summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--htaccess.sample5
-rw-r--r--lib/apiauth.php14
2 files changed, 14 insertions, 5 deletions
diff --git a/htaccess.sample b/htaccess.sample
index 37eb8e01e..18a868698 100644
--- a/htaccess.sample
+++ b/htaccess.sample
@@ -5,6 +5,11 @@
RewriteBase /mublog/
+ ## Uncomment these if having trouble with API authentication
+ ## when PHP is running in CGI or FastCGI mode.
+ #RewriteCond %{HTTP:Authorization} ^(.*)
+ #RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]
+
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule (.*) index.php?p=$1 [L,QSA]
diff --git a/lib/apiauth.php b/lib/apiauth.php
index 32502399f..17f803a1c 100644
--- a/lib/apiauth.php
+++ b/lib/apiauth.php
@@ -294,11 +294,15 @@ class ApiAuthAction extends ApiAction
function basicAuthProcessHeader()
{
- if (isset($_SERVER['AUTHORIZATION'])
- || isset($_SERVER['HTTP_AUTHORIZATION'])
- ) {
- $authorization_header = isset($_SERVER['HTTP_AUTHORIZATION'])
- ? $_SERVER['HTTP_AUTHORIZATION'] : $_SERVER['AUTHORIZATION'];
+ $authHeaders = array('AUTHORIZATION',
+ 'HTTP_AUTHORIZATION',
+ 'REDIRECT_HTTP_AUTHORIZATION'); // rewrite for CGI
+ $authorization_header = null;
+ foreach ($authHeaders as $header) {
+ if (isset($_SERVER[$header])) {
+ $authorization_header = $_SERVER[$header];
+ break;
+ }
}
if (isset($_SERVER['PHP_AUTH_USER'])) {