feat: FTP/WebDAV accept any username (password-only auth)

With one shared device password the username is pointless, so both file
servers now authenticate by password only - any username is accepted, a
wrong password is still rejected, and an empty device password leaves
them open.

- FTP: vendor ESP-FTP-Server-Lib into lib/ (dropped from lib_deps) and
  patch c_USER/c_PASS to accept any username and match only the password
  (empty password = open).
- WebDAV: the self-contained server now base64-decodes the HTTP-Basic
  header and compares only the password (any username), open when no
  password is set.
- Drop the now-pointless username fields from the FTP and WebDAV tabs and
  add a hint; the WebDAV settings POST only carries the auto-start flag.

Locales (de/en/fr) and README updated. Verified on device: FTP login
with arbitrary usernames + the device password works, wrong password is
rejected, empty password opens it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: fhirschmann

README.md

@@ -109,6 +109,7 @@ neon logo that doubles as the SVG favicon ([`7be5254`](../../commit/7be5254)):
 | **Configurable branding**: re-brand the navbar header + footer (General → Branding) with a live preview as you type — empty keeps the "Leo Industries" default, so the fork is easy to re-brand | [`fd57fcb`](../../commit/fd57fcb) |
 | **Password protection**: single password (no username), 90-day session cookie, brute-force lockout, logout entry; off in hotspot mode. Scripts/API clients authenticate with the password as an **API key** (`X-API-Key` header / `apikey` query param) | [`e74e712`](../../commit/e74e712) |
 | **One shared device password (Security tab)**: the password fields were pulled out of the WiFi/FTP/WebDAV tabs into a single **Security** sub-tab — one password now protects the web interface, FTP *and* WebDAV (set once, applies everywhere; applied live without a reboot). An **empty password is accepted** and disables protection for all three. The **hostname** moved to the top of the **General** tab (saved on its own; `/wificonfig` now does partial updates) and the navbar brand reads just **Leo Industries** | [`c6dfc67`](../../commit/c6dfc67) |
+| **FTP/WebDAV accept any username**: with one shared password the username is pointless, so both servers now authenticate by **password only — any username is accepted** (wrong password still rejected; empty device password = open). The username fields are gone from both tabs. FTP uses a **vendored, patched copy** of ESP-FTP-Server-Lib in [`lib/`](lib/ESP-FTP-Server-Lib) (password-only auth); WebDAV's self-contained server decodes the HTTP-Basic header and compares only the password | [`PENDINGHASH3`](../../commit/PENDINGHASH3) |
 | **One-click OTA + version badge**: a Tools-tab button (also bindable command **186** / MQTT `firmware_update`) pulls the rolling `latest` GitHub release and flashes it over OTA; a navbar badge shows the running build and turns amber when an update is available (passive `/version` check) — click it to install | [`8527f5e`](../../commit/8527f5e) · [`b736abc`](../../commit/b736abc) |
 | **HTTP file sync**: pull audio files from a web server onto the SD card from a JSON manifest — additive, streamed in chunks straight to SD, background task with live progress + stop, abort-on-button, stall watchdog, auto-pauses playback and keeps the device awake mid-transfer. The manifest is streamed into the parser to halve peak RAM | [`ac24bbc`](../../commit/ac24bbc) · [`42d2c46`](../../commit/42d2c46) |
 | **WebDAV server**: mount the SD card as a network drive (`http://<ip>:81/`) to copy audio on/off it straight from Finder/Explorer — no FTP client needed. Self-contained server (OPTIONS/PROPFIND/GET/HEAD+ranges/PUT/DELETE/MKCOL/MOVE/COPY/LOCK) running in its own task pinned to core 0 so transfers never disturb the audio pipeline; optional HTTP-Basic credentials. Configure + auto-start on boot in its own **WebDAV** settings sub-tab; start/stop live from the Control tab, command **188** or MQTT `webdav` (Home Assistant switch included). With auto-start on, the share is announced over **Bonjour/mDNS** (`_webdav._tcp`, `path=/`) so it pops up by itself in the Finder/Explorer network sidebar — no manual "Connect to Server" needed (currently disabled — see `WEBDAV_ENABLE`) | [`9b2bee0`](../../commit/9b2bee0) |

