X-Git-Url: http://www.dolda2000.com/gitweb/?a=blobdiff_plain;f=src%2Fhtextauth.c;h=1fbea07f19ecd4600da0e3b9e7a6f560a9ecb557;hb=f2df7a1b1aeeb0cec2309aeb62fae051fd3c687c;hp=27217e01e1bbf0dc41b8ac4f8d1287c3366b46e5;hpb=baaabaf72db3a414319824ced4ff99292801a06a;p=ashd.git

diff --git a/src/htextauth.c b/src/htextauth.c
index 27217e0..1fbea07 100644
--- a/src/htextauth.c
+++ b/src/htextauth.c
@@ -147,11 +147,11 @@ static void serve(struct hthead *req, int fd)
     size_t declen;
     
     now = time(NULL);
+    dec = NULL;
     if(reqssl && (((raw = getheader(req, "X-Ash-Protocol")) == NULL) || strcmp(raw, "https"))) {
 	simpleerror(fd, 403, "Forbidden", "The requested resource must be requested over HTTPS.");
 	goto out;
     }
-    dec = NULL;
     if(((raw = getheader(req, "Authorization")) == NULL) || strncasecmp(raw, "basic ", 6)) {
 	reqauth(req, fd);
 	goto out;
@@ -162,6 +162,12 @@ static void serve(struct hthead *req, int fd)
     }
     memset(raw, 0, strlen(raw));
     headrmheader(req, "Authorization");
+    for(p = dec; *p; p++) {
+	if(*p < 32) {
+	    simpleerror(fd, 400, "Invalid request", "The authentication data is invalid.");
+	    goto out;
+	}
+    }
     if((p = strchr(dec, ':')) == NULL) {
 	simpleerror(fd, 400, "Invalid request", "The authentication data is invalid.");
 	goto out;
@@ -198,10 +204,6 @@ static int auth(struct hthead *req, int fd, char *user, char *pass)
     FILE *out;
     
     rv = 0;
-    if(strchr(user, '\n') || strchr(pass, '\n')) {
-	simpleerror(fd, 401, "Invalid authentication", "The supplied credentials are invalid.");
-	return(0);
-    }
     msg = "The supplied credentials are invalid.";
     pipe(pfd);
     pipe(efd);