Fix handling of special characters in RTSP credentials

Merge branch 'rtsp-creds-special-chars' into release-3.1.7

debian/control.in

@@ -11,7 +11,8 @@ Build-Depends: debhelper (>= 11),
 #stretch default-libmysqlclient-dev,
 #buster default-libmysqlclient-dev,
  libidn11-dev, libbsd-dev, yasm, libudev-dev, libopencv-dev,
- libva-dev
+ libva-dev,
+ libcurl4, libcurl4-dev,
 Standards-Version: 3.9.5
 
 Package: bluecherry
@@ -30,6 +31,7 @@ Depends: ${shlibs:Depends}, ssl-cert, ucf, curl, sysstat,
  certbot,
  rsyslog,
  logrotate,
+ libcurl4,
 # python3-pip,
 #focal   php-sqlite3, php-gd, php-curl, php-mysql
 #jammy   php-sqlite3, php-gd, php-curl, php-mysql

lib/BCMK

@@ -5,9 +5,9 @@ else
 	LDFLAGS		+= -L/usr/lib64/mysql -lmysqlclient
 endif
 
-LDFLAGS		+= -lconfig -lm -lrt -lbsd
+LDFLAGS		+= -lconfig -lm -lrt -lbsd $(shell pkg-config --libs libcurl)
 LDFLAGS		+= -lavutil -lavformat -lavcodec -lpugixml
-CFLAGS		+= -fPIC -DETCDIR="\"$(etc_dir)\""
+CFLAGS		+= -fPIC -DETCDIR="\"$(etc_dir)\"" $(shell pkg-config --cflags libcurl)
 
 SOLIB		= libbluecherry.so
 SOLIBVER	= $(SOLIB).0

lib/bc-core.cpp

@@ -29,6 +29,7 @@
 #include <limits.h>
 #include <assert.h>
 #include <bsd/string.h>
+#include <curl/curl.h>
 
 #include "libbluecherry.h"
 #include "lavf_device.h"
@@ -85,7 +86,19 @@ static int get_creds(BC_DB_RES dbres, char *creds, size_t size)
 		return -1;
 
 	if (*user && *pass) {
-		size_t s = snprintf(creds, size, "%s:%s@", user, pass);
+		char *urlencoded_user = curl_easy_escape(NULL, user, 0);
+		if (!urlencoded_user) {
+			return -1;
+		}
+
+		char *urlencoded_pass = curl_easy_escape(NULL, pass, 0);
+		if (!urlencoded_pass) {
+			curl_free(urlencoded_user);
+			return -1;
+		}
+		size_t s = snprintf(creds, size, "%s:%s@", urlencoded_user, urlencoded_pass);
+		curl_free(urlencoded_user);
+		curl_free(urlencoded_pass);
 		if (s >= size)
 			return -1;
 	} else {
@@ -141,7 +154,7 @@ static int lavf_handle_init(struct bc_handle *bc, BC_DB_RES dbres)
 	 * __data, but completely unused and unreachable (bc_record type belongs to
 	 * server and not to lib) */
 
-	char creds[64];
+	char creds[4096];
 	if (get_creds(dbres, creds, sizeof(creds)) < 0)
 		return -1;
 

www/lib/lib.php

@@ -776,13 +776,13 @@ public function checkConnection() {
 
 		switch($this->info['protocol'])  {
 			case 'IP-RTSP':
-				$path = 'rtsp://'.((empty($this->info['rtsp_username'])) ? '' : $this->info['rtsp_username'].':'.$this->info['rtsp_password'].'@').$this->info['ipAddr'].':'.$this->info['port'].$this->info['rtsp'];
+				$path = 'rtsp://'.((empty($this->info['rtsp_username'])) ? '' : urlencode($this->info['rtsp_username']).':'.urlencode($this->info['rtsp_password']).'@').$this->info['ipAddr'].':'.$this->info['port'].$this->info['rtsp'];
 				$rtp_args_menu = array("-rtsp_flags +prefer_tcp", "-rtsp_transport tcp", "-rtsp_transport +udp+udp_multicast");
 				$args = $rtp_args_menu[$this->info['rtsp_rtp_prefer_tcp']];
 				break;
 			case 'IP-MJPEG': 
 				//FIXME: This is the old logic for testing MJPEG. Testing for MJPEG is currently not supported by the bundled ffprobe method used for RTSP
-				$path = 'http://'.((empty($this->info['rtsp_username'])) ? '' : $this->info['rtsp_username'].':'.$this->info['rtsp_password'].'@').((empty($this->info['ipAddrMjpeg'])) ? $this->info['ipAddr'] : $this->info['ipAddrMjpeg']).':'.$this->info['portMjpeg'].$this->info['mjpeg_path'];
+				$path = 'http://'.((empty($this->info['rtsp_username'])) ? '' : urlencode($this->info['rtsp_username']).':'.urlencode($this->info['rtsp_password']).'@').((empty($this->info['ipAddrMjpeg'])) ? $this->info['ipAddr'] : $this->info['ipAddrMjpeg']).':'.$this->info['portMjpeg'].$this->info['mjpeg_path'];
 				$headers = @get_headers($path);
 				if (!$headers) { $this->info['connection_status']['success'] = false; return; }
 				preg_match("/([0-9]{3})/", $headers[0], $response_code);