ZF-10286: Zend_Auth_Adapater_Digest does not read entire file on blank lines
Description
After a good 5 minutes of login failures during development using a digest authentification, I finally realized what was going on: my file has a blank line in it.
Look at the source code, I noticed that, on line 214 (in the authenticate() method), the while block condition fails whenever a blank line is found in the digest file.
Since this is not written in the docs, it should be added about this behavior. Or better yet, the condition should be modified to read the entire file regardless of empty lines. In the PHP manual (http://php.net/manual/en/function.fgets.php) the demo shows a similar while, but using feof($fileHandle) instead. Which gives more flexibility and ensures that the entire file is read before exiting the while block.
For example :
// line 214
while (!@feof($fileHandle)) {
$line = trim(fgets($fileHandle));
if (!empty($line) && substr($line, 0, $idLength) === $id) {
if (substr($line, -32) === md5("$this->_username:$this->_realm:$this->_password")) {
$result['code'] = Zend_Auth_Result::SUCCESS;
} else {
$result['code'] = Zend_Auth_Result::FAILURE_CREDENTIAL_INVALID;
$result['messages'][] = 'Password incorrect';
}
return new Zend_Auth_Result($result['code'], $result['identity'], $result['messages']);
}
}
Comments
Posted by Adam Lundrigan (adamlundrigan) on 2012-05-29T14:49:43.000+0000
Patch w/ Test:
The above test passes without any modification to the existing {{Zend_Auth_Adapter_Http_Resolver_File}} class.