From a71c5359a52d30567fba342a873b2ae972d30127 Mon Sep 17 00:00:00 2001 From: bloqaudio Date: Fri, 18 Sep 2026 14:00:51 -0500 Subject: [PATCH] httpd: refuse an unauthenticated firmware upload before it changes state The multipart branch for /config tests authenticated before it touches anything; the branch for /upload does not, and the 401 for it is only raised further down at the dispatch. By then the request has already set config_upload, uptr, verify_crc, max_upload and pre_acc, and announced a firmware upload on the console. Those five are globals while the transfer state they steer is per connection, and the stack is built for ten connections, so a request that is about to be rejected can still retarget an upload another client is in the middle of: a configuration upload continues as a firmware one and its remaining parts are written to the staging area instead of the configuration sector. Apply the same test the neighbouring branch uses, before the assignments. --- httpd/httpd.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/httpd/httpd.c b/httpd/httpd.c index 74c11148..761d6863 100644 --- a/httpd/httpd.c +++ b/httpd/httpd.c @@ -750,6 +750,10 @@ void handle_post(void) return; } if (is_word(request_path, "upload")) { + if (!authenticated) { + send_unauthorized(); + return; + } if (flash_size < FIRMWARE_UPLOAD_START*2) { print_string("Flash too small for firmware upload!\n");