[web]fix user access

modules/HTTP_Server/http_server.c

@@ -45,7 +45,7 @@ static err_t http_sent(void *arg, struct tcp_pcb *pcb, u16_t len);
 static err_t http_sent_history(void *arg, struct tcp_pcb *pcb, u16_t len);
 static err_t http_sent_log(void *arg, struct tcp_pcb *pcb, u16_t len);
 
-static void http_err(void * arg, err_t err);
+static void http_err(void *arg, err_t err);
 static void http_sent_log_err(void *arg, err_t err);
 static void send_data(struct tcp_pcb *pcb, struct http_state *hs);
 
@@ -158,7 +158,7 @@ web_func_handler_t process_web_funcs[] = {
 #ifdef HTTP_AUTH_ENABLE
     { "POST /login.cgi",            15,   COMMON_ANSWER,        ALL_ACCESS,   HTTP_LoginPage },
     { "GET /logout.cgi",            15,   COMMON_ANSWER,        TIME_ACCESS,  HTTP_LogoutPage },
-    { "GET /changepwd.cgi",         18,   COMMON_ANSWER,        TIME_ACCESS,  HTTP_ChangeUserPwd }, 
+    { "GET /changepwd.cgi",         18,   COMMON_ANSWER,        TIME_ACCESS,  HTTP_ChangeUserPwd },
 #endif
     { "GET /getJson.cgi",           16,   COMMON_ANSWER,        TIME_ACCESS,  HTTP_GetParamsPage },
     { "GET /settings.cgi",          17,   COMMON_ANSWER,        TIME_ACCESS,  HTTP_GetSettingsPage },
@@ -175,7 +175,7 @@ web_func_handler_t process_web_funcs[] = {
     { "GET /ups_power.cgi",         18,   COMMON_ANSWER,        TIME_ACCESS,  HTTP_UPSshutdown },
     { "GET /reboot.cgi",            15,   COMMON_ANSWER,        TIME_ACCESS,  HTTP_Reboot },
     { "GET /confirm.cgi",           16,   COMMON_ANSWER,        TIME_ACCESS,  HTTP_Confirm },
-    { "GET /fw_update.cgi",         18,   COMMON_ANSWER,        TIME_ACCESS,  HTTP_ConfirmBootPwd }, 
+    { "GET /fw_update.cgi",         18,   COMMON_ANSWER,        TIME_ACCESS,  HTTP_ConfirmBootPwd },
     { "GET",                        3,    COMMON_ANSWER,        ALL_ACCESS,   HTTP_GetRequest },
     { "",                           0,    COMMON_ANSWER,        ALL_ACCESS,   HTTP_NoFound },
     { "", 0, 0, 0, NULL }
@@ -703,7 +703,7 @@ void HTTP_Init()
 #endif
 }
 
-char* HTTP_HistoryPage(uint32_t reqNum, char *bufIn, char *bufOut, uint16_t lenBufIn, uint16_t *lenBufOut)
+char *HTTP_HistoryPage(uint32_t reqNum, char *bufIn, char *bufOut, uint16_t lenBufIn, uint16_t *lenBufOut)
 {
     uint8_t i, valueLen = 0;
     char value[20];
@@ -753,7 +753,7 @@ char* HTTP_HistoryPage(uint32_t reqNum, char *bufIn, char *bufOut, uint16_t lenB
     }
 }
 
