View | Details | Raw Unified | Return to bug 37816
Collapse All | Expand All

(-)a/C4/SIP/Sip.pm (-3 / +51 lines)
Lines 1-6 Link Here
1
#
1
2
# Sip.pm: General Sip utility functions
2
=head1 NAME
3
#
3
4
C4::SIP::Sip - General Sip utility functions
5
6
=cut
4
7
5
package C4::SIP::Sip;
8
package C4::SIP::Sip;
6
9
Lines 231-238 sub siplog { Link Here
231
234
232
    my $message = @args ? sprintf($mask, @args) : $mask;
235
    my $message = @args ? sprintf($mask, @args) : $mask;
233
236
237
    $message = remove_password_from_message($message);
238
234
    my $logger = C4::SIP::Logger::get_logger();
239
    my $logger = C4::SIP::Logger::get_logger();
235
    $logger->$method($message) if $logger;
240
    $logger->$method($message) if $logger;
236
}
241
}
237
242
243
=head2 remove_password_from_message
244
245
  my $safe_message = remove_password_from_message( $message );
246
247
Look for the fields AC, AD and CO, and replace contents with three asterisks.
248
249
We do this by looking for:
250
251
  delimiter + AC/AD/CO + something + delimiter
252
253
and replcing it with:
254
255
  delimiter + field name + asterisks + delimiter
256
257
Messages and fields that can contain passwords:
258
259
  23 Patron Status Request - AC terminal password - AD patron password
260
  11 Checkout - AC terminal password - AD patron password
261
  09 Checkin - AC terminal password
262
  01 Block Patron - AC terminal password
263
  93 Login - CO login password
264
  63 Patron Information - AC terminal password - AD patron password
265
  35 End Patron Session - AC terminal password - AD patron password
266
  37 Fee Paid - AC terminal password - AD patron password
267
  17 Item Information - AC terminal password
268
  19 Item Status Update - AC terminal password
269
  25 Patron Enable - AC terminal password- AD patron password
270
  15 Hold - AC terminal password - AD patron password
271
  29 Renew - AC terminal password - AD patron password
272
  65 Renew All - AC terminal password - AD patron password
273
274
=cut
275
276
sub remove_password_from_message {
277
    my ($message) = @_;
278
279
    $message =~ s/\Q${field_delimiter}\EAC.*?\Q${field_delimiter}\E/${field_delimiter}AC***${field_delimiter}/g;
280
    $message =~ s/\Q${field_delimiter}\EAD.*?\Q${field_delimiter}\E/${field_delimiter}AD***${field_delimiter}/g;
281
    $message =~ s/\Q${field_delimiter}\ECO.*?\Q${field_delimiter}\E/${field_delimiter}CO***${field_delimiter}/g;
282
283
    return $message;
284
}
285
238
1;
286
1;
(-)a/t/SIP/Sip.t (-2 / +52 lines)
Lines 17-23 Link Here
17
17
18
use Modern::Perl;
18
use Modern::Perl;
19
19
20
use Test::More tests => 9;
20
use Test::More tests => 10;
21
use Test::Warn;
21
use Test::Warn;
22
22
23
BEGIN {
23
BEGIN {
Lines 55-57 warning_is { $invalidTest = C4::SIP::Sip::Checksum::verify_cksum("1234567") } Link Here
55
            'verify_cksum prints the expected warning for an invalid checksum';
55
            'verify_cksum prints the expected warning for an invalid checksum';
56
is($invalidTest, 0, "Checksum: 1234567 is invalid as expected");
56
is($invalidTest, 0, "Checksum: 1234567 is invalid as expected");
57
57
58
- 
58
subtest 'remove_password_from_message' => sub {
59
    plan tests => 8;
60
61
    is(
62
        C4::SIP::Sip::remove_password_from_message("INPUT MSG: '9300CNterm1|COterm1|CPCPL|'"),
63
        "INPUT MSG: '9300CNterm1|CO***|CPCPL|'", "93 Login - password"
64
    );
65
66
    is(
67
        C4::SIP::Sip::remove_password_from_message("INPUT MSG: '9300CNterm1|COt|CPCPL|'"),
68
        "INPUT MSG: '9300CNterm1|CO***|CPCPL|'", "93 Login - short password"
69
    );
70
71
    is(
72
        C4::SIP::Sip::remove_password_from_message("INPUT MSG: '9300CNterm1|CO%&/()=+qwerty123456|CPCPL|'"),
73
        "INPUT MSG: '9300CNterm1|CO***|CPCPL|'", "93 Login - Complex password"
74
    );
75
76
    is(
77
        C4::SIP::Sip::remove_password_from_message("INPUT MSG: '9300CNterm1|CO1234|CPCPL|'"),
78
        "INPUT MSG: '9300CNterm1|CO***|CPCPL|'", "93 Login - PIN"
79
    );
80
81
    is(
82
        C4::SIP::Sip::remove_password_from_message(
83
            "11YN20240903    134450                  AOCPL|AA23529000035676|AB39999000003697|AC1234|AD1234|BON"),
84
        '11YN20240903    134450                  AOCPL|AA23529000035676|AB39999000003697|AC***|AD***|BON',
85
        "11 Checkout"
86
    );
87
88
    is(
89
        C4::SIP::Sip::remove_password_from_message(
90
            "11YN20240903    134450                  AOCPL|AA23529000035676|AB39999000003697|AC|AD1234|BON"),
91
        '11YN20240903    134450                  AOCPL|AA23529000035676|AB39999000003697|AC***|AD***|BON',
92
        "11 Checkout - empty AC"
93
    );
94
95
    is(
96
        C4::SIP::Sip::remove_password_from_message(
97
            "11YN20240903    134450                  AOCPL|AA23529000035676|AB39999000003697|AC1234|AD|BON"),
98
        '11YN20240903    134450                  AOCPL|AA23529000035676|AB39999000003697|AC***|AD***|BON',
99
        "11 Checkout - empty AD"
100
    );
101
102
    is(
103
        C4::SIP::Sip::remove_password_from_message(
104
            "11YN20240903    134450                  AOCPL|AA23529000035676|AB39999000003697|AC|AD|BON"),
105
        '11YN20240903    134450                  AOCPL|AA23529000035676|AB39999000003697|AC***|AD***|BON',
106
        "11 Checkout - empty AC and AND"
107
    );
108
};

Return to bug 37816