accessing dashboard of password protected device fails with ESP_Easy_mega_20210802

[chromo23]

i am unable to access the dashboard of a password protected device with ESP_Easy_mega_20210802
when i enter user and pw the prompt always reappears.
can anyone confirm this?

releases i tested without this issue:
ESP_Easy_mega_20210114
ESP_Easy_mega_20210223

[TD-er]

Can you also try a different browser?
Do you access the node from the same subnet? (e.g. 192.168.1.x both for your ESP as well as the device you use to connect to the ESP)
What exact build are you using? One with "beta" in the name?

[chromo23]

ESP_Easy_mega_20210802_normal_ESP8266_4M1M

Firefox, Chrome, Safari, same subnet, different subnet...always the same behavior

@TD-er: does it work for you?

[TD-er]

What do you call the "dashboard" ?
Is it a page (dashboard.esp) served from the filesystem of the ESP, or the web interface?
I just tested the web interface and that's working just fine.

But I also remember a report of another user about saving rules, which also does access a file from the flash file system.

Edit:
tested to edit a rules file and that fails too.

[TD-er]

I made an issue for this on Github: https://github.com/letscontrolit/ESPEasy/issues/3759

[chromo23]

What do you call the "dashboard" ?

i mean the dashboard.esp

tested to edit a rules file and that fails too.

editing the rules does work for me.

[TD-er]

Also if you switch to rules 2 or 3?
I do get a large GET url with the current rule page encoded in the GET URL.
Only if I strip the rules= parameter from the URL I can access the page.

[chromo23]

rules switching and editing with password works fine for me on all my browsers

however when i directly want to open the url http://espip/rules?set=3&rules= it fails in firefox and safari...

edit: it seems to happen with every url that has more than a simple name at the end e.g.: http://espip/devices?index=3&page=1
but i don’t get why only dashboard.esp also fails in chrome, while all the other urls work fine in chrome

[Ath]

releases i tested without this issue:
ESP_Easy_mega_20210114
ESP_Easy_mega_20210223

Does this also happen with the 20210615 release, (still available from the web-flasher https://td-er.nl/ESPEasy/) ?

[chromo23]

Does this also happen with the 20210615 release, (still available from the web-flasher https://td-er.nl/ESPEasy/) ?

Just tested it. It shows the same behavior...

[chromo23]

tested to edit a rules file and that fails too.

I now recall, that i had these issues with the newest release and probably with an older one too.
But it only occurred in ap mode when i tried to change the rules with my mobile phone (both safari and chrome). It wouldn't save the changes in the rules. I did´t give much thought about it because once it became a client saving the rules worked. I don´t know if it was a phone related issue because i didn’t have my laptop with me.

[TD-er]

Can you also test to see if it is already present in the May build? (on GitHub)
That makes searching for the commit that changed/broken it a bit easier.

Right now I suspect this commit: https://github.com/letscontrolit/ESPEas ... 5B%5D=.cpp

What this commit does, is making access to files a bit more strict as access to the files was not checked against the need to be logged in.

[TD-er]

OK, partly fixed it.
See: https://github.com/letscontrolit/ESPEasy/pull/3760

Can you build a test build yourself?

[chromo23]

Can you build a test build yourself?

I never did it .... if you can provide one i am happy to test it

Can you also test to see if it is already present in the May build? (on GitHub)

this it not necessary anymore i guess?

[TD-er]

Nope, I fixed it

What build do you need?

[chromo23]

normal_ESP8266_4M1M

[TD-er]

Here you are: https://www.dropbox.com/s/0ryv7yq7gllfb ... M.bin?dl=0

[chromo23]

thanks a lot... everything except accessing dashboard.esp directly seems to work fine...
I still get the password prompt and it still keeps popping up after entering the credentials

[TD-er]

Ah yep, knew I forgot to exclude that one....
I was too busy testing the rules issues I found.

[TD-er]

Made a new build (probably the same Dropbox link) https://www.dropbox.com/s/0ryv7yq7gllfb ... M.bin?dl=0

[chromo23]

I really appreciate that you are responding so quick an that you take immediate care of the issue but it is not an urgent problem. it can also wait. don't feel pressured by me...

[TD-er]

Well in the room next to me someone is trying really hard to not go to sleep, so I want to get this done as long as I am allowed to....

[chromo23]

You inverted the problem kind of
now dashboard needs no password at all and the rest is behaving like the dashboard before....

edit: though in chrome it works fine...
edit2: i was to quick with writing this... restarted all my browsers and it works!!! but the missing password request for dashboard.esp is intentional?

[TD-er]

Yep, for now it is intentional as it was added roughly 4 months ago.
So it was never password protected and I do think this is also what it needs to be.
Having a password set for a dashboard doesn't make sense.

It may make sense in the future if we have a more fine grained user access control list.

[chromo23]

Having a password set for a dashboard doesn't make sense.

I agree.
And thank you very much!!!

[TD-er]

Thanks for testing and reporting the issue

Will merge it now.

By the way when looking into this, I found another optimization we can make in ESPEasy to reduce the amount of memory used, making it more stable in the end.

[mrwee]

What do you call the "dashboard" ?
Is it a page (dashboard.esp) served from the filesystem of the ESP, or the web interface?
I just tested the web interface and that's working just fine.

But I also remember a report of another user about saving rules, which also does access a file from the flash file system.

Edit:
tested to edit a rules file and that fails too.

That's me . Have seen it (see it) on a couple of devices, so if this is fixed, then I'll be a happy bunny! I'll test the 4M1M version on one of the devices.

[mrwee]

What do you call the "dashboard" ?
Is it a page (dashboard.esp) served from the filesystem of the ESP, or the web interface?
I just tested the web interface and that's working just fine.

But I also remember a report of another user about saving rules, which also does access a file from the flash file system.

Edit:
tested to edit a rules file and that fails too.

That's me . Have seen it (see it) on a couple of devices, so if this is fixed, then I'll be a happy bunny! I'll test the 4M1M version on one of the devices.

The issue with changing rule page seems to be fixed. Thanks, it's been really annoying and made it impossible to edit/change any rule