From c7060e40ff2d18a0387956c212a72b5ade5aa98a Mon Sep 17 00:00:00 2001
From: lumapu <lp@lufami.de>
Date: Tue, 4 Apr 2023 22:50:21 +0200
Subject: [PATCH] 0.6.3 * fix login, password length was not checked #852

---
 src/CHANGES.md |  3 +++
 src/defines.h  |  2 +-
 src/web/web.h  | 12 +++++++-----
 3 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/src/CHANGES.md b/src/CHANGES.md
index 3702d0e6..7af7279e 100644
--- a/src/CHANGES.md
+++ b/src/CHANGES.md
@@ -1,5 +1,8 @@
 # Development Changes
 
+## 0.6.3 - 2023-04-04
+* fix login, password length was not checked #852
+
 ## 0.6.2 - 2023-04-04
 * fix login from multiple clients #819
 * fix login screen on small displays
diff --git a/src/defines.h b/src/defines.h
index 5d01003b..13799dbc 100644
--- a/src/defines.h
+++ b/src/defines.h
@@ -13,7 +13,7 @@
 //-------------------------------------
 #define VERSION_MAJOR       0
 #define VERSION_MINOR       6
-#define VERSION_PATCH       2
+#define VERSION_PATCH       3
 
 //-------------------------------------
 typedef struct {
diff --git a/src/web/web.h b/src/web/web.h
index 6b7aaed1..0cafacf6 100644
--- a/src/web/web.h
+++ b/src/web/web.h
@@ -130,11 +130,13 @@ class Web {
             bool prot;
             prot = mProtected;
             if(!prot) {
-                uint8_t ip[4];
-                ah::ip2Arr(ip, request->client()->remoteIP().toString().c_str());
-                for(uint8_t i = 0; i < 4; i++) {
-                    if(mLoginIp[i] != ip[i])
-                        prot = true;
+                if(strlen(mConfig->sys.adminPwd) > 0) {
+                    uint8_t ip[4];
+                    ah::ip2Arr(ip, request->client()->remoteIP().toString().c_str());
+                    for(uint8_t i = 0; i < 4; i++) {
+                        if(mLoginIp[i] != ip[i])
+                            prot = true;
+                    }
                 }
             }