[Security] Fixed digest authentication

Digest authentication fail if digest parameters contains `=` character or `, ` string.
[Security] Fixed digest authentication

Digest authentication fail if digest parameters contains `=` character or `, ` string.

* Support escaped characters
fixed CS
[Security] added test extra for digest authentication
[Security] remove escape charters from username provided by Digest DigestAuthenticationListener
merged branch sstok/fix_digest_authentication (PR #5874)

This PR was merged into the 2.0 branch.

Commits
-------

f2cbea3 [Security] remove escape charters from username provided by Digest DigestAuthenticationListener
80f6992 [Security] added test extra for digest authentication
d66b03c fixed CS
694697d [Security] Fixed digest authentication
c067586 [Security] Fixed digest authentication

Discussion
----------

Fix digest authentication

Bug fix: yes
Feature addition: no
Backwards compatibility break: no
Symfony2 tests pass: yes
Fixes the following tickets:
Todo: -
License of the code: MIT
Documentation PR: -
Replaces: #5485

This adds the missing fixes.

My only concerns is the ```\"``` removing.
```\"``` is only needed for the HTTP transport, but keeping them would require to also store the username with the escapes as well.

---------------------------------------------------------------------------

by fabpot at 2012-10-30T11:25:28Z

The digest authentication mechanism is not that widespread due to its limitation. And the transport is not HTTP, I think we are talking about very few cases.

---------------------------------------------------------------------------

by sstok at 2012-10-30T12:49:14Z

Apache seems to remove (ignore) escape characters.

```c
if (auth_line[0] == '=') {
            auth_line++;
            while (apr_isspace(auth_line[0])) {
                auth_line++;
            }

            vv = 0;
            if (auth_line[0] == '\"') {         /* quoted string */
                auth_line++;
                while (auth_line[0] != '\"' && auth_line[0] != '\0') {
                    if (auth_line[0] == '\\' && auth_line[1] != '\0') {
                        auth_line++;            /* escaped char */
                    }
                    value[vv++] = *auth_line++;
                }
                if (auth_line[0] != '\0') {
                    auth_line++;
                }
            }
            else {                               /* token */
                while (auth_line[0] != ',' && auth_line[0] != '\0'
                       && !apr_isspace(auth_line[0])) {
                    value[vv++] = *auth_line++;
                }
            }
            value[vv] = '\0';
        }
```

But would this change be a BC break for people already using quotes but without a comma and thus they never hit this bug?

The change it self is minimum, just calling ```str_replace('\\\\', '\\', str_replace('\\"', '"', $value))``` when getting the username.

---------------------------------------------------------------------------

by fabpot at 2012-11-13T13:00:12Z

@sstok Doing the same as Apache seems the best option here (just document the BC break).

---------------------------------------------------------------------------

by sstok at 2012-11-15T16:05:00Z

Hopefully I did this correct, but the needed escapes seem correctly removed.
`\"` is changed to `"` `\\` is changed to `\`
`\'` it kept as it is, as this needs no correcting.

@Vincent-Simonin Can you verify please.

---------------------------------------------------------------------------

by Vincent-Simonin at 2012-11-19T09:28:18Z

Authentication didn't work with this configuration :

```
providers:
    in_memory:
        name: in_memory
        users:
            te"st: { password: test, roles: [ 'ROLE_USER' ] }
```

`te"st` was set in authentication form's user field.

(Must we also escape `"` in configuration file ?)

Tests were performed with nginx.

---------------------------------------------------------------------------

by sstok at 2012-11-19T09:33:34Z

Yes. YAML escapes using an duplicate quote, like SQL.

```yaml
providers:
    in_memory:
        name: in_memory
        users:
            "te""st": { password: test, roles: [ 'ROLE_USER' ] }
```