Merge ~cjwatson/launchpad:basic-auth-password-bytes into launchpad:master

[Colin Watson]

Treat basic auth password as bytes

zope.publisher.http.HTTPRequest._authUserPW decodes the username and password in a basic auth header to bytes, so we must compare the password that way.

[Cristian Gonzalez (cristiangsp)]

Looks good!

review: Approve

diff --git a/lib/lp/services/webapp/authentication.py b/lib/lp/services/webapp/authentication.py
index 81a2384..c778407 100644
--- a/lib/lp/services/webapp/authentication.py
+++ b/lib/lp/services/webapp/authentication.py
@@ -69,7 +69,8 @@ class PlacelessAuthUtility:
             principal = login_src.getPrincipalByLogin(login)
             if principal is not None and principal.person.is_valid_person:
                 password = credentials.getPassword()
-                if password == config.launchpad.basic_auth_password:
+                if (password ==
+                        config.launchpad.basic_auth_password.encode('ASCII')):
                     # We send a LoggedInEvent here, when the
                     # cookie auth below sends a PrincipalIdentified,
                     # as the login form is never visited for BasicAuth.