Merge remote-tracking branch 'upstream/dev' into dev

code/espurna/config/defaults.h

@@ -556,9 +556,13 @@
 // General
 // -----------------------------------------------------------------------------
 
-// Default hostname will be ESPURNA-XXXXXX, where XXXXXX is last 3 octets of chipID
+// Device name (DNS, SoftAP SSID, ALEXA etc.)
+// If empty, default will be ESPURNA-XXXXXX, where XXXXXX is last 3 octets of chipID
+// When set, must be 1..31 characters. See:
+// https://github.com/xoseperez/espurna/issues/921
+// https://github.com/xoseperez/espurna/issues/1151
 #ifndef HOSTNAME
-#define HOSTNAME ""
+#define HOSTNAME                ""
 #endif
 
 // Relay providers

code/espurna/config/general.h

@@ -9,8 +9,11 @@
 
 #define DEVICE_NAME             MANUFACTURER "_" DEVICE     // Concatenate both to get a unique device name
 
+// When defined, ADMIN_PASS must be 8..63 printable ASCII characters. See:
+// https://en.wikipedia.org/wiki/Wi-Fi_Protected_Access#Target_users_(authentication_key_distribution)
+// https://github.com/xoseperez/espurna/issues/1151
 #ifndef ADMIN_PASS
-#define ADMIN_PASS              "fibonacci"     // Default password (WEB, OTA, WIFI)
+#define ADMIN_PASS              "fibonacci"     // Default password (WEB, OTA, WIFI SoftAP)
 #endif
 
 #ifndef USE_PASSWORD

code/espurna/config/prototypes.h

@@ -31,6 +31,9 @@ extern "C" {
 // -----------------------------------------------------------------------------
 void debugSend(const char * format, ...);
 void debugSend_P(PGM_P format, ...);
+extern "C" {
+     void custom_crash_callback(struct rst_info*, uint32_t, uint32_t);
+}
 
 // -----------------------------------------------------------------------------
 // Domoticz

code/espurna/ota.ino

@@ -16,7 +16,7 @@ void _otaConfigure() {
     ArduinoOTA.setPort(OTA_PORT);
     ArduinoOTA.setHostname(getSetting("hostname").c_str());
     #if USE_PASSWORD
-        ArduinoOTA.setPassword(getSetting("adminPass", ADMIN_PASS).c_str());
+        ArduinoOTA.setPassword(getAdminPass().c_str());
     #endif
 }
 

code/espurna/telnet.ino

@@ -14,6 +14,7 @@ Parts of the code have been borrowed from Thomas Sarlandie's NetServer
 
 AsyncServer * _telnetServer;
 AsyncClient * _telnetClients[TELNET_MAX_CLIENTS];
+bool _authenticated[TELNET_MAX_CLIENTS];
 bool _telnetFirst = true;
 
 // -----------------------------------------------------------------------------
@@ -51,11 +52,20 @@ bool _telnetWrite(unsigned char clientId, void *data, size_t len) {
 unsigned char _telnetWrite(void *data, size_t len) {
     unsigned char count = 0;
     for (unsigned char i = 0; i < TELNET_MAX_CLIENTS; i++) {
-        if (_telnetWrite(i, data, len)) ++count;
+
+        // Do not send broadcast messages to unauthenticated clients
+        if (_authenticated[i]) {
+            if (_telnetWrite(i, data, len)) ++count;
+        }
+
     }
     return count;
 }
 
+bool _telnetWrite(unsigned char clientId, const char * message) {
+    _telnetWrite(clientId, (void *) message, strlen(message));
+}
+
 void _telnetData(unsigned char clientId, void *data, size_t len) {
 
     // Skip first message since it's always garbage
@@ -80,7 +90,20 @@ void _telnetData(unsigned char clientId, void *data, size_t len) {
         return;
     }
 
-    // Inject into Embedis stream
+    // Password
+    if (!_authenticated[clientId]) {
+        String password = getAdminPass();
+        if (strncmp(p, password.c_str(), password.length()) == 0) {
+            DEBUG_MSG_P(PSTR("[TELNET] Client #%d authenticated\n"), clientId);
+            _telnetWrite(clientId, "Welcome!\n");
+            _authenticated[clientId] = true;
+        } else {
+            _telnetWrite(clientId, "Password: ");
+        }
+        return;
+    }
+
+    // Inject command
     settingsInject(data, len);
 
 }
@@ -109,6 +132,7 @@ void _telnetNewClient(AsyncClient *client) {
     }
 
     for (unsigned char i = 0; i < TELNET_MAX_CLIENTS; i++) {
+
         if (!_telnetClients[i] || !_telnetClients[i]->connected()) {
 
             _telnetClients[i] = client;
@@ -144,6 +168,8 @@ void _telnetNewClient(AsyncClient *client) {
             #endif
 