html/locales/de.json

@@ -443,6 +443,7 @@
 	},
 	"ftp": {
 		"title": "FTP-Einstellungen",
+		"authHint": "FTP akzeptiert jeden Benutzernamen – nur das Passwort zählt. Das Passwort ist das gemeinsame Geräte-Passwort (Tab \"Sicherheit\"). Leeres Passwort = Zugriff ohne Anmeldung.",
 		"user": {
 			"title": "FTP-Benutzername",
 			"placeholder": "Benutzername"
@@ -474,7 +475,7 @@
 			"show": "Passwort anzeigen/verbergen"
 		},
 		"auth": {
-			"hint": "Das WebDAV-Passwort wird im Tab \"Sicherheit\" gesetzt (gemeinsames Geräte-Passwort). Benutzername und Passwort leer lassen, um ohne Anmeldung zuzugreifen."
+			"hint": "WebDAV akzeptiert jeden Benutzernamen – nur das Passwort zählt. Das Passwort ist das gemeinsame Geräte-Passwort (Tab \"Sicherheit\"). Leeres Passwort = Zugriff ohne Anmeldung."
 		},
 		"start": {
 			"title": "WebDAV-Server starten",

html/locales/en.json

@@ -443,6 +443,7 @@
 	},
 	"ftp": {
 		"title": "FTP-settings",
+		"authHint": "FTP accepts any username - only the password matters. The password is the shared device password (\"Security\" tab). An empty password means access without a login.",
 		"user": {
 			"title": "FTP-Username",
 			"placeholder": "username"
@@ -474,7 +475,7 @@
 			"show": "Show/hide password"
 		},
 		"auth": {
-			"hint": "The WebDAV password is set on the \"Security\" tab (shared device password). Leave username and password empty to allow access without a login."
+			"hint": "WebDAV accepts any username - only the password matters. The password is the shared device password (\"Security\" tab). An empty password means access without a login."
 		},
 		"start": {
 			"title": "Start WebDAV server",

html/locales/fr.json

@@ -436,6 +436,7 @@
 	},
 	"ftp": {
 		"title": "Paramètres FTP",
+		"authHint": "Le FTP accepte n'importe quel nom d'utilisateur - seul le mot de passe compte. C'est le mot de passe partagé de l'appareil (onglet « Sécurité »). Un mot de passe vide permet l'accès sans connexion.",
 		"user": {
 			"title": "Nom d'utilisateur FTP",
 			"placeholder": "nom d'utilisateur"
@@ -467,7 +468,7 @@
 			"show": "Afficher/masquer le mot de passe"
 		},
 		"auth": {
-			"hint": "Le mot de passe WebDAV se règle dans l'onglet « Sécurité » (mot de passe partagé de l'appareil). Laissez le nom d'utilisateur et le mot de passe vides pour un accès sans connexion."
+			"hint": "Le WebDAV accepte n'importe quel nom d'utilisateur - seul le mot de passe compte. C'est le mot de passe partagé de l'appareil (onglet « Sécurité »). Un mot de passe vide permet l'accès sans connexion."
 		},
 		"start": {
 			"title": "Démarrer serveur WebDAV",

