From 356c995aa36cfb8130c6e3d68cd6d0522cab8bea Mon Sep 17 00:00:00 2001 From: Timothy Brown Date: Mon, 29 Dec 2014 13:04:17 -0700 Subject: [PATCH] Bugfix on Basic Auth username/password split. Basic Auth uses a colon (":") to separate the username and password values. Using the php 'explode' function on this string without limiting the number of substrings returned can truncate the users password if it contains a colon. By limiting the explode to 2, we get back the username and whatever else is left as the password (hence not truncated). --- inc/HTTPAuthSession.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inc/HTTPAuthSession.php b/inc/HTTPAuthSession.php index 3e2bd2f6..0b81e0ff 100644 --- a/inc/HTTPAuthSession.php +++ b/inc/HTTPAuthSession.php @@ -106,7 +106,7 @@ class HTTPAuthSession { if (isset($_SERVER['AUTHORIZATION']) && !empty($_SERVER['AUTHORIZATION'])) { list ($type, $cred) = explode(" ", $_SERVER['AUTHORIZATION']); if ($type == 'Basic') { - list ($user, $pass) = explode(":", base64_decode($cred)); + list ($user, $pass) = explode(":", base64_decode($cred), 2); $_SERVER['PHP_AUTH_USER'] = $user; $_SERVER['PHP_AUTH_PW'] = $pass; }