Proxy authentication is ignored by Requests

[francescobagnoli]

in wp-config.php

define('WP_PROXY_HOST',     '172.16.XXX.XXX');
define('WP_PROXY_PORT',     '3128');
define('WP_PROXY_USERNAME', 'XXX');
define('WP_PROXY_PASSWORD', 'XXX');

in function.php

$headers['X-Forwarded-For'] = $_SERVER['REMOTE_ADDR'];
$response = wp_remote_get('http://example.com/', array('headers' => $headers));

the proxy server raise an exception on authentication failed.

debugging i see in Requests_Proxy_HTTP class, $use_authentication property is always false and in curl_before_send() method if $use_authentication is false curl_setopt CURLOPT_PROXYUSERPWD is never set. If I force $use_authentication to be true, everything works.

the fix for me is edit /wp-includes/class-http.php line 354:

$options['proxy'] = new Requests_Proxy_HTTP( $proxy->host() . ':' . $proxy->port() );
if ( $proxy->use_authentication() ) {
    $options['proxy']->user = $proxy->username();
    $options['proxy']->pass = $proxy->password();
}

change to

if ( $proxy->use_authentication() ) {
    $options['proxy']->user = $proxy->username();
    $options['proxy']->pass = $proxy->password();
                                
    $options['proxy'] = new Requests_Proxy_HTTP( array($proxy->host() . ':' . $proxy->port(), $proxy->username(), $proxy->password()) );
} else {
    $options['proxy'] = new Requests_Proxy_HTTP( $proxy->host() . ':' . $proxy->port() );
}

This because Requests_Proxy_HTTP set $use_authentication property to true, only if Requests_Proxy_HTTP::__construct() has 3 parameters

public function __construct($args = null) {
    if (is_string($args)) {
        $this->proxy = $args;
    }
    elseif (is_array($args)) {
        if (count($args) == 1) {
            list($this->proxy) = $args;
        }
        elseif (count($args) == 3) {
            list($this->proxy, $this->user, $this->pass) = $args;
            $this->use_authentication = true;
        }
        else {
            throw new Requests_Exception('Invalid number of arguments', 'proxyhttpbadargs');
        }
    }
}

[ocean90]

Hello @francescobagnoli, welcome to our Trac!

Thanks for your detailed report, I've added 37494.patch​ which includes your suggested fix.

[ocean90]

37494.2.patch​ is an alternative but I think 37494.patch​ looks better. @rmccue, what do you think?

[francescobagnoli]

@ocean90 Requests_Proxy_HTTP set $use_authentication property to true, only if Requests_Proxy_HTTP::construct() an array parameter with 3 args!

<?php
$options['proxy'] = new Requests_Proxy_HTTP( array($proxy->host() . ':' . $proxy->port(), $proxy->username(), $proxy->password()) );

[ocean90]

Like 37494.patch, but uses an array

[rmccue]

37494.2.patch​ looks like the best option to me; the property is intentionally public, and marked as part of the public API, so it's fine to use it.

[ocean90]

Replying to rmccue:

37494.2.patch​ looks like the best option to me; the property is intentionally public, and marked as part of the public API, so it's fine to use it.

Fine by me, as long as you're not planning to make them private or so. 😉

[ocean90]

@dd32 Could you please review 37494.2.patch​?

[dd32]

I personally prefer branching and not doing it conditionally like this, so 37494.3.patch​ is how I'd personally do it (although it needs to remove the first $options['proxy'] = new ..).

However, as @rmccue notes, use_authentication (along with user and pass) are public and so a valid approach and consistent with the existing code, so 37494.2.patch​ also has my +1 for commit

[ocean90]

In 38173:

HTTP API: Set $use_authentication property of Requests_Proxy_HTTP to true when proxy authentication is required.

Props francescobagnoli for initial patch.
Fixes #37494.