From a71eb5770240fb53b41725793b16ba8526fa0092 Mon Sep 17 00:00:00 2001
From: orbisai0security <mediratta01.pally@gmail.com>
Date: Fri, 15 May 2026 02:46:09 +0000
Subject: [PATCH] fix: V-010 security vulnerability

Automated security fix generated by Orbis Security AI
---
 httpd/httpd.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/httpd/httpd.c b/httpd/httpd.c
index 30b1118..5480926 100644
--- a/httpd/httpd.c
+++ b/httpd/httpd.c
@@ -292,14 +292,14 @@ uint8_t stream_upload(uint16_t bptr)
 			if (verify_crc) {
 				dbg_string("CRC16: "); dbg_short(crc_final); dbg_char('\n');
 				if (crc_final == 0xb001) {
-					print_string("Checksum OK.");
+					print_string("Checksum OK.\nUpload to flash done, will reset!\n");
+					// close connection to avoid retries by browser
+					uip_close();
+					reset_chip();
 				} else {
-					print_string("Checksum incorrect!");
+					print_string("Checksum incorrect! Aborting.\n");
+					uip_close();
 				}
-				print_string("\nUpload to flash done, will reset!\n");
-				// close connection to avoid retries by browser
-				uip_close();
-				reset_chip();
 			}
 			// Make sure there is a 0 at the end of the uploaded data
 			flash_buf[0] = 0;
@@ -387,6 +387,10 @@ void handle_post(void)
 			verify_crc = 1;
 			max_upload = 1024576;
 		} else if (is_word(request_path, "config")) {
+			if (!authenticated) {
+				send_unauthorized();
+				return;
+			}
 			dbg_string("Configuration upload, erasing config mem!\n");
 			uptr = CONFIG_START;
 			verify_crc = 0;