浏览代码

Quick fix in handle_request: callbacks that do not handle a request

This is a border case in handle_request, which is probably an abuse
of callbacks that should not be allowed. For the moment, this quick
fix ensures compatibility to previous behavior.

The problem occurs only in the following situations:
1) A request is made to an URI. For this URI, there is a callback
   registered by mg_set_request_handler.
2) The callback is called, but it returns 0 to indicate it did not
   handle the request. Since the callback did not send any data,
   the server needs to handle the request and send a reply.
3) There is a file with the same name as the request.

Previous versions did deliver the content of the file.

4) The request could have been a DELETE request.
   For a DELETE request, it does make a difference if the URL
   belongs to a static file (on the disk of the server), or the
   delete request will be forwarded to a script.
   (a) In the first case, an autorization check to change files
   on the disk of the server is mandatory.
   (b) In the second case, the autorization check is optional, and
   a different password file is used.

In step (1) above, the request was identified as a request to a
script resource, and an authorization check according to (4b)
has been performed (if required). Now in step (2), the script did
not handle the request and only in step (3) we found out that we
have a request to a real file and would have needed authorization
according to (4a).

This border case is now temporarily fixed with a goto statement
back to the authorization check. This ensures compatibility to
the previous version - if anybody used callbacks and files for
the same URI, and filters access to the file in the callback.
Probably the support for using callbacks this way should be
skipped in the future version.
bel 10 年之前
父节点
当前提交
b3fe355e1e
共有 1 个文件被更改,包括 7 次插入0 次删除
  1. 7 0
      src/civetweb.c

+ 7 - 0
src/civetweb.c

@@ -6381,6 +6381,7 @@ static void handle_request(struct mg_connection *conn)
     }
 
     /* 6. authorization check */
+    auth_check:
     if (is_put_or_delete_request && !is_script_resource) {
         /* 6.1. this request is a PUT/DELETE to a real file */
         /* 6.1.1. thus, the server must have real files */
@@ -6425,6 +6426,12 @@ static void handle_request(struct mg_connection *conn)
             /* The last version did handle this as a file request, but
                since a file request is not always a script resource,
                the authorization check might be different */
+            interpret_uri(conn, path, sizeof(path), &file, &is_script_resource, &is_websocket_request, &is_put_or_delete_request);
+            callback_handler = NULL;
+
+            /* TODO: for the moment, a goto is simpler than some curious loop. */
+            /* The situation "callback does not handle the request" needs to be reconsidered anyway. */
+            goto auth_check;
         }
     }