andrews-web-libraries/awl — pull request #2 by calestyo (2013-03-28 23:42:43+00:00)
Title: use full user names when the webserver does auth

* When the authentication has happened in the webserver, take the full
content of the "REMOTE_USER" or "REDIRECT_REMOTE_USER" as user name
and do not longer split of anything after any "@" character including
the "@".
As this behaviour was not really documented, it was actually a
security issue, especially when DAViCal serves multiple vhosts.

In my opinion it is generally a bad idea, if DAViCal mangles up a user name
given by some external authentication, as it cannot really always know what it
should do (the user@domain is just one possible scenario).
For that reason, if the admin wants to use only part of the externally provided
user name, it should be his duty, to have the user name modified outside of
DAViCal.
This is also the reason, why I did not follow up the idea of havin a
configuration option, which controls the behaviour.

This was further discussed at
https://github.com/andrews-web-libraries/awl/issues/1 .