Fix: HTTP Basic Auth fails when password contains colons (#5153) * Fix: HTTP Basic Auth fails when password contains colons The credentials in HTTP Basic Auth are formatted as base64(username:password). Per RFC 7617, the username must not contain a colon, but the password can. The previous code used `.split(':')` which splits on all colons, truncating passwords that contain ':' characters. Fix by splitting only on the first colon. * Use spread syntax for credential parsing

df0e1256e67276f203bb2dc93ba747bb18df8f26

HimeHina <1545340072@qq.com>

Signed

src/middleware/basicAuth.js+2 -1 Viewed

+    }
     const usePerUserAuth = PER_USER_BASIC_AUTH && ENABLE_ACCOUNTS;
-    const [username, password] = Buffer.from(credentials, 'base64')
+    const [username, ...passwordParts] = Buffer.from(credentials, 'base64')
         .toString('utf8')
         .split(':');
+    const password = passwordParts.join(':');
     if (!usePerUserAuth && username === basicAuthUserName && password === basicAuthUserPassword) {
         return callback();

src/users.js+2 -1 Viewed

         return false;
+    }
-    const [username, password] = Buffer.from(credentials, 'base64')
+    const [username, ...passwordParts] = Buffer.from(credentials, 'base64')
         .toString('utf8')
         .split(':');
+    const password = passwordParts.join(':');
     const userHandles = await getAllUserHandles();
     for (const userHandle of userHandles) {