[ruby-talk:15690] Problems with MD5 and strong comparison.

Hello,

  I'm having a problem comparing a hexdigest with an item in an array.
I've been hitting walls for a while on this, here's what I've got:

  I'm running 1.6.4 preview 2 on RedHat 7.0 x86.  What I'm trying to do
is take the passwd entered in a form and run it through an MD5 object to
get the hexdigest.  The expected passwd is stored in a file for now and
I compare the two.  Here's the code relating to the login part:

--- Begin Code ---

  def loginPage(error="")
    @error = error
    @page = "<FORM ACTION='admin.rb?loginCheck' METHOD='POST'>
      <TABLE ALIGN='Center' WIDTH='20%' BORDER='0'>
        <TR><TD WIDTH='5%' ALIGN='Right'>Login ID:</TD>
            <TD><INPUT TYPE='text' NAME='loginID' SIZE='20'></TD></TR>
        <TR><TD WIDTH='5%' ALIGN='Right'>Password:</TD>
            <TD><INPUT TYPE='password' NAME='passwd'
SIZE='20'></TD></TR>
        <TR><TD COLSPAN='2' ALIGN='Center'><INPUT TYPE='submit'
VALUE='Login'></TD>
      </TABLE></FORM>"
    self.printPage(@page,@error)
  end

  def loginCheck
    cgi = CGI.new
    if cgi.param("loginID").empty?
      @error = "You must enter a login ID before submitting the form."
      self.loginPage(@error)
      return
    elsif cgi.param("passwd").empty?
      @error = "You must enter a password before submitting the form."
      self.loginPage(@error)
      return
    end

    idVal =  cgi.param("loginID")
    passVal = cgi.param("passwd")

    #Verify that this user exists and check their password.
    validUser = File.exists?("/var/www/info/#{idVal}")
    
    if not validUser
      @error = "Invalid user ID or password."
      self.loginPage(@error)
      return
    elsif validUser
      require 'md5'

      info = File.open("/var/www/info/#{idVal}", "r")
      md5 = MD5.new
      info.each{
        |x| tmp = x.split(":")

        if tmp[0] == "passwd"

##
# This part is the problem.
##

          case tmp[1].strip

            when md5.update(passVal).hexdigest.strip
              print "valid account..."
              return

            else
              @error = "Invalid user ID or password."
              # Print the values, if they didn't match.  Only for
testing.
              print md5.update(passVal).hexdigest, tmp[1]
              self.loginPage(@error)
              return
          end
        end
      }
    else
      print "Something odd happened..."
    end
  end

--- End Code ---

I have a case statement in this version, I've tried if/elsif/else as
well.  I can print out the values of tmp[1].strip and
md5.update(passVal).hexdigest.strip; they are identical.  I've tried to
replace either side with a string literal of the hexdigest, I've used
.to_s to ensure they are both strings.

They match when using .type on both sides, so I know they are both
strings.  But using .type is the only time they will match correctly.
I've tried to use ==, =~ and eql?.

Any help would be *greatly* appreciated; TIA,

Wayne

PS: Do the code snipets get archived outside of the normal mailing list
archives?  I was thinking that something scanning the mailing list to
add code snipets to the cookbook would be useful, but don't want to
repeat any existing system.