gitproxy/RTLPlayground
1
0
Fork 0
mirror of https://github.com/logicog/RTLPlayground.git synced 2026-08-30 14:52:51 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add URL decoding for password comparison.

Browse Source
This commit is contained in:
logicog
2026-05-15 16:04:48 +02:00
parent ede4137101
commit 8ab2a6a9da
1 changed files with 26 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
httpd/httpd.c
+26 -1
View File
@@ -131,6 +131,31 @@ char is_word(__xdata uint8_t *c, __code uint8_t * __xdata d)
}
char is_url_word_x(__xdata uint8_t *c, __xdata uint8_t *d)
{
uint8_t i = 0, j = 0;
while (d[i]) {
if (c[j] == '%') {
uint8_t v;
j++;
v = c[j] - '0' < 10 ? (c[j] - '0') << 4 : (c[j] - 'A' + 10) << 4;
j++;
v += c[j] - '0' < 10 ? c[j] - '0' : c[j] - 'A' + 10;
if (d[i] != v)
return 0;
} else if (d[i] != c[j])
return 0;
i++;
j++;
}
if (c[j] != ' ' && c[j] != '\t' && c[j] != ':' && c[j] != '?' && c[j] != '=' && c[j] != '\n' && c[j] != '\r' && c[j])
return 0;
return 1;
}
char is_word_x(__xdata uint8_t *c, __xdata uint8_t *d)
{
register uint8_t i = 0;
@@ -414,7 +439,7 @@ void handle_post(void)
} else if (is_word(request_path, "login")) {
dbg_string("POST login\n");
p += 8; // Read also over "pwd="
if (is_word_x(p, passwd)) {
if (is_url_word_x(p, passwd)) {
dbg_string("Password accepted!\n");
read_reg_timer(&last_session_use);
gen_random_bytes(session_id, SESSION_ID_LENGTH);