From: Jo-Philipp Wich <jo@mein.io>
Date: Tue, 7 Jan 2020 08:08:49 +0000 (+0100)
Subject: luci-base: dispatcher: fix rpc controller regression
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=38c9c9e0a2564b9644a56f1143f6acf0c9e272c8;p=oweals%2Fluci.git

luci-base: dispatcher: fix rpc controller regression

When testing the luci-rpc authnetication, avoid clobbering the HTTP
post request body.

Fixes: #3470
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
---

diff --git a/modules/luci-base/luasrc/dispatcher.lua b/modules/luci-base/luasrc/dispatcher.lua
index d4293422b..8dac8d6b6 100644
--- a/modules/luci-base/luasrc/dispatcher.lua
+++ b/modules/luci-base/luasrc/dispatcher.lua
@@ -305,7 +305,7 @@ local function tree_to_json(node, json)
 				elseif subname == "rpc" and subnode.module == "luci.controller.rpc" then
 					spec.auth = {
 						login = false,
-						methods = { "param:auth", "cookie:sysauth" }
+						methods = { "query:auth", "cookie:sysauth" }
 					}
 				elseif subnode.module == "luci.controller.admin.uci" then
 					spec.auth = {
@@ -546,6 +546,8 @@ local function check_authentication(method)
 		sid = http.getcookie(auth_param)
 	elseif auth_type == "param" then
 		sid = http.formvalue(auth_param)
+	elseif auth_type == "query" then
+		sid = http.formvalue(auth_param, true)
 	end
 
 	return session_retrieve(sid)