11
11
const char *host = " esp32-webupdate" ;
12
12
const char *ssid = " ........" ;
13
13
const char *password = " ........" ;
14
+ const char * authUser = " admin" ;
15
+ const char * authPass = " admin" ;
14
16
15
17
WebServer server (80 );
16
18
const char *serverIndex =
17
19
" <form method='POST' action='/update' enctype='multipart/form-data'><input type='file' name='update'><input type='submit' value='Update'></form>" ;
18
20
21
+ const char * csrfHeaders[2 ] = {" Origin" , " Host" };
22
+ static bool authenticated = false ;
23
+
19
24
void setup (void ) {
20
25
Serial.begin (115200 );
21
26
Serial.println ();
@@ -24,37 +29,62 @@ void setup(void) {
24
29
WiFi.begin (ssid, password);
25
30
if (WiFi.waitForConnectResult () == WL_CONNECTED) {
26
31
MDNS.begin (host);
32
+ server.collectHeaders (csrfHeaders, 2 );
27
33
server.on (" /" , HTTP_GET, []() {
34
+ if (!server.authenticate (authUser, authPass)) {
35
+ return server.requestAuthentication ();
36
+ }
28
37
server.sendHeader (" Connection" , " close" );
29
38
server.send (200 , " text/html" , serverIndex);
30
39
});
31
40
server.on (
32
41
" /update" , HTTP_POST,
33
42
[]() {
43
+ if (!authenticated) {
44
+ return server.requestAuthentication ();
45
+ }
34
46
server.sendHeader (" Connection" , " close" );
35
- server.send (200 , " text/plain" , (Update.hasError ()) ? " FAIL" : " OK" );
36
- ESP.restart ();
47
+ if (Update.hasError ()) {
48
+ server.send (200 , " text/plain" , " FAIL" );
49
+ } else {
50
+ server.send (200 , " text/plain" , " Success! Rebooting..." );
51
+ delay (500 );
52
+ ESP.restart ();
53
+ }
37
54
},
38
55
[]() {
39
56
HTTPUpload &upload = server.upload ();
40
57
if (upload.status == UPLOAD_FILE_START) {
41
58
Serial.setDebugOutput (true );
59
+ authenticated = server.authenticate (authUser, authPass);
60
+ if (!authenticated) {
61
+ Serial.println (" Authentication fail!" );
62
+ return ;
63
+ }
64
+ String origin = server.header (String (csrfHeaders[0 ]));
65
+ String host = server.header (String (csrfHeaders[1 ]));
66
+ String expectedOrigin = String (" http://" ) + host;
67
+ if (origin != expectedOrigin) {
68
+ Serial.printf (" Wrong origin received! Expected: %s, Received: %s\n " , expectedOrigin.c_str (), origin.c_str ());
69
+ authenticated = false ;
70
+ }
71
+
42
72
Serial.printf (" Update: %s\n " , upload.filename .c_str ());
43
73
if (!Update.begin ()) { // start with max available size
44
74
Update.printError (Serial);
45
75
}
46
- } else if (upload.status == UPLOAD_FILE_WRITE) {
76
+ } else if (authenticated && upload.status == UPLOAD_FILE_WRITE) {
47
77
if (Update.write (upload.buf , upload.currentSize ) != upload.currentSize ) {
48
78
Update.printError (Serial);
49
79
}
50
- } else if (upload.status == UPLOAD_FILE_END) {
80
+ } else if (authenticated && upload.status == UPLOAD_FILE_END) {
51
81
if (Update.end (true )) { // true to set the size to the current progress
52
82
Serial.printf (" Update Success: %u\n Rebooting...\n " , upload.totalSize );
53
83
} else {
54
84
Update.printError (Serial);
55
85
}
56
86
Serial.setDebugOutput (false );
57
- } else {
87
+ } else if (authenticated) {
58
88
Serial.printf (" Update Failed Unexpectedly (likely broken connection): status=%d\n " , upload.status );
59
89
}
60
90
}
0 commit comments