From 9f37b488503f5315a1b2821abdce76371570cbc4 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Mon, 7 Apr 2014 16:45:59 +0200 Subject: [PATCH] Bug 11944: Authentication The password should be encoded before hashing. Test plan: - Before applying the patch, create a user with a password "XXXX" - apply patches - try to log in - change the password - log out - try to log in Signed-off-by: Paola Rossi Signed-off-by: Bernardo Gonzalez Kriegel replaced string with XXXX, sorry --- C4/Auth.pm | 4 ++++ Koha/AuthUtils.pm | 3 +++ 2 files changed, 7 insertions(+) diff --git a/C4/Auth.pm b/C4/Auth.pm index 6cd72e7..ce75d5e 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -32,6 +32,7 @@ use C4::VirtualShelves; use Koha::AuthUtils qw(hash_password); use POSIX qw/strftime/; use List::MoreUtils qw/ any /; +use Encode qw( encode is_utf8); # use utf8; use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout); @@ -1542,6 +1543,9 @@ sub checkpw { sub checkpw_internal { my ( $dbh, $userid, $password ) = @_; + $password = Encode::encode( 'UTF-8', $password ) + if Encode::is_utf8($password); + my $sth = $dbh->prepare( "select password,cardnumber,borrowernumber,userid,firstname,surname,branchcode,flags from borrowers where userid=?" diff --git a/Koha/AuthUtils.pm b/Koha/AuthUtils.pm index a8024d9..b748c1b 100644 --- a/Koha/AuthUtils.pm +++ b/Koha/AuthUtils.pm @@ -19,6 +19,7 @@ package Koha::AuthUtils; use Modern::Perl; use Crypt::Eksblowfish::Bcrypt qw(bcrypt en_base64); +use Encode qw( encode is_utf8 ); use Fcntl qw/O_RDONLY/; # O_RDONLY is used in generate_salt use base 'Exporter'; @@ -51,6 +52,8 @@ user passwords. # Using Bcrypt method for hashing. This can be changed to something else in future, if needed. sub hash_password { my $password = shift; + $password = Encode::encode( 'UTF-8', $password ) + if Encode::is_utf8($password); # Generate a salt if one is not passed my $settings = shift; -- 1.7.9.5