[Bug 26586] New: xmlhttprequest basic authentication don't work

http://bugs.winehq.org/show_bug.cgi?id=26586

Summary: xmlhttprequest basic authentication don't work
           Product: Wine
           Version: 1.3.16
          Platform: x86
               URL: http://netikka.net/dev/basicauth.exe
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: -unknown
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]

Testsite/url: http://browserspy.dk/password-ok.php

Simple xmlhttprequest example: http://netikka.net/dev/basicauth.exe

Username and password is included in request. But response shows you did not
give username / password. Works ofcourse in Windows.

Source:

procedure TForm1.Button1Click(Sender: TObject);
var xmlhttp: variant;
s: string;
begin
 xmlhttp:=createoleobject('MSXML2.XMLHTTP.3.0');
 xmlhttp.open('GET', edit1.text, true, edit2.text, edit3.text);
 xmlhttp.send();
 while(xmlhttp.readystate<>4) do application.processmessages;
 s:=xmlhttp.responsetext;
 s:=copy(s, ansipos('<tbody>', s), length(s)-ansipos('<tbody>', s));
 s:=copy(s, 1, ansipos('</tbody>', s)-1);
 memo1.text:=s;
 if (ansipos(edit2.text, s)=0) or (ansipos(edit3.text, s)=0)
   then showmessage('Failed!');
end;

[Bug 26586] xmlhttprequest basic authentication don't work

http://bugs.winehq.org/show_bug.cgi?id=26586

--- Comment #1 from Dmitry Timoshkov  2011-03-29 08:48:18 CDT ---
Does installing msxml with winetricks help?

[Bug 26586] xmlhttprequest basic authentication don't work

http://bugs.winehq.org/show_bug.cgi?id=26586

--- Comment #2 from [e-mail] 2011-03-29 10:16:44 CDT ---
(In reply to comment #1)
> Does installing msxml with winetricks help?

I could not install winetricks msxml3 (resulted error)

Installed msxml6 and changed code to use 6.0.

http://netikka.net/dev/basicauth2.exe

This works with winetricks msxml6, but not without it!

[Bug 26586] xmlhttprequest basic authentication don't work

http://bugs.winehq.org/show_bug.cgi?id=26586

Austin English  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |download, testcase
             Status|UNCONFIRMED                 |NEW
          Component|-unknown                    |msxml3
     Ever Confirmed|0                           |1

--- Comment #3 from Austin English  2011-03-29 11:57:07 CDT ---
Confirming, native msxml3 fixes it for me.

[Bug 26586] xmlhttprequest basic authentication don't work

http://bugs.winehq.org/show_bug.cgi?id=26586

--- Comment #4 from Austin English  2011-03-29 11:58:37 CDT ---
Created an attachment (id=33851)
 --> (http://bugs.winehq.org/attachment.cgi?id=33851)
+msxml,+tid

[Bug 26586] xmlhttprequest basic authentication don't work

http://bugs.winehq.org/show_bug.cgi?id=26586

--- Comment #5 from Nikolay Sivov  2011-03-29 15:06:18 CDT ---
True, this shouldn't work. User/password strings are not used currently.
There's two ways to fix that as I remember when I added httprequest:

- proper way - implement missed urlmon part that calls IBindStatusCallback for
auth. info (I believe this is IAuthenticate);
- wrong way that could work probably - mess with headers inside msxml3. That
means to add manually some headers to request after receiving certain http
return codes. This won't always work probably.

[Bug 26586] xmlhttprequest basic authentication don't work

http://bugs.winehq.org/show_bug.cgi?id=26586

--- Comment #6 from [e-mail] 2011-04-01 10:34:19 CDT ---
Primary need is for https site, so hope possible fix also works in this case

[Bug 26586] xmlhttprequest basic authentication don't work

http://bugs.winehq.org/show_bug.cgi?id=26586

--- Comment #7 from [e-mail] 2011-07-28 09:12:17 CDT ---
About that second solution.

Simply if there is user & password given ->

xmlhttp.setrequestheader('Authorization', 'Basic
'+base64encode(edit2.text+':'+edit3.text));

Should be easy, if there is already base64 function in wine?

