Access permissions in rpcd and uhttpd

[Hauke Mehrtens]

Hi,

We got multiple security reports related to missing access permissions 
and I do not know if this is expected to be like this.

This for example returns all ubus actions:
 > curl http://192.168.1.1/ubus/list
No authentication needed.
https://github.com/openwrt/openwrt/security/advisories/GHSA-g9vr-gg8c-pvjx


uhttpd has basic authentication support, this is not the login used by 
OpenWrt, but it allows to protect some folders. This authentication only 
works for files, but not for file handlers like the rpcd endpoint.

Should we do something like this:
https://github.com/openwrt/uhttpd/pull/31/changes

https://github.com/openwrt/uhttpd/security/advisories/GHSA-5cgm-8h9x-v28c
The auth code in uhttpd was very buggy.

Hauke