*************EDIT ***************************
if you look at this bug fix https://support.ellislab.com/bugs/detail/17402 it fixes part of the problem this is there the real issue is
/system/expressionengine/libraries/auth.php line 139
function authenticate_http_basic
/**
* Authenticate from basic http auth
*
* @access public
*/
public function authenticate_http_basic($not_allowed_groups = array(),$realm='Authentication Required')
{
$always_disallowed = array(2, 3, 4);
$not_allowed_groups = array_merge($not_allowed_groups, $always_disallowed);
if ( ! $this->_retrieve_http_basic())
{
@header('WWW-Authenticate: Basic realm="'.$realm.'"');
$this->EE->output->set_status_header(401);
@header("Date: ".gmdate("D, d M Y H:i:s")." GMT");
exit("HTTP/1.0 401 Unauthorized");
}
return TRUE;
}
$not_allowed_groups is being set but its never being checked against anything. Im currently trying to work on a fix for this.
One fix I’ve found so far is passing $now_allowed_groups to _authenticate() line 425. But i haven’t tested this enough to even suggest it for a production site and wouldn’t suggest doing it.
******************Notice With Fix ***************************
So I found a way to correct the issue with authenticate_http_basic(). you can find my fix here. https://gist.github.com/2600813 . Please if you find any bugs or issues let me know so I can fix them.