             _telnetFirst = true;
+            _authenticated[i] = false;
+            _telnetWrite(i, "Password: ");
             wifiReconnectCheck();
             return;
 

code/espurna/utils.ino

@@ -33,6 +33,10 @@ String getBoardName() {
     return getSetting("boardName", DEVICE_NAME);
 }
 
+String getAdminPass() {
+    return getSetting("adminPass", ADMIN_PASS);
+}
+
 String getCoreVersion() {
     String version = ESP.getCoreVersion();
     #ifdef ARDUINO_ESP8266_RELEASE

code/espurna/web.ino

@@ -347,7 +347,7 @@ void _onRequest(AsyncWebServerRequest *request){
 
 bool webAuthenticate(AsyncWebServerRequest *request) {
     #if USE_PASSWORD
-        String password = getSetting("adminPass", ADMIN_PASS);
+        String password = getAdminPass();
         char httpPassword[password.length() + 1];
         password.toCharArray(httpPassword, password.length() + 1);
         return request->authenticate(WEB_USERNAME, httpPassword);
@@ -422,7 +422,7 @@ void webSetup() {
     #else
         _server->begin();
     #endif
-    
+
     DEBUG_MSG_P(PSTR("[WEBSERVER] Webserver running on port %u\n"), port);
 
 }

code/espurna/wifi.ino

@@ -34,7 +34,7 @@ void _wifiConfigure() {
 
     jw.setHostname(getSetting("hostname").c_str());
     #if USE_PASSWORD
-        jw.setSoftAP(getSetting("hostname").c_str(), getSetting("adminPass", ADMIN_PASS).c_str());
+        jw.setSoftAP(getSetting("hostname").c_str(), getAdminPass().c_str());
     #else
         jw.setSoftAP(getSetting("hostname").c_str());
     #endif
@@ -489,7 +489,7 @@ void wifiDebug(WiFiMode_t modes) {
     if (((modes & WIFI_AP) > 0) && ((WiFi.getMode() & WIFI_AP) > 0)) {
         DEBUG_MSG_P(PSTR("[WIFI] -------------------------------------- MODE AP\n"));
         DEBUG_MSG_P(PSTR("[WIFI] SSID  %s\n"), getSetting("hostname").c_str());
-        DEBUG_MSG_P(PSTR("[WIFI] PASS  %s\n"), getSetting("adminPass", ADMIN_PASS).c_str());
+        DEBUG_MSG_P(PSTR("[WIFI] PASS  %s\n"), getAdminPass().c_str());
         DEBUG_MSG_P(PSTR("[WIFI] IP    %s\n"), WiFi.softAPIP().toString().c_str());
         DEBUG_MSG_P(PSTR("[WIFI] MAC   %s\n"), WiFi.softAPmacAddress().c_str());
         footer = true;

code/espurna/ws.ino

@@ -302,8 +302,7 @@ bool _wsOnReceive(const char * key, JsonVariant& value) {
 void _wsOnStart(JsonObject& root) {
 
     #if USE_PASSWORD && WEB_FORCE_PASS_CHANGE
-        String adminPass = getSetting("adminPass", ADMIN_PASS);
-        bool changePassword = adminPass.equals(ADMIN_PASS);
+        bool changePassword = getAdminPass().equals(ADMIN_PASS);
     #else
         bool changePassword = false;
     #endif

code/html/custom.js

@@ -150,13 +150,17 @@ function validateForm(form) {
 
     // http://www.the-art-of-web.com/javascript/validate-password/
     // at least one lowercase and one uppercase letter or number
-    // at least five characters (letters, numbers or special characters)
-    var re_password = /^(?=.*[A-Z\d])(?=.*[a-z])[\w~!@#$%^&*\(\)<>,.\?;:{}\[\]\\|]{5,}$/;
+    // at least eight characters (letters, numbers or special characters)
+
+    // MUST be 8..63 printable ASCII characters. See:
+    // https://en.wikipedia.org/wiki/Wi-Fi_Protected_Access#Target_users_(authentication_key_distribution)
+    // https://github.com/xoseperez/espurna/issues/1151
+    var re_password = /^(?=.*[A-Z\d])(?=.*[a-z])[\w~!@#$%^&*\(\)<>,.\?;:{}\[\]\\|]{8,63}$/;
 
     // password
     var adminPass1 = $("input[name='adminPass']", form).first().val();
     if (adminPass1.length > 0 && !re_password.test(adminPass1)) {
-        alert("The password you have entered is not valid, it must have at least 5 characters, 1 lowercase and 1 uppercase or number!");
+        alert("The password you have entered is not valid, it must be 8..63 characters and have at least 1 lowercase and 1 uppercase / number!");
         return false;
     }
 
@@ -173,9 +177,9 @@ function validateForm(form) {
     // No other symbols, punctuation characters, or blank spaces are permitted.
 
