summaryrefslogtreecommitdiff
path: root/lib/apiauth.php
diff options
context:
space:
mode:
authorBrion Vibber <brion@pobox.com>2010-03-17 10:52:11 -0700
committerBrion Vibber <brion@pobox.com>2010-03-17 10:52:11 -0700
commit1c942afa60b7ec5a8f0855a14d32110837270119 (patch)
tree8c408eb36595dcad36b649bc7d730b590c74846d /lib/apiauth.php
parentb9fc4c24b44ba8a83448f3ea8e0698c689d74d19 (diff)
Workaround for HTTP authentication in the API when running PHP as CGI/FastCGI. Example rewrite lines added as comments in htaccess.sample, API tweaked to accept alternate environment var form.
Diffstat (limited to 'lib/apiauth.php')
-rw-r--r--lib/apiauth.php14
1 files changed, 9 insertions, 5 deletions
diff --git a/lib/apiauth.php b/lib/apiauth.php
index 32502399f..17f803a1c 100644
--- a/lib/apiauth.php
+++ b/lib/apiauth.php
@@ -294,11 +294,15 @@ class ApiAuthAction extends ApiAction
function basicAuthProcessHeader()
{
- if (isset($_SERVER['AUTHORIZATION'])
- || isset($_SERVER['HTTP_AUTHORIZATION'])
- ) {
- $authorization_header = isset($_SERVER['HTTP_AUTHORIZATION'])
- ? $_SERVER['HTTP_AUTHORIZATION'] : $_SERVER['AUTHORIZATION'];
+ $authHeaders = array('AUTHORIZATION',
+ 'HTTP_AUTHORIZATION',
+ 'REDIRECT_HTTP_AUTHORIZATION'); // rewrite for CGI
+ $authorization_header = null;
+ foreach ($authHeaders as $header) {
+ if (isset($_SERVER[$header])) {
+ $authorization_header = $_SERVER[$header];
+ break;
+ }
}
if (isset($_SERVER['PHP_AUTH_USER'])) {