These routes only verified that a session existed, so any logged-in user
could drive any device by id, including ungrouped ones the device list
never showed them. Apply the same visibility rule as the list: admins
reach everything, a regular user only devices in a group linked to one
of their user groups. Denials answer with the error page, a bare 403 for
websocket upgrades, and err 1004 for /cmd.
Also drop the two shortcuts in httpAuth that skipped authentication when
no password was configured or when local-auth was off and the request
came from loopback -- behind a reverse proxy every request looks local.
Both settings now log a warning instead.
Signed-off-by: GL.iNet-Yongping.Xie <yongping.xie@gl-inet.com>
- address the live device by ddns and call /cmd via bare axios
- write the response body once on timeout (was written twice)
- group results by outcome and show stderr in the detail dialog
- default user to root, minimum wait 1s, warn on long/streaming commands
Signed-off-by: GL.iNet-Yongping.Xie <yongping.xie@gl-inet.com>
Remove the obsolete legacy main entry to avoid confusion and reduce maintenance overhead.
Signed-off-by: GL.iNet-Yongping.Xie <yongping.xie@gl-inet.com>
GL.iNet-Yongping.Xie