mirror of
https://github.com/caiwx86/small-packages.git
synced 2026-11-03 01:43:56 +08:00
update 2026-10-14 11:12:00
This commit is contained in:
action committed
1 parent
c90a1f4fc1
commit
79897976d6
163 files changed
-41433
No files matched your search
@@ -1,2 +0,0 @@
|
||||
|
||||
config footstrap 'settings'
|
||||
@@ -1,51 +0,0 @@
|
||||
#!/bin/sh
|
||||
|
||||
# Registration, plus the two symlinks that expose what the admin uploads (a third, the pattern, is
|
||||
# deliberately NOT one — see below). Nothing here migrates a router off an older footstrap: OpenWrt
|
||||
# expects a sysupgrade rather than a package upgrade — the one exception is the stale pattern
|
||||
# symlink itself, removed below because leaving it would keep a reported security hole open.
|
||||
|
||||
changed=0
|
||||
|
||||
set_opt() {
|
||||
uci -q get "luci.$1" >/dev/null 2>&1 && return
|
||||
uci set "luci.$1=$2"
|
||||
changed=1
|
||||
}
|
||||
|
||||
set_opt themes.Footstrap /luci-static/footstrap
|
||||
|
||||
# A fresh install may pick the theme; an upgrade must never move a router off the theme it is on.
|
||||
# `changed` is what tells the two apart — on an upgrade the entry is already there — and it has to
|
||||
# carry the decision alone, because apk exports no PKG_UPGRADE.
|
||||
if [ "${PKG_UPGRADE:-}" != 1 ] && [ "$changed" = 1 ]; then
|
||||
set_opt main.mediaurlbase /luci-static/footstrap
|
||||
fi
|
||||
|
||||
[ "$changed" = 1 ] && uci commit luci
|
||||
|
||||
# uhttpd serves /www only, so the admin's uploads live in /etc — where a sysupgrade keeps them
|
||||
# (lib/upgrade/keep.d) — and are reached through symlinks, EXCEPT the pattern (below).
|
||||
#
|
||||
# The pattern is deliberately NOT symlinked into /www: an SVG is a document, and served as one
|
||||
# through a plain same-origin URL it runs as a script with the admin's session (OpenWrt forum
|
||||
# thread 251930). It is instead read by cgi-bin/luci-theme-footstrap-pattern, which answers with
|
||||
# CSP 'none' + sandbox and nosniff — headers uhttpd cannot attach to a static file. It needs its
|
||||
# .svg name to paint at all, so octet-stream is not open to it.
|
||||
#
|
||||
# The login background stays a plain symlink, and NOT because of what the browser did to the
|
||||
# bytes: the ACL authorises the cgi-upload POST whatever wrote it, so fs-assets.js's canvas
|
||||
# re-encode is compression and EXIF removal, not a boundary (it says so itself). What keeps a
|
||||
# direct open inert is the extension-less name — uhttpd types the response by extension and
|
||||
# answers application/octet-stream, which a browser downloads instead of running as a document.
|
||||
mkdir -p /etc/footstrap
|
||||
if [ -d /www/luci-static/footstrap ]; then
|
||||
ln -sf /etc/footstrap/login-bg /www/luci-static/footstrap/bg
|
||||
ln -sfn /etc/footstrap/fonts /www/luci-static/footstrap/fonts
|
||||
fi
|
||||
# Clean up a pre-0.14.11 install's stale pattern symlink — see the header comment above for why this
|
||||
# is the one migration this script makes. `-L` only: never remove a real file some other install
|
||||
# step could have left at that path.
|
||||
[ -L /www/luci-static/footstrap/pattern.svg ] && rm -f /www/luci-static/footstrap/pattern.svg
