adulau/cakephp2-php8
1
0
Fork 0
mirror of https://github.com/kamilwylegala/cakephp2-php8.git synced 2024-11-15 03:18:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Allow username of 0 in basic authentication.

Browse source 
Refs #3624
This commit is contained in:
mark_story 2014-06-02 22:02:28 -04:00
parent d1e4dfac47
commit 975e4c3af0
2 changed files with 27 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
lib/Cake/Controller/Component/Auth/BasicAuthenticate.php
View file

@ -78,7 +78,7 @@ class BasicAuthenticate extends BaseAuthenticate {
$username = env('PHP_AUTH_USER');
$pass = env('PHP_AUTH_PW');
if (empty($username) || empty($pass)) {
if (!is_string($username) || $username === '' || !is_string($pass) || $pass === '') {
return false;
}
return $this->_findUser($username, $pass);

27
lib/Cake/Test/Case/Controller/Component/Auth/BasicAuthenticateTest.php
View file

@ -126,10 +126,35 @@ class BasicAuthenticateTest extends CakeTestCase {
$_SERVER['PHP_AUTH_PW'] = "' OR 1 = 1";
$this->assertFalse($this->auth->getUser($request));
$this->assertFalse($this->auth->authenticate($request, $this->response));
}
/**
* Test that username of 0 works.
*
* @return void
*/
public function testAuthenticateUsernameZero() {
$User = ClassRegistry::init('User');
$User->updateAll(array('user' => $User->getDataSource()->value('0')), array('user' => 'mariano'));
$request = new CakeRequest('posts/index', false);
$request->data = array('User' => array(
'user' => '0',
'password' => 'password'
));
$_SERVER['PHP_AUTH_USER'] = '0';
$_SERVER['PHP_AUTH_PW'] = 'password';
$expected = array(
'id' => 1,
'user' => '0',
'created' => '2007-03-17 01:16:23',
'updated' => '2007-03-17 01:18:31'
);
$this->assertEquals($expected, $this->auth->authenticate($request, $this->response));
}
/**
* test that challenge headers are sent when no credentials are found.
*