[Rt-commit] rt branch, 4.2/non-ascii-password, created. rt-4.2.3-7-g67641f6

[Wallace Reis]

The branch, 4.2/non-ascii-password has been created
        at  67641f69cf9483521221304cba120dc0ed36b924 (commit)

- Log -----------------------------------------------------------------
commit 72f69eb3e5ab1e93081d9c620e9f42c45410ebe2
Author: Wallace Reis <wreis at bestpractical.com>
Date:   Mon Feb 24 16:55:19 2014 -0300

    I#28784: Tests for non-ASCII character in password
    
    Reproduce the following error:
    
      Wide character in subroutine entry at lib/RT/User.pm line 1002.

diff --git a/t/api/password-types.t b/t/api/password-types.t
index 7b75c62..af95ebb 100644
--- a/t/api/password-types.t
+++ b/t/api/password-types.t
@@ -3,6 +3,8 @@ use warnings;
 
 use RT::Test;
 use Digest::MD5;
+use Encode 'encode_utf8';
+use utf8;
 
 my $default = "bcrypt";
 
@@ -50,3 +52,12 @@ my $trunc = MIME::Base64::encode_base64(
 $root->_Set( Field => "Password", Value => $trunc);
 ok($root->IsPassword("secret"), "Unsalted MD5 base64 works");
 like($root->__Value("Password"), qr/^\!$default\!/, "And is now upgraded to salted $default");
+
+# Non-ASCII salted truncated SHA-256
+my $non_ascii_trunc = MIME::Base64::encode_base64(
+    "salt" . substr(Digest::SHA::sha256("salt".Digest::MD5::md5(encode_utf8("áěšý"))),0,26),
+    ""
+);
+$root->_Set( Field => "Password", Value => $non_ascii_trunc);
+ok($root->IsPassword("áěšý"), "Unsalted MD5 base64 works");
+like($root->__Value("Password"), qr/^\!$default\!/, "And is now upgraded to salted $default");

commit 67641f69cf9483521221304cba120dc0ed36b924
Author: Wallace Reis <wreis at bestpractical.com>
Date:   Mon Feb 24 17:33:04 2014 -0300

    I#28784: Handle non-ASCII character in passwod
    
    The md5 method expects a sequence of bytes.

diff --git a/lib/RT/User.pm b/lib/RT/User.pm
index c07cfc8..2f4b7c9 100644
--- a/lib/RT/User.pm
+++ b/lib/RT/User.pm
@@ -999,7 +999,7 @@ sub IsPassword {
         my $hash = MIME::Base64::decode_base64($stored);
         # Decoding yields 30 byes; first 4 are the salt, the rest are substr(SHA256,0,26)
         my $salt = substr($hash, 0, 4, "");
-        return 0 unless substr(Digest::SHA::sha256($salt . Digest::MD5::md5($value)), 0, 26) eq $hash;
+        return 0 unless substr(Digest::SHA::sha256($salt . Digest::MD5::md5(encode_utf8($value))), 0, 26) eq $hash;
     } elsif (length $stored == 32) {
         # Hex nonsalted-md5
         return 0 unless Digest::MD5::md5_hex(encode_utf8($value)) eq $stored;

-----------------------------------------------------------------------