server.arg() returns a String by value, so the pointer from c_str()
pointed into a temporary that was destroyed before strlen()/strcpy().
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
handleWI() dispatches internally on the "scan" query arg, so the same
handler serves both the scan link and the save form. #2037 narrowed the
route to POST-only, which orphaned the scan hyperlink (a GET) in
config_WebContent.h. Re-register /wi for HTTP_GET alongside HTTP_POST;
the credential Save form stays method=post, so no secrets move to GET.
Co-authored-by: Florian <1technophile@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Follow-up to #2321. That PR fixed five strcpy sites in XtoSYS/createOrUpdateDevice
but left adjacent attack surfaces using the same pattern (strncpy with the
destination's own size, leaving the buffer non-NUL-terminated when the source
is at the limit; or strcpy of WiFiManager/HTTP form values that bypass the
client-side maxlength). The over-long string then flows into saveConfig() and
back into a strcpy on next boot, corrupting heap/.bss on every reload.
main/main.cpp - XtoSYS: length-check before copying mqtt_topic, discovery_prefix,
gateway_name, gw_pass (ota_pass), and ble_aes. Reject over-length with
THEENGS_LOG_WARNING, preserving existing values.
main/main.cpp - loadConfigFromFlash: new loadStrField() helper applies the same
guard to every SPIFFS-loaded string (mqtt_server/port/user/pass per slot,
mqtt_topic, discovery_prefix, gateway_name, ota_pass, ble_aes). Defense in
depth in case a pre-fix build left an over-length value in /config.json.
main/main.cpp - WiFiManager save: bound mqtt_topic against the 150-byte portal
buffer overflowing the 66-byte destination (HTML maxlength is client-side
only; a raw POST bypasses it).
main/webUI.cpp - handleCG /gw save: bound gateway-password form input before
the strncpy that previously left ota_pass non-NUL-terminated.
main/blufi.cpp - ESP_BLUFI_EVENT_RECV_STA_SSID/PASSWD: clamp the wire-supplied
ssid_len/passwd_len before the memcpy and the trailing NUL so a crafted
BluFi provisioning frame cannot overrun gl_sta_ssid[32]/gl_sta_passwd[64].
main/gatewayBT.cpp - BLEDecryptor (Victron, encr==3): remove `nonce[16] = {0}`,
a one-byte stack-OOB write reachable from any BLE adv. The line was dead
(the memset two lines later zeroes the whole array); deleting it eliminates
the OOB write.
main/gatewaySRFB.cpp - SRFBtoX: bound the _uartbuf writer so a 433 MHz frame
with no STOP can no longer let _uartpos grow past sizeof(_uartbuf).
main/gatewaySRFB.cpp - _rfbSend: the hex output buffer was sized RF_MESSAGE_SIZE
(9) but _rawToHex writes 2*N+2 bytes per call. Resize to fit.
Tested on a Theengs Bridge: built theengs-bridge-v11 env, OTA-flashed, and
verified that publishing {"discovery_prefix":"Z"*200} to MQTTtoSYS/config
leaves discovery_prefix unchanged (no Z*65 truncation in subsequent discovery
topics), bridge keeps decoding BLE adverts, and SYStoMQTT/LWT stay healthy.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
ble_script is defined as "" (empty string). Passing it to
server.sendContent("") signals end of HTTP chunked transfer,
closing the response prematurely. All subsequent chunks then
fail with errno 104 "Connection reset by peer".
Guard the call with a length check so the empty string is
never sent as a chunk terminator.
Co-authored-by: Florian <1technophile@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Expand the BLE config page from encryption-only (BLEDecryptor) to a
comprehensive settings page available for all ZgatewayBT builds, covering
scan, publish, presence, external decoder, and encryption settings.
Add MQTT Discovery checkbox to the gateway configuration page.
Co-authored-by: Florian <1technophile@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Introduced RFConfiguration class to encapsulate RF settings and operations.
- Replaced direct usage of RFConfig structure with iRFConfig instance across multiple files.
- Updated frequency handling in actuatorSomfy, gatewayPilight, gatewayRF, and gatewayRF2 to use iRFConfig.
- Modified webUI to interact with iRFConfig for RF settings management.
- Removed deprecated RFConfig structure and related functions.
- Enhanced JSON handling for RF configuration loading and saving.
- Improved logging for RF configuration operations.
* Changing WebUI to include display device name, and change it to select drop down rather than checkbox
* Fix mqttDiscovery to require WebUI and ESP32 for displayDeviceName
* Fix mqttDiscovery to require WebUI and ESP32 and ESP8266 for displayDeviceName and ForceDeviceName
* Changing WebUI to include display device name, and change it to select drop down rather than checkbox
* Fixes for WebUI and BT for supporting custom setting Display name
* Fixes for WebUI and BT for supporting custom setting Display name
* Move DISPLAY_DEVICE_NAME to User_config.h
* Update docs to include change for Display temperature
* Update docs to include change for Display temperature
* Fix minor cosmetic bug where devices were not linking in HA to the gateway using via_device as it should be the gateway mac address not name
* Add support for decrypting BTHome v2 frames
* Add support for decrypting BTHome v2 frames
* Add support for decrypting BTHome v2 frames
* BTHome fix issue with theengs-plug
* BTHome fix issue with theengs-plug
* Adding support for all BLE encrypted methods, support in UI and gatewayBT for specific MACAddress AES Keys
* Fix lint
* Fix build issue with theengs-bridge-v11 and esp32dev-all-test and revert the documentation to Units of measurement displayed
* Revert docs
* Revert displayDeviceName and Units of measurement
* Revert displayDeviceName and Units of measurement
* Revert displayDeviceName and Units of measurement
* Revert minor typo
* Revert minor typo
* Revert minor typo
* Bug in Victron as nonce should be 16 bytes
* Shortened the client side javascript for BLE key validation that is commented out due to image constrains on theengs-bridge-v11
