Bug 39826

Summary: Vendor interface's password not utf8 decoded on display
Product: Koha Reporter: Jonathan Druart <jonathan.druart>
Component: Architecture, internals, and plumbingAssignee: Jonathan Druart <jonathan.druart>
Status: Pushed to main --- QA Contact: Martin Renvoize (ashimema) <martin.renvoize>
Severity: normal    
Priority: P5 - low CC: david, dcook, m.de.rooy, martin.renvoize
Version: unspecified   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38010
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
25.05.00
Circulation function:
Attachments: Bug 39826: UTF8-decode vendor interface's password on display
Bug 39826: UTF8-decode vendor interface's password on display

Description Jonathan Druart 2025-05-05 08:16:44 UTC
We store an encrypted version of the passwords for vendor's interfaces, but we don't utf8 decode it after it is decrypted
Comment 1 Jonathan Druart 2025-05-05 08:22:24 UTC
Created attachment 181897 [details] [review]
Bug 39826: UTF8-decode vendor interface's password on display

We store an encrypted version of the passwords for vendor's interfaces, but we don't utf8 decode it after it is decrypted

Test plan:
0. Do not apply this patch
1. Create or edit a vendor and add at least one interface with non ascii
   characters, eg. émyPassword❤
2. Go to the detail view of the vendor and click the "Show password"
   link
=> The password is not correctly utf8-decoded
3. Apply this patch, repeat 2
=> The password is correctly displayed
4. Repeat 1 and 2
=> The password is correctly displayed

Note that maybe we should make sure the encrypt_hex is getting a valid
utf8-encoded variable.
Comment 2 Jonathan Druart 2025-05-05 08:36:24 UTC
Oops, I... inadvertently pushed this to main.
Can I still get a SO and QA anyway please?
Comment 3 David Nind 2025-05-05 19:21:42 UTC
Created attachment 181943 [details] [review]
Bug 39826: UTF8-decode vendor interface's password on display

We store an encrypted version of the passwords for vendor's interfaces, but we don't utf8 decode it after it is decrypted

Test plan:
0. Do not apply this patch
1. Create or edit a vendor and add at least one interface with non ascii
   characters, eg. émyPassword❤
2. Go to the detail view of the vendor and click the "Show password"
   link
=> The password is not correctly utf8-decoded
3. Apply this patch, repeat 2
=> The password is correctly displayed
4. Repeat 1 and 2
=> The password is correctly displayed

Note that maybe we should make sure the encrypt_hex is getting a valid
utf8-encoded variable.

Signed-off-by: David Nind <david@davidnind.com>
Comment 4 Martin Renvoize (ashimema) 2025-05-08 12:17:54 UTC
Happy to PQA on this.. works as expected
Comment 5 Katrin Fischer 2025-05-09 06:28:55 UTC
This had already been pushed "by accident". So marking as Pushed to main now officially. :)