From 6f4c21c218681f05704a6e61bf4a92405ace3d19 Mon Sep 17 00:00:00 2001 From: Deomid Ryabkov Date: Tue, 22 Mar 2016 11:35:26 +0100 Subject: [PATCH] Do not bypass auth when handling CGI request PUBLISHED_FROM=9faccf9fedd92d0fb54b7ff660c0cf99c1cbdb74 --- mongoose.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/mongoose.c b/mongoose.c index 141723ef..954ac42a 100644 --- a/mongoose.c +++ b/mongoose.c @@ -7398,13 +7398,6 @@ MG_INTERNAL void mg_send_http_file(struct mg_connection *nc, char *path, /* If we have path_info, the only way to handle it is CGI. */ if (path_info->len > 0 && !is_cgi) { mg_http_send_http_error(nc, 501, NULL); - return; - } else if (is_cgi) { -#if !defined(MG_DISABLE_CGI) - mg_handle_cgi(nc, index_file ? index_file : path, path_info, hm, opts); -#else - mg_http_send_http_error(nc, 501, NULL); -#endif /* MG_DISABLE_CGI */ MG_FREE(index_file); return; } @@ -7416,6 +7409,12 @@ MG_INTERNAL void mg_send_http_file(struct mg_connection *nc, char *path, !mg_is_authorized(hm, path, is_directory, opts->auth_domain, opts->per_directory_auth_file, 0)) { mg_http_send_digest_auth_request(nc, opts->auth_domain); + } else if (is_cgi) { +#if !defined(MG_DISABLE_CGI) + mg_handle_cgi(nc, index_file ? index_file : path, path_info, hm, opts); +#else + mg_http_send_http_error(nc, 501, NULL); +#endif /* MG_DISABLE_CGI */ } else if ((!exists || mg_is_file_hidden(path, opts, 0 /* specials are ok */)) && !mg_is_creation_request(hm)) {