If you like BoxMatrix then please contribute Supportdata, Supportdata2, Firmware and/or Hardware (get in touch).
My metamonk@yahoo.com is not reachable by me since years. Please use hippie2000@webnmail.de instead.
0
U
Property:security.lua (restapi)
From BoxMatrix
| BoxMatrix >> Webinterface >> security.lua (restapi) | @ BoxMatrix - IRC-Chat - Translate: de es fr it nl pl |
| News | Selectors | Models | Accessories | Components | Environment | Config | Commands | System | Webif | Software | Develop | Lexicon | Community | Project | Media |
| UI-Structure | UI-Modules | HTML-Files | XML-Files | REST-API | Lua-Scripts | Javascript | Browser | SSI-Files | SSI-Directives | HTML-Text | Event-Text | Help-Pages | CSS-Files | Graphics | Research |
 |
Name-Collision - multiple objects in this wiki use the name security.lua!
|
RESTAPI-Script
| RESTAPI-Script: | security.lua (restapi) - type Script | Wiki | Freetz | IPPF | whmf | AVM | Web |
| Location: | Webinterface >> RESTAPI-Scripts - Origin: AVM | ||||||
| Path: | Release: /usr/rest_api Lab+Rel: /usr/rest_api | ||||||
| Properties: | Size: 7.0k - 14.0k - Firmware: 7.39 - 8.00 | ||||||
| Function: | REST-API Security | ||||||
Goto: Functions - Dependencies - Model-Matrix - SMW-Browser
Details
security.lua is the REST-API Security checker. It is included by api.lua and api_generic.lua.
It provides a method for checking the access permissions for a given <endpoint> URL and access method (lan, wan).
By default an <endpoint> is denied, and whitelisted by a per <endpoint> access mask assigned in this script.
AVM comments it: Allow-List definition which endpoint with which rights can be accessed.
Security is enabled in ui-module webui:settings/rest_api_endpoint_security, which defaults to 1.
Tests to set it to 0 using ctlmgr_ctl did not work in fw 7.50.
root@fritz1:/var/media/ftp# ctlmgr_ctl r webui settings/rest_api_endpoint_security 1 root@fritz1:/var/media/ftp# ctlmgr_ctl w webui settings/rest_api_endpoint_securityr 0 root@fritz1:/var/media/ftp# ctlmgr_ctl r webui settings/rest_api_endpoint_security 1
This is likely limited to internal development firmware.
- Lexicon: REST, API, SCGI
- Commands: scgi_server
- Ports: Port-8187-tcp
- UI-Mods: webui
- API-Root: api.lua
- Includes: api_generic.lua, rest_config.lua, security.lua, espresso.lua, rest_api_const.lua, response.lua, error.lua
- Includes: avmluamessages.lua, uimod.lua, api_generic_filter.lua, resource.lua, datatype.lua, plugin_common.lua
- Modules: storagenasrights_rest.lua, webusb_rest.lua
- Modules: calllog_rest.lua, faxjournal_rest.lua, phonebook_rest.lua, smarthome_rest.lua, boxnotify_rest.lua
- Develop: obl_fboxname.lua, dev_debug.lua, landevice.lua, query_tree.lua, fake_modules.lua, obl.lua
- Common: array.lua, common.lua, func.lua, math.lua, string.lua, table.lua, typecheck.lua, validcheck.lua
- Plugins: configflags.lua, eventlog.lua, info.lua, monitor.lua, phonebook.lua, smarthome.lua, timermix.lua
- Misc-Plugins: misc.lua, boxname.lua, configuration.lua, handsets.lua, update_status.lua, wan_status.lua
- Setup-Plugins: setup.lua
Functions
The function names of scripts often help to understand function blocks (and show gaps in the docs). fw 7.50 functions:
$ grep -e '^function' -e '^local function' /usr/rest_api/security.lua # Get the user rights from rights UIM. local function get_user_session_rights() # Check if the user(session) match any of the given required rights. local function check_authentication(required_rights) # Check if rights for endpoints should be checked or not. local function security_active() # Checks if the user has the permissions to access the requested url path. function security.permission(path, access_type)
Dependencies
Daily updated index of all dependencies of this script. Last update: GMT.
A * in the Mod column marks info from Supportdata-Probes, which will always stay incomplete.