-char* HTTP_UpsHistoryPage(uint32_t reqNum, char *bufIn, char *bufOut, uint16_t lenBufIn, uint16_t *lenBufOut)
+char *HTTP_UpsHistoryPage(uint32_t reqNum, char *bufIn, char *bufOut, uint16_t lenBufIn, uint16_t *lenBufOut)
 {
     uint8_t i, valueLen = 0;
     char value[20];
@@ -847,7 +847,7 @@ char *HTTP_SetSettingsPage(uint32_t reqNum, char *bufIn, char *bufOut, uint16_t
     (void)reqNum;
 
     if (seclevel == USER) {
-      return 0;
+        return 0;
     }
 
     DataOffset = 0;
@@ -1163,6 +1163,10 @@ char *HTTP_SnmpParam(uint32_t reqNum, char *bufIn, char *bufOut, uint16_t lenBuf
     }
     /* В запросе есть параметры, нужно парсить и сохранять настройки */
     else {
+
+        if (seclevel == USER) {
+            return 0;
+        }
         HTTP_SetNotification(bufIn, lenBufIn);
 
         fs_open("/snmp.html", &file);
@@ -1224,7 +1228,7 @@ char *HTTP_SetInfoPage(uint32_t reqNum, char *bufIn, char *bufOut, uint16_t lenB
     (void)reqNum;
 
     if (seclevel == USER) {
-      return 0;
+        return 0;
     }
 
     DataOffset = 0;
@@ -1324,104 +1328,107 @@ void HTTP_SetInfo(char *buf, uint16_t lenBuf)
     HTTP_SaveSettings();
 }
 
-char* HTTP_Reset(uint32_t reqNum, char *bufIn, char *bufOut, uint16_t lenBufIn, uint16_t *lenBufOut)
+char *HTTP_Reset(uint32_t reqNum, char *bufIn, char *bufOut, uint16_t lenBufIn, uint16_t *lenBufOut)
 {
-  (void)bufIn;
-	(void)bufOut;
-	(void)lenBufIn;
-  (void)reqNum;
+    (void)bufIn;
+    (void)bufOut;
+    (void)lenBufIn;
+    (void)reqNum;
 
-  telnet_act = false;
+    if (seclevel == USER) {
+      return 0;
+    }
 
-  HTTP_ResetSettings();
-        HTTP_SaveSettings();
+    telnet_act = false;
 
-	fs_open("/settings.html", &file);
-	*lenBufOut = file.len;
-	return file.data;
+    HTTP_ResetSettings();
+    HTTP_SaveSettings();
+
+    fs_open("/settings.html", &file);
+    *lenBufOut = file.len;
+    return file.data;
 }
 
-char* HTTP_Confirm(uint32_t reqNum, char *bufIn, char *bufOut, uint16_t lenBufIn, uint16_t *lenBufOut)
+char *HTTP_Confirm(uint32_t reqNum, char *bufIn, char *bufOut, uint16_t lenBufIn, uint16_t *lenBufOut)
 {
-	(void)bufIn;
-	(void)bufOut;
-	(void)lenBufIn;
-  (void)reqNum;
+    (void)bufIn;
+    (void)bufOut;
+    (void)lenBufIn;
+    (void)reqNum;
 
-  telnet_act = false;
+    telnet_act = false;
 
-	SetWebReinitFlag(false);
-	SetConfirmWebParamsFlag();
+    SetWebReinitFlag(false);
+    SetConfirmWebParamsFlag();
 
-	fs_open("/index.html", &file);
-	*lenBufOut = file.len;
-	return file.data;
+    fs_open("/index.html", &file);
+    *lenBufOut = file.len;
+    return file.data;
 }
 
