From 623247da4f423e72940028157e6edfeb16b36965 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ren=C3=A9=20van=20Dorst?= <opensource@vdorst.com>
Date: Sun, 17 May 2026 17:15:51 +0200
Subject: [PATCH] httpd: Added extra content_type check for login.

Ensure login content_type is "application/x-www-form-urlencoded".
---
 httpd/httpd.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/httpd/httpd.c b/httpd/httpd.c
index 77db515..2b84adf 100644
--- a/httpd/httpd.c
+++ b/httpd/httpd.c
@@ -442,6 +442,13 @@ void handle_post(void)
 			cmd_available = 1;
 	} else if (is_word(request_path, "login")) {
 		dbg_string("POST login\n");
+
+		if (!content_type || !is_word(content_type, "application/x-www-form-urlencoded")) {
+			dbg_string("Bad request!\n");
+			send_bad_request();
+			return;
+		}
+
 		p += 8; // Read also over "pwd="
 		if (is_url_word_x(p, passwd)) {
 			dbg_string("Password accepted!\n");