If an Object includes itself then this is a file with the same name but another Path and the dependencies are merged.
| Relation | Typ | Object | Mod | Firmware | Info | Origin |
|---|---|---|---|---|---|---|
| Accesses | uimod | aura (uimod) | 5 | 4.85 | AURA - AVM USB remote architecture | AVM |
| Accesses | uimod | blocked_wan_ips | 21 | 7.63 - 8.00 | TODO | AVM |
| Accesses | uimod | box | 43 | 5.01 - 8.00 | Global box settings | AVM |
| Accesses | uimod | boxusers | 81 | 6.10 - 8.00 | FritzBox-Users | AVM |
| Accesses | uimod | capiotcp | 51 | 7.19 - 8.00 | CAPI-over-TCP remote CAPI | AVM |
| Accesses | uimod | capture | 64 | 6.10 - 7.24 | AVM Packet-Capture | AVM |
| Accesses | uimod | connection0 | 73 | 6.10 - 7.31 | Internet connection | AVM |
| Accesses | uimod | connections | 44 | 7.39 - 8.00 | TODO | AVM |
| Accesses | uimod | ctlusb | 97 | 4.85 - 8.00 | USB-Host related config | AVM |
| Accesses | uimod | dect (uimod) | 67 | 6.10 - 8.00 | DECT base, handsets, repeater, ULE | AVM |
| Accesses | uimod | dnscfg | 51 | 7.19 - 8.00 | DNS servers and config | AVM |
| Accesses | uimod | emailnotify | 75 | 6.36 - 8.00 | Push-Mail settings | AVM |
| Accesses | uimod | filelinks | 81 | 6.10 - 8.00 | MyFRITZ! NAS links | AVM |
| Accesses | uimod | logic | 45 | 6.10 - 6.87 | uptime and NSP (SDK) version | AVM |
| Accesses | uimod | openports | 51 | 7.24 - 8.00 | TODO | AVM |
| Accesses | uimod | remoteman | 73 | 6.10 - 7.39 | Remote-HTTPS | AVM |
| Accesses | uimod | rights | 32 | 7.39 - 7.63 | Status of the currently logged in user | AVM |
| Accesses | uimod | services (uimod) | 51 | 7.19 - 8.00 | Network-Ports list | AVM |
| Accesses | uimod | sipextra | 68 | 6.54 - 8.00 | Global VoIP settings | AVM |
| Accesses | uimod | storagedirectories | 28 | 4.85 - 5.27 | Storage directories and access permissions | AVM |
| Accesses | uimod | storageusers | 28 | 4.85 - 5.27 | User permissions to access storage | AVM |
| Accesses | uimod | telcfg | 80 | 6.10 - 8.00 | Telephony configuration | AVM |
| Accesses | uimod | tr069 | 51 | 7.19 - 8.00 | TR-069 settings | AVM |
| Accesses | uimod | tr369 | 44 | 7.39 - 8.00 | TR-369 settings | AVM |
| Accesses | uimod | uimodlogic | 68 | 6.84 - 8.00 | uptime and Firmware version | AVM |
| Accesses | uimod | updatecheck (uimod) | 81 | 6.10 - 8.00 | JSON or JUIS firmware update check | AVM |
| Accesses | uimod | wlan (uimod) | 91 | 5.01 - 8.00 | WLAN configuration | AVM |
| Requires | rest | avmluamessages.lua | 32 | 7.39 - 7.63 | REST-API Debug Message Printer | AVM |
| Requires | rest | rest_api_const.lua | 37 | 7.39 - 8.00 | REST-API Const Tables | AVM |
| Requires | rest | uimod.lua (restapi) | 37 | 7.39 - 8.00 | REST-API UI-Modules API | AVM |
| Required by | rest | api.lua | 37 | 7.39 - 8.00 | REST-API Lua-Land root for scgi_server | AVM |
| Required by | rest | api_generic.lua | 25 | 7.90 - 8.00 | REST-API Generic Endpoints | AVM |
| 32 dependencies for this script | ||||||
Model-Matrix
Daily updated index of the presence, path and size of this script for each model. Last update: GMT.
Showing all models using this script. Click any column header (click-wait-click) to sort the list by the respective data.
The (main/scrpn/boot/arm/prx/atom/rtl) label in the Model column shows which CPU is meant for Multi-Linux models.