-char* HTTP_GetRequest(uint32_t reqNum, char *bufIn, char *bufOut, uint16_t lenBufIn, uint16_t *lenBufOut)
+char *HTTP_GetRequest(uint32_t reqNum, char *bufIn, char *bufOut, uint16_t lenBufIn, uint16_t *lenBufOut)
 {
-	(void)bufOut;
-  (void)reqNum;
+    (void)bufOut;
+    (void)reqNum;
 #ifdef HTTP_AUTH_ENABLE
-  const char* html_page_name[] = {
-    "/main.css",
-    "/rotek.png",
-    "/favicon.ico",
-    "/role.js"
-  };
+    const char *html_page_name[] = {
+        "/main.css",
+        "/rotek.png",
+        "/favicon.ico",
+        "/role.js"
+    };
 #endif
-	char filename[MAX_FILENAME_LEN];
-  char nonmatch[MAX_ETAG_LEN];
-  char *pnonmatch = NULL;
-  uint8_t len;
-
-  memset(filename, 0, MAX_FILENAME_LEN);
-  if (GetFileName(bufIn, filename, &len)) {
-    /* Parce If-Non_Match value */
-#ifdef HTTP_AUTH_ENABLE    
-    if(!Authenticated){
-      for(uint8_t i = 0; i < 4; i ++){
-        if(strcmp(filename, html_page_name[i]) == 0){
-          break;
-        }
-        if(i == 3){
-          strcpy(filename, "/login.html");
+    char filename[MAX_FILENAME_LEN];
+    char nonmatch[MAX_ETAG_LEN];
+    char *pnonmatch = NULL;
+    uint8_t len;
+
+    memset(filename, 0, MAX_FILENAME_LEN);
+    if (GetFileName(bufIn, filename, &len)) {
+        /* Parce If-Non_Match value */
+#ifdef HTTP_AUTH_ENABLE
+        if (!Authenticated) {
+            for (uint8_t i = 0; i < 4; i ++) {
+                if (strcmp(filename, html_page_name[i]) == 0) {
+                    break;
+                }
+                if (i == 3) {
+                    strcpy(filename, "/login.html");
+                }
+            }
+        } else {
+            HTTP_UpdateUserLoginTime(user_id);
         }
-      }
-    }
-    else{
-      HTTP_UpdateUserLoginTime(user_id);
-    }
 #endif
-    uint8_t nonmatch_len = Parse_Header(bufIn, lenBufIn, lenBufIn, 15, nonmatch);
-    if (nonmatch_len < MAX_ETAG_LEN && nonmatch_len > 0) {
-      //DBG printf("If_None_Match: %s\r\n", nonmatch);
-      pnonmatch = nonmatch;
+        uint8_t nonmatch_len = Parse_Header(bufIn, lenBufIn, lenBufIn, 15, nonmatch);
+        if (nonmatch_len < MAX_ETAG_LEN && nonmatch_len > 0) {
+            //DBG printf("If_None_Match: %s\r\n", nonmatch);
+            pnonmatch = nonmatch;
+        }
+        return send_file(filename, pnonmatch, &file, lenBufOut);
     }
-    return send_file(filename, pnonmatch, &file, lenBufOut);
-  }
-  return 0;
+    return 0;
 }
 
-char* HTTP_NoFound(uint32_t reqNum, char *bufIn, char *bufOut, uint16_t lenBufIn, uint16_t *lenBufOut)
+char *HTTP_NoFound(uint32_t reqNum, char *bufIn, char *bufOut, uint16_t lenBufIn, uint16_t *lenBufOut)
 {
-	(void)bufIn;
-	(void)bufOut;
-	(void)lenBufIn;
-  (void)reqNum;
+    (void)bufIn;
+    (void)bufOut;
+    (void)lenBufIn;
+    (void)reqNum;
 #ifdef HTTP_AUTH_ENABLE
-  HTTP_UpdateUserLoginTime(user_id);
+    HTTP_UpdateUserLoginTime(user_id);
 #endif
-	fs_open("/index.html", &file); // +
-	*lenBufOut = file.len;
-	return file.data;
+    fs_open("/index.html", &file); // +
+    *lenBufOut = file.len;
+    return file.data;
 }
 
 
 /**
   * @brief  Запуск/останов теста UPS
   */
-char* HTTP_UPSTest(uint32_t reqNum, char *bufIn, char *bufOut, uint16_t lenBufIn, uint16_t *lenBufOut)
+char *HTTP_UPSTest(uint32_t reqNum, char *bufIn, char *bufOut, uint16_t lenBufIn, uint16_t *lenBufOut)
 {
     uint8_t valueLen = 0;
     char tempValue[20];
@@ -1432,6 +1439,10 @@ char* HTTP_UPSTest(uint32_t reqNum, char *bufIn, char *bufOut, uint16_t lenBufIn
     (void)lenBufIn;
     (void)reqNum;
 
