Password of "0" ignored in drupal_http_request() [#1282986]

Yet another example of empty("0") returning TRUE and causing issues.

  // If the server URL has a user then attempt to use basic authentication.
  if (isset($uri['user'])) {
    $options['headers']['Authorization'] = 'Basic ' . base64_encode($uri['user'] . (!empty($uri['pass']) ? ":" . $uri['pass'] : ''));
  }

$uri['pass'] comes from parsing the URL, so something like this will demonstrate the issue:

drupal_http_request('http://bob:0@localhost');

Comment	File	Size	Author
#2	empty-password-http-request-1282986-2.patch	691 bytes	valthebald

Comments

Comment #1

lyricnz commented 18 September 2011 at 12:46

Issue tags:

+Novice

Code should probably check for array_key_exists()

Comment #2

valthebald

Sofia

commented 18 September 2011 at 15:15

Status	File	Size
new	empty-password-http-request-1282986-2.patch	691 bytes

Replaced !empty() with isset() + replaced double quotes "" with ''

Comment #3

valthebald

Sofia

commented 18 September 2011 at 15:16

Status:

Active

» Needs review

Comment #4

rickmanelius commented 18 September 2011 at 17:35

I'm unable to recreate the issue with the current 8.x dev snapshot. I tested against 2 sites: one with a browser password required and another publicly available one. I took the response of drupal_http_request('http://user:0@site') and output the results using dpm.

On a site with a browser password
When I used the correct user/pass, I got a 200 response ok.
When I used the incorrect user/pass, I get a 401 response (authorization required)
When I use "0" or "" for the password, I also get a 401 response.

On a site without a browser password, there is never an issue.

What response are you getting in order to recreate? Or is there supposed to be a different error than 401?