nik/davical
1
0
Fork 0
mirror of https://gitlab.com/davical-project/davical.git synced 2026-07-28 13:09:24 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bugfix on Basic Auth username/password split.

Browse Source 
Basic Auth uses a colon (":") to separate the username and
password values. Using the php 'explode' function on this
string without limiting the number of substrings returned
can truncate the users password if it contains a colon.
By limiting the explode to 2, we get back the username and
whatever else is left as the password (hence not truncated).
This commit is contained in:
Timothy Brown 2014-12-29 13:04:17 -07:00
parent 39f1d04abe
commit 356c995aa3
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
inc/HTTPAuthSession.php
View File

@ -106,7 +106,7 @@ class HTTPAuthSession {
if (isset($_SERVER['AUTHORIZATION']) && !empty($_SERVER['AUTHORIZATION'])) {
list ($type, $cred) = explode(" ", $_SERVER['AUTHORIZATION']);
if ($type == 'Basic') {
list ($user, $pass) = explode(":", base64_decode($cred));
list ($user, $pass) = explode(":", base64_decode($cred), 2);
$_SERVER['PHP_AUTH_USER'] = $user;
$_SERVER['PHP_AUTH_PW'] = $pass;
}