🌴 Sync 2026-04-20 08:30:53

luci-app-openclawmgr/luasrc/controller/openclawmgr.lua

@@ -211,6 +211,37 @@ local function trim(v)
 	return tostring(v or ""):gsub("^%s+", ""):gsub("%s+$", "")
 end
 
+local function normalize_dir_path(path)
+	path = trim(path)
+	if path == "" then
+		return ""
+	end
+	if path ~= "/" then
+		path = path:gsub("/+$", "")
+		if path == "" then
+			path = "/"
+		end
+	end
+	return path
+end
+
+local function validate_base_dir_input(path)
+	path = normalize_dir_path(path)
+	if path == "" then
+		return false, "数据目录不能为空"
+	end
+	if not path:match("^/") then
+		return false, "数据目录必须是绝对路径"
+	end
+	if path == "/" then
+		return false, "数据目录不能使用 / 根目录"
+	end
+	if path == "/root" or path:match("^/root/") then
+		return false, "数据目录不能使用 /root 开头的目录"
+	end
+	return true, nil, path
+end
+
 local function split_dots(v)
 	local parts = {}
 	for part in tostring(v or ""):gmatch("[^%.]+") do
@@ -1231,11 +1262,13 @@ function action_config_data()
 		end
 
 		if has("base_dir") then
-			local base_dir = tostring(body.base_dir or "")
-			if base_dir == "" then
-				write_json({ ok = false, error = "base_dir required" })
+			local ok, err, normalized = validate_base_dir_input(body.base_dir or "")
+			if not ok then
+				write_json({ ok = false, error = err })
 				return
 			end
+			body.base_dir = normalized
+			local base_dir = normalized
 			uci:set("openclawmgr", section, "base_dir", base_dir)
 		end