[Web Login] Fix file access with password set (#3759 )

Fixes: #3759

src/ESPEasy-Globals.cpp

@@ -27,6 +27,7 @@ float vcc = -1.0f;
 
 boolean WebLoggedIn = false;
 int WebLoggedInTimer = 300;
+IPAddress WebLoggedInClientIP;
 
 
 String dummyString;  // FIXME @TD-er  This may take a lot of memory over time, since long-lived Strings only tend to grow.

src/ESPEasy-Globals.h

@@ -94,6 +94,7 @@ extern float vcc;
 
 extern boolean WebLoggedIn;
 extern int WebLoggedInTimer;
+extern IPAddress WebLoggedInClientIP;
 
 
 extern String dummyString;  // FIXME @TD-er  This may take a lot of memory over time, since long-lived Strings only tend to grow.

src/src/Helpers/PeriodicalActions.cpp

@@ -176,8 +176,10 @@ void runOncePerSecond()
   {
     if (WebLoggedIn)
       WebLoggedInTimer++;
-    if (WebLoggedInTimer > 300)
+    if (WebLoggedInTimer > 300) {
       WebLoggedIn = false;
+      WebLoggedInClientIP = IPAddress();
+    }
   }
 
   // I2C Watchdog feed

src/src/WebServer/LoadFromFS.cpp

@@ -29,10 +29,16 @@ bool loadFromFS(boolean spiffs, String path) {
   String dataType = F("text/plain");
   bool mustCheckCredentials = false;
 
+  const int questionmarkPos = path.indexOf('?');
+  if (questionmarkPos >= 0) {
+    path = path.substring(0, questionmarkPos);
+  }
+
   if (!path.startsWith(F("/"))) {
     path = String(F("/")) + path;
   }
 
+
   if (path.endsWith(F("/"))) { path += F("index.htm"); }
 
   if (path.endsWith(F(".src"))) { path = path.substring(0, path.lastIndexOf(".")); }
@@ -55,6 +61,9 @@ bool loadFromFS(boolean spiffs, String path) {
     return handle_custom(path); 
   }
 #endif
+  else {
+    mustCheckCredentials = true;
+  }
 
   if (mustCheckCredentials) {
     if (!isLoggedIn()) { return false; }

src/src/WebServer/WebServer.cpp

@@ -974,38 +974,43 @@ void addTaskValueSelect(const String& name, int choice, taskIndex_t TaskIndex)
 // ********************************************************************************
 bool isLoggedIn(bool mustProvideLogin)
 {
-  String www_username = F(DEFAULT_ADMIN_USERNAME);
-
   if (!clientIPallowed()) { return false; }
 
   if (SecuritySettings.Password[0] == 0) { return true; }
 
-  if (!mustProvideLogin) {
-    return false;
+  if (WebLoggedIn && WebLoggedInClientIP == web_server.client().remoteIP()) {
+    WebLoggedInTimer = 0;
+    return true;
   }
-  if (!web_server.authenticate(www_username.c_str(), SecuritySettings.Password))
-
-  // Basic Auth Method with Custom realm and Failure Response
-  // return server.requestAuthentication(BASIC_AUTH, www_realm, authFailResponse);
-  // Digest Auth Method with realm="Login Required" and empty Failure Response
-  // return server.requestAuthentication(DIGEST_AUTH);
-  // Digest Auth Method with Custom realm and empty Failure Response
-  // return server.requestAuthentication(DIGEST_AUTH, www_realm);
-  // Digest Auth Method with Custom realm and Failure Response
   {
+    String www_username = F(DEFAULT_ADMIN_USERNAME);
+    if (!web_server.authenticate(www_username.c_str(), SecuritySettings.Password))
+
+    // Basic Auth Method with Custom realm and Failure Response
+    // return server.requestAuthentication(BASIC_AUTH, www_realm, authFailResponse);
+    // Digest Auth Method with realm="Login Required" and empty Failure Response
+    // return server.requestAuthentication(DIGEST_AUTH);
+    // Digest Auth Method with Custom realm and empty Failure Response
+    // return server.requestAuthentication(DIGEST_AUTH, www_realm);
+    // Digest Auth Method with Custom realm and Failure Response
+    {
 #ifdef CORE_PRE_2_5_0
 
-    // See https://github.com/esp8266/Arduino/issues/4717
-    HTTPAuthMethod mode = BASIC_AUTH;
+      // See https://github.com/esp8266/Arduino/issues/4717
+      HTTPAuthMethod mode = BASIC_AUTH;
 #else // ifdef CORE_PRE_2_5_0
-    HTTPAuthMethod mode = DIGEST_AUTH;
+      HTTPAuthMethod mode = DIGEST_AUTH;
 #endif // ifdef CORE_PRE_2_5_0
-    String message = F("Login Required (default user: ");
-    message += www_username;
-    message += ')';
-    web_server.requestAuthentication(mode, message.c_str());
-    return false;
+      String message = F("Login Required (default user: ");
+      message += www_username;
+      message += ')';
+      web_server.requestAuthentication(mode, message.c_str());
+      return false;
+    }
   }
+  WebLoggedIn      = true;
+  WebLoggedInTimer = 0;
+  WebLoggedInClientIP = web_server.client().remoteIP();
   return true;
 }
 

src/src/WebServer/login.cpp

@@ -55,6 +55,7 @@ void handle_login() {
     {
       WebLoggedIn      = true;
       WebLoggedInTimer = 0;
+      WebLoggedInClientIP = web_server.client().remoteIP();
       addHtml(F("<script>window.location = '.'</script>"));
     }
     else