luci-base: add FULL_REQUEST_URI template property
authorJo-Philipp Wich <jo@mein.io>
Wed, 4 Apr 2018 21:24:31 +0000 (23:24 +0200)
committerJo-Philipp Wich <jo@mein.io>
Wed, 4 Apr 2018 21:24:31 +0000 (23:24 +0200)
commit8c617c02b5de93c51c896d58b2496b29b2d2c5bd
tree5851a82ba7058d2d2e14c7e813db3b29eee2f16f
parent94ea9077076d98374a331131fb7c9fc57df370a6
luci-base: add FULL_REQUEST_URI template property

Introduce a new template property FULL_REQUEST_URI which returns the full
canonicalized request URL built from SCRIPT_NAME, PATH_INFO and QUERY_STRING.

This new property is safer to use compared to using the raw REQUEST_URI CGI
environment variable directly as this value is essentially untrusted user
input which may contain embedded escaped slashes, double forward slashes and
other oddities allowing XSS exploitation or request redirection.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
modules/luci-base/luasrc/dispatcher.lua