diff --git a/src/Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener.php b/src/Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener.php index b679f4d251..2bc4aa550f 100644 --- a/src/Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener.php +++ b/src/Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener.php @@ -157,7 +157,7 @@ class DigestData public function getUsername() { - return $this->elements['username']; + return strtr($this->elements['username'], array("\\\"" => "\"", "\\\\" => "\\")); } public function validateAndDecode($entryPointKey, $expectedRealm) diff --git a/tests/Symfony/Tests/Component/Security/Http/Firewall/DigestDataTest.php b/tests/Symfony/Tests/Component/Security/Http/Firewall/DigestDataTest.php index d201c8f6df..cfb929cacc 100644 --- a/tests/Symfony/Tests/Component/Security/Http/Firewall/DigestDataTest.php +++ b/tests/Symfony/Tests/Component/Security/Http/Firewall/DigestDataTest.php @@ -48,7 +48,7 @@ class DigestDataTest extends \PHPUnit_Framework_TestCase 'response="b52938fc9e6d7c01be7702ece9031b42"' ); - $this->assertEquals('\"user\"', $digestAuth->getUsername()); + $this->assertEquals('"user"', $digestAuth->getUsername()); } public function testGetUsernameWithQuoteAndEscape() @@ -60,7 +60,7 @@ class DigestDataTest extends \PHPUnit_Framework_TestCase 'response="b52938fc9e6d7c01be7702ece9031b42"' ); - $this->assertEquals('\"u\\\\\"ser\"', $digestAuth->getUsername()); + $this->assertEquals('"u\\"ser"', $digestAuth->getUsername()); } public function testGetUsernameWithSingleQuote() @@ -72,7 +72,19 @@ class DigestDataTest extends \PHPUnit_Framework_TestCase 'response="b52938fc9e6d7c01be7702ece9031b42"' ); - $this->assertEquals('\"u\'ser\"', $digestAuth->getUsername()); + $this->assertEquals('"u\'ser"', $digestAuth->getUsername()); + } + + public function testGetUsernameWithSingleQuoteAndEscape() + { + $digestAuth = new DigestData( + 'username="\"u\\\'ser\"", realm="Welcome, robot!", ' . + 'nonce="MTM0NzMyMTgyMy42NzkzOmRlZjM4NmIzOGNjMjE0OWJiNDU0MDAxNzJmYmM1MmZl", ' . + 'uri="/path/info?p1=5&p2=5", cnonce="MDIwODkz", nc=00000001, qop="auth", ' . + 'response="b52938fc9e6d7c01be7702ece9031b42"' + ); + + $this->assertEquals('"u\\\'ser"', $digestAuth->getUsername()); } public function testGetUsernameWithEscape() @@ -84,7 +96,7 @@ class DigestDataTest extends \PHPUnit_Framework_TestCase 'response="b52938fc9e6d7c01be7702ece9031b42"' ); - $this->assertEquals('\"u\\ser\"', $digestAuth->getUsername()); + $this->assertEquals('"u\\ser"', $digestAuth->getUsername()); } public function testValidateAndDecode()