+    if (seclevel == USER) {
+      return 0;
+    }
+
     memset(tempValue, 0, 20);
     memset(tempValue2, 0, 20);
     memset(log_string, 0, 50);
@@ -1483,7 +1494,7 @@ char* HTTP_UPSTest(uint32_t reqNum, char *bufIn, char *bufOut, uint16_t lenBufIn
 /**
   * @brief  Выклюение UPS
   */
-char* HTTP_UPSshutdown(uint32_t reqNum, char *bufIn, char *bufOut, uint16_t lenBufIn, uint16_t *lenBufOut)
+char *HTTP_UPSshutdown(uint32_t reqNum, char *bufIn, char *bufOut, uint16_t lenBufIn, uint16_t *lenBufOut)
 {
     uint8_t valueLen = 0;
     char *valueLenEnd = 0;
@@ -1495,6 +1506,10 @@ char* HTTP_UPSshutdown(uint32_t reqNum, char *bufIn, char *bufOut, uint16_t lenB
     (void)lenBufIn;
     (void)reqNum;
 
+    if (seclevel == USER) {
+      return 0;
+    }
+
     memset(tempValue, 0, 50);
     memset(log_string, 0, 50);
 
@@ -1521,7 +1536,7 @@ char* HTTP_UPSshutdown(uint32_t reqNum, char *bufIn, char *bufOut, uint16_t lenB
             log_event_data(LOG_SHUTDOWN_UPS, name_login);
         } else {
             strcat(bufOut, "Отключение нагрузки ИБП не удалось!");
-        }   
+        }
     }
     *lenBufOut = strlen(bufOut);
 
@@ -1532,12 +1547,16 @@ char* HTTP_UPSshutdown(uint32_t reqNum, char *bufIn, char *bufOut, uint16_t lenB
   * @brief  Проверка пароля для перехода в режим bootloader
   * @retval None
   */
-char* HTTP_ConfirmBootPwd(uint32_t reqNum, char *bufIn, char *bufOut, uint16_t lenBufIn, uint16_t *lenBufOut)
+char *HTTP_ConfirmBootPwd(uint32_t reqNum, char *bufIn, char *bufOut, uint16_t lenBufIn, uint16_t *lenBufOut)
 {
     (void)bufIn;
     (void)lenBufIn;
     (void)reqNum;
 
+    if (seclevel == USER) {
+      return 0;
+    }
+
     strcpy(bufOut, HTTP_200_OK);
     *lenBufOut = strlen(bufOut);
 
@@ -1629,7 +1648,7 @@ int HTTP_ConfirmWebPwd(char *bufIn, char *bufOut, uint16_t lenBufIn, uint16_t *l
         strcat(bufOut, login);
         strcat(bufOut, "\r\nSet-Cookie: id=");
         strcat(bufOut, tempStr);
-        sprintf(tempStr, "%d", user_id);
+        sprintf(tempStr, "%d", (user_id + 1));
         strcat(bufOut, "\r\nSet-Cookie: role=");
         strcat(bufOut, tempStr);
         strcat(bufOut, "\r\nSet-Cookie: auth=1");
@@ -1740,6 +1759,10 @@ char *HTTP_ChangeUserPwd(uint32_t reqNum, char *bufIn, char *bufOut, uint16_t le
     (void)reqNum;
     (void)lenBufIn;
 
+    if (seclevel == USER) {
+      return 0;
+    }
+
     memset(login, 0, sizeof(login));
     memset(password, 0, sizeof(password));
     memset(tempStr, 0, sizeof(tempStr));