[GNUnet-SVN] r19022 - in libmicrohttpd: . src/daemon

[gnunet]

Author: grothoff
Date: 2012-01-05 22:02:21 +0100 (Thu, 05 Jan 2012)
New Revision: 19022

Modified:
   libmicrohttpd/ChangeLog
   libmicrohttpd/src/daemon/digestauth.c
Log:
partial fix for #2059

Modified: libmicrohttpd/ChangeLog
===================================================================
--- libmicrohttpd/ChangeLog     2012-01-05 20:58:18 UTC (rev 19021)
+++ libmicrohttpd/ChangeLog     2012-01-05 21:02:21 UTC (rev 19022)
@@ -1,3 +1,6 @@
+Thu Jan  5 22:01:37 CET 2012
+       Partial fix for #2059, digest authentication with GET arguments. -CG
+
 Thu Dec  1 15:22:57 CET 2011
        Updated authorization_example.c to actually demonstrate the current
        MHD API. -SG

Modified: libmicrohttpd/src/daemon/digestauth.c
===================================================================
--- libmicrohttpd/src/daemon/digestauth.c       2012-01-05 20:58:18 UTC (rev 
19021)
+++ libmicrohttpd/src/daemon/digestauth.c       2012-01-05 21:02:21 UTC (rev 
19022)
@@ -518,13 +518,16 @@
      * exceeds `nonce_timeout' then the nonce is
      * invalid.
      */
-    if (t > nonce_time + nonce_timeout) 
+    if ( (t > nonce_time + nonce_timeout) ||
+        (0 != strncmp (uri,
+                       connection->url,
+                       strlen (connection->url))) )
       return MHD_INVALID_NONCE;    
     calculate_nonce (nonce_time,
                     connection->method,
                     connection->daemon->digest_auth_random,
                     connection->daemon->digest_auth_rand_size,
-                    uri,
+                    connection->url,
                     realm,
                     noncehashexp);
     /*