http://api.drupal.org/api/drupal/includes--common.inc/function/drupal_ht...
Is the function I am referring to encase anyone needs it.
I would create a patch for common.inc but I am in a bit of a crunch and already found a work around.
On line 863 of common.inc
$options['headers']['Authorization'] = 'Basic ' . base64_encode($uri['user'] . (isset($uri['pass']) ? ':' . $uri['pass'] : ''));
This is the faulty code it should look like this
$options['headers']['Authorization'] = 'Basic ' . base64_encode($uri['user'] . (isset($uri['pass']) ? ':' . $uri['pass'] : ':'));
Even when the password is empty you still want to set a colon there for server side compatibility. Without it a server will return a fault code because it is not to spec http://en.wikipedia.org/wiki/Basic_access_authentication I know that link never says anything like 'always send a colon' but it also never says to not include it. So I am also looking to get feedback as to why it is programmed to do it in this manner if you disagree with the change, Thanks.
| Comment | File | Size | Author |
|---|---|---|---|
| #11 | 1414368-dhr-empty-password-authorization.patch | 691 bytes | dave reid |
| #8 | drupalhttprequestcolond8-1414368-8.patch | 710 bytes | coolestdude1 |
| #7 | httprequestcolond7-1414368-7.patch | 690 bytes | coolestdude1 |
| #3 | drupalhttprequestcolon-1414368-3.patch | 711 bytes | coolestdude1 |
| #2 | drupalhttprequestcolon-1414368-2.patch | 691 bytes | coolestdude1 |
Comments
Comment #1
coolestdude1 commentedStill Exists in latest version.
Comment #2
coolestdude1 commentedHere is the patch file associated with d7, ill get d8 in a sec.
Comment #3
coolestdude1 commentedHere is the drupal 8 version patch
Comment #4
nod_wouldn't it be better to put the ':' before the condition since it's there anyway?
Comment #5
nod_sorry about that.
Comment #6
coolestdude1 commentedYup you are right ill have to change this on Monday but the patch is still a good representation of the change. The d7 one will fail as long as the version number is mismatching ..... meh details.
Comment #7
coolestdude1 commentedhere is the d7 patch, d8 to follow
Comment #8
coolestdude1 commentedd8 patch
Comment #9
lva commentedPlease note that this is also a problem in Drupal 6.
Also keep in mind that the patch should not only fix the Basic Authentication to the web server, but also to the Proxy server (see Proxy-Authorization).
Comment #10
mikeytown2 commentedD8 now has Guzzle.
Moving this issue to D7.
Comment #11
dave reidConfirmed this causes major issues with any kind of API that users username only and no passwords. Just a re-roll, so marking as RTBC.
Comment #12
David_Rothstein commentedCommitted to 7.x - thanks! http://drupalcode.org/project/drupal.git/commit/76bc39e
Wondering... does the Proxy-Authorization header (further up in drupal_http_request()) need the same fix?
Comment #13
David_Rothstein commentedWas also mentioned above that this patch affects Drupal 6.