xavi/slcl, branch v0.2.1-rc2

main.c: Force valid cookie on check_length

2024-02-19T23:17:40+00:00

Otherwise, a malicious user could send multipart/form-data requests without a valid cookie.

page.c: Use open(2) fdopen(3) and fstat(2)

2024-02-19T22:35:09+00:00

Now, the same file descriptor can be reused for all of the operations above, instead of calling stat(2) and fopen(3) separately.

page.c: URL-encode href

2024-02-19T22:35:09+00:00

Otherwise, files with special characters, such as '%', could not be downloaded or previewed.

main.c: const-qualify name and dir

2024-02-19T22:35:08+00:00

There was no reason why these should not be const-qualified. It was probably missed during the implementation.

main.c: URL-encode created directories

2024-02-19T22:35:08+00:00

Otherwise, directories with special characters, such as "%", would not be accessible when performing the redirection.

main.c: Use fstat(2) on move_file

2024-02-19T22:35:08+00:00

This allows to reuse the same file descriptor to both open(2) and fstat(2) the file.

Bump libweb to 0.3.0

2024-02-19T22:35:08+00:00

The following commits fix a couple of security issues on libweb. Because of afe0681c0b26bb64bad55d7e86770f346cfa043e, slcl had to be updated to set up its struct http_cfg_post. commit afe0681c0b26bb64bad55d7e86770f346cfa043e Author: Xavier Del Campo Romero Date: Mon Feb 19 23:00:56 2024 +0100 Limit maximum multipart/form-data pairs and files A malicious user could inject an infinite number of empty files or key/value pairs into a request in order to exhaust the device's resources. commit 9d9e0c2979f43297b2ebbf84f14f064f3f9ced0e Author: Xavier Del Campo Romero Date: Mon Feb 19 22:49:09 2024 +0100 html.c: Avoid half-init objects on html_node_add_attr The previous implementation would leave half-initialised objects if one of the calls to strdup(3) failed. Now, n->attrs is only modified when all previous memory allocations were successful.

main.c: Add missing relative path check

2024-02-19T15:59:54+00:00

CMakeLists.txt: Bump version to 0.2.0

2024-02-12T22:15:15+00:00

Bump libweb to 0.2.0

2024-02-12T22:15:14+00:00