Re: PHP 4.0 Bug #10464 Updated: PHP_AUTH_PW is not set altough PHP_AUTH_USER is
| From: | Rasmus Lerdorf | Date: | Thu, 26 Apr 2001 16:44:19 +0000 |
| Subject: | Re: PHP 4.0 Bug #10464 Updated: PHP_AUTH_PW is not set altough PHP_AUTH_USER is | ||
| References: | 1 | Groups: | php.dev |
| Request: | Send a blank email to php-dev+get-52510@lists.php.net to get a copy of this message | ||
> I figured out that our webmaster took special care
> for passwords - we have AFS here and AFS passwords are
> often used to authenticate Web stuff.
>
> Therefore he somehow deletes PHO_AUTH_PW before my script
> gets executed.
>
> Sorry for the wrong bug - the real bug is that I need to
> be able to tell PHP not to reveal passwords already used
> by Apache for some kind of authentication.
But even if PHP tries to hide this, you can still get it straight from the
browser headers. It will be in the Authentication header using trivial
base64 encoding. A base64_decode() on the authentication header will
reveal the username and password.
-Rasmus