[ ijbswa-Patches-3615021 ] upstream proxy with 'Basic' authentication

Patches item #3615021, was opened at 2013-09-17 21:37
Message generated for change (Comment added) made by fabiankeil
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=311118&aid=3615021&group_id=11118

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
>Category: other
>Group: None
>Status: Pending
Resolution: None
Priority: 5
Private: No
Submitted By: lsoltero (lsoltero)
>Assigned to: Fabian Keil (fabiankeil)
>Summary: upstream proxy with 'Basic' authentication

Initial Comment:

the following patch to proxy 3.0.21 adds upstream proxy authentication of the type

user:password@host:port

sample usage

forward  /  johndoe:boguspw@upstreamproxy:8000



----------------------------------------------------------------------

>Comment By: Fabian Keil (fabiankeil)
Date: 2013-09-18 06:00

Message:
Thanks a lot for the patch.

I think the following issues have to be addressed before it can be
committed:

1. It lacks documentation (doc/source/p-config.sgml)
2. It sends the Basic authentication header unconditionally and doesn't
deal with 407 responses which might occur if the proxy uses a different
authentication scheme.
3. The password is hidden for a LOG_LEVEL_CONNECT message but will still be
shown when viewing the config file through the CGI interface which by
default is available for all Privoxy users while the log file should only
be accessible for the Privoxy administrator.
4. A couple of style issues. strcpy and strpcat shouldn't be used in new
code either.
5. The buffer sizes seem arbitrary (200, 256, 512) and if they aren't
sufficient it looks like the token will be silently truncated due to lack
of error checking.

Also note that Privoxy already sort of "supports" Basic authentication by
adding a custom header with the pre-computed value.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=311118&aid=3615021&group_id=11118

------------------------------------------------------------------------------
LIMITED TIME SALE - Full Year of Microsoft Training For Just $49.99!
1,500+ hours of tutorials including VisualStudio 2012, Windows 8, SharePoint
2013, SQL 2012, MVC 4, more. BEST VALUE: New Multi-Library Power Pack includes
Mobile, Cloud, Java, and UX Design. Lowest price ever! Ends 9/20/13. 
http://pubads.g.doubleclick.net/gampad/clk?id=58041151&iu=/4140/ostg.clktrk