Skip to content

Return 401 on incorrect OTA password instead of misleading success message #5222

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Copilot wants to merge 7 commits into
base: main
Choose a base branch
from
Open

Return 401 on incorrect OTA password instead of misleading success message #5222

Changes from 6 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
ce9a8fb
Initial plan
Copilot Dec 23, 2025
e9a366e
Add OTA password validation feedback for security settings
Copilot Dec 23, 2025
92a43ff
Code review and security check completed
Copilot Dec 23, 2025
b7485e2
Address PR feedback: invert flag logic to otaPassCorrect, simplify er…
Copilot Dec 23, 2025
38b159d
Return 401 immediately on incorrect password instead of using global …
Copilot Dec 23, 2025
3e5646d
Only return 401 when OTA settings are actually being changed
Copilot Dec 27, 2025
5760385
Check password validation before any operations to prevent partial saves
Copilot Dec 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions wled00/set.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -607,6 +607,14 @@ void handleSettingsSet(AsyncWebServerRequest *request, byte subPage)
}
}

// Check if any OTA-related settings are being changed
bool otaSettingsChanged = (request->hasArg(F("NO")) != otaLock) ||
(request->hasArg(F("OW")) != wifiLock) ||
#ifndef WLED_DISABLE_OTA
(request->hasArg(F("AO")) != aOtaEnabled) ||
#endif
(request->hasArg(F("SU")) != otaSameSubnet);

if (pwdCorrect) //allow changes if correct pwd or no ota active
{
otaLock = request->hasArg(F("NO"));
Expand All @@ -615,6 +623,10 @@ void handleSettingsSet(AsyncWebServerRequest *request, byte subPage)
aOtaEnabled = request->hasArg(F("AO"));
#endif
otaSameSubnet = request->hasArg(F("SU"));
} else if (otaLock && otaSettingsChanged) {
// If OTA is locked and password is incorrect AND user tried to change OTA settings, return error immediately
serveMessage(request, 401, F("Error"), F("Password incorrect"), 254);

@willmmiles willmmiles Dec 27, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we're going to fail out a request, this must be checked and handled before any other operations are performed. Otherwise the user could be surprised by a request being "partially handled".

Copilot AI Dec 27, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done in commit 5760385. Password validation is now checked at the beginning of the handler, before any other operations are performed. This prevents partial saves where PIN might be updated but OTA settings fail.

return;
}
}

Expand Down