benya/rmm-openwrt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix LuCI menu authentication through proxy

Browse Source
This commit is contained in:
benya
2026-06-04 20:36:31 +03:00
parent ee80018652
commit 063374150c
2 changed files with 20 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
server/internal/httpapi/server.go
View File

@@ -1183,7 +1183,7 @@ func rewriteLuCIHeaders(header http.Header, prefix string) {
} }
} }
func rewriteLuCICookie(cookie, prefix string) string { func rewriteLuCICookie(cookie, _ string) string {
parts := strings.Split(cookie, ";") parts := strings.Split(cookie, ";")
pathFound := false pathFound := false
for index := 1; index < len(parts); index++ { for index := 1; index < len(parts); index++ {
@@ -1191,15 +1191,14 @@ func rewriteLuCICookie(cookie, prefix string) string {
if !strings.HasPrefix(strings.ToLower(attribute), "path=") { if !strings.HasPrefix(strings.ToLower(attribute), "path=") {
continue continue
} }
path := strings.TrimSpace(attribute[len("path="):]) // LuCI themes and JavaScript use absolute /cgi-bin, /ubus and
if !strings.HasPrefix(path, "/") { // /luci-static requests. The auth cookie must cover those fallback
path = "/" + path // routes as well as the session-prefixed entry point.
} parts[index] = " Path=/"
parts[index] = " Path=" + prefix + path
pathFound = true pathFound = true
} }
if !pathFound { if !pathFound {
parts = append(parts, " Path="+prefix+"/") parts = append(parts, " Path=/")
} }
return strings.Join(parts, ";") return strings.Join(parts, ";")
} }

15
server/internal/httpapi/server_test.go
View File

@@ -432,7 +432,7 @@ func TestLuCIProxyRequiresActiveSessionAndRewritesPaths(t *testing.T) {
w.WriteHeader(http.StatusFound) w.WriteHeader(http.StatusFound)
return return
} }
if r.URL.Path == "/cgi-bin/luci/admin/status/overview" { if r.URL.Path == "/cgi-bin/luci/admin/status/overview" || r.URL.Path == "/cgi-bin/luci/admin/menu" {
cookie, err := r.Cookie("sysauth") cookie, err := r.Cookie("sysauth")
authenticated = err == nil && cookie.Value == "session-token" authenticated = err == nil && cookie.Value == "session-token"
if !authenticated { if !authenticated {
@@ -548,6 +548,19 @@ func TestLuCIProxyRequiresActiveSessionAndRewritesPaths(t *testing.T) {
if resp.StatusCode != http.StatusOK || !authenticated { if resp.StatusCode != http.StatusOK || !authenticated {
t.Fatalf("LuCI login cookie was not preserved, status=%d authenticated=%t", resp.StatusCode, authenticated) t.Fatalf("LuCI login cookie was not preserved, status=%d authenticated=%t", resp.StatusCode, authenticated)
} }
menuReq, err := http.NewRequest(http.MethodGet, srv.URL+"/cgi-bin/luci/admin/menu", nil)
if err != nil {
t.Fatal(err)
}
menuReq.Header.Set("Authorization", "Bearer operator-test")
menuResp, err := client.Do(menuReq)
if err != nil {
t.Fatal(err)
}
_ = menuResp.Body.Close()
if menuResp.StatusCode != http.StatusOK || !authenticated {
t.Fatalf("LuCI auth cookie was not sent to absolute menu route, status=%d authenticated=%t", menuResp.StatusCode, authenticated)
}
} }
func TestServesStaticWebUI(t *testing.T) { func TestServesStaticWebUI(t *testing.T) {