summaryrefslogtreecommitdiffhomepage
path: root/response.cpp
diff options
context:
space:
mode:
Diffstat (limited to 'response.cpp')
-rw-r--r--response.cpp28
1 files changed, 28 insertions, 0 deletions
diff --git a/response.cpp b/response.cpp
index 8f66c54..0c619a2 100644
--- a/response.cpp
+++ b/response.cpp
@@ -1,4 +1,6 @@
#include "response.h"
+
+#include "base64.h"
#include "file.h"
#include <boost/algorithm/string/predicate.hpp>
@@ -183,6 +185,8 @@ response_type HttpStatus(std::string status, std::string message, response_type&
{
res.result(unsigned(stoul(status)));
res.set(http::field::content_type, "text/html");
+ if (res.result_int() == 401)
+ res.set(http::field::www_authenticate, "Basic realm=\"Webbox Login\"");
res.body() = "<html><body><h1>"s + VersionString + " Error</h1><p>"s + status + " "s + message + "</p></body></html>"s;
res.prepare_payload();
@@ -201,6 +205,30 @@ response_type generate_response(request_type& req, Server& server)
try {
RequestContext req_ctx{req, server}; // can throw std::out_of_range
+ auto& auth{req_ctx.GetPath().auth};
+ if (auth.size() != 0) {
+ std::string authorization{req[http::field::authorization]};
+ if (authorization.substr(0, 6) != "Basic "s)
+ return HttpStatus("401", "Bad Authorization Type", res);
+
+ authorization = authorization.substr(6);
+ authorization = decode64(authorization);
+
+ size_t pos {authorization.find(':')};
+ if (pos == authorization.npos)
+ return HttpStatus("401", "Bad Authorization Encoding", res);
+
+ std::string login{authorization.substr(0, pos)};
+ std::string password{authorization.substr(pos + 1)};
+
+ auto it {auth.find(login)};
+ if (it == auth.end())
+ return HttpStatus("401", "Bad Authorization", res);
+
+ if (it->second != password)
+ return HttpStatus("401", "Bad Authorization", res); // should be same message as previous one to prevent login guessing
+ }
+
plugin_type plugin{req_ctx.GetPlugin()};
auto GetServerParamFunction {std::function<std::string(const std::string& key)>(std::bind(GetServerParam, _1, std::ref(server)))};