The same error as bug 17720 can occur if the userid has unicode characters. Wide character in subroutine entry at /usr/share/perl5/Digest/HMAC.pm line 63.
Created attachment 58502 [details] [review] Bug 17830: CSRF - Handle unicode characters in userid If the userid of the logged in user contains unicode characters, the token will not be generated correctly and Koha will crash with: Wide character in subroutine entry at /usr/share/perl5/Digest/HMAC.pm line 63. Test plan: - Edit a superlibrarian user and set his/her userid to '❤' or any other strings with unicode characters. - Login using this patron - Search for patrons and click on a result. => Without this patch, you will get a software error (with "Wide character in subroutine entry" in the logs). => With this patch, everything will go fine You can also test the other files modified by this patch.
Created attachment 58515 [details] [review] [SIGNED-OFF]-Bug-17830-CSRF-Handle-unicode-characters in userid If the userid of the logged in user contains unicode characters, the token will not be generated correctly and Koha will crash with: Wide character in subroutine entry at /usr/share/perl5/Digest/HMAC.pm line 63. Test plan: - Edit a superlibrarian user and set his/her userid to '❤' or any other strings with unicode characters. - Login using this patron - Search for patrons and click on a result. => Without this patch, you will get a software error (with "Wide character in subroutine entry" in the logs). => With this patch, everything will go fine You can also test the other files modified by this patch. Signed-off-by: Karam Qubsi <karamqubsi@gmail.com> Patch is solving the problem as described .
Why not move those encodes to sub _gen_csrf in Token.pm? Since the source of this problem actually is WWW::CSRF, we could have this workaround closer to the call.
(In reply to Marcel de Rooy from comment #3) > Why not move those encodes to sub _gen_csrf in Token.pm? > Since the source of this problem actually is WWW::CSRF, we could have this > workaround closer to the call. I wanted to provide a quick and safe fix. Moving the encode to Koha::Token would have implied to move the existing ones as well (i.e. more changes).
Created attachment 58535 [details] [review] Bug 17830: CSRF - Handle unicode characters in userid If the userid of the logged in user contains unicode characters, the token will not be generated correctly and Koha will crash with: Wide character in subroutine entry at /usr/share/perl5/Digest/HMAC.pm line 63. Test plan: - Edit a superlibrarian user and set his/her userid to '❤' or any other strings with unicode characters. - Login using this patron - Search for patrons and click on a result. => Without this patch, you will get a software error (with "Wide character in subroutine entry" in the logs). => With this patch, everything will go fine You can also test the other files modified by this patch. Signed-off-by: Karam Qubsi <karamqubsi@gmail.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Pushed to master for 17.05, thanks Jonathan!
This patch has been pushed to 16.11.x and will be in 16.11.02.
patchset applied via BZ-18124 for 16.05.x, for 16.05.12 release