmware flash
262         --
263         if http.formvalue("cancel") then
264                 fs.unlink(image_tmp)
265                 http.redirect(luci.dispatcher.build_url('admin/system/flashops'))
266                 return
267         end
268
269         --
270         -- Initiate firmware flash
271         --
272         local step = tonumber(http.formvalue("step")) or 1
273         if step == 1 then
274                 local force = http.formvalue("force")
275                 if image_supported(image_tmp) or force then
276                         luci.template.render("admin_system/upgrade", {
277                                 checksum = image_checksum(image_tmp),
278                                 sha256ch = image_sha256_checksum(image_tmp),
279                                 storage  = storage_size(),
280                                 size     = (fs.stat(image_tmp, "size") or 0),
281                                 keep     = (not not http.formvalue("keep")),
282                                 force    = (not not http.formvalue("force"))
283                         })
284                 else
285                         fs.unlink(image_tmp)
286                         luci.template.render("admin_system/flashops", {
287                                 reset_avail   = supports_reset(),
288                                 upgrade_avail = supports_sysupgrade(),
289                                 image_invalid = true
290                         })
291                 end
292
293         --
294         -- Start sysupgrade flash
295         --
296         elseif step == 2 then
297                 local keep = (http.formvalue("keep") == "1") and "" or "-n"
298                 local force = (http.formvalue("force") == "1") and "-F" or ""
299                 luci.template.render("admin_system/applyreboot", {
300                         title = luci.i18n.translate("Flashing..."),
301                         msg   = luci.i18n.translate("The system is flashing now.<br /> DO NOT POWER OFF THE DEVICE!<br /> Wait a few minutes before you try to reconnect. It might be necessary to renew the address of your computer to reach the device again, depending on your settings."),
302                         addr  = (#keep > 0) and (#force > 0) and "192.168.1.1" or nil
303                 })
304                 fork_exec("sleep 1; killall dropbear uhttpd; sleep 1; /sbin/sysupgrade %s %s %q" %{ keep, force, image_tmp })
305         end
306 end
307
308 function action_backup()
309         local reader = ltn12_popen("sysupgrade --create-backup - 2>/dev/null")
310
311         luci.http.header(
312                 'Content-Disposition', 'attachment; filename="backup-%s-%s.tar.gz"' %{
313                         luci.sys.hostname(),
314                         os.date("%Y-%m-%d")
315                 })
316
317         luci.http.prepare_content("application/x-targz")
318         luci.ltn12.pump.all(reader, luci.http.write)
319 end
320
321 function action_backupmtdblock()
322         local mv = luci.http.formvalue("mtdblockname") or ""
323         local m, n = mv:match('^([^%s%./"]+)/%d+/(%d+)$')
324
325         if not m and n then
326                 luci.http.status(400, "Bad Request")
327                 return
328         end
329
330         local reader = ltn12_popen("dd if=/dev/mtd%s conv=fsync,notrunc 2>/dev/null" % n)
331
332         luci.http.header(
333                 'Content-Disposition', 'attachment; filename="backup-%s-%s-%s.bin"' %{
334                         luci.sys.hostname(), m,
335                         os.date("%Y-%m-%d")
336                 })
337
338         luci.http.prepare_content("application/octet-stream")
339         luci.ltn12.pump.all(reader, luci.http.write)
340 end
341
342 function action_restore()
343         local fs = require "nixio.fs"
344         local http = require "luci.http"
345         local archive_tmp = "/tmp/restore.tar.gz"
346
347         local fp
348         http.setfilehandler(
349                 function(meta, chunk, eof)
350                         if not fp and meta and meta.name == "archive" then
351                                 fp = io.open(archive_tmp, "w")
352                         end
353                         if fp and chunk then
354                                 fp:write(chunk)
355                         end
356                         if fp and eof then
357                                 fp:close()
358                         end
359                 end
360         )
361
362         if not luci.dispatcher.test_post_security() then
363                 fs.unlink(archive_tmp)
364                 return
365         end
366
367         local upload = http.formvalue("archive")
368         if upload and #upload > 0 then
369                 if os.execute("gunzip -t %q >/dev/null 2>&1" % archive_tmp) == 0 then
370                         luci.template.render("admin_system/applyreboot")
371                         os.execute("tar -C / -xzf %q >/dev/null 2>&1" % archive_tmp)
372                         luci.sys.reboot()
373                 else
374                         luci.template.render("admin_system/flashops", {
375                                 reset_avail   = supports_reset(),
376                                 upgrade_avail = supports_sysupgrade(),
377                                 backup_invalid = true
378                         })
379                 end
380                 return
381         end
382
383         http.redirect(luci.dispatcher.build_url('admin/system/flashops'))
384 end
385
386 function action_reset()
387         if supports_reset() then
388                 luci.template.render("admin_system/applyreboot", {
389                         title = luci.i18n.translate("Erasing..."),
390                         msg   = luci.i18n.translate("The system is erasing the configuration partition now and will reboot itself when finished."),
391                         addr  = "192.168.1.1"
392                 })
393
394                 fork_exec("sleep 1; killall dropbear uhttpd; sleep 1; jffs2reset -y && reboot")
395                 return
396         end
397
398         http.redirect(luci.dispatcher.build_url('admin/system/flashops'))
399 end
400
401 function action_passwd()
402         local p1 = luci.http.formvalue("pwd1")
403         local p2 = luci.http.formvalue("pwd2")
404         local stat = nil
405
406         if p1 or p2 then
407                 if p1 == p2 then
408                         stat = luci.sys.user.setpasswd("root", p1)
409                 else
410                         stat = 10
411                 end
412         end
413
414         luci.template.render("admin_system/passwd", {stat=stat})
415 end
416
417 function action_reboot()
418         luci.sys.reboot()
419 end
420
421 function fork_exec(command)
422         local pid = nixio.fork()
423         if pid > 0 then
424                 return
425         elseif pid == 0 then
426                 -- change to root dir
427                 nixio.chdir("/")
428
429                 -- patch stdin, out, err to /dev/null
430                 local null = nixio.open("/dev/null", "w+")
431                 if null then
432                         nixio.dup(null, nixio.stderr)
433                         nixio.dup(null, nixio.stdout)
434                         nixio.dup(null, nixio.stdin)
435                         if null:fileno() > 2 then
436                                 null:close()
437                         end
438                 end
439
440                 -- replace with target command
441                 nixio.exec("/bin/sh", "-c", command)
442         end
443 end
444
445 function ltn12_popen(command)
446
447         local fdi, fdo = nixio.pipe()
448         local pid = nixio.fork()
449
450         if pid > 0 then
451                 fdo:close()
452                 local close
453                 return function()
454                         local buffer = fdi:read(2048)
455                         local wpid, stat = nixio.waitpid(pid, "nohang")
456                         if not close and wpid and stat == "exited" then
457                                 close = true
458                         end
459
460                         if buffer and #buffer > 0 then
461                                 return buffer
462                         elseif close then
463                                 fdi:close()
464                                 return nil
465                         end
466                 end
467         elseif pid == 0 then
468                 nixio.dup(fdo, nixio.stdout)
469                 fdi:close()
470                 fdo:close()
471                 nixio.exec("/bin/sh", "-c", command)
472         end
473 end