⛅ Sync 2026-09-29 21:45:00

luci-app-homeproxy/root/usr/share/rpcd/acl.d/luci-app-homeproxy.json

@@ -3,20 +3,34 @@
 		"description": "Grant access to homeproxy configuration",
 		"read": {
 			"file": {
-				"/etc/homeproxy/scripts/update_subscriptions.uc": [ "exec" ],
 				"/var/run/homeproxy/homeproxy.log": [ "read" ],
 				"/var/run/homeproxy/sing-box-c.log": [ "read" ],
 				"/var/run/homeproxy/sing-box-s.log": [ "read" ]
 			},
 			"ubus": {
 				"service": [ "list" ],
-				"luci.homeproxy": [ "*" ]
+				"luci.homeproxy": [
+					"acllist_read",
+					"connection_check",
+					"resources_get_version",
+					"singbox_get_features"
+				]
 			},
 			"uci": [ "homeproxy" ]
 		},
 		"write": {
 			"file": {
-				"/tmp/homeproxy_certificate.tmp": [ "write" ]
+				"/tmp/homeproxy_certificate.tmp": [ "write" ],
+				"/etc/homeproxy/scripts/update_subscriptions.uc": [ "exec" ]
+			},
+			"ubus": {
+				"luci.homeproxy": [
+					"acllist_write",
+					"certificate_write",
+					"log_clean",
+					"resources_update",
+					"singbox_generator"
+				]
 			},
 			"uci": [ "homeproxy" ]
 		}

luci-app-homeproxy/root/usr/share/rpcd/ucode/luci.homeproxy

@@ -23,6 +23,11 @@ function hasKernelModule(kmod) {
 const HP_DIR = '/etc/homeproxy';
 const RUN_DIR = '/var/run/homeproxy';
 
+/* Resource lists the status page may query/update; single source for the two
+   methods below (the update path also validates the type against it to keep
+   path traversal out). */
+const RESOURCE_TYPES = ['china_ip4', 'china_ip6', 'gfw_list', 'china_list', 'geoip_cn', 'geosite_cn'];
+
 const methods = {
 	acllist_read: {
 		args: { type: 'type' },
@@ -108,6 +113,8 @@ const methods = {
 			switch (filename) {
 			case 'client_ca':
 			case 'server_publickey':
+			/* the ECH config the client form uploads (node.js uploadCertificate) */
+			case 'client_ech_conf':
 				return writeCertificate(filename, false);
 				break;
 			case 'server_privatekey':
@@ -234,7 +241,7 @@ const methods = {
 		args: { type: 'type' },
 		call: function(req) {
 			/* whitelist resource types to prevent path traversal */
-			if (index(['china_ip4', 'china_ip6', 'gfw_list', 'china_list'], req.args?.type) === -1)
+			if (index(RESOURCE_TYPES, req.args?.type) === -1)
 				return { error: 'illegal type', version: null };
 			let version = trim(readfile(`${HP_DIR}/resources/${req.args?.type}.ver`));
 			const fields = version ? match(version, /^(\S+) (\S+)$/) : null;
@@ -246,7 +253,7 @@ const methods = {
 	resources_update: {
 		args: { type: 'type' },
 		call: function(req) {
-			if (index(['china_ip4', 'china_ip6', 'gfw_list', 'china_list'], req.args?.type) === -1)
+			if (index(RESOURCE_TYPES, req.args?.type) === -1)
 				return { status: 255, error: 'illegal type' };
 			if (req.args?.type) {
 				const type = shellquote(req.args?.type);