BasicAuthenticate - added check to avoid parsing if "Authorization: B…

…earer <token>" is in place
cakephp · Mar 15, 2017 · a15c5c7 · a15c5c7
1 parent f5795f0
commit a15c5c7
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/Cake/Controller/Component/Auth/BasicAuthenticate.php b/lib/Cake/Controller/Component/Auth/BasicAuthenticate.php
@@ -83,7 +83,7 @@ public function authenticate(CakeRequest $request, CakeResponse $response) {
  */
 	public function getUser(CakeRequest $request) {
 		if(!isset($_SERVER['PHP_AUTH_USER'])) {
-		    if (isset($_SERVER['HTTP_AUTHORIZATION']) && (strlen($_SERVER['HTTP_AUTHORIZATION']) > 0)) {
+		    if (isset($_SERVER['HTTP_AUTHORIZATION']) && strlen($_SERVER['HTTP_AUTHORIZATION']) > 0 && strpos($_SERVER['HTTP_AUTHORIZATION'], 'basic') !== false) {
 		        list($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']) = explode(':', base64_decode(substr($_SERVER['HTTP_AUTHORIZATION'], 6)));
 		        if(strlen($_SERVER['PHP_AUTH_USER']) === 0 || strlen($_SERVER['PHP_AUTH_PW']) === 0) {
 		            unset($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']);