html/management.html

@@ -3239,19 +3239,10 @@ <h5 class="modal-title" data-i18n="tools.nvs.erase.title"></h5>
 		</div>
 		<div class="tab-pane fade" id="nav-ftp" role="tabpanel" aria-labelledby="nav-ftp-tab">
 			<div class="container" id="ftpConfig">
-				<form action="#ftpConfig" method="POST" onsubmit="ftpSettings('ftpConfig'); return false">
-					<div class="mb-3 col-md-12">
-						<legend data-i18n="ftp.title"></legend>
-						<label for="ftpUser" data-i18n="[prepend]ftp.user.title">:</label>
-						<input type="text" class="form-control" id="ftpUser" maxlength="0"
-							data-i18n="[placeholder]ftp.user.placeholder" name="ftpUser" value="" required>
-						<small class="form-text text-muted" data-i18n="ftp.pwd.securityHint"></small>
-					</div>
-					<div class="text-center">
-						<button type="reset" class="btn btn-warning" data-i18n="reset"></button>&nbsp;<button
-							type="submit" class="btn btn-primary" data-i18n="submit"></button>
-					</div>
-				</form>
+				<div class="mb-3 col-md-12">
+					<legend data-i18n="ftp.title"></legend>
+					<div class="mb-2"><small class="text-muted" data-i18n="ftp.authHint"></small></div>
+				</div>
 				<hr>
 			</div>
 			<div class="container" id="ftpStart">
@@ -3277,9 +3268,6 @@ <h5 class="modal-title" data-i18n="tools.nvs.erase.title"></h5>
 							<input class="form-check-input" type="checkbox" id="webdavEnable" name="webdavEnable">
 							<label class="form-check-label" for="webdavEnable" data-i18n="webdav.enable"></label>
 						</div>
-						<label for="webdavUser" data-i18n="[prepend]webdav.user.title">:</label>
-						<input type="text" class="form-control" id="webdavUser" maxlength="0"
-							data-i18n="[placeholder]webdav.user.placeholder" name="webdavUser" value="">
 						<small class="text-muted" data-i18n="webdav.auth.hint"></small>
 					</div>
 					<div class="text-center">
@@ -5358,16 +5346,12 @@ <h5 class="modal-title" data-i18n="tools.nvs.erase.title"></h5>
 			let ftpSettings = settings.ftp;
 			if (ftpSettings) {
 				document.getElementById('nav-ftp-tab').setAttribute('data-visible', true);
-				document.getElementById("ftpUser").value = (ftpSettings.username === "-1") ? "" : ftpSettings.username;
-				document.getElementById("ftpUser").setAttribute('maxlength', ftpSettings.maxUserLength);
 			}
 			// webdav (the sub-tab stays hidden unless the firmware reports WebDAV support)
 			let webdavSettingsData = settings.webdav;
 			if (webdavSettingsData) {
 				document.getElementById('nav-webdav-tab').setAttribute('data-visible', true);
 				document.getElementById('btn-webdav').style.display = '';
-				document.getElementById("webdavUser").value = (webdavSettingsData.username === "-1") ? "" : webdavSettingsData.username;
-				document.getElementById("webdavUser").setAttribute('maxlength', webdavSettingsData.maxUserLength);
 				document.getElementById("webdavEnable").checked = !!webdavSettingsData.enable;
 				const port = webdavSettingsData.port || 81;
 				document.getElementById("webdavMountUrl").textContent = "http://" + host + ":" + port + "/";
@@ -5973,22 +5957,6 @@ <h5 class="modal-title" data-i18n="tools.nvs.erase.title"></h5>
 			toaster.info(i18next.t("toast.saved"));
 		}
 
-		async function ftpSettings(clickedId) {
-			lastIdclicked = clickedId;
-			var myObj = {
-				"ftp": {
-					username: document.getElementById('ftpUser').value
-				}
-			};
-			var myJSON = JSON.stringify(myObj);
-			await fetch("http://" + host + "/settings", {
-				method: "POST",
-				headers: { "Content-Type": "application/json" },
-				body: myJSON
-			});
-			toaster.info(i18next.t("toast.saved"));
-		}
-
 		function ftpSetStatus(start) {
 			var myObj = {
 				"ftpStatus": {
@@ -5999,12 +5967,11 @@ <h5 class="modal-title" data-i18n="tools.nvs.erase.title"></h5>
 			socket.send(myJSON);
 		}
 
