From 888606e0040fdb8e80e0933ad9e1fed31cafc5ce Mon Sep 17 00:00:00 2001 From: Christian Grothoff Date: Tue, 28 Jul 2026 10:58:39 +0200 Subject: [PATCH] fix algorithm parsing, string cmp was matching wrong strings to client requests to determine selected algorithm --- src/microhttpd/gen_auth.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/src/microhttpd/gen_auth.c b/src/microhttpd/gen_auth.c index 54775dd0..3cc5dc2a 100644 --- a/src/microhttpd/gen_auth.c +++ b/src/microhttpd/gen_auth.c @@ -290,15 +290,14 @@ get_rq_dauth_algo (const struct MHD_RqDAuthParam *const algo_param) return MHD_DIGEST_AUTH_ALGO3_SHA256; if (MHD_str_equal_caseless_quoted_s_bin_n (algo_param->value.str, \ algo_param->value.len, \ - _MHD_MD5_TOKEN _MHD_SESS_TOKEN)) + _MHD_SHA512_256_TOKEN)) return MHD_DIGEST_AUTH_ALGO3_SHA512_256; + + /* Algorithms below are not supported by MHD for authentication */ + if (MHD_str_equal_caseless_quoted_s_bin_n (algo_param->value.str, \ algo_param->value.len, \ - _MHD_SHA512_256_TOKEN \ - _MHD_SESS_TOKEN)) - - /* Algorithms below are not supported by MHD for authentication */ - + _MHD_MD5_TOKEN _MHD_SESS_TOKEN)) return MHD_DIGEST_AUTH_ALGO3_MD5_SESSION; if (MHD_str_equal_caseless_quoted_s_bin_n (algo_param->value.str, \ algo_param->value.len, \ @@ -307,7 +306,8 @@ get_rq_dauth_algo (const struct MHD_RqDAuthParam *const algo_param) return MHD_DIGEST_AUTH_ALGO3_SHA256_SESSION; if (MHD_str_equal_caseless_quoted_s_bin_n (algo_param->value.str, \ algo_param->value.len, \ - _MHD_SHA512_256_TOKEN)) + _MHD_SHA512_256_TOKEN \ + _MHD_SESS_TOKEN)) return MHD_DIGEST_AUTH_ALGO3_SHA512_256_SESSION; /* No known algorithm has been detected */