View | Details | Raw Unified | Return to bug 37816
Collapse All | Expand All

(-)a/C4/SIP/Sip.pm (-3 / +51 lines)
Lines 1-6 Link Here
1
#
1
2
# Sip.pm: General Sip utility functions
2
=head1 NAME
3
#
3
4
C4::SIP::Sip - General Sip utility functions
5
6
=cut
4
7
5
package C4::SIP::Sip;
8
package C4::SIP::Sip;
6
9
Lines 230-237 sub siplog { Link Here
230
233
231
    my $message = @args ? sprintf($mask, @args) : $mask;
234
    my $message = @args ? sprintf($mask, @args) : $mask;
232
235
236
    $message = remove_password_from_message($message);
237
233
    my $logger = C4::SIP::Logger::get_logger();
238
    my $logger = C4::SIP::Logger::get_logger();
234
    $logger->$method($message) if $logger;
239
    $logger->$method($message) if $logger;
235
}
240
}
236
241
242
=head2 remove_password_from_message
243
244
  my $safe_message = remove_password_from_message( $message );
245
246
Look for the fields AC, AD and CO, and replace contents with three asterisks.
247
248
We do this by looking for:
249
250
  delimiter + AC/AD/CO + something + delimiter
251
252
and replcing it with:
253
254
  delimiter + field name + asterisks + delimiter
255
256
Messages and fields that can contain passwords:
257
258
  23 Patron Status Request - AC terminal password - AD patron password
259
  11 Checkout - AC terminal password - AD patron password
260
  09 Checkin - AC terminal password
261
  01 Block Patron - AC terminal password
262
  93 Login - CO login password
263
  63 Patron Information - AC terminal password - AD patron password
264
  35 End Patron Session - AC terminal password - AD patron password
265
  37 Fee Paid - AC terminal password - AD patron password
266
  17 Item Information - AC terminal password
267
  19 Item Status Update - AC terminal password
268
  25 Patron Enable - AC terminal password- AD patron password
269
  15 Hold - AC terminal password - AD patron password
270
  29 Renew - AC terminal password - AD patron password
271
  65 Renew All - AC terminal password - AD patron password
272
273
=cut
274
275
sub remove_password_from_message {
276
    my ($message) = @_;
277
278
    $message =~ s/\Q${field_delimiter}\EAC.*?\Q${field_delimiter}\E/${field_delimiter}AC***${field_delimiter}/g;
279
    $message =~ s/\Q${field_delimiter}\EAD.*?\Q${field_delimiter}\E/${field_delimiter}AD***${field_delimiter}/g;
280
    $message =~ s/\Q${field_delimiter}\ECO.*?\Q${field_delimiter}\E/${field_delimiter}CO***${field_delimiter}/g;
281
282
    return $message;
283
}
284
237
1;
285
1;
(-)a/t/SIP/Sip.t (-2 / +52 lines)
Lines 17-23 Link Here
17
17
18
use Modern::Perl;
18
use Modern::Perl;
19
19
20
use Test::More tests => 9;
20
use Test::More tests => 10;
21
use Test::Warn;
21
use Test::Warn;
22
22
23
BEGIN {
23
BEGIN {
Lines 55-57 warning_is { $invalidTest = C4::SIP::Sip::Checksum::verify_cksum("1234567") } Link Here
55
            'verify_cksum prints the expected warning for an invalid checksum';
55
            'verify_cksum prints the expected warning for an invalid checksum';
56
is($invalidTest, 0, "Checksum: 1234567 is invalid as expected");
56
is($invalidTest, 0, "Checksum: 1234567 is invalid as expected");
57
57
58
- 
58
subtest 'remove_password_from_message' => sub {
59
    plan tests => 8;
60
61
    is(
62
        C4::SIP::Sip::remove_password_from_message("INPUT MSG: '9300CNterm1|COterm1|CPCPL|'"),
63
        "INPUT MSG: '9300CNterm1|CO***|CPCPL|'", "93 Login - password"
64
    );
65
66
    is(
67
        C4::SIP::Sip::remove_password_from_message("INPUT MSG: '9300CNterm1|COt|CPCPL|'"),
68
        "INPUT MSG: '9300CNterm1|CO***|CPCPL|'", "93 Login - short password"
69
    );
70
71
    is(
72
        C4::SIP::Sip::remove_password_from_message("INPUT MSG: '9300CNterm1|CO%&/()=+qwerty123456|CPCPL|'"),
73
        "INPUT MSG: '9300CNterm1|CO***|CPCPL|'", "93 Login - Complex password"
74
    );
75
76
    is(
77
        C4::SIP::Sip::remove_password_from_message("INPUT MSG: '9300CNterm1|CO1234|CPCPL|'"),
78
        "INPUT MSG: '9300CNterm1|CO***|CPCPL|'", "93 Login - PIN"
79
    );
80
81
    is(
82
        C4::SIP::Sip::remove_password_from_message(
83
            "11YN20240903    134450                  AOCPL|AA23529000035676|AB39999000003697|AC1234|AD1234|BON"),
84
        '11YN20240903    134450                  AOCPL|AA23529000035676|AB39999000003697|AC***|AD***|BON',
85
        "11 Checkout"
86
    );
87
88
    is(
89
        C4::SIP::Sip::remove_password_from_message(
90
            "11YN20240903    134450                  AOCPL|AA23529000035676|AB39999000003697|AC|AD1234|BON"),
91
        '11YN20240903    134450                  AOCPL|AA23529000035676|AB39999000003697|AC***|AD***|BON',
92
        "11 Checkout - empty AC"
93
    );
94
95
    is(
96
        C4::SIP::Sip::remove_password_from_message(
97
            "11YN20240903    134450                  AOCPL|AA23529000035676|AB39999000003697|AC1234|AD|BON"),
98
        '11YN20240903    134450                  AOCPL|AA23529000035676|AB39999000003697|AC***|AD***|BON',
99
        "11 Checkout - empty AD"
100
    );
101
102
    is(
103
        C4::SIP::Sip::remove_password_from_message(
104
            "11YN20240903    134450                  AOCPL|AA23529000035676|AB39999000003697|AC|AD|BON"),
105
        '11YN20240903    134450                  AOCPL|AA23529000035676|AB39999000003697|AC***|AD***|BON',
106
        "11 Checkout - empty AC and AND"
107
    );
108
};

Return to bug 37816