7
7
8
8
#define SSID_FORMAT " ESP32-%06lX" // 12 chars total
9
9
// #define PASSWORD "test123456" // generate if remarked
10
+ const char * authUser = " admin" ;
11
+ const char * authPass = " admin" ;
10
12
11
13
WebServer server (80 );
12
14
Ticker tkSecond;
13
15
uint8_t otaDone = 0 ;
14
16
17
+ const char * csrfHeaders[2 ] = {" Origin" , " Host" };
18
+ static bool authenticated = false ;
19
+
15
20
const char *alphanum = " 0123456789!@#$%^&*abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ" ;
16
21
String generatePass (uint8_t str_len) {
17
22
String buff;
@@ -38,13 +43,17 @@ void apMode() {
38
43
}
39
44
40
45
void handleUpdateEnd () {
46
+ if (!authenticated) {
47
+ return server.requestAuthentication ();
48
+ }
41
49
server.sendHeader (" Connection" , " close" );
42
50
if (Update.hasError ()) {
43
51
server.send (502 , " text/plain" , Update.errorString ());
44
52
} else {
45
53
server.sendHeader (" Refresh" , " 10" );
46
54
server.sendHeader (" Location" , " /" );
47
55
server.send (307 );
56
+ delay (500 );
48
57
ESP.restart ();
49
58
}
50
59
}
@@ -56,18 +65,34 @@ void handleUpdate() {
56
65
}
57
66
HTTPUpload &upload = server.upload ();
58
67
if (upload.status == UPLOAD_FILE_START) {
68
+ authenticated = server.authenticate (authUser, authPass);
69
+ if (!authenticated) {
70
+ Serial.println (" Authentication fail!" );
71
+ otaDone = 0 ;
72
+ return ;
73
+ }
74
+ String origin = server.header (String (csrfHeaders[0 ]));
75
+ String host = server.header (String (csrfHeaders[1 ]));
76
+ String expectedOrigin = String (" http://" ) + host;
77
+ if (origin != expectedOrigin) {
78
+ Serial.printf (" Wrong origin received! Expected: %s, Received: %s\n " , expectedOrigin.c_str (), origin.c_str ());
79
+ authenticated = false ;
80
+ otaDone = 0 ;
81
+ return ;
82
+ }
83
+
59
84
Serial.printf (" Receiving Update: %s, Size: %d\n " , upload.filename .c_str (), fsize);
60
85
if (!Update.begin (fsize)) {
61
86
otaDone = 0 ;
62
87
Update.printError (Serial);
63
88
}
64
- } else if (upload.status == UPLOAD_FILE_WRITE) {
89
+ } else if (authenticated && upload.status == UPLOAD_FILE_WRITE) {
65
90
if (Update.write (upload.buf , upload.currentSize ) != upload.currentSize ) {
66
91
Update.printError (Serial);
67
92
} else {
68
93
otaDone = 100 * Update.progress () / Update.size ();
69
94
}
70
- } else if (upload.status == UPLOAD_FILE_END) {
95
+ } else if (authenticated && upload.status == UPLOAD_FILE_END) {
71
96
if (Update.end (true )) {
72
97
Serial.printf (" Update Success: %u bytes\n Rebooting...\n " , upload.totalSize );
73
98
} else {
@@ -78,6 +103,7 @@ void handleUpdate() {
78
103
}
79
104
80
105
void webServerInit () {
106
+ server.collectHeaders (csrfHeaders, 2 );
81
107
server.on (
82
108
" /update" , HTTP_POST,
83
109
[]() {
@@ -92,6 +118,9 @@ void webServerInit() {
92
118
server.send_P (200 , " image/x-icon" , favicon_ico_gz, favicon_ico_gz_len);
93
119
});
94
120
server.onNotFound ([]() {
121
+ if (!server.authenticate (authUser, authPass)) {
122
+ return server.requestAuthentication ();
123
+ }
95
124
server.send (200 , " text/html" , indexHtml);
96
125
});
97
126
server.begin ();
0 commit comments