d00f 6ea9503ab2 httpd: do not accept a session cookie before the first login ...

session_id is cleared at boot and only a successful login fills it in,
while the uptime counter and last_session_use both start at 0. For the
first SESSION_TIMEOUT seconds after a start, a request carrying an empty
"Cookie: session=" therefore passes is_word_x(session, session_id) and
is treated as logged in, which is enough for /cmd, /config and /upload.

Only look at the cookie once a session has been handed out.

2026-09-15 09:37:11 +02:00

..

httpd.c

httpd: do not accept a session cookie before the first login

2026-09-15 09:37:11 +02:00

httpd.h

Add caching and usage of MIME-type enums

2025-08-20 10:11:31 +02:00

page_impl.c

stp: treat a link aggregation group as one entity

2026-09-09 20:58:35 +02:00

page_impl.h

httpd: answer /cmd with the shared text header

2026-09-03 22:18:45 +02:00

treatasm.py

http: use python3.

2025-08-27 23:11:12 +02:00