MyFavMirrors
/
owntone-server
mirror of https://github.com/owntone/owntone-server.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[httpd] Expose function for authenticating admin requests

This commit is contained in:
chme 2017-08-20 15:38:26 +02:00
parent 1d49413070
commit 9275f7a938
2 changed files with 41 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

60
src/httpd.c
View File

@ -930,12 +930,44 @@ redirect_to_index(struct evhttp_request *req, char *uri)
httpd_send_reply(req, HTTP_MOVETEMP, "Moved", NULL, HTTPD_SEND_NO_GZIP);
}
bool
httpd_admin_check_auth(struct evhttp_request *req)
{
const char *host;
const char *passwd;
int ret;
passwd = cfg_getstr(cfg_getsec(cfg, "general"), "admin_password");
if (passwd)
{
DPRINTF(E_DBG, L_HTTPD, "Checking web interface authentication\n");
ret = httpd_basic_auth(req, "admin", passwd, PACKAGE " web interface");
if (ret != 0)
return false;
DPRINTF(E_DBG, L_HTTPD, "Authentication successful\n");
}
else
{
host = evhttp_request_get_host(req);
if ((strcmp(host, "::1") != 0)
&& (strcmp(host, "127.0.0.1") != 0))
{
DPRINTF(E_LOG, L_HTTPD, "Remote web interface request denied; no password set\n");
httpd_send_error(req, 403, "Forbidden");
return false;
}
}
return true;
}
/* Thread: httpd */
static void
serve_file(struct evhttp_request *req, char *uri)
{
const char *host;
const char *passwd;
char *ext;
char path[PATH_MAX];
char *deref;
@ -949,28 +981,10 @@ serve_file(struct evhttp_request *req, char *uri)
int ret;
/* Check authentication */
passwd = cfg_getstr(cfg_getsec(cfg, "general"), "admin_password");
if (passwd)
if (!httpd_admin_check_auth(req))
{
DPRINTF(E_DBG, L_HTTPD, "Checking web interface authentication\n");
ret = httpd_basic_auth(req, "admin", passwd, PACKAGE " web interface");
if (ret != 0)
return;
DPRINTF(E_DBG, L_HTTPD, "Authentication successful\n");
}
else
{
host = evhttp_request_get_host(req);
if ((strcmp(host, "::1") != 0)
&& (strcmp(host, "127.0.0.1") != 0))
{
DPRINTF(E_LOG, L_HTTPD, "Remote web interface request denied; no password set\n");
httpd_send_error(req, 403, "Forbidden");
return;
}
DPRINTF(E_DBG, L_HTTPD, "Remote web interface request denied;\n");
return;
}
if (strncmp(uri, "/oauth", strlen("/oauth")) == 0)

4
src/httpd.h
View File

@ -4,6 +4,7 @@
#include <event2/http.h>
#include <event2/buffer.h>
#include <stdbool.h>
enum httpd_send_flags
{
@ -58,6 +59,9 @@ httpd_fixup_uri(struct evhttp_request *req);
int
httpd_basic_auth(struct evhttp_request *req, const char *user, const char *passwd, const char *realm);
bool
httpd_admin_check_auth(struct evhttp_request *req);
int
httpd_init(void);