[asterisk-bugs] [Asterisk 0010961]: [patch] Add HTTP Basic Authentication Scheme (rfc2617) for manager web interface.

[noreply at bugs.digium.com]

A NOTE has been added to this issue. 
====================================================================== 
http://bugs.digium.com/view.php?id=10961 
====================================================================== 
Reported By:                ys
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   10961
Category:                   Core/HTTP
Reproducibility:            N/A
Severity:                   feature
Priority:                   normal
Status:                     new
Asterisk Version:            SVN 
SVN Branch (only for SVN checkouts, not tarball releases):  trunk 
SVN Revision (number only!): 85514 
Disclaimer on File?:        N/A 
Request Review:              
====================================================================== 
Date Submitted:             10-12-2007 06:48 CDT
Last Modified:              11-13-2007 07:34 CST
====================================================================== 
Summary:                    [patch] Add HTTP Basic Authentication Scheme
(rfc2617) for manager web interface.
Description: 
I found, that manager web interface used "Cookie" Header for authenticate
the user. This require two http request, one for authenticate and next for
commands.
This patch add only Basic authentication scheme implementation, as defined
in rfc2617.
If used this scheme, httptimeout are unused, but we don't need to keep a
http session (and mansession) alive, after HTTP Request is processed.







====================================================================== 

---------------------------------------------------------------------- 
 ys - 11-13-07 07:34  
---------------------------------------------------------------------- 
I upload new patch for SVN branch-1.4.

There I implement the following functionality:

manager.c:
Save cpu time:
Loading all manager user information into memory and prepare ACL, read and
write permissions in init_manager() function.
authenticate(): Don't read file (users.conf and manager.conf) at manager
connection event, use item cached in memory.

http.c:
* Basic authentication scheme implementation (rfc2617)
* NETWORK SECURITY: Add global ACL  permit/deny check for TCP
connections.
Add config lock (mutex) for reload process. 

Issue History 
Date Modified   Username       Field                    Change               
====================================================================== 
11-13-07 07:34  ys             Note Added: 0073568                          
======================================================================