I'm using Crypt::CBC generate a token that's sent to the user to confirm that their email address is valid. I take their username and a couple other bits of information:

sub get_magic_token {
    my $self=shift;
    my $token=LocalSites::Crypt::encrypt_string(join '|',$self->id(), 
+$self->username(), $self->password());
    return $token;
}
[download]

...and stuff it into this (in LocalSites::Crypt):

sub encrypt_string {
    my $clear_string=shift;
    my ($prepend, $key ) = &_secret_vals();
    $key = pack( "H32", $key );
    my $cipher=new Crypt::CBC( $key, 'IDEA' );
    my $crypt_string=$cipher->encrypt_hex( $clear_string );
    return $crypt_string;
}
[download]

$crypt_string is then used as a GET parameter in a link in the email message. When clicked, it's picked up by this:

sub decode_magic_token {
    my $self=shift;
    my $token=shift;
    return 0 unless $token;
    my $decrypted=LocalSites::Crypt::decrypt_string($token);
    my ($id,$username,$password)=split /\|/, $decrypted;
    return $id;
}
[download]

All of this works beautifully when everything is working beautifully.

The problem comes when the user comes back with a bad token. If, for example, the token is truncated, the script fails with this error:

"Ciphertext does not begin with a valid header for 'salt' header mode at (library_path)/LocalSites/Crypt.pm line 42"

Line 42 is the decrypt_hex line in the following subroutine, also in LocalSites::Crypt

sub decrypt_string {
    my $crypt_string=shift;
    my ( $prepend, $key ) = &_secret_vals();
    $key = pack( "H32", $key );
    my $cipher=new Crypt::CBC( $key, 'IDEA' );
    my $clear_string=$cipher->decrypt_hex( $crypt_string );
    return $clear_string;
}
[download]

I've tried putting the decrypt_string() code in an eval() in the hopes of trapping the error:

sub decode_magic_token {
    my $self=shift;
    my $token=shift;
    return 0 unless $token;
    my ($id, $username, $password);
    eval {
        my $decrypted=LocalSites::Crypt::decrypt_string($token);
        ($id,$username,$password)=split /\|/, $decrypted;
    };
    if (@$) {
        return 0;
    } else {
        return $id;
    }
}
[download]

But this doesn't help for reasons that I should probably understand but don't.

If I could have some advice on how to fix this, I'd really appreciate it.

---

---

Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!

Titles consisting of a single word are discouraged, and in most cases are disallowed outright.

Read Where should I post X? if you're not absolutely sure you're posting in the right place.

Please read these before you post! —

• How do I compose an effective node title?
• How do I post a question effectively?
• Markup in the Monastery

Posts may use any of the Perl Monks Approved HTML tags:

a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr

You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)

	For:		Use:
	&		&
	<		&lt;
	>		&gt;
	[		&#91;
	]		&#93;

Link using PerlMonks shortcuts! What shortcuts can I use for linking?

See Writeup Formatting Tips and other pages linked from there for more info.