MD5 Response fix

B0mb3tt4 · chriskacerguis · commit 570d4579c4cc · 2019-02-16T15:45:32.000-06:00
diff --git a/application/libraries/REST_Controller.php b/application/libraries/REST_Controller.php
@@ -2108,7 +2108,7 @@ protected function _prepare_digest_auth()
         }
 
         $md5 = md5(strtoupper($this->request->method).':'.$digest['uri']);
-        $valid_response = md5($username.':'.$digest['nonce'].':'.$digest['nc'].':'.$digest['cnonce'].':'.$digest['qop'].':'.$md5);
+        $valid_response = md5($digest['username'].':'.$digest['nonce'].':'.$digest['nc'].':'.$digest['cnonce'].':'.$digest['qop'].':'.$md5);
 
         // Check if the string don't compare (case-insensitive)
         if (strcasecmp($digest['response'], $valid_response) !== 0)

Original file line number	Diff line number	Diff line change
`@@ -2108,7 +2108,7 @@ protected function _prepare_digest_auth()`
`2108`	`2108`	`}`
`2109`	`2109`
`2110`	`2110`	`$md5 = md5(strtoupper($this->request->method).':'.$digest['uri']);`
`2111`		`- $valid_response = md5($username.':'.$digest['nonce'].':'.$digest['nc'].':'.$digest['cnonce'].':'.$digest['qop'].':'.$md5);`
	`2111`	`+ $valid_response = md5($digest['username'].':'.$digest['nonce'].':'.$digest['nc'].':'.$digest['cnonce'].':'.$digest['qop'].':'.$md5);`
`2112`	`2112`
`2113`	`2113`	`// Check if the string don't compare (case-insensitive)`
`2114`	`2114`	`if (strcasecmp($digest['response'], $valid_response) !== 0)`