I have a case where I need to use basic auth credentials to access an external resource for a feed import. The username has characters that need to be urlencoded in order to form a valid url.

As an example:
the username bob@smith.com
the password is password
the url is https://feed-source.com

Since the username has an '@' sign in it, we can't just use the url https://bob@smith.com:password@feed-source.com (and the form at /import/feed_name correctly says that this is an invalid url).

As a result we need to use something like https://bob%40smith.com:password@feed-source.com (notice the urlencoding of bob@smith.com becomes bob%40smith.com)

In http_request_get, the user and password get added to the headers as-is, causing an incorrect username to get set.

urldecoding the username and password as they get assigned to their variables after the url is parsed using parse_url prevents the issue from occurring.

CommentFileSizeAuthor
#1 http_fetcher_does_not-2468401-1.patch573 bytesjlandfried

Comments

jlandfried’s picture

Status: Active » Needs review
StatusFileSize
new573 bytes

patch that decodes the username and password variables as they get set.

  • twistor committed ecc18ab on 7.x-2.x authored by jiff
    Issue #2468401 by jiff: HTTP fetcher does not correctly decode...
twistor’s picture

Status: Needs review » Fixed

Looks right, thanks.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.