From a15c5c7a70bc742a5ba612084619706c5cc6128b Mon Sep 17 00:00:00 2001 From: Nicola Beghin Date: Wed, 15 Mar 2017 14:08:17 +0100 Subject: [PATCH] BasicAuthenticate - added check to avoid parsing if "Authorization: Bearer " is in place --- lib/Cake/Controller/Component/Auth/BasicAuthenticate.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/Cake/Controller/Component/Auth/BasicAuthenticate.php b/lib/Cake/Controller/Component/Auth/BasicAuthenticate.php index fcb0ddec5..563fa3071 100644 --- a/lib/Cake/Controller/Component/Auth/BasicAuthenticate.php +++ b/lib/Cake/Controller/Component/Auth/BasicAuthenticate.php @@ -83,7 +83,7 @@ class BasicAuthenticate extends BaseAuthenticate { */ public function getUser(CakeRequest $request) { if(!isset($_SERVER['PHP_AUTH_USER'])) { - if (isset($_SERVER['HTTP_AUTHORIZATION']) && (strlen($_SERVER['HTTP_AUTHORIZATION']) > 0)) { + if (isset($_SERVER['HTTP_AUTHORIZATION']) && strlen($_SERVER['HTTP_AUTHORIZATION']) > 0 && strpos($_SERVER['HTTP_AUTHORIZATION'], 'basic') !== false) { list($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']) = explode(':', base64_decode(substr($_SERVER['HTTP_AUTHORIZATION'], 6))); if(strlen($_SERVER['PHP_AUTH_USER']) === 0 || strlen($_SERVER['PHP_AUTH_PW']) === 0) { unset($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']);