From c4fc291fa78ba620900dfd6106fc8528473f2a54 Mon Sep 17 00:00:00 2001
From: Lukas Reschke <lukas@statuscode.ch>
Date: Tue, 25 Sep 2012 19:57:40 +0200
Subject: [PATCH] Passwords containing a ":" don't work with this explode
Thanks to mETz
---
lib/base.php | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/lib/base.php b/lib/base.php
index 6b4dd789b2..f6afc8fe2f 100644
--- a/lib/base.php
+++ b/lib/base.php
@@ -303,14 +303,14 @@ class OC{
//set http auth headers for apache+php-cgi work around
if (isset($_SERVER['HTTP_AUTHORIZATION']) && preg_match('/Basic\s+(.*)$/i', $_SERVER['HTTP_AUTHORIZATION'], $matches)) {
- list($name, $password) = explode(':', base64_decode($matches[1]));
+ list($name, $password) = explode(':', base64_decode($matches[1]), 2);
$_SERVER['PHP_AUTH_USER'] = strip_tags($name);
$_SERVER['PHP_AUTH_PW'] = strip_tags($password);
}
//set http auth headers for apache+php-cgi work around if variable gets renamed by apache
if (isset($_SERVER['REDIRECT_HTTP_AUTHORIZATION']) && preg_match('/Basic\s+(.*)$/i', $_SERVER['REDIRECT_HTTP_AUTHORIZATION'], $matches)) {
- list($name, $password) = explode(':', base64_decode($matches[1]));
+ list($name, $password) = explode(':', base64_decode($matches[1]), 2);
$_SERVER['PHP_AUTH_USER'] = strip_tags($name);
$_SERVER['PHP_AUTH_PW'] = strip_tags($password);
}
--
GitLab