Bugzilla – Attachment 57957 Details for
Bug 17720
CSRF token is not generated correctly
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
[SIGNED-OFF] Bug 17720: CSRF - Handle unicode characters
SIGNED-OFF-Bug-17720-CSRF---Handle-unicode-charact.patch (text/plain), 13.17 KB, created by
Josef Moravec
on 2016-12-05 12:59:18 UTC
(
hide
)
Description:
[SIGNED-OFF] Bug 17720: CSRF - Handle unicode characters
Filename:
MIME Type:
Creator:
Josef Moravec
Created:
2016-12-05 12:59:18 UTC
Size:
13.17 KB
patch
obsolete
>From e37fe1c7ce9816ffe6ac697000effd4b6190d76e Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Mon, 5 Dec 2016 08:17:21 +0000 >Subject: [PATCH] [SIGNED-OFF] Bug 17720: CSRF - Handle unicode characters >MIME-Version: 1.0 >Content-Type: text/plain; charset=UTF-8 >Content-Transfer-Encoding: 8bit > >From the pod of Digest::MD5: >""" >Since the MD5 algorithm is only defined for strings of bytes, it can not >be used on strings that contains chars with ordinal number above 255 >(Unicode strings). The MD5 functions and methods will croak if you try >to feed them such input data. >What you can do is calculate the MD5 checksum of the UTF-8 >representation of such strings. >""" > >Test plan: >- Set a MySQL/MariaDB password with unicode characters: > UPDATE user SET password=PASSWORD('â¤') WHERE USER='koha_kohadev'; > FLUSH PRIVILEGES >- Update your $KOHA_CONF file >- Restart Memcached >- Hit the files modified by this patch > >=> Without this patch, you will get a software error (with "Wide >character in subroutine entry" in the logs). >=> With this patch, everything will go fine > >Signed-off-by: Josef Moravec <josef.moravec@gmail.com> >--- > basket/sendbasket.pl | 4 ++-- > members/deletemem.pl | 5 +++-- > members/member-password.pl | 5 +++-- > members/memberentry.pl | 5 +++-- > members/moremember.pl | 3 ++- > opac/opac-memberentry.pl | 9 +++++---- > opac/opac-sendbasket.pl | 4 ++-- > t/db_dependent/Koha/Patrons.t | 1 + > tools/import_borrowers.pl | 6 +++--- > tools/picture-upload.pl | 7 ++++--- > 10 files changed, 28 insertions(+), 21 deletions(-) > >diff --git a/basket/sendbasket.pl b/basket/sendbasket.pl >index 040ae09..faeebf4 100755 >--- a/basket/sendbasket.pl >+++ b/basket/sendbasket.pl >@@ -53,7 +53,7 @@ my $dbh = C4::Context->dbh; > if ( $email_add ) { > die "Wrong CSRF token" unless Koha::Token->new->check_csrf({ > id => C4::Context->userenv->{id}, >- secret => md5_base64( C4::Context->config('pass') ), >+ secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ), > token => scalar $query->param('csrf_token'), > }); > my $email = Koha::Email->new(); >@@ -178,7 +178,7 @@ else { > virtualshelves => C4::Context->preference("virtualshelves"), > csrf_token => Koha::Token->new->generate_csrf( > { id => C4::Context->userenv->{id}, >- secret => md5_base64( C4::Context->config('pass') ), >+ secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ), > } > ), > ); >diff --git a/members/deletemem.pl b/members/deletemem.pl >index b51c721..c764f35 100755 >--- a/members/deletemem.pl >+++ b/members/deletemem.pl >@@ -26,6 +26,7 @@ use strict; > > use CGI qw ( -utf8 ); > use Digest::MD5 qw(md5_base64); >+use Encode qw( encode ); > use C4::Context; > use C4::Output; > use C4::Auth; >@@ -148,7 +149,7 @@ if ( $op eq 'delete_confirm' or $countissues > 0 or $flags->{'CHARGES'} or $is_ > op => 'delete_confirm', > csrf_token => Koha::Token->new->generate_csrf( > { id => C4::Context->userenv->{id}, >- secret => md5_base64( C4::Context->config('pass') ), >+ secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ), > } > ), > ); >@@ -158,7 +159,7 @@ if ( $op eq 'delete_confirm' or $countissues > 0 or $flags->{'CHARGES'} or $is_ > die "Wrong CSRF token" > unless Koha::Token->new->check_csrf({ > id => C4::Context->userenv->{id}, >- secret => md5_base64( C4::Context->config('pass') ), >+ secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ), > token => scalar $input->param('csrf_token'), > }); > my $patron = Koha::Patrons->find( $member ); >diff --git a/members/member-password.pl b/members/member-password.pl >index d2255f8..82cd642 100755 >--- a/members/member-password.pl >+++ b/members/member-password.pl >@@ -21,6 +21,7 @@ use Koha::Token; > use Koha::Patron::Categories; > > use Digest::MD5 qw(md5_base64); >+use Encode qw( encode ); > > my $input = new CGI; > >@@ -69,7 +70,7 @@ if ( $newpassword && !scalar(@errors) ) { > die "Wrong CSRF token" > unless Koha::Token->new->check_csrf({ > id => C4::Context->userenv->{id}, >- secret => md5_base64( C4::Context->config('pass') ), >+ secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ), > token => scalar $input->param('csrf_token'), > }); > >@@ -151,7 +152,7 @@ $template->param( > RoutingSerials => C4::Context->preference('RoutingSerials'), > csrf_token => Koha::Token->new->generate_csrf({ > id => C4::Context->userenv->{id}, >- secret => md5_base64( C4::Context->config('pass') ), >+ secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ), > }), > ); > >diff --git a/members/memberentry.pl b/members/memberentry.pl >index 27e6687..61ebed9 100755 >--- a/members/memberentry.pl >+++ b/members/memberentry.pl >@@ -26,6 +26,7 @@ use warnings; > use CGI qw ( -utf8 ); > use List::MoreUtils qw/uniq/; > use Digest::MD5 qw(md5_base64); >+use Encode qw( encode ); > > # internal modules > use C4::Auth; >@@ -290,7 +291,7 @@ if ($op eq 'save' || $op eq 'insert'){ > die "Wrong CSRF token" > unless Koha::Token->new->check_csrf({ > id => C4::Context->userenv->{id}, >- secret => md5_base64( C4::Context->config('pass') ), >+ secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ), > token => scalar $input->param('csrf_token'), > }); > >@@ -752,7 +753,7 @@ $template->param( > $template->param( > csrf_token => Koha::Token->new->generate_csrf( > { id => C4::Context->userenv->{id}, >- secret => md5_base64( C4::Context->config('pass') ), >+ secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ), > } > ), > ); >diff --git a/members/moremember.pl b/members/moremember.pl >index 0661d0f..70aed84 100755 >--- a/members/moremember.pl >+++ b/members/moremember.pl >@@ -37,6 +37,7 @@ use strict; > #use warnings; FIXME - Bug 2505 > use CGI qw ( -utf8 ); > use Digest::MD5 qw(md5_base64); >+use Encode qw( encode ); > use C4::Context; > use C4::Auth; > use C4::Output; >@@ -275,7 +276,7 @@ $template->param( picture => 1 ) if $patron_image; > $template->param( > csrf_token => Koha::Token->new->generate_csrf({ > id => C4::Context->userenv->{id}, >- secret => md5_base64( C4::Context->config('pass') ), >+ secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ), > }), > ); > >diff --git a/opac/opac-memberentry.pl b/opac/opac-memberentry.pl >index e03d503..59306bc 100755 >--- a/opac/opac-memberentry.pl >+++ b/opac/opac-memberentry.pl >@@ -19,6 +19,7 @@ use Modern::Perl; > > use CGI qw ( -utf8 ); > use Digest::MD5 qw( md5_base64 md5_hex ); >+use Encode qw( encode ); > use String::Random qw( random_string ); > > use C4::Auth; >@@ -200,7 +201,7 @@ elsif ( $action eq 'update' ) { > die "Wrong CSRF token" > unless Koha::Token->new->check_csrf({ > id => $borrower->{userid}, >- secret => md5_base64( C4::Context->config('pass') ), >+ secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ), > token => scalar $cgi->param('csrf_token'), > }); > >@@ -221,7 +222,7 @@ elsif ( $action eq 'update' ) { > borrower => \%borrower, > csrf_token => Koha::Token->new->generate_csrf({ > id => $borrower->{userid}, >- secret => md5_base64( C4::Context->config('pass') ), >+ secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ), > }), > ); > >@@ -262,7 +263,7 @@ elsif ( $action eq 'update' ) { > borrower => GetMember( borrowernumber => $borrowernumber ), > csrf_token => Koha::Token->new->generate_csrf({ > id => $borrower->{userid}, >- secret => md5_base64( C4::Context->config('pass') ), >+ secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ), > }), > ); > } >@@ -285,7 +286,7 @@ elsif ( $action eq 'edit' ) { #Display logged in borrower's data > hidden => GetHiddenFields( $mandatory, 'modification' ), > csrf_token => Koha::Token->new->generate_csrf({ > id => $borrower->{userid}, >- secret => md5_base64( C4::Context->config('pass') ), >+ secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ), > }), > ); > >diff --git a/opac/opac-sendbasket.pl b/opac/opac-sendbasket.pl >index 77fc370..25b6eac 100755 >--- a/opac/opac-sendbasket.pl >+++ b/opac/opac-sendbasket.pl >@@ -55,7 +55,7 @@ my $dbh = C4::Context->dbh; > if ( $email_add ) { > die "Wrong CSRF token" unless Koha::Token->new->check_csrf({ > id => C4::Context->userenv->{id}, >- secret => md5_base64( C4::Context->config('pass') ), >+ secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ), > token => scalar $query->param('csrf_token'), > }); > my $email = Koha::Email->new(); >@@ -198,7 +198,7 @@ else { > virtualshelves => C4::Context->preference("virtualshelves"), > csrf_token => Koha::Token->new->generate_csrf( > { id => C4::Context->userenv->{id}, >- secret => md5_base64( C4::Context->config('pass') ), >+ secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ), > } > ), > ); >diff --git a/t/db_dependent/Koha/Patrons.t b/t/db_dependent/Koha/Patrons.t >index 7be731c..89bcd8a 100644 >--- a/t/db_dependent/Koha/Patrons.t >+++ b/t/db_dependent/Koha/Patrons.t >@@ -71,6 +71,7 @@ is( $retrieved_patron_1->cardnumber, $new_patron_1->cardnumber, 'Find a patron b > subtest 'guarantees' => sub { > plan tests => 8; > my $guarantees = $new_patron_1->guarantees; >+ use Data::Printer colored => 1; warn p $guarantees->unblessed; > is( ref($guarantees), 'Koha::Patrons', 'Koha::Patron->guarantees should return a Koha::Patrons result set in a scalar context' ); > is( $guarantees->count, 0, 'new_patron_1 should have 0 guarantee' ); > my @guarantees = $new_patron_1->guarantees; >diff --git a/tools/import_borrowers.pl b/tools/import_borrowers.pl >index f5a7921..f22f2ef 100755 >--- a/tools/import_borrowers.pl >+++ b/tools/import_borrowers.pl >@@ -59,8 +59,8 @@ use Text::CSV; > # Ä > > use CGI qw ( -utf8 ); >-# use encoding 'utf8'; # don't do this > use Digest::MD5 qw(md5_base64); >+use Encode qw( encode ); > > my (@errors, @feedback); > my $extended = C4::Context->preference('ExtendedPatronAttributes'); >@@ -113,7 +113,7 @@ if ( $uploadborrowers && length($uploadborrowers) > 0 ) { > die "Wrong CSRF token" > unless Koha::Token->new->check_csrf({ > id => C4::Context->userenv->{id}, >- secret => md5_base64( C4::Context->config('pass') ), >+ secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ), > token => scalar $input->param('csrf_token'), > }); > >@@ -392,7 +392,7 @@ if ( $uploadborrowers && length($uploadborrowers) > 0 ) { > $template->param( > csrf_token => Koha::Token->new->generate_csrf( > { id => C4::Context->userenv->{id}, >- secret => md5_base64( C4::Context->config('pass') ), >+ secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ), > } > ), > ); >diff --git a/tools/picture-upload.pl b/tools/picture-upload.pl >index 7e403bb..87cac77 100755 >--- a/tools/picture-upload.pl >+++ b/tools/picture-upload.pl >@@ -26,6 +26,7 @@ use File::Copy; > use CGI qw ( -utf8 ); > use GD; > use Digest::MD5 qw(md5_base64); >+use Encode qw( encode ); > use C4::Context; > use C4::Auth; > use C4::Output; >@@ -88,7 +89,7 @@ if ( ( $op eq 'Upload' ) && $uploadfile ) { > die "Wrong CSRF token" > unless Koha::Token->new->check_csrf({ > id => C4::Context->userenv->{id}, >- secret => md5_base64( C4::Context->config('pass') ), >+ secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ), > token => scalar $input->param('csrf_token'), > }); > >@@ -176,7 +177,7 @@ elsif ( $op eq 'Delete' ) { > die "Wrong CSRF token" > unless Koha::Token->new->check_csrf({ > id => C4::Context->userenv->{id}, >- secret => md5_base64( C4::Context->config('pass') ), >+ secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ), > token => scalar $input->param('csrf_token'), > }); > >@@ -195,7 +196,7 @@ else { > $template->param( > csrf_token => Koha::Token->new->generate_csrf({ > id => C4::Context->userenv->{id}, >- secret => md5_base64( C4::Context->config('pass') ), >+ secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ), > }), > ); > output_html_with_http_headers $input, $cookie, $template->output; >-- >2.1.4
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=57957">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 17720
:
57949
|
57957
|
57967