Bug #68380 [Opn->Nab]: Problem with HTTP authentication with PHP

Edit report at https://bugs.php.net/bug.php?id=68380&edit=1 ID: 68380 Updated by: requinix@php.net Reported by: thomaxz at gmail dot com Summary: Problem with HTTP authentication with PHP -Status: Open +Status: Not a bug Type: Bug Package: HTTP related Operating System: Unkowen PHP Version: Irrelevant Block user comment: N Private report: N New Comment: Sorry, but your problem does not imply a bug in PHP itself. For a list of more appropriate places to ask for help using PHP, please visit http://www.php.net/support.php as this bug system is not the appropriate forum for asking support questions. Due to the volume of reports we can not explain in detail here why your report is not a bug. The support channels will be able to provide an explanation for you. Thank you for your interest in PHP. You've made modifications to the example code so this isn't the right place to get help with it. But I will tell you that you're (at least) missing some {}s with the "analyze the PHP_AUTH_DIGEST variable" check. Previous Comments: ------------------------------------------------------------------------ [2014-11-08 18:41:50] thomaxz at gmail dot com Description: ------------ First of the, I use an online web hosting server so can't upgrade anything. PHP 5.3 When using Example 2 in the HTTP authentication with PHP article it works first, but when wrong creditnals is neter, it will be wrong forever. Which makes the user not able to login. Test script: --------------- $realm = "Hurra 2"; //user => password $users = array('tcx' => 'yesmrsir'); if (empty($_SERVER['PHP_AUTH_DIGEST'])) { header('WWW-Authenticate: Digest realm="'.$realm. '",qop="auth",nonce="'.uniqid().'",opaque="'.md5($realm).'"'); header($_SERVER["SERVER_PROTOCOL"].' 401 Unauthorized'); $txts='<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\"><html><head><title>403 Forbidden</title></head><body>'; $txts.='<h1>Forbidden</h1><p>You don\'t have permission to access ny.php on this server.</p><hr>'; $txts.='<address>Apache Server at example.com Port 80</address></body></html>'; die($txts); } // analyze the PHP_AUTH_DIGEST variable if (!($data = http_digest_parse($_SERVER['PHP_AUTH_DIGEST'])) || !isset($users[$data['username']])) header('WWW-Authenticate: Digest realm="'.$realm. '",qop="auth",nonce="'.uniqid().'",opaque="'.md5($realm).'"'); header($_SERVER["SERVER_PROTOCOL"].' 401 Unauthorized'); die('Wrong Credentials!'); var_dump($_SERVER['PHP_AUTH_DIGEST']); // generate the valid response $A1 = md5($data['username'] . ':' . $realm . ':' . $users[$data['username']]); $A2 = md5($_SERVER['REQUEST_METHOD'].':'.$data['uri']); $valid_response = md5($A1.':'.$data['nonce'].':'.$data['nc'].':'.$data['cnonce'].':'.$data['qop'].':'.$A2); if ($data['response'] != $valid_response) die('Wrong Credentials!'); // ok, valid username & password echo 'You are logged in as: ' . $data['username']; //comment reae change // function to parse the http auth header function http_digest_parse($txt) { // protect against missing data $needed_parts = array('nonce'=>1, 'nc'=>1, 'cnonce'=>1, 'qop'=>1, 'username'=>1, 'uri'=>1, 'response'=>1); $data = array(); preg_match_all('@(\w+)=(?:([\'"])([^$2]+)$2|([^\s,]+))@', $txt, $matches, PREG_SET_ORDER); foreach ($matches as $m) { $data[$m[1]] = $m[3] ? trim($m[3],"\",'") : trim($m[4],"\",'"); unset($needed_parts[$m[1]]); } return $needed_parts ? false : $data; } Expected result: ---------------- the user is able to renter creditals and then login. Actual result: -------------- the script show wrong crenditals and not show new login box ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=68380&edit=1