[Bug 26586] IXMLHTTPRequest basic authentication doesn't work

http://bugs.winehq.org/show_bug.cgi?id=26586

Nikolay Sivov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|xmlhttprequest basic        |IXMLHTTPRequest basic
                   |authentication don't work   |authentication doesn't work

[Bug 26586] IXMLHTTPRequest basic authentication doesn't work

http://bugs.winehq.org/show_bug.cgi?id=26586

--- Comment #8 from [e-mail] 2012-09-13 04:09:54 CDT ---
Still unimplemented wine-1.5.12-246-g92ad0a4

[Bug 26586] IXMLHTTPRequest basic authentication doesn't work

http://bugs.winehq.org/show_bug.cgi?id=26586

Nikolay Sivov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends on|                            |33214

[Bug 26586] IXMLHTTPRequest basic authentication doesn't work

http://bugs.winehq.org/show_bug.cgi?id=26586

Daniel Jelinski  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #9 from Daniel Jelinski  2013-03-15 08:46:39 CDT ---
(In reply to comment #5)
> - wrong way that could work probably - mess with headers inside msxml3. That
>
> means to add manually some headers to request after receiving certain http
> return codes. This won't always work probably.

Um, native msxml works around this bug. Doesn't that mean that this is the
right way to do it?

[Bug 26586] IXMLHTTPRequest basic authentication doesn't work

http://bugs.winehq.org/show_bug.cgi?id=26586

--- Comment #10 from Nikolay Sivov  2013-03-15 08:57:44 CDT ---
(In reply to comment #9)
> (In reply to comment #5)
> > - wrong way that could work probably - mess with headers inside msxml3. That
> >
> > means to add manually some headers to request after receiving certain http
> > return codes. This won't always work probably.
>
> Um, native msxml works around this bug. Doesn't that mean that this is the
> right way to do it?

No, it doesn't. Native msxml doesn't use urlmon as far as I know, but we do.

[Bug 26586] IXMLHTTPRequest basic authentication doesn't work

http://bugs.winehq.org/show_bug.cgi?id=26586

Jacek Caban  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #11 from Jacek Caban  2013-03-15 09:17:04 CDT ---
(In reply to comment #10)
> (In reply to comment #9)
> > (In reply to comment #5)
> > > - wrong way that could work probably - mess with headers inside msxml3. That
> > >
> > > means to add manually some headers to request after receiving certain http
> > > return codes. This won't always work probably.
> >
> > Um, native msxml works around this bug. Doesn't that mean that this is the
> > right way to do it?
>
> No, it doesn't. Native msxml doesn't use urlmon as far as I know, but we do.

I'm pretty sure it does. Also, if you pass username+password as part of URL,
utlmon should work fine.

[Bug 26586] IXMLHTTPRequest basic authentication doesn't work

http://bugs.winehq.org/show_bug.cgi?id=26586

--- Comment #12 from Nikolay Sivov  2013-03-15 09:28:46 CDT ---
(In reply to comment #11)
> (In reply to comment #10)
> > (In reply to comment #9)
> > > (In reply to comment #5)
> > > > - wrong way that could work probably - mess with headers inside msxml3. That
> > > >
> > > > means to add manually some headers to request after receiving certain http
> > > > return codes. This won't always work probably.
> > >
> > > Um, native msxml works around this bug. Doesn't that mean that this is the
> > > right way to do it?
> >
> > No, it doesn't. Native msxml doesn't use urlmon as far as I know, but we do.
>
> I'm pretty sure it does.

Okay, I wasn't sure about that.
> Also, if you pass username+password as part of URL,
> utlmon should work fine.

You mean in syntax like http://username:password@location? I can do that, what
about using IUriBuilder for that? Cause otherwise I'll need to crack it myself
and also local paths should not be affected by this too.

[Bug 26586] IXMLHTTPRequest basic authentication doesn't work

http://bugs.winehq.org/show_bug.cgi?id=26586

--- Comment #13 from Jacek Caban  2013-03-15 09:35:02 CDT ---
> > Also, if you pass username+password as part of URL,
> > utlmon should work fine.
>
> You mean in syntax like http://username:password@location? I can do that, what
> about using IUriBuilder for that? Cause otherwise I'll need to crack it myself
> and also local paths should not be affected by this too.

It sounds like a good solution for me.

[Bug 26586] IXMLHTTPRequest basic authentication doesn't work

http://bugs.winehq.org/show_bug.cgi?id=26586

Nikolay Sivov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|[e-mail]        |[e-mail]

--- Comment #14 from Nikolay Sivov  2013-03-15 10:11:41 CDT ---
Okay, let's do it.

[Bug 26586] IXMLHTTPRequest basic authentication doesn't work

http://bugs.winehq.org/show_bug.cgi?id=26586

--- Comment #15 from [e-mail] 2013-03-15 10:22:23 CDT ---
> http://username:password@location

Is that still supported in Windows, I had thought it was removed for security
reasons.

Thanks for looking into this, I changed my soft to use setrequestheader.

[Bug 26586] IXMLHTTPRequest basic authentication doesn't work

http://bugs.winehq.org/show_bug.cgi?id=26586

--- Comment #16 from Nikolay Sivov  2013-03-15 12:34:35 CDT ---
Patch sent http://www.winehq.org/pipermail/wine-patches/2013-March/122875.html,
and it seems to fix this test application.

