Ticket #57512: 57512_with_tests_2.diff

src/wp-includes/load.php

@@ -122 +122 @@
         $token    = substr( $header, 6 );
         $userpass = base64_decode( $token );
 
-        list( $user, $pass ) = explode( ':', $userpass );
+        // There must be at least one colon in the string
+        if ( ! str_contains( $userpass, ':' ) ) {
+                return;
+        }
+
+        list( $user, $pass ) = explode( ':', $userpass, 2 );
 
         // Now shove them in the proper keys where we're expecting later on.
         $_SERVER['PHP_AUTH_USER'] = $user;

tests/phpunit/tests/auth.php

@@ -675 +675 @@
                         'not allowed' => array( 'subscriber', false ),
                 );
         }
+
+        /*
+         * @ticket 57512
+         * @covers ::wp_populate_basic_auth_from_authorization_header
+         */
+        public function tests_basic_http_authentication_with_username_and_password() {
+                // username:password
+                $_SERVER['HTTP_AUTHORIZATION'] = 'Basic dXNlcm5hbWU6cGFzc3dvcmQ=';
+
+                wp_populate_basic_auth_from_authorization_header();
+
+                $this->assertSame($_SERVER['PHP_AUTH_USER'], 'username');
+                $this->assertSame($_SERVER['PHP_AUTH_PW'], 'password');
+        }
+
+        /*
+         * @ticket 57512
+         * @covers ::wp_populate_basic_auth_from_authorization_header
+         */
+        public function tests_basic_http_authentication_with_username_only() {
+                // username
+                $_SERVER['HTTP_AUTHORIZATION'] = 'Basic dXNlcm5hbWU=';
+
+                wp_populate_basic_auth_from_authorization_header();
+
+                $this->assertArrayNotHasKey('PHP_AUTH_USER', $_SERVER);
+                $this->assertArrayNotHasKey('PHP_AUTH_PW', $_SERVER);
+        }
+
+        /*
+         * @ticket 57512
+         * @covers ::wp_populate_basic_auth_from_authorization_header
+         */
+        public function tests_basic_http_authentication_with_more_than_2_parts() {
+                // username:pass:word
+                $_SERVER['HTTP_AUTHORIZATION'] = 'Basic dXNlcm5hbWU6cGFzczp3b3Jk';
+
+                wp_populate_basic_auth_from_authorization_header();
+
+                $this->assertSame($_SERVER['PHP_AUTH_USER'], 'username');
+                $this->assertSame($_SERVER['PHP_AUTH_PW'], 'pass:word');
+        }
 }