Changeset 25318

Timestamp:

2012-03-30T16:37:23+13:00 (12 years ago)

Author:

ak19

Message:

The process of hashing the password is modified to use US-ASCII charset instead of UTF-8 (to make the hex value of it be of an acceptable length, avoiding an SQLException). And then this hashed password is converted to its hex value. This appears to avoid the problem of a login failure occurring in LibraryServlet on otherwise acceptable strings, despite such password strings matching whatever is already stored in the database.

File:

• main/trunk/greenstone3/src/java/org/greenstone/gsdl3/service/Authentication.java (modified) (3 diffs)

main/trunk/greenstone3/src/java/org/greenstone/gsdl3/service/Authentication.java

@@ -9 +9 @@
 import org.w3c.dom.NodeList;
 
+import java.math.BigInteger;
 import java.util.ArrayList;
 import java.util.HashMap;
@@ -694 +695 @@
             MessageDigest digest = MessageDigest.getInstance("SHA-1");
             digest.reset();
-            hashedPassword = new String(digest.digest(password.getBytes("UTF-8")));
+            hashedPassword = new String(digest.digest(password.getBytes("US-ASCII"))); // toHex after using ASCII charset will result in acceptable length of hex string
+            hashedPassword = toHex(hashedPassword); // this conversion is required to avoid the strange error of login failure on some legal password strings
         }
         catch (Exception ex)
@@ -702 +704 @@
         return hashedPassword;
     }
+
+
+    
+    // This method can also be used for printing out the password in hex (in case
+    // the password used the UTF-8 Charset), or the hex values in any unicode string.
+    // From http://stackoverflow.com/questions/923863/converting-a-string-to-hexadecimal-in-java
+    public static String toHex(String arg) {
+    try {
+        return String.format("%x", new BigInteger(arg.getBytes("US-ASCII"))); // set to same charset as used by hashPassword
+    } catch (Exception e) { // UnsupportedEncodingException
+        e.printStackTrace();
+    } 
+    return "Unable to print";
+    }
+
 
     private void checkAdminUserExists()