adulau/cakephp2-php8
1
0
Fork 0
mirror of https://github.com/kamilwylegala/cakephp2-php8.git synced 2024-11-15 03:18:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Whitelist more URL-y characters in digest parsing.

Browse source 
Android clients include a full URL instead of just the URI. Also handle
situations where URLencoded bytes and document fragments are used.

Refs #3779
This commit is contained in:
mark_story 2014-06-23 14:39:35 -04:00
parent 59c3b73f7a
commit b4bcd74e60
2 changed files with 24 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
lib/Cake/Controller/Component/Auth/DigestAuthenticate.php
View file

@ -1,7 +1,5 @@
<?php <?php
/** /**
*
*
* CakePHP(tm) : Rapid Development Framework (http://cakephp.org) * CakePHP(tm) : Rapid Development Framework (http://cakephp.org)
* Copyright (c) Cake Software Foundation, Inc. (http://cakefoundation.org) * Copyright (c) Cake Software Foundation, Inc. (http://cakefoundation.org)
* *
@ -164,7 +162,7 @@ class DigestAuthenticate extends BasicAuthenticate {
} }
$keys = $match = array(); $keys = $match = array();
$req = array('nonce' => 1, 'nc' => 1, 'cnonce' => 1, 'qop' => 1, 'username' => 1, 'uri' => 1, 'response' => 1); $req = array('nonce' => 1, 'nc' => 1, 'cnonce' => 1, 'qop' => 1, 'username' => 1, 'uri' => 1, 'response' => 1);
preg_match_all('/(\w+)=([\'"]?)([a-zA-Z0-9@=.\/_-]+)\2/', $digest, $match, PREG_SET_ORDER); preg_match_all('/(\w+)=([\'"]?)([a-zA-Z0-9\:\#\%@=.\/_-]+)\2/', $digest, $match, PREG_SET_ORDER);
foreach ($match as $i) { foreach ($match as $i) {
$keys[$i[1]] = $i[3]; $keys[$i[1]] = $i[3];

23
lib/Cake/Test/Case/Controller/Component/Auth/DigestAuthenticateTest.php
View file

@ -242,6 +242,29 @@ DIGEST;
$this->assertNull($result); $this->assertNull($result);
} }
/**
* Test parsing a full URI. While not part of the spec some mobile clients will do it wrong.
*
* @return void
*/
public function testParseAuthDataFullUri() {
$digest = <<<DIGEST
Digest username="admin",
realm="192.168.0.2",
nonce="53a7f9b83f61b",
uri="http://192.168.0.2/pvcollection/sites/pull/HFD%200001.json#fragment",
qop=auth,
nc=00000001,
cnonce="b85ff144e496e6e18d1c73020566ea3b",
response="5894f5d9cd41d012bac09eeb89d2ddf2",
opaque="6f65e91667cf98dd13464deaf2739fde"
DIGEST;
$expected = 'http://192.168.0.2/pvcollection/sites/pull/HFD%200001.json#fragment';
$result = $this->auth->parseAuthData($digest);
$this->assertSame($expected, $result['uri']);
}
/** /**
* test parsing digest information with email addresses * test parsing digest information with email addresses
* *