nik/davical
1
0
Fork 0
mirror of https://gitlab.com/davical-project/davical.git synced 2026-08-22 17:16:06 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge branch 'master' into 'master'

Browse Source 
Basic Auth Bugfix

Bugfix on Basic Auth username/password split.

Basic Auth uses a colon (":") to separate the username and password values. Using the php 'explode' function on this string without limiting the number of substrings returned can truncate the users password if it contains a colon.

By limiting the explode to 2, we get back the username and whatever else is left as the password (hence not truncated).

See merge request !12
This commit is contained in:
Andrew Ruthven 2015-05-18 23:07:52 +00:00
commit 71db9008af
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
inc/HTTPAuthSession.php
View File

@ -106,7 +106,7 @@ class HTTPAuthSession {
if (isset($_SERVER['AUTHORIZATION']) && !empty($_SERVER['AUTHORIZATION'])) {
list ($type, $cred) = explode(" ", $_SERVER['AUTHORIZATION']);
if ($type == 'Basic') {
list ($user, $pass) = explode(":", base64_decode($cred));
list ($user, $pass) = explode(":", base64_decode($cred), 2);
$_SERVER['PHP_AUTH_USER'] = $user;
$_SERVER['PHP_AUTH_PW'] = $pass;
}