luci-base: consider empty parameters as well when testing POST requirement

The cbi class will react on an empty "cbi.submit" parameter as well so we
must intercept GET requests using that too.

Fixes 186e690c0 ("luci-base: dispatcher: reject non-POST requests with any cbi.submit value")

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

diff --git a/modules/luci-base/luasrc/dispatcher.lua b/modules/luci-base/luasrc/dispatcher.lua
index 4866727572e67f2bb87ad563e65b3f039aba1127..91b86679fd739bc5ba67deb47258a9c46c09d0c5 100644 (file)
--- a/modules/luci-base/luasrc/dispatcher.lua
+++ b/modules/luci-base/luasrc/dispatcher.lua
@@ -136,8 +136,7 @@ local function require_post_security(target)
 
                                if (type(required_val) == "string" and
                                    request_val ~= required_val) or
-                                  (required_val == true and
-                                   (request_val == nil or request_val == ""))
+                                  (required_val == true and request_val == nil)
                                then
                                        return false
                                end