| Subject: | Authentication failure with password containing colon |
| Date: | Sun, 30 Dec 2018 09:14:50 +0100 |
| To: | bug-Mojolicious-Plugin-BasicAuthPlus [...] rt.cpan.org |
| From: | Jan Paul Schmidt <jps [...] signal42.de> |
When authenticating against AD using LDAP, passwords containing a colon fail.
It looks like not all cases are considered.
The following patch seems to fix this.
$diff -u BasicAuthPlus.pm.orig BasicAuthPlus.pm
--- BasicAuthPlus.pm.orig 2018-06-16 02:36:17.000000000 +0200
+++ BasicAuthPlus.pm 2018-12-30 09:03:59.003376597 +0100
@@ -42,16 +42,14 @@
# No credentials entered
return {realm => $realm} if !$auth and !$callback and !$params;
- # Split $auth into username and password (which may contain ":" )
- my ($auth_username, $auth_password) = ($1, $2)
- if $auth =~ /^([^:]+):(.*)/;
+ my ($auth_username, $auth_password) = _split_auth($auth);
# Hash for return data
my %data;
$data{username} = $auth_username if $auth_username;
# Verification within callback
- return (\%data, 1) if $callback and $callback->(split /:/, $auth, 2);
+ return (\%data, 1) if $callback and $callback->(_split_auth($auth));
# Verified with realm => username => password syntax
return (\%data, 1) if $auth eq ($username || '') . ":$password";
@@ -98,7 +96,8 @@
}
sub _split_auth {
- my ($username, $password) = split ':', $_[0];
+ # Split $auth into username and password (which may contain ":")
+ my ($username, $password) = split ':', $_[0], 2;
$username = '' unless defined $username;
$password = '' unless defined $password;