AtHeartEngineer/rails
1
1
Fork 0
mirror of https://github.com/github/rails.git synced 2026-01-09 14:48:08 -05:00
Code Issues Packages Projects Releases Wiki Activity

Fix http digest authentication with trailing '/' or '?' (fixes #4038 and #3228)

Browse Source
This commit is contained in:
Piotr Sarnacki
2011-12-20 21:01:47 +01:00
parent 79b12a0ffb
commit d65b766426
2 changed files with 51 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
actionpack/lib/action_controller/metal/http_authentication.rb
View File

@@ -192,12 +192,15 @@ module ActionController
return false unless password
method = request.env['rack.methodoverride.original_method'] || request.env['REQUEST_METHOD']
uri = credentials[:uri][0,1] == '/' ? request.fullpath : request.url
uri = credentials[:uri][0,1] == '/' ? request.original_fullpath : request.original_url
[true, false].any? do |password_is_ha1|
expected = expected_response(method, uri, credentials, password, password_is_ha1)
expected == credentials[:response]
end
[true, false].any? do |trailing_question_mark|
[true, false].any? do |password_is_ha1|
_uri = trailing_question_mark ? uri + "?" : uri
expected = expected_response(method, _uri, credentials, password, password_is_ha1)
expected == credentials[:response]
end
end
end
end

45
actionpack/test/controller/http_digest_authentication_test.rb
View File

@@ -139,7 +139,7 @@ class HttpDigestAuthenticationTest < ActionController::TestCase
test "authentication request with request-uri that doesn't match credentials digest-uri" do
@request.env['HTTP_AUTHORIZATION'] = encode_credentials(:username => 'pretty', :password => 'please')
@request.env['PATH_INFO'] = "/http_digest_authentication_test/dummy_digest/altered/uri"
@request.env['ORIGINAL_FULLPATH'] = "/http_digest_authentication_test/dummy_digest/altered/uri"
get :display
assert_response :unauthorized
@@ -208,6 +208,44 @@ class HttpDigestAuthenticationTest < ActionController::TestCase
assert !ActionController::HttpAuthentication::Digest.validate_digest_response(@request, "SuperSecret"){nil}
end
test "authentication request with request-uri ending in '/'" do
@request.env['PATH_INFO'] = "/http_digest_authentication_test/dummy_digest/"
@request.env['HTTP_AUTHORIZATION'] = encode_credentials(:username => 'pretty', :password => 'please')
# simulate normalizing PATH_INFO
@request.env['PATH_INFO'] = "/http_digest_authentication_test/dummy_digest"
get :display
assert_response :success
assert_equal 'Definitely Maybe', @response.body
end
test "authentication request with request-uri ending in '?'" do
@request.env['PATH_INFO'] = "/http_digest_authentication_test/dummy_digest/?"
@request.env['HTTP_AUTHORIZATION'] = encode_credentials(:username => 'pretty', :password => 'please')
# simulate normalizing PATH_INFO
@request.env['PATH_INFO'] = "/http_digest_authentication_test/dummy_digest"
get :display
assert_response :success
assert_equal 'Definitely Maybe', @response.body
end
test "authentication request with absolute uri in credentials (as in IE) ending with /" do
@request.env['PATH_INFO'] = "/http_digest_authentication_test/dummy_digest/"
@request.env['HTTP_AUTHORIZATION'] = encode_credentials(:uri => "http://test.host/http_digest_authentication_test/dummy_digest/",
:username => 'pretty', :password => 'please')
# simulate normalizing PATH_INFO
@request.env['PATH_INFO'] = "/http_digest_authentication_test/dummy_digest"
get :display
assert_response :success
assert assigns(:logged_in)
assert_equal 'Definitely Maybe', @response.body
end
private
def encode_credentials(options)
@@ -228,7 +266,10 @@ class HttpDigestAuthenticationTest < ActionController::TestCase
credentials = decode_credentials(@response.headers['WWW-Authenticate'])
credentials.merge!(options)
credentials.merge!(:uri => @request.env['PATH_INFO'].to_s)
path_info = @request.env['PATH_INFO'].to_s
uri = options[:uri] || path_info
credentials.merge!(:uri => uri)
@request.env["ORIGINAL_FULLPATH"] = path_info
ActionController::HttpAuthentication::Digest.encode_credentials(method, credentials, password, options[:password_is_ha1])
end