Bug 4840 - HTML client doesn't support unicode usernames
Summary: HTML client doesn't support unicode usernames
Status: CLOSED FIXED
Alias: None
Product: ThinLinc
Classification: Unclassified
Component: Web Access (show other bugs)
Version: trunk
Hardware: PC Unknown
: P2 Normal
Target Milestone: 4.2.0
Assignee: Samuel Mannehed
URL:
Keywords: hean01_tester, prosaic
Depends on:
Blocks: 5093
  Show dependency treegraph
 
Reported: 2013-10-10 14:14 CEST by Pierre Ossman
Modified: 2014-04-24 14:51 CEST (History)
2 users (show)

See Also:
Acceptance Criteria:


Attachments

Description Pierre Ossman cendio 2013-10-10 14:14:51 CEST
I get this traceback on the user "båsse":

2013-10-10 14:13:01 INFO tlwebaccess[25660]: "GET /websocket/b%C3%A5sse/1 HTTP/1.1" 101 -
2013-10-10 14:13:01 INFO tlwebaccess[25660]: : SSL/TLS (wss://) WebSocket connection
2013-10-10 14:13:01 INFO tlwebaccess[25660]: : Version hybi-13, base64: 'True'
----------------------------------------
Exception happened during processing of request from ('', '', True)
Traceback (most recent call last):
  File "/usr/lib64/python2.7/SocketServer.py", line 568, in process_request
    self.finish_request(request, client_address)
  File "/opt/thinlinc/sbin/tlwebaccess", line 521, in finish_request
    self . RequestHandlerClass ( request , client_address , self )
  File "/opt/thinlinc/modules/thinlinc/websocket.py", line 97, in __init__
    SimpleHTTPRequestHandler.__init__(self, req, addr, server)
  File "/usr/lib64/python2.7/SocketServer.py", line 649, in __init__
    self.handle()
  File "/opt/thinlinc/sbin/tlwebaccess", line 346, in handle
    thinlinc . websocket . WebSocketRequestHandler . handle ( self )
  File "/opt/thinlinc/modules/thinlinc/websocket.py", line 499, in handle
    SimpleHTTPRequestHandler.handle(self)
  File "/usr/lib64/python2.7/BaseHTTPServer.py", line 340, in handle
    self.handle_one_request()
  File "/usr/lib64/python2.7/BaseHTTPServer.py", line 328, in handle_one_request
    method()
  File "/opt/thinlinc/sbin/tlwebaccess", line 186, in do_GET
    if not self . handle_websocket ( ) :
  File "/opt/thinlinc/sbin/tlwebaccess", line 204, in handle_websocket
    return thinlinc . websocket . WebSocketRequestHandler . handle_websocket ( self )
  File "/opt/thinlinc/modules/thinlinc/websocket.py", line 444, in handle_websocket
    self.log_message("%s: Path: '%s'" % (client_addr, self.path))
  File "/opt/thinlinc/sbin/tlwebaccess", line 335, in log_message
    OOo0o0 . info ( fstring % args )
TypeError: not enough arguments for format string
----------------------------------------
Comment 1 Samuel Mannehed cendio 2014-03-14 16:26:09 CET
Fixed with the following commits:

Proper encoding/decoding to allow unicode  - revision 28627.
Input validation                           - revision 28628.
Allow unicode in doc title                 - revision 28629.
Fix bugs with %-operator and escaped chars - revision 28632.
Display errors when input validation fails - revision 28633 and 28635.
Added a wrapper for the JS UTF-8 decoding  - revision 28634.
Use locale_encode for all getpwnam calls   - revision 28639.
Comment 2 Henrik Andersson cendio 2014-03-18 14:44:31 CET
Shouldn't commit r28632 go upstream and a new vendor drop be performed in bug #4940 ?
Comment 3 Samuel Mannehed cendio 2014-03-18 15:27:01 CET
(In reply to comment #2)
> Shouldn't commit r28632 go upstream and a new vendor drop be performed in bug
> #4940 ?

The changes in r28632 + r28656 have now been committed upstream.

r28656 removed another usage of the %-operator missed in r28632.
Comment 4 Henrik Andersson cendio 2014-03-19 09:04:23 CET
(In reply to comment #1)

> Use locale_encode for all getpwnam calls   - revision 28639.

The logics in vsmconnect seems a bit strange, no checks if user_id == None before use.
Comment 5 Samuel Mannehed cendio 2014-03-19 09:46:25 CET
(In reply to comment #4)
> The logics in vsmconnect seems a bit strange, no checks if user_id == None
> before use.

Fixed in revision 28661.
Comment 6 Henrik Andersson cendio 2014-03-20 07:43:02 CET
(In reply to comment #1)
> Fixed with the following commits:
> 
> Proper encoding/decoding to allow unicode  - revision 28627.
> Input validation                           - revision 28628.
> Allow unicode in doc title                 - revision 28629.
> Fix bugs with %-operator and escaped chars - revision 28632.
> Display errors when input validation fails - revision 28633 and 28635.
> Added a wrapper for the JS UTF-8 decoding  - revision 28634.
> Use locale_encode for all getpwnam calls   - revision 28639.

