webcit-ng/server/static.c

   1 // Output static content
   2 //
   3 // Copyright (c) 1996-2022 by the citadel.org team
   4 //
   5 // This program is open source software.  Use, duplication, or disclosure is subject to the GNU General Public License v3.
   6
   7 #include "webcit.h"
   8
   9
  10 // Called from perform_request() to handle static content.
  11 void output_static(struct http_transaction *h) {
  12         char filename[PATH_MAX];
  13         struct stat statbuf;
  14
  15         syslog(LOG_DEBUG, "static: %s", h->url);
  16
  17         if (!strncasecmp(h->url, "/ctdl/s/", 8)) {
  18                 snprintf(filename, sizeof filename, "static/%s", &h->url[8]);
  19         }
  20         else if (!strncasecmp(h->url, "/.well-known/", 13)) {
  21                 snprintf(filename, sizeof filename, "static/.well-known/%s", &h->url[13]);
  22         }
  23         else if (!strcasecmp(h->url, "/favicon.ico")) {
  24                 snprintf(filename, sizeof filename, "static/images/favicon.ico");
  25         }
  26         else {
  27                 do_404(h);
  28                 return;
  29         }
  30
  31         if (strstr(filename, "../")) {          // 100% guaranteed attacker.
  32                 do_404(h);                      // Die in a car fire.
  33                 return;
  34         }
  35
  36         FILE *fp = fopen(filename, "r");        // Try to open the requested file.
  37         if (fp == NULL) {
  38                 syslog(LOG_DEBUG, "%s: %s", filename, strerror(errno));
  39                 do_404(h);
  40                 return;
  41         }
  42
  43         fstat(fileno(fp), &statbuf);
  44         h->response_body_length = statbuf.st_size;
  45         h->response_body = malloc(h->response_body_length);
  46         if (h->response_body != NULL) {
  47                 fread(h->response_body, h->response_body_length, 1, fp);
  48         }
  49         else {
  50                 h->response_body_length = 0;
  51         }
  52         fclose(fp);                             // Content is now in memory.
  53
  54         h->response_code = 200;
  55         h->response_string = strdup("OK");
  56         add_response_header(h, strdup("Content-type"), strdup(GuessMimeByFilename(filename, strlen(filename))));
  57
  58         char *datestring = http_datestring(statbuf.st_mtime);
  59         if (datestring) {
  60                 add_response_header(h, strdup("Last-Modified"), datestring);
  61         }
  62 }