[Bug] Http::sendHttpRequest() drops HTTP auth credentials when the username or password is "0"

[snake14]

What happened?

Http::sendHttpRequest() silently drops HTTP auth credentials when the username or password is exactly 0, and the request fails with 401 as though they were wrong.

The cURL transport gates them on !empty($httpUsername) && !empty($httpPassword) (core/Http.php:813 on 6.x-dev, :816 on 5.x-dev), and empty('0') is true in PHP. The socket transport does not agree: it uses || and then encodes the raw values (:398 / :401), so it authenticates correctly with the same credentials. Which transport runs decides whether the request succeeds.

What should happen?

A password of 0 is a valid password and should be sent, by both transports.

How can this be reproduced?

Call Http::sendHttpRequest() against a Basic-auth endpoint through the cURL transport:

• password test → 200
• password 0 → 401

Matomo version

6.x-dev and 5.x-dev (same guard in both)

PHP version

Any — empty('0') is true in every supported version.

What browsers are you seeing the problem on?

Not applicable (e.g. an API call etc.)

Validations

• Read our Contributing Guidelines.
• Follow our Security Policy.
• Check that there isn't already an issue that reports the same bug to avoid creating duplicates.
• The provided steps to reproduce is a minimal reproducible of the Bug.