Reviewed code and it looks good, instrumented a http post in latin1 to test input validation which works as expected...

2014-03-20 07:40:12 ERROR tlwebaccess[32256]: code 500, message Error on page '/main/' - Failed to decode the username.
2014-03-20 07:40:12 INFO tlwebaccess[32256]: 'POST /main/ HTTP/1.1' 500 -
Comment 7 Henrik Andersson cendio 2014-03-20 08:13:50 CET
I have tested this with build 4294 and it works as expected.
Comment 8 Henrik Andersson cendio 2014-03-20 09:55:55 CET
During testing of this bug I stumble into problem were logging to file was ignored due to a an unhandled exception was raised while logging.

I have a fix that i will commit.
Comment 9 Henrik Andersson cendio 2014-03-20 09:58:55 CET
(In reply to comment #8)
> During testing of this bug I stumble into problem were logging to file was
> ignored due to a an unhandled exception was raised while logging.
> 
> I have a fix that i will commit.

Fixed in commit 28677.
Comment 10 Karl Mikaelsson cendio 2014-04-03 15:01:05 CEST
Användarnamn båsse ger följande traceback och en felsida till användaren:

> 2014-04-03 14:53:33 ERROR tlwebaccess[27898]: ----------------------------------------
> 2014-04-03 14:53:33 ERROR tlwebaccess[27898]: Traceback (most recent call last):
> 2014-04-03 14:53:33 ERROR tlwebaccess[27898]:   File "/opt/thinlinc/sbin/tlwebaccess", line 323, in post_or_get
> 2014-04-03 14:53:33 ERROR tlwebaccess[27898]:     i1I11i1iI , oO00OOoO00 = getattr ( IiIiii1I1 , action ) ( ooOOO0 , o0O0OOO0Ooo , i1I11i1iI )
> 2014-04-03 14:53:33 ERROR tlwebaccess[27898]:   File "/opt/thinlinc/modules/thinlinc/tlwebaccess/main.py", line 152, in do_POST
> 2014-04-03 14:53:33 ERROR tlwebaccess[27898]:     self . _POST_METHODS . get ( page_name , self . error_404 ) ( query ) )
> 2014-04-03 14:53:33 ERROR tlwebaccess[27898]:   File "/opt/thinlinc/modules/thinlinc/tlwebaccess/main.py", line 280, in home
> 2014-04-03 14:53:33 ERROR tlwebaccess[27898]:     iII . launch_pamtester ( OoO0O00IIiII )
> 2014-04-03 14:53:33 ERROR tlwebaccess[27898]:   File "/opt/thinlinc/modules/thinlinc/tlwebaccess/main.py", line 650, in launch_pamtester
> 2014-04-03 14:53:33 ERROR tlwebaccess[27898]:     preexec_fn = lambda : self . pamtester_prexec ( ) )
> 2014-04-03 14:53:33 ERROR tlwebaccess[27898]:   File "/opt/thinlinc/modules/subprocess.py", line 593, in __init__
> 2014-04-03 14:53:33 ERROR tlwebaccess[27898]:     errread, errwrite)
> 2014-04-03 14:53:33 ERROR tlwebaccess[27898]:   File "/opt/thinlinc/modules/subprocess.py", line 1079, in _execute_child
> 2014-04-03 14:53:33 ERROR tlwebaccess[27898]:     raise child_exception
> 2014-04-03 14:53:33 ERROR tlwebaccess[27898]: TypeError: execv() arg 2 must contain only strings
> 2014-04-03 14:53:33 ERROR tlwebaccess[27898]: ----------------------------------------
> 2014-04-03 14:53:33 ERROR tlwebaccess[27898]: code 500, message Internal error on page '/main/'
> 2014-04-03 14:53:33 INFO tlwebaccess[27898]: 'POST /main/ HTTP/1.1' 500 -
Comment 11 Samuel Mannehed cendio 2014-04-07 16:12:20 CEST
(In reply to comment #10)
> Användarnamn båsse ger följande traceback och en felsida till användaren:
> 
> > 2014-04-03 14:53:33 ERROR tlwebaccess[27898]: ----------------------------------------
> > 2014-04-03 14:53:33 ERROR tlwebaccess[27898]: Traceback (most recent call last):
> > 2014-04-03 14:53:33 ERROR tlwebaccess[27898]:   File "/opt/thinlinc/sbin/tlwebaccess", line 323, in post_or_get
> > 2014-04-03 14:53:33 ERROR tlwebaccess[27898]:     i1I11i1iI , oO00OOoO00 = getattr ( IiIiii1I1 , action ) ( ooOOO0 , o0O0OOO0Ooo , i1I11i1iI )
> > 2014-04-03 14:53:33 ERROR tlwebaccess[27898]:   File "/opt/thinlinc/modules/thinlinc/tlwebaccess/main.py", line 152, in do_POST
> > 2014-04-03 14:53:33 ERROR tlwebaccess[27898]:     self . _POST_METHODS . get ( page_name , self . error_404 ) ( query ) )
> > 2014-04-03 14:53:33 ERROR tlwebaccess[27898]:   File "/opt/thinlinc/modules/thinlinc/tlwebaccess/main.py", line 280, in home
> > 2014-04-03 14:53:33 ERROR tlwebaccess[27898]:     iII . launch_pamtester ( OoO0O00IIiII )
> > 2014-04-03 14:53:33 ERROR tlwebaccess[27898]:   File "/opt/thinlinc/modules/thinlinc/tlwebaccess/main.py", line 650, in launch_pamtester
> > 2014-04-03 14:53:33 ERROR tlwebaccess[27898]:     preexec_fn = lambda : self . pamtester_prexec ( ) )
> > 2014-04-03 14:53:33 ERROR tlwebaccess[27898]:   File "/opt/thinlinc/modules/subprocess.py", line 593, in __init__
> > 2014-04-03 14:53:33 ERROR tlwebaccess[27898]:     errread, errwrite)
> > 2014-04-03 14:53:33 ERROR tlwebaccess[27898]:   File "/opt/thinlinc/modules/subprocess.py", line 1079, in _execute_child
> > 2014-04-03 14:53:33 ERROR tlwebaccess[27898]:     raise child_exception
> > 2014-04-03 14:53:33 ERROR tlwebaccess[27898]: TypeError: execv() arg 2 must contain only strings
> > 2014-04-03 14:53:33 ERROR tlwebaccess[27898]: ----------------------------------------
> > 2014-04-03 14:53:33 ERROR tlwebaccess[27898]: code 500, message Internal error on page '/main/'
> > 2014-04-03 14:53:33 INFO tlwebaccess[27898]: 'POST /main/ HTTP/1.1' 500 -