Note that this list is merged from Firmware-Probes of all known AVM firmware for a model, including Recovery.exe and Labor-Files.
| Model | Firmware | Path | Size/Bytes |
|---|---|---|---|
| FRITZ!Box 4040 | 7.39 - 8.00 | /usr/rest_api | 8.2k - 14.0k |
| FRITZ!Box 4050 | 7.58 - 7.90 | /usr/rest_api | 8.2k - 14.0k |
| FRITZ!Box 4060 | 7.39 - 7.90 | /usr/rest_api | 8.2k - 14.0k |
| FRITZ!Box 5530 Fiber (main) | 7.39 - 8.00 | /usr/rest_api | 7.0k - 14.0k |
| FRITZ!Box 5590 Fiber (main) | 7.39 - 8.00 | /usr/rest_api | 7.0k - 14.0k |
| FRITZ!Box 5590 Fiber (prx) | 7.70 - 8.00 | /usr/rest_api | 7.0k - 14.0k |
| FRITZ!Box 5690 Pro (main) | 7.62 | /usr/rest_api | 8.2k |
| FRITZ!Box 6490 Cable (atom) | 7.39 - 7.51 | /usr/rest_api | 8.2k |
| FRITZ!Box 6590 Cable (atom) | 7.39 - 7.51 | /usr/rest_api | 8.2k |
| FRITZ!Box 6591 Cable (arm) | 8.00 | /usr/rest_api | 14.0k |
| FRITZ!Box 6591 Cable (atom) | 7.39 - 8.00 | /usr/rest_api | 7.8k - 14.0k |
| FRITZ!Box 6660 Cable (arm) | 7.90 - 8.00 | /usr/rest_api | 14.0k |
| FRITZ!Box 6660 Cable (atom) | 7.39 - 8.00 | /usr/rest_api | 7.8k - 14.0k |
| FRITZ!Box 6670 Cable (arm) | 7.90 | /usr/rest_api | 14.0k |
| FRITZ!Box 6670 Cable (atom) | 7.61 - 7.90 | /usr/rest_api | 8.2k - 14.0k |
| FRITZ!Box 6690 Cable (arm) | 7.90 | /usr/rest_api | 14.0k |
| FRITZ!Box 6690 Cable (atom) | 7.39 - 7.90 | /usr/rest_api | 7.8k - 14.0k |
| FRITZ!Box 6820 LTE v1 (main) | 7.51 - 7.59 | /usr/rest_api | 8.2k |
| FRITZ!Box 6820 LTE v2 (main) | 7.51 - 7.59 | /usr/rest_api | 8.2k |
| FRITZ!Box 6820 LTE v3 (main) | 7.51 - 7.57 | /usr/rest_api | 8.2k |
| FRITZ!Box 6820 LTE v4 | 7.59 | /usr/rest_api | 8.2k |
| FRITZ!Box 6850 LTE | 7.39 - 7.90 | /usr/rest_api | 7.8k - 14.0k |
| FRITZ!Box 6850 5G | 7.39 - 7.90 | /usr/rest_api | 8.2k - 14.0k |
| FRITZ!Box 6890 LTE (main) | 7.39 - 7.57 | /usr/rest_api | 7.8k - 8.2k |
| FRITZ!Box 6890 LTE v1 (main) | 7.39 - 7.57 | /usr/rest_api | 7.8k - 8.2k |
| FRITZ!Box 6890 LTE v2 (main) | 7.39 - 7.57 | /usr/rest_api | 7.8k - 8.2k |
| FRITZ!Box 7490 (main) | 7.51 | /usr/rest_api | 8.2k |
| FRITZ!Box 7510 | 7.39 - 8.00 | /usr/rest_api | 8.2k - 14.0k |
| FRITZ!Box 7520 | 7.39 - 8.00 | /usr/rest_api | 8.2k - 14.0k |
| FRITZ!Box 7520 v2 (main) | 7.39 - 8.00 | /usr/rest_api | 8.2k - 14.0k |
| FRITZ!Box 7530 | 7.39 - 8.00 | /usr/rest_api | 7.8k - 14.0k |
| FRITZ!Box 7530 AX | 7.39 - 8.00 | /usr/rest_api | 7.0k - 14.0k |
| FRITZ!Box 7583 (main) | 7.50 - 7.59 | /usr/rest_api | 8.2k |
| FRITZ!Box 7583 VDSL (main) | 7.59 - 8.00 | /usr/rest_api | 8.2k - 14.0k |
| FRITZ!Box 7590 (main) | 7.39 - 8.00 | /usr/rest_api | 7.8k - 14.0k |
| FRITZ!Box 7590 AX (main) | 7.39 - 8.00 | /usr/rest_api | 7.0k - 14.0k |
| FRITZ!Box 7690 | 7.61 - 7.90 | /usr/rest_api | 8.2k - 14.0k |
| 37 models use this script | |||
