Ticket #57512: 57512_with_tests.diff

src/wp-includes/load.php

@@ -122 +122 @@
         $token    = substr( $header, 6 );
         $userpass = base64_decode( $token );
 
-        list( $user, $pass ) = explode( ':', $userpass );
+        // If there is no password provided, exit.
+        $exploded_basic_auth = explode( ':', $userpass );
+
+        if ( 2 !== count($exploded_basic_auth) ) {
+                return;
+        }
 
         // Now shove them in the proper keys where we're expecting later on.
-        $_SERVER['PHP_AUTH_USER'] = $user;
-        $_SERVER['PHP_AUTH_PW']   = $pass;
+        $_SERVER['PHP_AUTH_USER'] = $exploded_basic_auth[0];
+        $_SERVER['PHP_AUTH_PW']   = $exploded_basic_auth[1];
 }
 
 /**

tests/phpunit/tests/auth.php

@@ -675 +675 @@
                         'not allowed' => array( 'subscriber', false ),
                 );
         }
+
+        /*
+         * @ticket 57512
+         * @covers ::wp_populate_basic_auth_from_authorization_header
+         */
+        public function tests_basic_http_authentication_with_username_and_password() {
+                // username:password
+                $_SERVER['HTTP_AUTHORIZATION'] = 'Basic dXNlcm5hbWU6cGFzc3dvcmQ=';
+
+                wp_populate_basic_auth_from_authorization_header();
+
+                $this->assertSame($_SERVER['PHP_AUTH_USER'], 'username');
+                $this->assertSame($_SERVER['PHP_AUTH_PW'], 'password');
+        }
+
+        /*
+         * @ticket 57512
+         * @covers ::wp_populate_basic_auth_from_authorization_header
+         */
+        public function tests_basic_http_authentication_with_username_only() {
+                // username
+                $_SERVER['HTTP_AUTHORIZATION'] = 'Basic dXNlcm5hbWU=';
+
+                wp_populate_basic_auth_from_authorization_header();
+
+                $this->assertArrayNotHasKey('PHP_AUTH_USER', $_SERVER);
+                $this->assertArrayNotHasKey('PHP_AUTH_PW', $_SERVER);
+        }
+
+        /*
+         * @ticket 57512
+         * @covers ::wp_populate_basic_auth_from_authorization_header
+         */
+        public function tests_basic_http_authentication_with_more_than_2_parts() {
+                // username:password:foo
+                $_SERVER['HTTP_AUTHORIZATION'] = 'Basic dXNlcm5hbWU6cGFzc3dvcmQ6Zm9v';
+
+                wp_populate_basic_auth_from_authorization_header();
+
+                $this->assertArrayNotHasKey('PHP_AUTH_USER', $_SERVER);
+                $this->assertArrayNotHasKey('PHP_AUTH_PW', $_SERVER);
+        }
 }