lunarmodules / cgilua Goto Github PK
View Code? Open in Web Editor NEWCGILua is a tool for creating dynamic HTML pages and manipulating input data from Web forms.
Home Page: http://lunarmodules.github.io/cgilua
CGILua is a tool for creating dynamic HTML pages and manipulating input data from Web forms.
Home Page: http://lunarmodules.github.io/cgilua
I don't actually see any bug reports open on this CVE, so I am creating a bug report here.
https://security-tracker.debian.org/tracker/CVE-2014-2875
As far as I can tell, the issue is still present in the latest git source.
I believe the vulnerable code itself is in
https://github.com/keplerproject/cgilua/blob/master/src/cgilua/session.lua
and is these bits:
local RANGE = 999999999
[...]
randseed (mod (time(), RANGE))
[...]
local function new_id ()
return rand (RANGE)
end
I think it it probably safe to assume rand() doesn't meet the requirements for a session id. As in it generates numbers that are predictable.
I am not really familiar with how to generate an appropriate id, but I do notice there are some crypto libraries for LUA, e.g. https://github.com/philanc/plc
On the Debian mailing list, it was suggested "a more secure function is to simply read the value from /dev/urandom".
@tomasguisasola on Luarocks.org https://luarocks.org/modules/tomasguisasola/cgilua,
the latest version of CGILua (6.0.2) comes only with a rockspec.
Please, could you upload too the src.rock ?
The following command allows to create it :
$ luarocks pack <your_rockspec>
Different web pages have different numbers.
It would be good if the official information for the project could be a little bit more consistent :-)
The test suite may need some changes to permit unattended running during smoke tests. See [2] for suggestions. Currently LuaDist skips running tests [2] on this module.
Hi!
I'm trying to get the example app to run on Lua 5.2 and 5.3 and I'm having some problems. The first one is related to the builtin function unpack on Lua 5.3, installing the head of the branch master fix it. The seccond problem it with src/launchers/cgilua.fcgi, I'm not sure if I'm doing something wrong but the only way I can get it to work is if I set filename with the full path to app.lua
It maybe help to mention I'm using spawn-fcgi
If this is intended behavior, make note in your installation page. The modules I had to install were:
I did not found how to send custom http status. Is this posible?
I'm not sure what i'm doing wrong here but I get this error in my apache webserver logs, something about SAPI...
I made a paste on the apache paste bucket containing the error: http://apaste.info/ZM7
How do i fix that?
I get this error with apache2.4
cgilua.fcgi:33: attempt to index global 'wsapi' (a nil value)
Update:
I believe I am using old version as I was using luarocks.
it always tried to find cgilua.lua or cgilua/init.lua but there are no such files in 6.x release
on a old cgilua release with lua-5.1, I saw cgilua.lua installed via luarocks, that worked fine.
am I missing something to use cgilua 6.x?
local cgilua = require "cgilua"
print("CGILua loaded successfully.")
Can I ask you to update the luarockt for this project, please?
I'm sorry I did not explain myself. I'm Massimiliano Bertinetti and I'm the new lead developer of Sailor. By applying the master branches of the packages on which sailor depends I managed to put into production Sailor with Lua 5.3. If published on Luarocks I can also update Sailor with new dependencies and allow Sailor users to use Lua 5.3 with Sailor 0.6.0. Thank you!
I am using the example files, which I set the options.tokenPersistence ot 'cookie'. Then I created a page named as aa.lp following the reference manual:
<title>Login</title> <% cgilua.enablesession () if not cgilua.authentication.username() then cgilua.redirect(cgilua.authentication.checkURL()) else -- continues with the application flow end %> dondoanfdafdBut the login fails, and the reason is there is no Set-Cookie in 302 redirection packet.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.