From 4a5f9150d09474099bc1a8711a92ed1fe52203c0 Mon Sep 17 00:00:00 2001
From: Santtu Lakkala <inz@inz.fi>
Date: Fri, 22 May 2026 11:08:56 +0300
Subject: Fix error body leaks

activitypub_post_handler uses custom error responses for 400 and 403.
The 400 NULL check was reversed and 403 was missing the check in
httpd_connection and both errors were lost and leaked.

Add a common custom error gate around all default errors to avoid
similar issues in the future.
---
 httpd.c | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

(limited to 'httpd.c')

diff --git a/httpd.c b/httpd.c
index 248f5fa..5957cd6 100644
--- a/httpd.c
+++ b/httpd.c
@@ -600,17 +600,19 @@ void httpd_connection(FILE *f)
         status = HTTP_STATUS_NOT_FOUND;
     }
 
-    if (status == HTTP_STATUS_FORBIDDEN)
-        body = xs_str_new("<h1>403 Forbidden (" USER_AGENT ")</h1>");
+    if (body == NULL) {
+        if (status == HTTP_STATUS_FORBIDDEN)
+            body = xs_str_new("<h1>403 Forbidden (" USER_AGENT ")</h1>");
 
-    if (status == HTTP_STATUS_NOT_FOUND)
-        body = xs_str_new("<h1>404 Not Found (" USER_AGENT ")</h1>");
+        if (status == HTTP_STATUS_NOT_FOUND)
+            body = xs_str_new("<h1>404 Not Found (" USER_AGENT ")</h1>");
 
-    if (status == HTTP_STATUS_GONE)
-        body = xs_str_new("<h1>410 Gone (" USER_AGENT ")</h1>");
+        if (status == HTTP_STATUS_GONE)
+            body = xs_str_new("<h1>410 Gone (" USER_AGENT ")</h1>");
 
-    if (status == HTTP_STATUS_BAD_REQUEST && body != NULL)
-        body = xs_str_new("<h1>400 Bad Request (" USER_AGENT ")</h1>");
+        if (status == HTTP_STATUS_BAD_REQUEST)
+            body = xs_str_new("<h1>400 Bad Request (" USER_AGENT ")</h1>");
+    }
 
     if (status == HTTP_STATUS_SEE_OTHER)
         headers = xs_dict_append(headers, "location", body);
-- 
cgit 


From a0fada72cc4829d757a8691d214069b27aa80fbb Mon Sep 17 00:00:00 2001
From: grunfink <grunfink@comam.es>
Date: Wed, 10 Jun 2026 09:46:33 +0200
Subject: Tweaked first httpd log line.

---
 httpd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'httpd.c')

diff --git a/httpd.c b/httpd.c
index 5957cd6..acbe895 100644
--- a/httpd.c
+++ b/httpd.c
@@ -1067,8 +1067,8 @@ void httpd(void)
     signal(SIGTERM, term_handler);
     signal(SIGINT,  term_handler);
 
-    srv_log(xs_fmt("httpd%s start %s %s", p_state->use_fcgi ? " (FastCGI)" : "",
-                    full_address, USER_AGENT));
+    srv_log(xs_fmt(USER_AGENT " httpd%s start %s", p_state->use_fcgi ? " (FastCGI)" : "",
+                    full_address));
 
     /* show the number of usable file descriptors */
     struct rlimit r;
-- 
cgit