From b0cf8304cbe076ffadc966e03877e3a2246e65cc Mon Sep 17 00:00:00 2001 From: Alex Skalozub Date: Sat, 28 Jun 2014 23:14:21 +0400 Subject: [PATCH 1/3] Disallow WebDAV MKCOL/PUT/DELETE requests to protected files (like .htpasswd) --- mongoose.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mongoose.c b/mongoose.c index ef3e98b1..066e9243 100644 --- a/mongoose.c +++ b/mongoose.c @@ -4268,6 +4268,8 @@ static void open_local_endpoint(struct connection *conn, int skip_user) { #ifndef MONGOOSE_NO_DAV } else if (!strcmp(conn->mg_conn.request_method, "PROPFIND")) { handle_propfind(conn, path, &st, exists); + } else if (must_hide_file(conn, path)) { + send_http_error(conn, 404, NULL); } else if (!strcmp(conn->mg_conn.request_method, "MKCOL")) { handle_mkcol(conn, path); } else if (!strcmp(conn->mg_conn.request_method, "DELETE")) { From a6bf2bcbf4c9ad9289b0daca886de861b25f3c15 Mon Sep 17 00:00:00 2001 From: Alex Skalozub Date: Sun, 29 Jun 2014 00:03:52 +0400 Subject: [PATCH 2/3] Should also disallow PROPFIND as well --- mongoose.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mongoose.c b/mongoose.c index 066e9243..fc755fdc 100644 --- a/mongoose.c +++ b/mongoose.c @@ -4266,10 +4266,10 @@ static void open_local_endpoint(struct connection *conn, int skip_user) { close_local_endpoint(conn); #endif #ifndef MONGOOSE_NO_DAV - } else if (!strcmp(conn->mg_conn.request_method, "PROPFIND")) { - handle_propfind(conn, path, &st, exists); } else if (must_hide_file(conn, path)) { send_http_error(conn, 404, NULL); + } else if (!strcmp(conn->mg_conn.request_method, "PROPFIND")) { + handle_propfind(conn, path, &st, exists); } else if (!strcmp(conn->mg_conn.request_method, "MKCOL")) { handle_mkcol(conn, path); } else if (!strcmp(conn->mg_conn.request_method, "DELETE")) { From 82872e86fd43867b5e88fe90e91790044938fa9a Mon Sep 17 00:00:00 2001 From: Pavel Pimenov Date: Mon, 7 Jul 2014 09:24:48 +0400 Subject: [PATCH 3/3] Change printf mask %zu -> %lu for MS VC++ compatibility http://stackoverflow.com/questions/15610053/correct-printf-format-specifier-for-size-t-zu-or-iu --- examples/mjpg.c | 2 +- mongoose.c | 14 +++++++------- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/examples/mjpg.c b/examples/mjpg.c index ad6bc1ab..1fe26288 100644 --- a/examples/mjpg.c +++ b/examples/mjpg.c @@ -13,7 +13,7 @@ static void send_file(struct mg_connection *conn, const char *path) { if (stat(path, &st) == 0 && (fp = fopen(path, "rb")) != NULL) { mg_printf(conn, "--myboundary\r\nContent-Type: image/jpeg\r\n" - "Content-Length: %zu\r\n\r\n", st.st_size); + "Content-Length: %llu\r\n\r\n", (unsigned long long) st.st_size); while ((n = fread(buf, 1, sizeof(buf), fp)) > 0) { mg_write(conn, buf, n); } diff --git a/mongoose.c b/mongoose.c index fc755fdc..eee7667e 100644 --- a/mongoose.c +++ b/mongoose.c @@ -1638,7 +1638,7 @@ size_t mg_printf(struct mg_connection *conn, const char *fmt, ...) { } static void ns_forward(struct ns_connection *from, struct ns_connection *to) { - DBG(("%p -> %p %zu bytes", from, to, from->recv_iobuf.len)); + DBG(("%p -> %p %lu bytes", from, to, (unsigned long)from->recv_iobuf.len)); ns_send(to, from->recv_iobuf.buf, from->recv_iobuf.len); iobuf_remove(&from->recv_iobuf, from->recv_iobuf.len); } @@ -3443,7 +3443,7 @@ static void handle_put(struct connection *conn, const char *path) { #endif send_http_error(conn, 500, "open(%s): %s", path, strerror(errno)); } else { - DBG(("PUT [%s] %zu", path, conn->ns_conn->recv_iobuf.len)); + DBG(("PUT [%s] %lu", path, (unsigned long) conn->ns_conn->recv_iobuf.len)); conn->endpoint_type = EP_PUT; ns_set_close_on_exec(conn->endpoint.fd); range = mg_get_header(&conn->mg_conn, "Content-Range"); @@ -4067,7 +4067,7 @@ int mg_terminate_ssl(struct mg_connection *c, const char *cert) { // When clear-text reply is pushed to client, switch to SSL mode. n = send(conn->ns_conn->sock, ok, sizeof(ok) - 1, 0); - DBG(("%p %zu %d SEND", c, sizeof(ok) - 1, n)); + DBG(("%p %lu %d SEND", c, (unsigned long)sizeof(ok) - 1, n)); conn->ns_conn->send_iobuf.len = 0; conn->endpoint_type = EP_USER; // To keep-alive in close_local_endpoint() close_local_endpoint(conn); // Clean up current CONNECT request @@ -4226,8 +4226,8 @@ static void open_local_endpoint(struct connection *conn, int skip_user) { if ((strcmp(conn->mg_conn.request_method, "POST") == 0 || strcmp(conn->mg_conn.request_method, "PUT") == 0) && (cl == NULL || to64(cl) > MONGOOSE_POST_SIZE_LIMIT)) { - send_http_error(conn, 500, "POST size > %zu", - (size_t) MONGOOSE_POST_SIZE_LIMIT); + send_http_error(conn, 500, "POST size > %lu", + (unsigned long) MONGOOSE_POST_SIZE_LIMIT); } } #endif @@ -4347,7 +4347,7 @@ static void on_recv_data(struct connection *conn) { } try_parse(conn); - DBG(("%p %d %zu %d", conn, conn->request_len, io->len, conn->ns_conn->flags)); + DBG(("%p %d %lu %d", conn, conn->request_len, (unsigned long)io->len, conn->ns_conn->flags)); if (conn->request_len < 0 || (conn->request_len > 0 && !is_valid_uri(conn->mg_conn.uri))) { send_http_error(conn, 400, NULL); @@ -4401,7 +4401,7 @@ static void process_response(struct connection *conn) { struct iobuf *io = &conn->ns_conn->recv_iobuf; try_parse(conn); - DBG(("%p %d %zu", conn, conn->request_len, io->len)); + DBG(("%p %d %lu", conn, conn->request_len, (unsigned long)io->len)); if (conn->request_len < 0 || (conn->request_len == 0 && io->len > MAX_REQUEST_SIZE)) { call_http_client_handler(conn);