wt/mongoose
1
0 Fork 0
mirror of https://github.com/cesanta/mongoose.git synced 2026-10-29 12:41:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

Do not bypass auth when handling CGI request

Browse Source 
PUBLISHED_FROM=9faccf9fedd92d0fb54b7ff660c0cf99c1cbdb74
This commit is contained in:
Deomid Ryabkov authored and rojer committed 2016-03-22 11:45:49 +00:00
1 parent 5060640408
commit 6f4c21c218
1 file changed
+6 -7
Download Patch File Download Diff File Expand all files Collapse all files
mongoose.c
+6 -7
View File
@@ -7398,13 +7398,6 @@ MG_INTERNAL void mg_send_http_file(struct mg_connection *nc, char *path,
/* If we have path_info, the only way to handle it is CGI. */
if (path_info->len > 0 && !is_cgi) {
mg_http_send_http_error(nc, 501, NULL);
return;
} else if (is_cgi) {
#if !defined(MG_DISABLE_CGI)
mg_handle_cgi(nc, index_file ? index_file : path, path_info, hm, opts);
#else
mg_http_send_http_error(nc, 501, NULL);
#endif /* MG_DISABLE_CGI */
MG_FREE(index_file);
return;
}
@@ -7416,6 +7409,12 @@ MG_INTERNAL void mg_send_http_file(struct mg_connection *nc, char *path,
!mg_is_authorized(hm, path, is_directory, opts->auth_domain,
opts->per_directory_auth_file, 0)) {
mg_http_send_digest_auth_request(nc, opts->auth_domain);
} else if (is_cgi) {
#if !defined(MG_DISABLE_CGI)
mg_handle_cgi(nc, index_file ? index_file : path, path_info, hm, opts);
#else
mg_http_send_http_error(nc, 501, NULL);
#endif /* MG_DISABLE_CGI */
} else if ((!exists ||
mg_is_file_hidden(path, opts, 0 /* specials are ok */)) &&
!mg_is_creation_request(hm)) {