| 317 | } |
| 318 | |
| 319 | void CScriptWebServer::ProcessImgFileReq(ThreadData Data) |
| 320 | { |
| 321 | webInterface->DebugShow("**** imgrequest: " + Data.sURL + "\n"); |
| 322 | |
| 323 | const CSession* session = CheckLoggedin(Data); |
| 324 | |
| 325 | // To prevent access to non-template images, we disallow use of paths in filenames. |
| 326 | wxString imgName = "/" + wxFileName(Data.parsedURL.File()).GetFullName(); |
| 327 | CAnyImage *img = m_ImageLib.GetImage(imgName); |
| 328 | |
| 329 | // Only static images are available to visitors, in order to prevent |
| 330 | // information leakage, but still allowing images on the login page. |
| 331 | if (img && (session->m_logged_in || dynamic_cast<CFileImage*>(img))) { |
| 332 | int img_size = 0; |
| 333 | unsigned char* img_data = img->RequestData(img_size); |
| 334 | // This unicode2char is ok. |
| 335 | Data.pSocket->SendContent(unicode2char(img->GetHTTP()), img_data, img_size); |
| 336 | } else if (!session->m_logged_in) { |
| 337 | webInterface->DebugShow("**** imgrequest: failed, not logged in\n"); |
| 338 | ProcessURL(Data); |
| 339 | } else { |
| 340 | webInterface->DebugShow("**** imgrequest: failed\n"); |
| 341 | } |
| 342 | } |
| 343 | |
| 344 | // send EC request and discard output |
| 345 | void CWebServerBase::Send_Discard_V2_Request(CECPacket *request) |
no test coverage detected