@@ -135,6 +135,18 @@ callback_http(wk *web, int connid, wk_uri *uri, void *userptr)

         resindex *res;

         char partialpath[1024];

         char *ptr;

+        struct {

+                char *name;

+        } whitelist[]={{"/index.html"},

+                       {"/newuser.html"}

+                      };

+        int len;

+        int ishtml;

+        int whitelisted;

+        int validsession;

+        char session[SESSIONSIZE];

+        char user[MAXUSERSIZE+1];

+        int i;

         if(ka==NULL)

                 return(wkact_finished);

         /* log without passwords */

@@ -144,17 +156,45 @@ callback_http(wk *web, int connid, wk_uri *uri, void *userptr)

                 log_write("HTTP","Request: /newuser?...");

         else

                 log_write("HTTP","Request: %s",uri->path);

-        /* check for an in-memory file */

+

+        /* extract the name */

         strncpy(partialpath,uri->path,sizeof(partialpath)-1);

         partialpath[sizeof(partialpath)-1]='\0';

+        if(strcmp(uri->path,"/")==0)

+                strcpy(partialpath,"/index.html");

         if((ptr=strchr(partialpath,'?'))!=NULL)

                 *ptr='\0';

-#warning TODO check if the page is a "protected" one and, in that case, check for correct session id

-        if((strcmp(uri->path,"/")==0 && (res=res_find(resindexdata,"index.html"))!=NULL) ||

-          (partialpath[0]=='/' && (res=res_find(resindexdata,partialpath+1))!=NULL)) {

-                log_write("HTTP","Serving in-memory file %s",partialpath+1);

-                wk_serve_buffer_as_file(web,connid,res->data,res->len,mime_getdefault(res->name,"application/octet-stream"));

-                return(wkact_finished);

+        /* check whitelist */

+        len=strlen(partialpath);

+        ishtml=(len>5 && strcmp(partialpath+len-5,".html")==0)?1:0;

+        if(ishtml) {

+                for(whitelisted=0,i=0;i<(sizeof(whitelist)/sizeof(whitelist[0]));i++) {

+                        if(strcmp(partialpath,whitelist[i].name)==0) {

+                                whitelisted=1;

+                                break;

+                        }

+                }

+        } else

+                whitelisted=1;

+        if(wk_uri_copyvar(uri,"s",session,sizeof(session))==NULL)

+                session[0]='\0';

+        user[0]='\0';

+        validsession=(session_check(ka,session,user,sizeof(user))!=NULL)?1:0;

+        /* serve the page */

+        if(partialpath[0]=='/' && (res=res_find(resindexdata,partialpath+1))!=NULL) {

+                if(whitelisted || validsession) {

+                        log_write("HTTP","Serving in-memory file %s",partialpath+1);

+                        wk_serve_buffer_as_file(web,connid,res->data,res->len,mime_getdefault(res->name,"application/octet-stream"));

+                        return(wkact_finished);

+                } else if((res=res_find(resindexdata,"index.html"))!=NULL) {

+                        log_write("HTTP","Not allowed page, redirecting to login");

+                        wk_serve_buffer_as_file(web,connid,res->data,res->len,mime_getdefault(res->name,"application/octet-stream"));

+                        return(wkact_finished);

+                } else {

+                        log_write("EINT","%s:%i",__FILE__,__LINE__);

+                        wk_serve_error(web,connid,wkerr_internal);

+                        return(wkact_finished); /* internal error */

+                }

         }

         /* check for actions */

         if(memcmp(uri->path,"/login?",7)==0) {

@@ -195,6 +235,7 @@ http_login(wk *web, int connid, wk_uri *uri, void *userptr)

         kakumei *ka=(kakumei *)userptr;

         if(web==NULL || connid<0 || uri==NULL || ka==NULL) {

                 log_write("EINT","%s:%i",__FILE__,__LINE__);

+                wk_serve_error(web,connid,wkerr_internal);

                 return(wkact_finished); /* internal error */

         }

         if(wk_uri_copyvar(uri,"u",u,sizeof(u))==NULL)

@@ -233,6 +274,7 @@ http_newuser(wk *web, int connid, wk_uri *uri, void *userptr)

         kakumei *ka=(kakumei *)userptr;

         if(web==NULL || connid<0 || uri==NULL || ka==NULL) {

                 log_write("EINT","%s:%i",__FILE__,__LINE__);

+

                 return(wkact_finished); /* internal error */

         }

         /* get vars */