WebDAV: don't send Basic Auth via http (FDO #57248)

Sending basic authentication headers via http is insecure.
Only do it when the connection is encrypted and thus
protects the information.

1 files changed, 14 insertions, 10 deletions

diff --git a/src/backends/webdav/NeonCXX.cpp b/src/backends/webdav/NeonCXX.cpp
index 26a6ea58..5092af21 100644
--- a/src/backends/webdav/NeonCXX.cpp
+++ b/src/backends/webdav/NeonCXX.cpp
@@ -341,17 +341,21 @@ void Session::preSend(ne_request *req, ne_buffer *header)
         // only do this once
         m_forceAuthorizationOnce = false;
 
-        // append "Authorization: Basic" header if not present already
-        if (!boost::starts_with(header->data, "Authorization:") &&
-            !strstr(header->data, "\nAuthorization:")) {
-            std::string credentials = m_forceUsername + ":" + m_forcePassword;
-            SmartPtr<char *> blob(ne_base64((const unsigned char *)credentials.c_str(), credentials.size()));
-            ne_buffer_concat(header, "Authorization: Basic ", blob.get(), "\r\n", NULL);
-        }
+        if (m_uri.m_scheme == "https") {
+            // append "Authorization: Basic" header if not present already
+            if (!boost::starts_with(header->data, "Authorization:") &&
+                !strstr(header->data, "\nAuthorization:")) {
+                std::string credentials = m_forceUsername + ":" + m_forcePassword;
+                SmartPtr<char *> blob(ne_base64((const unsigned char *)credentials.c_str(), credentials.size()));
+                ne_buffer_concat(header, "Authorization: Basic ", blob.get(), "\r\n", NULL);
+            }
 
-        // check for acceptance of credentials later
-        m_credentialsSent = true;
-        SE_LOG_DEBUG(NULL, NULL, "forced sending credentials");
+            // check for acceptance of credentials later
+            m_credentialsSent = true;
+            SE_LOG_DEBUG(NULL, NULL, "forced sending credentials");
+        } else {
+            SE_LOG_DEBUG(NULL, NULL, "skipping forced sending credentials because not using https");
+        }
     }
 }