     // Negative lookbehind does not work in Javascript
-    // var re_hostname = new RegExp('^(?!-)[A-Za-z0-9-]{1,32}(?<!-)$');
+    // var re_hostname = new RegExp('^(?!-)[A-Za-z0-9-]{1,31}(?<!-)$');
 
-    var re_hostname = new RegExp('^(?!-)[A-Za-z0-9-]{0,31}[A-Za-z0-9]$');
+    var re_hostname = new RegExp('^(?!-)[A-Za-z0-9-]{0,30}[A-Za-z0-9]$');
 
     var hostname = $("input[name='hostname']", form);
     var hasChanged = hostname.attr("hasChanged") || 0;

code/html/index.html

@@ -43,11 +43,11 @@
 
                                 <div class="pure-g">
                                     <label class="pure-u-1 pure-u-lg-1-4">Admin password</label>
-                                    <input name="adminPass" class="pure-u-1 pure-u-lg-3-4" type="password" tabindex="1" autocomplete="false" />
+                                    <input name="adminPass" class="pure-u-1 pure-u-lg-3-4" maxlength="63" type="password" tabindex="1" autocomplete="false" />
                                     <div class="pure-u-0 pure-u-lg-1-4"></div>
                                     <div class="pure-u-1 pure-u-lg-3-4 hint">
                                         The administrator password is used to access this web interface (user 'admin'), but also to connect to the device when in AP mode or to flash a new firmware over-the-air (OTA).<br />
-                                        It must have at least <strong>five characters</strong> (numbers and letters and any of these special characters: _,.;:~!?@#$%^&amp;*&lt;&gt;\|(){}[]) and at least <strong>one lowercase</strong> and <strong>one uppercase</strong> or <strong>one number</strong>.</div>
+                                        It must be <strong>8..63 characters</strong> (numbers and letters and any of these special characters: _,.;:~!?@#$%^&amp;*&lt;&gt;\|(){}[]) and have at least <strong>one lowercase</strong> and <strong>one uppercase</strong> or <strong>one number</strong>.</div>
                                 </div>
 
                                 <div class="pure-g">
@@ -323,7 +323,7 @@
 
                                 <div class="pure-g">
                                     <label class="pure-u-1 pure-u-lg-1-4">Hostname</label>
-                                    <input name="hostname" class="pure-u-1 pure-u-lg-1-4"  maxlength="32" type="text" action="reboot" tabindex="1" />
+                                    <input name="hostname" class="pure-u-1 pure-u-lg-1-4"  maxlength="31" type="text" action="reboot" tabindex="1" />
                                     <div class="pure-u-0 pure-u-lg-1-2"></div>
                                     <div class="pure-u-0 pure-u-lg-1-4"></div>
                                     <div class="pure-u-1 pure-u-lg-3-4 hint">
@@ -522,16 +522,16 @@
 
                                 <div class="pure-g">
                                     <label class="pure-u-1 pure-u-lg-1-4">Admin password</label>
-                                    <input name="adminPass" class="pure-u-1 pure-u-lg-3-4" type="password" action="reboot" tabindex="11" autocomplete="false" />
+                                    <input name="adminPass" class="pure-u-1 pure-u-lg-3-4" maxlength="63" type="password" action="reboot" tabindex="11" autocomplete="false" />
                                     <div class="pure-u-0 pure-u-lg-1-4"></div>
                                     <div class="pure-u-1 pure-u-lg-3-4 hint">
                                         The administrator password is used to access this web interface (user 'admin'), but also to connect to the device when in AP mode or to flash a new firmware over-the-air (OTA).<br />
-                                        It must have at least <strong>five characters</strong> (numbers and letters and any of these special characters: _,.;:~!?@#$%^&amp;*&lt;&gt;\|(){}[]) and at least <strong>one lowercase</strong> and <strong>one uppercase</strong> or <strong>one number</strong>.</div>
+                                        It must be <strong>8..63 characters</strong> (numbers and letters and any of these special characters: _,.;:~!?@#$%^&amp;*&lt;&gt;\|(){}[]) and have at least <strong>one lowercase</strong> and <strong>one uppercase</strong> or <strong>one number</strong>.</div>
                                 </div>
 
                                 <div class="pure-g">
                                     <label class="pure-u-1 pure-u-lg-1-4">Repeat password</label>
-                                    <input name="adminPass" class="pure-u-1 pure-u-lg-3-4" type="password" action="reboot" tabindex="12" autocomplete="false" />
+                                    <input name="adminPass" class="pure-u-1 pure-u-lg-3-4" maxlength="63" type="password" action="reboot" tabindex="12" autocomplete="false" />
                                 </div>
 
                                 <div class="pure-g">