svn commit: r1743028 - in /ofbiz/branches/release15.12: ./ applications/securityext/src/org/ofbiz/securityext/login/LoginEvents.java

Author: jleroux
Date: Mon May  9 19:04:33 2016
New Revision: 1743028

URL: http://svn.apache.org/viewvc?rev=1743028&view=rev
Log:
"Applied fix from trunk for revision: 1743025  "
------------------------------------------------------------------------
r1743025 | jleroux | 2016-05-09 20:53:40 +0200 (lun. 09 mai 2016) | 22 lignes

A patch from Amardeep Singh Jhajj for "New password set in forgot password workflow not works sometimes and gives error" https://issues.apache.org/jira/browse/OFBIZ-7058

Sometimes, on clicking the reset password link from "New password sent" email we get a reset password page and on saving the new password we get following error.
[java] org.apache.shiro.crypto.CryptoException: Unable to execute 'doFinal' with cipher instance [javax.crypto.Cipher@3ea85a47].
     [java] at org.apache.shiro.crypto.JcaCipherService.crypt(JcaCipherService.java:462) ~[shiro-core-1.2.3.jar:1.2.3]
     [java] at org.apache.shiro.crypto.JcaCipherService.crypt(JcaCipherService.java:445) ~[shiro-core-1.2.3.jar:1.2.3]
     [java] at org.apache.shiro.crypto.JcaCipherService.decrypt(JcaCipherService.java:390) ~[shiro-core-1.2.3.jar:1.2.3]
     [java] at org.apache.shiro.crypto.JcaCipherService.decrypt(JcaCipherService.java:382) ~[shiro-core-1.2.3.jar:1.2.3]
     [java] at org.ofbiz.entity.util.EntityCrypto$ShiroStorageHandler.decryptValue(EntityCrypto.java:282) ~[ofbiz-entity.jar:?]
     [java] at org.ofbiz.entity.util.EntityCrypto.doDecrypt(EntityCrypto.java:147) ~[ofbiz-entity.jar:?]
     [java] at org.ofbiz.entity.util.EntityCrypto.decrypt(EntityCrypto.java:126) ~[ofbiz-entity.jar:?]
     [java] at org.ofbiz.webapp.control.LoginWorker.login(LoginWorker.java:389) ~[ofbiz-webapp.jar:?]



I found that sometimes encrypted password string (Base64 String created from EntityCrypto's encrypt method) contain "+".
So on clicking the reset password link from email we get a reset password page and on saving the new password we get this error. The reason is "+" is converted to " "
after url decoding. For example: Below URL having encrypted token with "+"

https://localhost:8443/partymgr/control/passwordChange?USERNAME=DemoUser&password=CcXuJ3vDfba0J7A8xO+X5A==&forgotPwdFlag=true&tenantId=

We can encrypt the token using URL encoder so that it is taken as it is in URL decoding.
------------------------------------------------------------------------


Modified:
    ofbiz/branches/release15.12/   (props changed)
    ofbiz/branches/release15.12/applications/securityext/src/org/ofbiz/securityext/login/LoginEvents.java

Propchange: ofbiz/branches/release15.12/
------------------------------------------------------------------------------
--- svn:mergeinfo (original)
+++ svn:mergeinfo Mon May  9 19:04:33 2016
@@ -9,4 +9,4 @@
 /ofbiz/branches/json-integration-refactoring:1634077-1635900
 /ofbiz/branches/multitenant20100310:921280-927264
 /ofbiz/branches/release13.07:1547657
-/ofbiz/trunk:1722712,1723007,1723248,1724402,1724411,1724566,1724689,1724763,1724916,1724918,1724925,1724930,1724940,1724943,1724946,1724951,1724957,1724975,1724978,1725006,1725217,1725257,1725561,1725574,1726388,1726486,1726493,1726828,1727894,1728398,1728411,1729005,1729078,1729609,1729809,1730035,1730456,1730735-1730736,1730747,1730758,1730882,1730889,1731382,1731396,1732454,1732570,1732721,1733951,1733956,1734246,1734269,1734276,1734912,1734918,1735021,1735244,1735385,1735398,1735569,1735731,1735734,1735750,1735753,1735756,1735759,1735773,1736083,1736087,1736272,1736434,1736628,1736851,1736854,1736890,1737156,1737440,1738235,1738303,1738407,1738902,1739438,1739448,1739571,1740008,1740442,1740629,1741146,1741563,1741684,1741925,1741930,1741960,1742018,1742097,1742103,1742712,1742737,1742741
+/ofbiz/trunk:1722712,1723007,1723248,1724402,1724411,1724566,1724689,1724763,1724916,1724918,1724925,1724930,1724940,1724943,1724946,1724951,1724957,1724975,1724978,1725006,1725217,1725257,1725561,1725574,1726388,1726486,1726493,1726828,1727894,1728398,1728411,1729005,1729078,1729609,1729809,1730035,1730456,1730735-1730736,1730747,1730758,1730882,1730889,1731382,1731396,1732454,1732570,1732721,1733951,1733956,1734246,1734269,1734276,1734912,1734918,1735021,1735244,1735385,1735398,1735569,1735731,1735734,1735750,1735753,1735756,1735759,1735773,1736083,1736087,1736272,1736434,1736628,1736851,1736854,1736890,1737156,1737440,1738235,1738303,1738407,1738902,1739438,1739448,1739571,1740008,1740442,1740629,1741146,1741563,1741684,1741925,1741930,1741960,1742018,1742097,1742103,1742712,1742737,1742741,1743025

Modified: ofbiz/branches/release15.12/applications/securityext/src/org/ofbiz/securityext/login/LoginEvents.java
URL: http://svn.apache.org/viewvc/ofbiz/branches/release15.12/applications/securityext/src/org/ofbiz/securityext/login/LoginEvents.java?rev=1743028&r1=1743027&r2=1743028&view=diff
==============================================================================
--- ofbiz/branches/release15.12/applications/securityext/src/org/ofbiz/securityext/login/LoginEvents.java (original)
+++ ofbiz/branches/release15.12/applications/securityext/src/org/ofbiz/securityext/login/LoginEvents.java Mon May  9 19:04:33 2016
@@ -19,6 +19,8 @@
 
 package org.ofbiz.securityext.login;
 
+import java.io.UnsupportedEncodingException;
+import java.net.URLEncoder;
 import java.util.HashMap;
 import java.util.Iterator;
 import java.util.Map;
@@ -258,12 +260,19 @@ public class LoginEvents {
             } else {
                 passwordToSend = supposedUserLogin.getString("currentPassword");
             }
+            /* Its a Base64 string, it can contain + and this + will be converted to space after decoding the url.
+               For example: passwordToSend "DGb1s2wgUQmwOBK9FK+fvQ==" will be converted to "DGb1s2wgUQmwOBK9FK fvQ=="
+               So to fix it, done Url encoding of passwordToSend.
+            */
+            passwordToSend = URLEncoder.encode(passwordToSend, "UTF-8");
         } catch (GenericEntityException e) {
             Debug.logWarning(e, "", module);
             Map<String, String> messageMap = UtilMisc.toMap("errorMessage", e.toString());
             errMsg = UtilProperties.getMessage(resource, "loginevents.error_accessing_password", messageMap, UtilHttp.getLocale(request));
             request.setAttribute("_ERROR_MESSAGE_", errMsg);
             return "error";
+        } catch (UnsupportedEncodingException e) {
+            e.printStackTrace();
         }
 
         StringBuilder emails = new StringBuilder();