uci: fix session delta isolation

The libuci `uci_set_savedir()` function does not replace, but appends the
requested delta directory to the search path, this causes information leaks
between sessions.

Due to a lack of an official api for this, clear the uci contexts private
delta path before setting the save directory.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

1 files changed, 7 insertions, 0 deletions

diff --git a/uci.c b/uci.c
index 72ae5a6..bad9e16 100644
--- a/uci.c
+++ b/uci.c
@@ -210,8 +210,15 @@ rpc_uci_status(void)
 static void
 rpc_uci_set_savedir(struct blob_attr *sid)
 {
+	struct uci_element *e, *tmp;
 	char path[PATH_MAX];
 
+	uci_foreach_element_safe(&cursor->delta_path, tmp, e)
+		free(e);
+
+	cursor->delta_path.prev = &cursor->delta_path;
+	cursor->delta_path.next = &cursor->delta_path;
+
 	if (!sid)
 	{
 		uci_set_savedir(cursor, "/tmp/.uci");