themactep / thingino-firmware

Open-source firmware for Ingenic SoC IP cameras
https://thingino.com
MIT License
173 stars 52 forks source link

Wifi AP configuration page can be re-POSTed to from a cache browser window #259

Open 8none1 opened 1 week ago

8none1 commented 1 week ago

I have configured two cameras today. When I flashed the first one I connected to the provided access point from my iPhone. I provided the config information and submitted the form. The device rebooted and I everything worked.

Later on that same day I was flashing a second device. I had a few snags because it was running Dafang, but in the end I was able to get it working with help from the Discord channel (thank you!).

When I connected my phone to the access point on the second camera and opened up the browser I still had the original config page open at the same URL (http://172.16.0.1). When the access point connected the browser attempted to refresh the page and I think it re-POSTed the form.

The camera then accepted that form as it's configuration data and rebooted.

The camera came up with the same hostname and root password (and perhaps other things) as the first camera.

This was a mild hold up and easily fixed.

gtxaspec commented 1 day ago

@themactep we can't expire the data using httpd or via the web, can we?

themactep commented 1 day ago

the page is in client's browser and any attempt to refresh it will send the same requests as was sent previously. http is a stateless protocol, we cannot control what's on the client's side. i usually make a GET redirect to another url so that there was no pending POST page in the browser. But I did not do that on the portal because most devices just close the portal window after the network is gone. I had hard time even to reproduce the issue. I think I'll extract Done page to a separate html file and will redirect to it.