xsltforms-support

[Xsltforms-support] Calculation before submit ?

[Grégoire C. <gco...@gm...>]

Hi!

Is it possible to do a calculation just before the submission of an
instance? Can I use the "calculate" attribute of a xf:bind to do this?

The need is to hash the password given by the user, so that it doesn't
travel as clear text. But obviously, we don't want the user to see the
hashed password appear in the xf:input.

Ideas welcome! :-)

Cheers,
Grégoire

Re: [Xsltforms-support] Calculation before submit ?

[Efraim F. <efr...@gm...>]

Hi,

On 03/29/2011 12:04 PM, Grégoire COLBERT wrote:
> Hi!
>
> Is it possible to do a calculation just before the submission of an
> instance? Can I use the "calculate" attribute of a xf:bind to do this?
>    
Two ideas:
1. (Answer: yes, you can) Have the xf:input reference a separate 
instance than the one you send, use an xf:bind with @calculate, binding 
the one you actually send and calculating with the value from the 
xf:input. The value in the instance should then *always* be the hashed 
password - not just before you submit. I think this is the better solution.
2. Capture the xforms-submit event in your submission and use 
xf:setvalue to set the hashed value. Then, the hash will only be present 
before the submission. You can capture xforms-submit-done and 
xforms-submit-error to clear the hashed copy.

-- 
---
Efraim Feinstein
Lead Developer
Open Siddur Project
http://opensiddur.net
http://wiki.jewishliturgy.org

Re: [Xsltforms-support] Calculation before submit ?

[Grégoire C. <gco...@gm...>]

Hi Efraim!

Le 29/03/2011 18:29, Efraim Feinstein a écrit :
> Hi,
>
> On 03/29/2011 12:04 PM, Grégoire COLBERT wrote:
>> Hi!
>>
>> Is it possible to do a calculation just before the submission of an
>> instance? Can I use the "calculate" attribute of a xf:bind to do this?
>>    
> Two ideas:
> 1. (Answer: yes, you can) Have the xf:input reference a separate
> instance than the one you send, use an xf:bind with @calculate,
> binding the one you actually send and calculating with the value from
> the xf:input. The value in the instance should then *always* be the
> hashed password - not just before you submit. I think this is the
> better solution.

Thanks! I just did that and it works fine! For the archives of the list,
the solution looks like:

    <xf:bind
nodeset="instance('instance-compte-client-creation-requete')/hash-mot-de-passe"
                 
calculate="digest(digest(instance('instance-compte-client-creation-mots-de-passe')/mot-de-passe-1,'SHA-1','hex'),'SHA-1','hex')"/>

I call twice the SHA-1 function in order to prevent the use of a
brute-force hash dictionary (supposedly no one has done a double SHA-1
dictionary yet!).

> 2. Capture the xforms-submit event in your submission and use
> xf:setvalue to set the hashed value. Then, the hash will only be
> present before the submission. You can capture xforms-submit-done and
> xforms-submit-error to clear the hashed copy.
>

Best regards,
Grégoire