Merge pull request #484 from bloqaudio/fix/upload-auth-gate

httpd: gate /upload on authentication before it changes state, and make the length limit count

httpd/httpd.c

@@ -752,6 +752,10 @@ void handle_post(void)
 			return;
 		}
 		if (is_word(request_path, "upload")) {
+			if (!authenticated) {
+				send_unauthorized();
+				return;
+			}
 			if (flash_size < FIRMWARE_UPLOAD_START*2)
 			{
 				print_string("Flash too small for firmware upload!\n");
@@ -907,8 +911,9 @@ void httpd_appcall(void)
 			reset_chip();
 		}
 	} else if (uip_newdata() && s->tstate == TSTATE_POST) {
-		// Check here maxupload by subtracting uip_len and close socekt if fails!
-		if (max_upload - uip_len > 0) {
+		if (config_upload || uip_len <= max_upload) {
+			if (!config_upload)
+				max_upload -= uip_len;
 			upload_settings.p = uip_appdata;
 			upload_settings.bptr = 0;
 			upload_settings.plen = uip_len;