mirror of
https://github.com/php/php-src.git
synced 2026-10-29 02:07:35 +08:00
Daniel Scherzer
ed8ff1ec53
The server previously responded with a copy of the requested "Host" header in the response, without any validation. That header, as defined in RFC 9110, is intended for use in *requests*; remove it from the responses.
37 lines
1.0 KiB
PHP
37 lines
1.0 KiB
PHP
--TEST--
|
|
Digest Authentication
|
|
--SKIPIF--
|
|
<?php
|
|
include "skipif.inc";
|
|
?>
|
|
--FILE--
|
|
<?php
|
|
include "php_cli_server.inc";
|
|
php_cli_server_start('var_dump(!isset($_SERVER["PHP_AUTH_USER"]), !isset($_SERVER["PHP_AUTH_PW"]), $_SERVER["PHP_AUTH_DIGEST"]);');
|
|
|
|
$host = PHP_CLI_SERVER_HOSTNAME;
|
|
$fp = php_cli_server_connect();
|
|
|
|
if(fwrite($fp, <<<HEADER
|
|
GET / HTTP/1.1
|
|
Host: {$host}
|
|
Authorization: digest username="Mufasa", realm="testrealm@host.com", nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093", uri="/dir/index.html", qop=auth, nc=00000001, cnonce="0a4f113b", response="6629fae49393a05397450978507c4ef1", opaque="5ccc069c403ebaf9f0171e9517f40e41"
|
|
|
|
|
|
HEADER
|
|
)) {
|
|
fpassthru($fp);
|
|
}
|
|
|
|
?>
|
|
--EXPECTF--
|
|
HTTP/1.1 200 OK
|
|
Date: %s
|
|
Connection: close
|
|
X-Powered-By: PHP/%s
|
|
Content-type: text/html; charset=UTF-8
|
|
|
|
bool(true)
|
|
bool(true)
|
|
string(242) "username="Mufasa", realm="testrealm@host.com", nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093", uri="/dir/index.html", qop=auth, nc=00000001, cnonce="0a4f113b", response="6629fae49393a05397450978507c4ef1", opaque="5ccc069c403ebaf9f0171e9517f40e41""
|