fix: Use PHP_AUTH_PW for strict password confirmation

Signed-off-by: Marcel Müller <marcel-mueller@gmx.de>

Author: SystemKeeper

lib/private/AppFramework/Http/Request.php

@@ -272,6 +272,8 @@ public function getHeader(string $name): string {
 			case 'CONTENT_TYPE':
 			case 'CONTENT_LENGTH':
 			case 'REMOTE_ADDR':
+			case 'PHP_AUTH_USER':
+			case 'PHP_AUTH_PW':
 				if (isset($this->server[$name])) {
 					return $this->server[$name];
 				}

lib/private/AppFramework/Middleware/Security/PasswordConfirmationMiddleware.php

@@ -84,11 +84,12 @@ public function beforeController(Controller $controller, string $methodName) {
 
 		$reflectionMethod = new ReflectionMethod($controller, $methodName);
 		if ($this->isPasswordConfirmationStrict($reflectionMethod)) {
-			$authHeader = $this->request->getHeader('Authorization');
-			if (!str_starts_with(strtolower($authHeader), 'basic ')) {
+			$password = $this->request->getHeader('PHP_AUTH_PW');
+
+			if ($password === '') {
 				throw new NotConfirmedException('Required authorization header missing');
 			}
-			[, $password] = explode(':', base64_decode(substr($authHeader, 6)), 2);
+
 			$loginName = $this->session->get('loginname');
 			$loginResult = $this->userManager->checkPassword($loginName, $password);
 			if ($loginResult === false) {