From e1248def30068ca49d9e83e544db2d946882995a Mon Sep 17 00:00:00 2001 From: "Evgeny Grin (Karlson2k)" Date: Thu, 25 Jul 2024 15:22:44 +0200 Subject: [PATCH] digestauth: explicitly reject unsupported algorithm requested by application --- src/microhttpd/digestauth.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/microhttpd/digestauth.c b/src/microhttpd/digestauth.c index e2e326f0..8cf4e6c7 100644 --- a/src/microhttpd/digestauth.c +++ b/src/microhttpd/digestauth.c @@ -3537,7 +3537,8 @@ queue_auth_required_response3_inner (struct MHD_Connection *connection, size_t p; /* The position in the buffer */ char *hdr_name; - if (0 == (((unsigned int) malgo3) & MHD_DIGEST_AUTH_ALGO3_NON_SESSION)) + if ((0 == (((unsigned int) malgo3) & MHD_DIGEST_AUTH_ALGO3_NON_SESSION)) || + (0 != (((unsigned int) malgo3) & MHD_DIGEST_AUTH_ALGO3_SESSION))) { #ifdef HAVE_MESSAGES MHD_DLOG (connection->daemon,