🌈 Sync 2026-10-01 13:09:37

luci-app-meow/root/usr/libexec/meow-api

@@ -1,4 +1,6 @@
 #!/bin/sh
+# Small, allowlisted bridge from authenticated LuCI RPC to the local HTTP API.
+# Caller-controlled hosts, ports and arbitrary API paths are never accepted.
 set -eu
 case "$#:${1:-}:${2:-}" in
     2:GET:/version|2:GET:/configs|2:GET:/connections) body='' ;;

luci-app-meow/root/usr/libexec/meow-validate

@@ -1,13 +1,14 @@
 #!/bin/sh
+# No caller-supplied CLI flags or paths: only the generated scratch token.
 set -eu
 [ "$#" -eq 1 ] || exit 1
 case "$1" in
     check) scratch=/tmp/meow-luci-check.yaml ;;
     *)
         [ "${#1}" -eq 32 ] || exit 1
-        case "$1" in *[!0-9a-f]*) exit 1 ;;
-        esac
+        case "$1" in *[!0-9a-f]*) exit 1 ;; esac
         scratch="/tmp/meow-luci-settings-$1.yaml"
         ;;
 esac
+# Delegated LuCI configuration is deliberately confined to /etc/meow.
 exec /usr/bin/meow --no-external-plugins -d /etc/meow -f "$scratch" -t

luci-app-meow/root/usr/share/luci/menu.d/luci-app-meow.json

@@ -2,37 +2,66 @@
 	"admin/services/meow": {
 		"title": "meow",
 		"order": 60,
-		"action": { "type": "firstchild" },
-		"depends": { "acl": [ "luci-app-meow" ], "uci": { "meow": true } }
+		"action": {
+			"type": "firstchild"
+		},
+		"depends": {
+			"acl": [ "luci-app-meow" ],
+			"uci": { "meow": true }
+		}
 	},
+
 	"admin/services/meow/overview": {
 		"title": "Overview",
 		"order": 10,
-		"action": { "type": "view", "path": "meow/overview" }
+		"action": {
+			"type": "view",
+			"path": "meow/overview"
+		}
 	},
+
 	"admin/services/meow/panel": {
 		"title": "Panel",
 		"order": 20,
-		"action": { "type": "view", "path": "meow/panel" }
+		"action": {
+			"type": "view",
+			"path": "meow/panel"
+		}
 	},
+
 	"admin/services/meow/config": {
 		"title": "Configuration",
 		"order": 30,
-		"action": { "type": "view", "path": "meow/config" }
+		"action": {
+			"type": "view",
+			"path": "meow/config"
+		}
 	},
+
 	"admin/services/meow/clients": {
 		"title": "Clients",
 		"order": 35,
-		"action": { "type": "view", "path": "meow/clients" }
+		"action": {
+			"type": "view",
+			"path": "meow/clients"
+		}
 	},
+
 	"admin/services/meow/settings": {
 		"title": "Settings",
 		"order": 40,
-		"action": { "type": "view", "path": "meow/settings" }
+		"action": {
+			"type": "view",
+			"path": "meow/settings"
+		}
 	},
+
 	"admin/services/meow/log": {
 		"title": "Log",
 		"order": 50,
-		"action": { "type": "view", "path": "meow/log" }
+		"action": {
+			"type": "view",
+			"path": "meow/log"
+		}
 	}
 }