Printer name containing "#" breaks signing

[tresf]

Reported as:

If your printer name has a # in, it will override the support certificate and display the untrusted request. We have managed to resolve this issue by renaming the printer.

[tresf]

Contrary to the OP's feedback, this doesn't override the support certificate.

This is an edge-case caused by the use of GET for signing and is not going to be fixed. Instead POST can be used to workaround this problem, which is already recommended in in production environments for several other reasons (such as the default GET length limitations)

Why this occurs:

• When # is seen in the URL, php (or any server-side language) strips off the characters following. This is standard behavior such as http://mysite.com/loadpage.php?item=22#BookMark3. In this case #BookMark3 is stripped off because it is not part of the data stream, but rather a bookmark hash which the client can use to jump to a particular part of the page.
• When the request to PHP mismatches from the message to QZ Tray, QZ Tray sees the certificate as being invalid (because it IS invalid, the signature matches what the data looks like without anything after the #)

The necessary work-around:

• To handle these # tags correctly, we'd need to do a lot of translating and assuming.
  • First, qz-websocket.js would need to translate the # to unicode %23
  • Second, sign-message.php would have to re-encode the translated %23 from # to %23 (it decodes it automatically, which would cause a problem because %23 will still mismatch #)
  • Third, PrintSocket would have to translate %23 back to # so that we aren't calling findPrinter("foo%23")
  • We'd have to repeat this code hack for every signing example in the repository.

The effort to fix this bug is not worth it when compared to the edge-case which causes it. Using POST instead of GET should fix this problem without renaming the printer. This recommendation is already spelled out in our signing wiki. We've added the # limitations to the documentation as well.

Closing as won't-fix.