file: enforce Basic Auth realms for URL-prefix handlers

[hauke]

uh_handle_request() selects check_url dispatch handlers (lua, ucode and ubus) via dispatch_find(url, NULL) and invokes them through uh_invoke_handler() before reaching __handle_file_request(), which holds the only uh_auth_check() call. As a result a configured Basic Auth realm was never evaluated for those handlers: a request to a lua/ucode/ubus prefix was served without authentication, and even invalid credentials were ignored. CGI scripts are not affected because they register a check_path handler and fall through to the authenticated file path, so the same realm protected /cgi-bin/foo but silently not /api/foo.

Evaluate the matching realm against the request URL before invoking a check_url handler. uh_auth_check() already emits the 401 challenge and tears the request down on failure, so handlers stay consistent with the static file and CGI paths. Deployments without a realm covering the prefix are unaffected.

Link: https://github.com/openwrt/uhttpd/security/advisories/GHSA-5cgm-8h9x-v28c
Reported-by: @aramosf
Assisted-by: Claude:claude-opus-4-8

[jow-]

The return without expression followed by the return-with-function-call-returning-void looks a bit weird, even if technically correct, but it'll likely let casual readers stumble.

I suggest writing it like this:

	if (d) {
		/* check_url handlers (lua, ucode, ubus) are dispatched here,
		 * before the file/CGI path that performs uh_auth_check().
		 * Enforce any matching Basic Auth realm so these handlers are
		 * protected consistently with static files and CGI scripts. */
		if (uh_auth_check_url(cl, url))
			uh_invoke_handler(cl, d, url, NULL);

		return;
	}