Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

API login broken for non-ASCII usernames #56

Open
samuelvogel opened this issue Nov 21, 2017 · 0 comments
Open

API login broken for non-ASCII usernames #56

samuelvogel opened this issue Nov 21, 2017 · 0 comments
Labels
bug Issues that describe an unexpected behaviour in an existing functionality. minor "bug" issues that are neither "critical" nor "major".

Comments

@samuelvogel
Copy link
Member

We've had multiple occurrences of users not being able to log in via the API, because their username contained non-ASCII characters. See the following Shopware JIRA Issue as well: https://issues.shopware.com/issues/SW-15358

Unfortunately this is deeply buried inside the Zend Framework 1 which is shipped with Shopware: https://github.com/zendframework/zf1/blob/a90f3a8d71e0788020f730da83674b7312bd3b16/library/Zend/Auth/Adapter/Http.php#L527-L532

The ctype_print function is used to check the base64-decoded Authorization header for non-ASCII characters. See here fore the referenced ticket ZF-1253: https://framework.zend.com/issues/browse/ZF-1253

As there is no realistic way to fix this, we should implement a special validation in the Shopware backend user administration which only allows ASCII characters in the username when the API key (and therefore API access) is activated:
screenshot 2017-11-21 17 01 17

@samuelvogel samuelvogel added bug Issues that describe an unexpected behaviour in an existing functionality. minor "bug" issues that are neither "critical" nor "major". labels Nov 21, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Issues that describe an unexpected behaviour in an existing functionality. minor "bug" issues that are neither "critical" nor "major".
Projects
None yet
Development

No branches or pull requests

2 participants