privacyidea / FreeRADIUS

Add two factor authentication to FreeRADIUS via privacyIDEA
GNU General Public License v2.0
19 stars 17 forks source link

Special chars in password break with privacyidea 3.6.1 #50

Closed cornelinux closed 3 years ago

cornelinux commented 3 years ago

The freeradius sends the data as x-www-urlencoded content type.

The updated decoding in the privacyIDEA server can break some special characters.

We should either send another content type or we need to encode some data (password, maybe username?)

We would need an additional dependency: liburi-encode-perl

In the perl module we might add something like or even nicer:

use URI::Encode;

...

    if ( exists( $RAD_REQUEST{'User-Password'} ) ) {
        my $password = $RAD_REQUEST{'User-Password'};
        my $uri = URI::Encode->new( { encode_reserved => 0 } );   # <-- new
        my $password = $uri->encode($password);    # <-- new
        if ( $Config->{SPLIT_NULL_BYTE} =~ /true/i ) {
            my @p = split(/\0/, $password);
            $password = @p[0];
        }
        $params{"pass"} = $password;
    } elsif ( $Config->{ADD_EMPTY_PASS} =~ /true/i ) {