Notice when HTTP_PHP_AUTH_USER passed without pass

vitman · Vitali Tsyrkin · commit b541ffd1b615 · 2021-12-22T01:33:41.000+03:00
There is a chance to get notice when HTTP_PHP_AUTH_USER passed, but HTTP_PHP_AUTH_PW is not
diff --git a/src/Symfony/Component/HttpFoundation/ServerBag.php b/src/Symfony/Component/HttpFoundation/ServerBag.php
@@ -89,6 +89,7 @@ public function getHeaders()
 
         // PHP_AUTH_USER/PHP_AUTH_PW
         if (isset($headers['PHP_AUTH_USER'])) {
+            $headers['PHP_AUTH_PW'] = $headers['PHP_AUTH_PW'] ?? '';
             $headers['AUTHORIZATION'] = 'Basic '.base64_encode($headers['PHP_AUTH_USER'].':'.$headers['PHP_AUTH_PW']);
         } elseif (isset($headers['PHP_AUTH_DIGEST'])) {
             $headers['AUTHORIZATION'] = $headers['PHP_AUTH_DIGEST'];
diff --git a/src/Symfony/Component/HttpFoundation/Tests/ServerBagTest.php b/src/Symfony/Component/HttpFoundation/Tests/ServerBagTest.php
@@ -57,6 +57,17 @@ public function testHttpPasswordIsOptional()
         ], $bag->getHeaders());
     }
 
+    public function testHttpPasswordIsOptionalWhenPassedWithHttpPrefix()
+    {
+        $bag = new ServerBag(['HTTP_PHP_AUTH_USER' => 'foo']);
+
+        $this->assertEquals([
+            'AUTHORIZATION' => 'Basic '.base64_encode('foo:'),
+            'PHP_AUTH_USER' => 'foo',
+            'PHP_AUTH_PW' => '',
+        ], $bag->getHeaders());
+    }
+
     public function testHttpBasicAuthWithPhpCgi()
     {
         $bag = new ServerBag(['HTTP_AUTHORIZATION' => 'Basic '.base64_encode('foo:bar')]);