[Bug 26586] IXMLHTTPRequest basic authentication doesn't work

http://bugs.winehq.org/show_bug.cgi?id=26586

--- Comment #17 from Nikolay Sivov  2013-03-17 12:23:47 CDT ---
(In reply to comment #15)
> > http://username:password@location
>
> Is that still supported in Windows, I had thought it was removed for security
> reasons.

I'm not sure what these reasons could be. In wine it works like that:

- you pass full uri including userinfo to urlmon;
- urlmon extracts username/password from it and passes it to wininet;
- wininet does its job as usual.

So basically it's just a way to pass userinfo to urlmon as I see it.

[Bug 26586] IXMLHTTPRequest basic authentication doesn't work

http://bugs.winehq.org/show_bug.cgi?id=26586

--- Comment #18 from [e-mail] 2013-03-18 00:50:19 CDT ---
I meant it doesn't work with native urlmon. If you do winetricks ie8 for
example, then there is

fixme:msxml:Authenticate_Authenticate (0x18fe08)->(0x190d7c 0x32ea80 0x32ea84)

And sample must be killed. Some links

http://support.microsoft.com/kb/834489/en-us
http://support.microsoft.com/kb/832414/en-us

[Bug 26586] IXMLHTTPRequest basic authentication doesn't work

http://bugs.winehq.org/show_bug.cgi?id=26586

--- Comment #19 from Nikolay Sivov  2013-03-18 01:48:32 CDT ---
Created attachment 43962
  --> http://bugs.winehq.org/attachment.cgi?id=43962
patch

(In reply to comment #18)
> I meant it doesn't work with native urlmon. If you do winetricks ie8 for
> example, then there is
>
> fixme:msxml:Authenticate_Authenticate (0x18fe08)->(0x190d7c 0x32ea80 0x32ea84)

I see. Please try attached patch.
> And sample must be killed. Some links
>
> http://support.microsoft.com/kb/834489/en-us
> http://support.microsoft.com/kb/832414/en-us

I see, so first article is for IE part only (urlmon), and second seems to be a
fix at msxml level, but I'm not sure. For some reason I can't install IE8 right
now, so please go ahead and test proposed fix. Hopefully it won't reject
modified uri and will still call this callback method.

[Bug 26586] IXMLHTTPRequest basic authentication doesn't work

http://bugs.winehq.org/show_bug.cgi?id=26586

--- Comment #20 from [e-mail] 2013-03-18 03:31:13 CDT ---
Yes, this patch works also in IE8.

But seems something is wrong, because sample from bug 26339 now crashes in
msxml. Any url is crash.

trace:msxml:XMLHTTPRequest_open (0x144100)->(L"GET" L"http://winehq.org"
{VT_BOOL: ffffffff})
trace:seh:raise_exception code=c0000005 flags=0 addr=0x2005be0f ip=2005be0f
tid=0009
trace:seh:raise_exception  info[0]=00000000
trace:seh:raise_exception  info[1]=00000000
...

[Bug 26586] IXMLHTTPRequest basic authentication doesn't work

http://bugs.winehq.org/show_bug.cgi?id=26586

Nikolay Sivov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #43962|0                           |1
        is obsolete|                            |

--- Comment #21 from Nikolay Sivov  2013-03-18 03:45:53 CDT ---
Created attachment 43963
  --> http://bugs.winehq.org/attachment.cgi?id=43963
patch2

This one should fix a crash.

[Bug 26586] IXMLHTTPRequest basic authentication doesn't work

http://bugs.winehq.org/show_bug.cgi?id=26586

--- Comment #22 from [e-mail] 2013-03-18 04:23:46 CDT ---
Now it works!

[Bug 26586] IXMLHTTPRequest basic authentication doesn't work

http://bugs.winehq.org/show_bug.cgi?id=26586

Nikolay Sivov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
      Fixed by SHA1|                            |448e939ebe3faeec2f837b1c44a
                   |                            |14c58e8ba93c5
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED

--- Comment #23 from Nikolay Sivov  2013-03-26 23:10:53 CDT ---
Should work now with both builtin and native urlmon,
448e939ebe3faeec2f837b1c44a14c58e8ba93c5.

[Bug 26586] IXMLHTTPRequest basic authentication doesn't work

http://bugs.winehq.org/show_bug.cgi?id=26586

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #24 from Alexandre Julliard  2013-03-29 13:32:42 CDT ---
Closing bugs fixed in 1.5.27.

[Bug 26586] IXMLHTTPRequest basic authentication doesn't work

https://bugs.winehq.org/show_bug.cgi?id=26586

Nikolay Sivov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|[e-mail]        |[e-mail]