-		/* save the WebDAV credentials + auto-start-on-boot flag */
+		/* save the WebDAV auto-start-on-boot flag (no credentials: any username, password via Security tab) */
 		async function webdavSettings(clickedId) {
 			lastIdclicked = clickedId;
 			var myObj = {
 				"webdav": {
-					username: document.getElementById('webdavUser').value,
 					enable: document.getElementById('webdavEnable').checked
 				}
 			};

lib/ESP-FTP-Server-Lib/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2020 Peter Buchegger
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

lib/ESP-FTP-Server-Lib/README.md

@@ -0,0 +1,43 @@
+# ESP-FTP-Server-Lib
+
+This is a fork form https://github.com/peterus/ESP-FTP-Server-Lib, since there seems to be no maintanance anymore.
+This library will provide a simple and modern FTP server for your ESP32 or ESP8266 device.
+You can setup multiple users and mutliple filesystems (SD-Card, MMC-Card or/and SPIFFS).
+
+## Examples
+
+In the example folder you can find a very simple usage of the FTP server. You just need to setup the users, add the filesystems which you want to use, and call the handle function in the loop.
+With the Compileflag -DENABLE_FTP_SANITIZATION you can enable support for special-characters like ":" or "?" by URL-Encodeing of Files.
+
+## Known Commands to the server
+
+Currently all kind of simple commands are known to the server:
+* CDUP
+* CLNT
+* CWD
+* DELE
+* FEAT
+* LISST
+* MKD
+* MLSD
+* NLST
+* OPTS
+* PASV
+* PORT
+* PWD
+* RETR
+* RMD
+* RNFR
+* RNTO
+* STAT
+* STOR
+* TYPE
+* USER
+* PASS
+* SYST
+* QUIT
+* ABOR
+
+## What is still missing / TODO
+
+Some commands are still missing, if you need them create a ticket :)

lib/ESP-FTP-Server-Lib/library.properties

@@ -0,0 +1,11 @@
+name=ESP-FTP-Server-Lib
+version=0.14.1
+author=Peter Buchegger <peter@pbuchegger.at>
+maintainer=Peter Buchegger <peter@pbuchegger.at>
+sentence=Simple and modern FTP server for ESP devices.
+paragraph=With this library you can run a simple and modern FTP server on your ESP32 or ESP8266. You can mount multiple filesystems like SD-Card, MMC-Card or SPIFFS at the same time.
+category=Communication
+url=https://github.com/peterus/ESP-FTP-Server-Lib
+architectures=esp8266,esp32,arduino-esp32
+includes=ESP-FTP-Server-Lib.h
+depends=

lib/ESP-FTP-Server-Lib/src/Commands/CDUP.h

@@ -0,0 +1,20 @@
+#ifndef CDUP_H_
+#define CDUP_H_
+
+#include <WiFiClient.h>
+
+#include "../FTPCommand.h"
+#include "../FTPResponseCodes.h"
+
+class CDUP : public FTPCommand {
+public:
+  explicit CDUP(WiFiClient *const Client) : FTPCommand("CDUP", 0, Client) {
+  }
+
+  void run(FTPPath &WorkDirectory, const std::vector<String> &Line) override {
+    WorkDirectory.goPathUp();
+    SendResponse(FtpCodes::COMMAND_OK, "Ok. Current directory is " + WorkDirectory.getClearPath());
+  }
+};
+
+#endif

lib/ESP-FTP-Server-Lib/src/Commands/CWD.h

@@ -0,0 +1,31 @@
+#ifndef CWD_H_
+#define CWD_H_
+
+#include <WiFiClient.h>
+
+#include "../FTPCommand.h"
+#include "../FTPResponseCodes.h"
+
+class CWD : public FTPCommand {
+public:
+  explicit CWD(WiFiClient *const Client, FTPFilesystem *const Filesystem) : FTPCommand("CWD", 1, Client, Filesystem) {
+  }
+
+  void run(FTPPath &WorkDirectory, const std::vector<String> &Line) override {
+    FTPPath path = WorkDirectory;
+    if (Line[1] == "..") {
+      path.goPathUp();
+    } else {
+      path.changePath(Line[1]);
+    }
+    File dir = _Filesystem->open(path.getPath());
+    if (dir.isDirectory()) {
+      WorkDirectory = path;
+      SendResponse(FtpCodes::COMMAND_OK, "Ok. Current directory is " + WorkDirectory.getClearPath());
+    } else {
+      SendResponse(FtpCodes::FILE_ACTION_NOT_TAKEN, "Directory does not exist");
+    }
+  }
+};
+
+#endif