N°9954 - Login-basic incompatible with OAuth2 server - #1018
Conversation
|
| Filename | Overview |
|---|---|
| application/loginbasic.class.inc.php | Refactors Basic-mode detection to parse credentials first, but the seven-character prefix removal corrupts standard Basic authorization headers. |
| tests/php-unit-tests/unitary-tests/application/LoginFSM/LoginBasicTest.php | Adds mode-detection coverage for Bearer values, but does not cover the standard Authorization: Basic path affected by the parser change. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Authorization header] --> B[GetAuthUserAndPassword]
B --> C[Remove authorization prefix]
C --> D[Base64 decode]
D --> E{Decoded value contains colon?}
E -->|Yes| F[Set login_mode to basic]
E -->|No| G[Leave login mode unset]
F --> H[Read and validate credentials]
Reviews (1): Last reviewed commit: "N°9954 - Login-basic incompatible with O..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
Updates basic-auth detection to avoid conflicts with OAuth2 Bearer tokens and adds coverage.
Changes:
- Refactors credential extraction and mode detection.
- Adds tests for authorization-header handling.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
application/loginbasic.class.inc.php |
Refines authentication header parsing. |
tests/php-unit-tests/unitary-tests/application/LoginFSM/LoginBasicTest.php |
Adds login-mode detection tests. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| // Decode without Bearer | ||
| $sDecodedAuthorisation = base64_decode(substr($sAuthorization, 7)); | ||
| if (str_contains($sDecodedAuthorisation, ':')) { | ||
| return explode(':', $sDecodedAuthorisation); | ||
| } | ||
|
|
||
| return null; |
| } elseif (isset($_SERVER['REDIRECT_HTTP_AUTHORIZATION']) && !empty($_SERVER['REDIRECT_HTTP_AUTHORIZATION'])) { | ||
| Session::Set('login_mode', 'basic'); | ||
| } elseif (isset($_SERVER['PHP_AUTH_USER'])) { | ||
| if (!is_null($this->GetAuthUserAndPassword())) { |
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
N°9954 - Login-basic incompatible with OAuth2 server