luci/plugins, branch master

luci-plugin-2fa: stop trusting X-Forwarded-For

2026-08-08T01:33:38Z

get_client_ip() fell back to the leftmost X-Forwarded-For element whenever REMOTE_ADDR was loopback, and the value it returned decides two security outcomes in check(): whether the IP is whitelisted, which skips 2FA entirely, and which bucket the login rate limiter charges. The fallback only fires behind a reverse proxy, which is what it was written for - but that is exactly where the leftmost element is the one the client sent, since a proxy appends rather than prepends. A request carrying `X-Forwarded-For: ` therefore returns `{ required: false, whitelisted: true }` and never asks for an OTP, and a fresh header value per request gives every attempt its own rate-limit bucket, so the max_attempts lockout never fires and the six digits can be brute forced. The same header pointed at someone else's address locks that address out instead. Nothing else in LuCI reads X-Forwarded-For, and the plugin has no trusted-proxy configuration that could tell the header apart from a forged one, so drop the fallback and use REMOTE_ADDR alone. Its loopback gate means only an on-box proxy is affected by the removal, and there every client collapses onto 127.0.0.1. The whitelist then simply stops matching, and strict_mode stops taking the local_subnet_bypass on an uncalibrated clock - both fail closed, which is the point. The rate limiter does not: its gate runs ahead of is_2fa_enabled() and returns blocked rather than an OTP prompt, so five bad codes from any one client behind the proxy would lock every account on the box out of LuCI for the lockout period, including accounts with no OTP configured. So key the bucket on user and address together, the way luci-base already keys its own verify limiter. Brute forcing one account still trips the lockout after max_attempts, which is what the limiter is for, while a shared address no longer makes one client's failures anyone else's. The address-only key was also the reason the three call sites skipped the limiter entirely when REMOTE_ADDR was absent; the key is well formed either way now, so they no longer need to. A proxy on a separate host is a different deployment and this commit does not change it: REMOTE_ADDR is the proxy's own LAN address there, the fallback never fired, and both gates read that address rather than the client's - so a whitelist entry or LAN subnet covering the proxy exempts everyone behind it, before and after. Distinguishing those clients needs a trusted-proxy setting the plugin does not have. Assisted-by: Claude:claude-opus-5 Signed-off-by: Julius Bairaktaris

luci-plugin-csp: add configuration options for CSP

2026-05-20T20:20:26Z

- ucode: add configured CSP HTTP headers - js: add dropdown to select CSP-mode and textbox to configure custom CSP policy Signed-off-by: Jostein Kjønigsen

luci-plugins: align naming

2026-04-09T12:51:38Z

consistency in the repo Signed-off-by: Paul Donald

luci-base: add authentication plugin mechanism

2026-04-09T12:26:09Z

This commit introduces a generic authentication plugin mechanism to the LuCI dispatcher, enabling multi-factor authentication (MFA/2FA) and other custom verification methods without modifying core files. This implementation integrates with the new plugin UI architecture introduced in commit 617f364 (luci-mod-system: implement plugin UI architecture), allowing authentication plugins to be managed through the unified System > Plugins interface. Signed-off-by: Han Yiming

luci-app-2fa: init checkin

2026-04-07T14:00:58Z

Co-authored-by: Christian Marangi Signed-off-by: Han Yiming luci-app-2fa: add priority option and QR code display This update adds a priority option and enables QR code display for 2FA. luci-app-2fa: native ubus IPvalid fsLOCK and log use native ubus IP validation instead of custom regex and parsing, use native fs lock instead of popen-call and add log for logging auth events. now, will clean stale rate limit entries on each check and log when entries are removed due to staleness. This prevents the rate limit file from growing indefinitely with old entries. luci-app-2fa: move dir and sync sysfixtime move to the new location. update the default time calibration threshold to sync sysfixtime. luci-app-2fa: native hex and more readable use native hex and base32 decoding functions Signed-off-by: Han Yiming

luci-mod-system: implement plugin UI architecture

2026-03-30T22:13:54Z

include some example plugins also. JS files provide UI to configure behaviour of plugins which typically live in /usr/share/ucode/luci/plugins// Signed-off-by: Paul Donald