Fixed in commits 28812-28817.

Typo fix, catch the correct error for encoding - 28812
Display a user-friendly error when decode fails - 28813
Verify early that encoding to system locale works - 28814
Fixed using system's locale for a system process - 28815
Verify that vncpassword is a base64-valid string - 28816
Verify that the username doesn't contain slashes - 28817
Comment 12 Karl Mikaelsson cendio 2014-04-11 17:21:48 CEST
NoVNC doesn't seem to work when logging in to a system with ISO8859-1 usernames. ASCII usernames work fine, I haven't tested other username encodings.

Here's what Firefox 28 has to say about this:

> recv_message, caught exception:
>  Util.decodeUTF8@https://sunray.lkpg.cendio.se:300/include/util.js:237
>  RFB/init_msg@https://sunray.lkpg.cendio.se:300/include/rfb.js:923
>  RFB/handle_message@https://sunray.lkpg.cendio.se:300/include/rfb.js:542
>  recv_message@https://sunray.lkpg.cendio.se:300/include/websock.js:220
Comment 13 Karl Mikaelsson cendio 2014-04-11 17:35:46 CEST
(In reply to comment #12)
> NoVNC doesn't seem to work when logging in to a system with ISO8859-1
> usernames. ASCII usernames work fine, I haven't tested other username
> encodings.

Here's what Chrome 34.0.1847.116 says:

> recv_message, caught exception: URIError: URI malformed
>     at decodeURIComponent (native)
>     at Object.Util.decodeUTF8 (https://sunray.lkpg.cendio.se:300/include/util.js:237:31)
>     at RFB.init_msg (https://sunray.lkpg.cendio.se:300/include/rfb.js:923:24)
>     at Object.RFB.handle_message [as message] (https://sunray.lkpg.cendio.se:300/include/rfb.js:542:9)
>     at WebSocket.recv_message (https://sunray.lkpg.cendio.se:300/include/websock.js:220:27)
Comment 14 Samuel Mannehed cendio 2014-04-15 13:07:23 CEST
Moved comment #12 and comment #13 to a new bug (bug 5093).
Comment 15 Henrik Andersson cendio 2014-04-16 11:24:59 CEST
(In reply to comment #11)
> 
> Typo fix, catch the correct error for encoding - 28812
> Display a user-friendly error when decode fails - 28813
> Verify early that encoding to system locale works - 28814
> Fixed using system's locale for a system process - 28815

Verified using build 4325.
Comment 16 Henrik Andersson cendio 2014-04-24 14:50:39 CEST
(In reply to comment #11)
> (In reply to comment #10)

Verified using build 4332.

> Verify that vncpassword is a base64-valid string - 28816

Tested using following query string which works as expected.

https://10.47.254.194:300/main/agent?launch_vnc=1&username=b%C3%A5sse&display=12&vncpassword=GURKA

> Verify that the username doesn't contain slashes - 28817

Tested using both the login form and the query above with a slash in username.
Works as expected..

Note You need to log in before you can comment on or make changes to this bug.