|
|
bfcb2463c3
|
Harden web UI auth, input handling, and SD path validation
- Add optional Basic Auth with NVS-backed credentials and STA/AP flags; protect status, wifi, history, and download routes
- Stop pre-filling WiFi/MQTT/Web UI password fields; keep stored secrets on blank and add clear-password checkboxes
- Add HTML escaping + URL encoding helpers and apply to user-controlled strings; add unit test
- Harden /sd/download path validation (prefix, length, dotdot, slashes) and log rejections
- Enforce protocol version in LoRa receive and release GPIO14 before SD init
- Update README security, SD, and GPIO sharing notes
|
2026-02-13 23:56:36 +01:00 |
|
