diff options
| author | Piotr Sarnacki <drogus@gmail.com> | 2011-12-20 21:01:47 +0100 |
|---|---|---|
| committer | Piotr Sarnacki <drogus@gmail.com> | 2012-01-10 04:42:46 +0100 |
| commit | d65b76642637928f64c9aa092e305238eb3b6f4f (patch) | |
| tree | 4b730fba9edd27c53c9c2528fc2263af09239245 /actionpack/lib/action_controller | |
| parent | 79b12a0ffbffc05186d489e0f553aa8f2a50d5b7 (diff) | |
| download | rails-d65b76642637928f64c9aa092e305238eb3b6f4f.tar.gz rails-d65b76642637928f64c9aa092e305238eb3b6f4f.tar.bz2 rails-d65b76642637928f64c9aa092e305238eb3b6f4f.zip | |
Fix http digest authentication with trailing '/' or '?' (fixes #4038 and #3228)
Diffstat (limited to 'actionpack/lib/action_controller')
| -rw-r--r-- | actionpack/lib/action_controller/metal/http_authentication.rb | 13 |
1 files changed, 8 insertions, 5 deletions
diff --git a/actionpack/lib/action_controller/metal/http_authentication.rb b/actionpack/lib/action_controller/metal/http_authentication.rb index edff40a483..fcb21907a3 100644 --- a/actionpack/lib/action_controller/metal/http_authentication.rb +++ b/actionpack/lib/action_controller/metal/http_authentication.rb @@ -192,12 +192,15 @@ module ActionController return false unless password method = request.env['rack.methodoverride.original_method'] || request.env['REQUEST_METHOD'] - uri = credentials[:uri][0,1] == '/' ? request.fullpath : request.url + uri = credentials[:uri][0,1] == '/' ? request.original_fullpath : request.original_url - [true, false].any? do |password_is_ha1| - expected = expected_response(method, uri, credentials, password, password_is_ha1) - expected == credentials[:response] - end + [true, false].any? do |trailing_question_mark| + [true, false].any? do |password_is_ha1| + _uri = trailing_question_mark ? uri + "?" : uri + expected = expected_response(method, _uri, credentials, password, password_is_ha1) + expected == credentials[:response] + end + end end end |