Having issue in merchant user creation

bhupendra.doniwal

Hi team, 

I'm encountering an error while creating merchant user from merchants->merchantEdit->add merchant user . (this issue occurs sometimes not always) 
Error : "Uncaught exception 'ValueError' with message 'Bcrypt password must not contain null character'" when using the following function: 

password_hash($password, PASSWORD_BCRYPT); 
 

After some debugging, I found that Spryker uses this method: 

public function generateRandomByteString(int $length = 32): string 



{ return random_bytes($length); 
} 
 

It seems that this function can generate null characters, which might be causing the error when used in password hashing.
Do I understand this issue correctly? Can anyone confirm? 

fsmeier

Heyhey @bhupendra.doniwal ,

can you please create an official support ticket for that and link the issue number here so I can log some more feedback there?

For me it seems like an issue from a php update, see also https://stackoverflow.com/questions/78646470/how-to-prevent-null-bytes-from-being-passed-to-bcrypt-password-hash (maybe also use that link in the ticket as explanation).

All the best,

Florian

fsmeier

Heyhey @bhupendra.doniwal ,

which version of the module spryker/merchant-user do you have? In version 1.6.0 there was a fix related to that.

Maybe this solves it?

All the best,

Florian

bhupendra.doniwal

Hey @fsmeier ,
Thank you for your response,
As of now i have fixed that issue by using following method

  $userTransfer->setPassword(  bin2hex($this->utilTextService->generateRandomByteString(static::USER_CREATION_DEFAULT_PASSWORD_LENGTH)), )->setStatus($this->merchantUserConfig->getUserCreationStatus());

profuel

You're absolutely right, @bhupendra.doniwal, nulls may happen!

I checked the latest version of the code, and we have fixed this issue, and now use a String generator, not a ByteString one:

https://github.com/spryker/merchant-user/blob/master/src/Spryker/Zed/MerchantUser/Business/Creator/MerchantUserCreator.php#L172

Please update your module!