Re: [hackers] [quark][PATCH] Don't erase response on http_send_error_response

2020-10-26 Thread Laslo Hunhold
On Mon, 26 Oct 2020 11:34:17 +0100 José Miguel Sánchez García wrote: Dear José, > > I also don't see a reason for the constraints you mention. Just add > > an array of group-auth-pairs to the server struct and also add a > > group-auth-pair to the req-struct that you then fill when you parse >

Re: [hackers] [quark][PATCH] Don't erase response on http_send_error_response

2020-10-26 Thread José Miguel Sánchez García
On 10/26/2020 8:34 AM, Laslo Hunhold wrote: Definitely don't make exceptions here, because erasing the entire struct is a consistency measure and being inconsistent there complicates the semantics. I'll be careful then. I also don't see a reason for the constraints you mention. Just add an

Re: [hackers] [quark][PATCH] Don't erase response on http_send_error_response

2020-10-26 Thread Laslo Hunhold
On Sun, 25 Oct 2020 11:04:26 +0100 José Miguel Sánchez García wrote: Dear José, > I'm currently relying on the req struct NOT being erased, because I'm > storing the realm the file belongs to there. Then, I'm using that > realm information to build the WWW-Authenticate header for the 401 >

Re: [hackers] [quark][PATCH] Don't erase response on http_send_error_response

2020-10-25 Thread José Miguel Sánchez García
On 10/25/2020 8:39 AM, Laslo Hunhold wrote: Dear Laslo, No, this is supposed to be like this. I agree that the comment is a bit misleading, but http_parse_header() really builds a request from scratch and first sets it all to zero. With "fields" I'm referring to the struct fields in request,

Re: [hackers] [quark][PATCH] Don't erase response on http_send_error_response

2020-10-25 Thread Laslo Hunhold
On Sat, 24 Oct 2020 16:19:13 + José Miguel Sánchez García wrote: Dear José, thanks for taking your time reading the code and reporting this! > The comment before the offending line indicated it was intended to > only erase the fields, but it erased the whole response. It was most > likely

[hackers] [quark][PATCH] Don't erase response on http_send_error_response

2020-10-24 Thread José Miguel Sánchez García
The comment before the offending line indicated it was intended to only erase the fields, but it erased the whole response. It was most likely a bug. --- http.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/http.c b/http.c index f1e15a4..27d20f7 100644 --- a/http.c +++