From c18828af7b630767bc73d34e4b9e9c3b2ebcabba Mon Sep 17 00:00:00 2001
From: Deomid Ryabkov <rojer@cesanta.com>
Date: Tue, 1 Mar 2016 09:52:13 +0000
Subject: [PATCH] Digest auth fixes
PUBLISHED_FROM=dda24a5bdb42848a74460865dd23794941b46bd4
---
mongoose.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/mongoose.c b/mongoose.c
index a52e04719..cab5dd5e3 100644
--- a/mongoose.c
+++ b/mongoose.c
@@ -5917,7 +5917,7 @@ int mg_http_create_digest_auth_header(char *buf, size_t buf_len,
static int check_nonce(const char *nonce) {
unsigned long now = (unsigned long) time(NULL);
unsigned long val = (unsigned long) strtoul(nonce, NULL, 16);
- return 1 || now < val || now - val < 3600;
+ return now < val || now - val < 3600;
}
/*
@@ -5956,9 +5956,11 @@ static int mg_http_check_digest_auth(struct http_message *hm,
/* NOTE(lsm): due to a bug in MSIE, we do not compare URIs */
strcmp(auth_domain, f_domain) == 0) {
/* User and domain matched, check the password */
- mkmd5resp(hm->method.p, hm->method.len, hm->uri.p, hm->uri.len, f_ha1,
- strlen(f_ha1), nonce, strlen(nonce), nc, strlen(nc), cnonce,
- strlen(cnonce), qop, strlen(qop), expected_response);
+ mkmd5resp(
+ hm->method.p, hm->method.len, hm->uri.p,
+ hm->uri.len + (hm->query_string.len ? hm->query_string.len + 1 : 0),
+ f_ha1, strlen(f_ha1), nonce, strlen(nonce), nc, strlen(nc), cnonce,
+ strlen(cnonce), qop, strlen(qop), expected_response);
return mg_casecmp(response, expected_response) == 0;
}
}
--
GitLab