diff options
| author | Steve Klabnik <steve@steveklabnik.com> | 2013-03-18 11:56:26 -0700 |
|---|---|---|
| committer | Steve Klabnik <steve@steveklabnik.com> | 2013-03-18 11:56:26 -0700 |
| commit | 2a5521eff8acd1bbe2176076c5c8f2fff186f5a2 (patch) | |
| tree | 4123dfc4f7f432044ec9179f0e4c9a82c4e207df | |
| parent | bfdd3c2182156fa2cb81ed4f048b065a2d6f1341 (diff) | |
| parent | 95332abe091d0fe8b6b108fffa8208af21a4cca0 (diff) | |
| download | rails-2a5521eff8acd1bbe2176076c5c8f2fff186f5a2.tar.gz rails-2a5521eff8acd1bbe2176076c5c8f2fff186f5a2.tar.bz2 rails-2a5521eff8acd1bbe2176076c5c8f2fff186f5a2.zip | |
Merge pull request #9022 from braddunbar/digest-basic-auth
Digest auth should not 500 when given a basic header.
| -rw-r--r-- | actionpack/CHANGELOG.md | 5 | ||||
| -rw-r--r-- | actionpack/lib/action_controller/metal/http_authentication.rb | 1 | ||||
| -rw-r--r-- | actionpack/test/controller/http_digest_authentication_test.rb | 8 |
3 files changed, 14 insertions, 0 deletions
diff --git a/actionpack/CHANGELOG.md b/actionpack/CHANGELOG.md index 69096443fe..97bd2bf97f 100644 --- a/actionpack/CHANGELOG.md +++ b/actionpack/CHANGELOG.md @@ -1,5 +1,10 @@ ## Rails 4.0.0 (unreleased) ## +* Ensure that digest authentication responds with a 401 status when a basic + header is received. + + *Brad Dunbar* + * Include I18n locale fallbacks in view lookup. Fixes GH#3512. diff --git a/actionpack/lib/action_controller/metal/http_authentication.rb b/actionpack/lib/action_controller/metal/http_authentication.rb index e295002b16..c7bb2dd147 100644 --- a/actionpack/lib/action_controller/metal/http_authentication.rb +++ b/actionpack/lib/action_controller/metal/http_authentication.rb @@ -299,6 +299,7 @@ module ActionController # allow a user to use new nonce without prompting user again for their # username and password. def validate_nonce(secret_key, request, value, seconds_to_timeout=5*60) + return false if value.nil? t = ::Base64.decode64(value).split(":").first.to_i nonce(secret_key, t) == value && (t - Time.now.to_i).abs <= seconds_to_timeout end diff --git a/actionpack/test/controller/http_digest_authentication_test.rb b/actionpack/test/controller/http_digest_authentication_test.rb index 537de7a2dd..4287856550 100644 --- a/actionpack/test/controller/http_digest_authentication_test.rb +++ b/actionpack/test/controller/http_digest_authentication_test.rb @@ -249,6 +249,14 @@ class HttpDigestAuthenticationTest < ActionController::TestCase assert_equal 'Definitely Maybe', @response.body end + test "when sent a basic auth header, returns Unauthorized" do + @request.env['HTTP_AUTHORIZATION'] = 'Basic Gwf2aXq8ZLF3Hxq=' + + get :display + + assert_response :unauthorized + end + private def encode_credentials(options) |