From: Jo-Philipp Wich <jow@openwrt.org>
Date: Tue, 7 Aug 2012 19:11:52 +0000 (+0000)
Subject: return "403 Forbidden" if authentication token was given, however is invalid
X-Git-Tag: 0.11.0~468
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=69aa218335330e1e8c623fdc2e5e336b2b78056f;p=oweals%2Fluci.git

return "403 Forbidden" if authentication token was given, however is invalid

Contributed by T-Labs, Deutsche Telekom Innovation Laboratories

Signed-off-by: Mirko Vogt <mirko@openwrt.org>
---

diff --git a/modules/rpc/luasrc/controller/rpc.lua b/modules/rpc/luasrc/controller/rpc.lua
index 7255c1780..6b091163f 100644
--- a/modules/rpc/luasrc/controller/rpc.lua
+++ b/modules/rpc/luasrc/controller/rpc.lua
@@ -24,11 +24,13 @@ module "luci.controller.rpc"
 function index()
 	local function authenticator(validator, accs)
 		local auth = luci.http.formvalue("auth", true)
-		if auth then
+		if auth then -- if authentication token was given
 			local sdat = luci.sauth.read(auth)
-			user = loadstring(sdat)().user
-			if user and luci.util.contains(accs, user) then
-				return user, auth
+			if sdat then -- if given token is valid
+				user = loadstring(sdat)().user
+				if user and luci.util.contains(accs, user) then
+					return user, auth
+				end
 			end
 		end
 		luci.http.status(403, "Forbidden")