|
||||
|
||||
exit 0
|
||||
@@ -1,11 +0,0 @@
|
||||
# Preserve what the ADMIN put on this router across sysupgrade: the login/page background, the
|
||||
# wallpaper pattern and the webfonts in /etc/footstrap/fonts. All three are written at runtime, so
|
||||
# they survive a package upgrade on their own; a firmware sysupgrade keeps only paths listed here
|
||||
# (or in a conffile / /etc/sysupgrade.conf).
|
||||
# Not conffiles: they live outside root/etc/config, and a conffiles-define entry
|
||||
# the package does not ship is rejected.
|
||||
/etc/footstrap/login-bg
|
||||
/etc/footstrap/pattern.svg
|
||||
# The whole directory: the faces plus the fonts.css generated beside them. Keeping the faces
|
||||
# without the sheet leaves footstrap.settings.fonts pointing at nothing — a 404 on every page.
|
||||
/etc/footstrap/fonts
|
||||
@@ -1,13 +0,0 @@
|
||||
{
|
||||
"admin/system/footstrap": {
|
||||
"title": "Footstrap",
|
||||
"order": 3,
|
||||
"action": {
|
||||
"type": "view",
|
||||
"path": "footstrap/appearance"
|
||||
},
|
||||
"depends": {
|
||||
"acl": [ "luci-theme-footstrap" ]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,44 +0,0 @@
|
||||
{
|
||||
"luci-theme-footstrap": {
|
||||
"description": "Footstrap theme settings saved to the router, the login background and pattern uploads, and the Footstrap settings page",
|
||||
"read": {
|
||||
"uci": [
|
||||
"footstrap"
|
||||
]
|
||||
},
|
||||
"write": {
|
||||
"ubus": {
|
||||
"uci": [
|
||||
"set",
|
||||
"commit"
|
||||
],
|
||||
"file": [
|
||||
"remove",
|
||||
"exec"
|
||||
]
|
||||
},
|
||||
"uci": [
|
||||
"footstrap"
|
||||
],
|
||||
"cgi-io": [
|
||||
"upload"
|
||||
],
|
||||
"file": {
|
||||
"/etc/footstrap/login-bg": [
|
||||
"write",
|
||||
"remove"
|
||||
],
|
||||
"/bin/chmod 644 /etc/footstrap/login-bg": [
|
||||
"exec"
|
||||
],
|
||||
"/etc/footstrap/pattern.svg": [
|
||||
"write",
|
||||
"remove"
|
||||
],
|
||||
"/bin/chmod 644 /etc/footstrap/pattern.svg": [
|
||||
"exec"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,43 +0,0 @@
|
||||
#!/bin/sh
|
||||
# Serves the admin-uploaded wallpaper pattern with headers a browser will not execute: opened
|
||||
# directly, the /www symlink this replaces was a same-origin document with an authenticated LuCI
|
||||
# session reachable from it (OpenWrt forum thread 251930, confirmed on a stand — a marker SVG set
|
||||
# document.title, read location.origin as the router's, and reached document.cookie, pre-login
|
||||
# too, since /www needs no session). The theme's own rendering never hits this: 15-wallpaper.css
|
||||
# paints the same file through mask-image or a tiled background-image, and neither ever runs
|
||||
# script inside it — the exposure was only the direct URL, which is what CSP 'none' + sandbox and
|
||||
# nosniff below close, without touching how the mask/background paints it.
|
||||
#
|
||||
# Deliberately unauthenticated, on purpose and not an oversight: the pattern paints before login
|
||||
# too (head.ut's pre-paint, from window.__fsSD). That is safe here ONLY because this script takes
|
||||
# NO input at all — FILE below is a shell constant, never $QUERY_STRING, $PATH_INFO or anything
|
||||
# else request-supplied — so there is nothing to traverse and nothing else this handler can be
|
||||
# made to read.
|
||||
#
|
||||
# The login background (/etc/footstrap/login-bg) stays a plain /www symlink and does NOT get this
|
||||
# treatment: fs-assets.js re-encodes every upload to a JPEG on a canvas before it is sent, so the
|
||||
# stored bytes are pixels only and there is no script grammar left in the file for a direct hit to
|
||||
# run — see docs/package.md.
|
||||
|
||||
FILE=/etc/footstrap/pattern.svg
|
||||
|
||||
if [ ! -r "$FILE" ]; then
|
||||
printf 'Status: 404 Not Found\r\n'
|
||||
printf 'Content-Type: text/plain\r\n'
|
||||
printf '\r\n'
|
||||
exit 0
|
||||
fi
|
||||
|
||||
printf 'Status: 200 OK\r\n'
|
||||
printf 'Content-Type: image/svg+xml\r\n'
|
||||
# Cacheable forever, because the URL is not stable: fs-axes.js appends `?v=<token>` and the token
|
||||
# changes with every upload, so a new file is a new URL. Without this the /www symlink's ETag and
|
||||
# Last-Modified were gone and the tile was re-fetched on EVERY page load - a background image on a
|
||||
# router that serves it off flash with no gzip, which is the cost this handler must not add.
|
||||
printf 'Cache-Control: public, max-age=31536000, immutable\r\n'
|
||||
printf 'X-Content-Type-Options: nosniff\r\n'
|
||||
printf "Content-Security-Policy: default-src 'none'; sandbox\r\n"
|
||||
printf '\r\n'
|
||||
cat "$FILE"
|
||||
|
||||
exit 0
|
||||
Reference in new issue
Block a user