- if (TheSession == NULL) {
- lprintf(3, "Creating a new session\n");
- TheSession = (wcsession *)
- malloc(sizeof(wcsession));
- memset(TheSession, 0, sizeof(wcsession));
- TheSession->Hdr = Hdr;
- TheSession->SessionKey = Hdr->HR.SessionKey;
- TheSession->serv_sock = (-1);
- TheSession->chat_sock = (-1);
-
- /* If we're recreating a session that expired, it's best to give it the same
- * session number that it had before. The client browser ought to pick up
- * the new session number and start using it, but in some rare situations it
- * doesn't, and that's a Bad Thing because it causes lots of spurious sessions
- * to get created.
- */
- if (Hdr->HR.desired_session == 0) {
- TheSession->wc_session = GenerateSessionID();
- }
- else {
- TheSession->wc_session = Hdr->HR.desired_session;
- }
-
- pthread_setspecific(MyConKey, (void *)TheSession);
- session_new_modules(TheSession);
-
- pthread_mutex_init(&TheSession->SessionMutex, NULL);
- pthread_mutex_lock(&SessionListMutex);
- TheSession->nonce = rand();
- TheSession->next = SessionList;
- TheSession->is_mobile = -1;
- SessionList = TheSession;
- pthread_mutex_unlock(&SessionListMutex);
-
- if (StrLength(Hdr->c_language) > 0) {
- lprintf(9, "Session cookie requests language '%s'\n", ChrPtr(Hdr->c_language));
- set_selected_language(ChrPtr(Hdr->c_language));
- go_selected_language();
- }
+ if ( (StrLength(Hdr->c_username) == 0)
+ && (!Hdr->HR.DontNeedAuth)
+ && (Hdr->HR.Handler != NULL)
+ && ((XHTTP_COMMANDS & Hdr->HR.Handler->Flags) == XHTTP_COMMANDS)
+ ) {
+ syslog(LOG_DEBUG, "http-auth required but not provided");
+ OverrideRequest(Hdr, HKEY("GET /401 HTTP/1.0"));
+ Hdr->HR.prohibit_caching = 1;