[pavankumar464]

Reason for change: WebUI - SSO - Local LAN Bypass
Test Procedure: Test for WebUI access
Risks: Low
Priority: P1

[Copilot]

🟡 Changes recommended

EPON/XGSPON addresses can be misclassified, causing valid SSO logins to be rejected.

1 open finding

• Include active PON modes in WAN address classification · New

What changed in this PR

Updates login interface detection to support local LAN SSO bypass.

Changes:

• Restricts MSO authentication to cable-modem interfaces.
• Normalizes IP comparisons and includes configured WAN addresses.

File	Description
source/​Styles/​xb3/​jst/​check.jst	Updates login routing and IP-interface classification.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

The new MSO guard makes the dedicated LAN/DOCSIS rejection and audit path unreachable.

0 open findings

1 resolved since last review

• Include active PON modes in WAN address classification

Previously missed (1)

In code that hasn't changed since last review

Dead nested guard drops dedicated MSO unauthorized handling

source/​Styles/​xb3/​jst/​check.jst:167

This new outer guard makes the immediately nested if ($iface == "lan_ip" || $iface == "docsis_ip") impossible to enter. Consequently, MSO attempts on those interfaces now fall through to the generic username-failure path, so the dedicated unauthorized-attempt audit log and response are silently lost. Please either retain an outer MSO-only guard and branch by interface inside it, or remove the dead branch if the generic path is intentional.

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

The admin exception is not restricted to local clients and may expose LAN-bypass behavior to remote requests.

1 open finding

• Restrict admin exception to verified LAN client addresses · New

Previously missed (1)

In code that hasn't changed since last review

Remove unreachable nested interface rejection branch

source/​Styles/​xb3/​jst/​check.jst:167

The outer condition guarantees $iface == "cm_ip", so the immediately nested lan_ip/docsis_ip rejection can never execute. Remove the contradictory dead branch so the access policy has one unambiguous condition.

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

Current interface classification can reject valid SSO logins and fail the bypass on non-erouter0 WAN interfaces.

1 open finding

• Resolve bypass remote IP from the active WAN interface · New

1 resolved since last review

• Restrict admin exception to verified LAN client addresses

Previously missed (1)

In code that hasn't changed since last review

Do not restrict MSO logins to cm_ip interfaces

source/​Styles/​xb3/​jst/​check.jst:167

Restricting this branch to cm_ip rejects valid mso logins classified as rm_ip or eth_ip before they can reach the OAuth flow. Those interface types were previously accepted by this branch (the existing interface check only rejects LAN/RG/DOCSIS access), and the new LAN bypass already occurs in if_type only when the submitted username is admin, so this extra condition is not needed for the bypass. Keep routing every mso login through the existing interface authorization checks.

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

The LAN authorization check has a concurrent temporary-file race that can associate a request with the wrong client address.

2 open findings

• Avoid shared temporary file for client IP authorization · New
• Remove unreachable LAN/DOCSIS interface rejection · New

1 resolved since last review

• Resolve bypass remote IP from the active WAN interface

🧠 Review effort: Balanced