View | Details | Raw Unified | Return to bug 37816
Collapse All | Expand All

(-)a/C4/SIP/Sip.pm (+36 lines)
Lines 230-237 sub siplog { Link Here
230
230
231
    my $message = @args ? sprintf($mask, @args) : $mask;
231
    my $message = @args ? sprintf($mask, @args) : $mask;
232
232
233
    $message = remove_password_from_message( $message );
234
233
    my $logger = C4::SIP::Logger::get_logger();
235
    my $logger = C4::SIP::Logger::get_logger();
234
    $logger->$method($message) if $logger;
236
    $logger->$method($message) if $logger;
235
}
237
}
236
238
239
# remove_password_from_message( $message )
240
#
241
# Look for the fields AC, AD and CO, and replace contents with three asterisks.
242
# We do this by looking for:
243
#   delimiter + AC/AD/CO + something + delimiter
244
# and replcing it with:
245
#   delimiter + field name + asterisks + delimiter
246
#
247
# Messages and fields that can contain passwords:
248
#   23 Patron Status Request - AC terminal password - AD patron password
249
#   11 Checkout - AC terminal password - AD patron password
250
#   09 Checkin - AC terminal password
251
#   01 Block Patron - AC terminal password
252
#   93 Login - CO login password
253
#   63 Patron Information - AC terminal password - AD patron password
254
#   35 End Patron Session - AC terminal password - AD patron password
255
#   37 Fee Paid - AC terminal password - AD patron password
256
#   17 Item Information - AC terminal password
257
#   19 Item Status Update - AC terminal password
258
#   25 Patron Enable - AC terminal password- AD patron password
259
#   15 Hold - AC terminal password - AD patron password
260
#   29 Renew - AC terminal password - AD patron password
261
#   65 Renew All - AC terminal password - AD patron password
262
263
sub remove_password_from_message {
264
    my ( $message ) = @_;
265
266
    $message =~ s/\Q${field_delimiter}\EAC.*?\Q${field_delimiter}\E/${field_delimiter}AC***${field_delimiter}/g;
267
    $message =~ s/\Q${field_delimiter}\EAD.*?\Q${field_delimiter}\E/${field_delimiter}AD***${field_delimiter}/g;
268
    $message =~ s/\Q${field_delimiter}\ECO.*?\Q${field_delimiter}\E/${field_delimiter}CO***${field_delimiter}/g;
269
270
    return $message;
271
}
272
237
1;
273
1;
(-)a/t/db_dependent/SIP/Sip.t (-1 / +53 lines)
Line 0 Link Here
0
- 
1
#!/usr/bin/perl
2
3
# This test is db dependent: SIPServer needs MsgType which needs Auth.
4
# And Auth needs config vars and prefences in its BEGIN block.
5
6
# This file is part of Koha.
7
#
8
# Koha is free software; you can redistribute it and/or modify it
9
# under the terms of the GNU General Public License as published by
10
# the Free Software Foundation; either version 3 of the License, or
11
# (at your option) any later version.
12
#
13
# Koha is distributed in the hope that it will be useful, but
14
# WITHOUT ANY WARRANTY; without even the implied warranty of
15
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16
# GNU General Public License for more details.
17
#
18
# You should have received a copy of the GNU General Public License
19
# along with Koha; if not, see <http://www.gnu.org/licenses>.
20
21
use Modern::Perl;
22
23
use Test::More tests => 1;
24
25
use C4::SIP::Sip;
26
27
subtest 'remove_password_from_message' => sub {
28
    plan tests => 8;
29
30
    is( C4::SIP::Sip::remove_password_from_message( "INPUT MSG: '9300CNterm1|COterm1|CPCPL|'" ),
31
                                                     "INPUT MSG: '9300CNterm1|CO***|CPCPL|'", "93 Login - password" );
32
33
    is( C4::SIP::Sip::remove_password_from_message( "INPUT MSG: '9300CNterm1|COt|CPCPL|'" ),
34
                                                     "INPUT MSG: '9300CNterm1|CO***|CPCPL|'", "93 Login - short password" );
35
36
    is( C4::SIP::Sip::remove_password_from_message( "INPUT MSG: '9300CNterm1|CO%&/()=+qwerty123456|CPCPL|'" ),
37
                                                     "INPUT MSG: '9300CNterm1|CO***|CPCPL|'", "93 Login - Complex password" );
38
39
    is( C4::SIP::Sip::remove_password_from_message( "INPUT MSG: '9300CNterm1|CO1234|CPCPL|'" ),
40
                                                     "INPUT MSG: '9300CNterm1|CO***|CPCPL|'", "93 Login - PIN" );
41
42
    is( C4::SIP::Sip::remove_password_from_message( "11YN20240903    134450                  AOCPL|AA23529000035676|AB39999000003697|AC1234|AD1234|BON" ),
43
                                                    '11YN20240903    134450                  AOCPL|AA23529000035676|AB39999000003697|AC***|AD***|BON', "11 Checkout" );
44
45
    is( C4::SIP::Sip::remove_password_from_message( "11YN20240903    134450                  AOCPL|AA23529000035676|AB39999000003697|AC|AD1234|BON" ),
46
                                                    '11YN20240903    134450                  AOCPL|AA23529000035676|AB39999000003697|AC***|AD***|BON', "11 Checkout - empty AC" );
47
48
    is( C4::SIP::Sip::remove_password_from_message( "11YN20240903    134450                  AOCPL|AA23529000035676|AB39999000003697|AC1234|AD|BON" ),
49
                                                    '11YN20240903    134450                  AOCPL|AA23529000035676|AB39999000003697|AC***|AD***|BON', "11 Checkout - empty AD" );
50
51
    is( C4::SIP::Sip::remove_password_from_message( "11YN20240903    134450                  AOCPL|AA23529000035676|AB39999000003697|AC|AD|BON" ),
52
                                                    '11YN20240903    134450                  AOCPL|AA23529000035676|AB39999000003697|AC***|AD***|BON', "11 Checkout - empty AC and AND" );
53
};

Return to bug 37816