Hi all,

What I am trying to do is to verify a password from a Web form send with CHAP.
The password is send in md5_hex and is formed in this way with Java Script:

document.formname.password.value = hexMD5('\027' + document.formname.p
+assword.value + '\340\174\012\314\214\070\070\231\377\005\016\132\270
+\024\241\163');
[download]

When I 'alert' in JavaScript the upper string, I see that \340 and other are actually displayed as UTF characters.

For the Upper example with password 'AAA' the result is:
18ed4d4f656255182e771016deb7d23a
But in Perl I can not generate the same md5 in almost no way.

For example:

#!/usr/bin/perl
use strict;
use Digest::MD5;

#Example 1====================
my $chapid = "\027";
my $chapchalange = "\340\174\012\314\214\070\070\231\377\005\016\132\2
+70\024\241\163";

print "\nExample1=". Digest::MD5::md5_hex($chapid."AAA".$chapchalange)
+;

#Example2=====================
my $chapid2= '\027';
my $chapchalange2= '\340\174\012\314\214\070\070\231\377\005\016\132\2
+70\024\241\163';

print "\nExample2=".Digest::MD5::md5_hex($chapid2."AAA".$chapchalange2
+);
[download]

The result is:

Example1=18ed4d4f656255182e771016deb7d23a
Example2=3f40ad10610755cefd8223a3a1a566db
[download]

As you can see in Example2 the values are not interpreted as utf-8 chars and this mess the md5 sum.
The other thing I have noticed is that when I dump the upper string with use 'Devel::Peek qw(Dump);' the result is:

Example1=
------------------------
SV = PV(0x80120d070) at 0x801269f18
  REFCNT = 1
  FLAGS = (PADTMP,POK,pPOK)
  PV = 0x801209f58 "\27AAA\340|\n\314\21488\231\377\5\16Z\270\24\241s"
+\0
  CUR = 20
  LEN = 24
------------------------------
Example2=
-------------------------------
SV = PV(0x80120d650) at 0x8012c5810
  REFCNT = 1
  FLAGS = (PADTMP,POK,pPOK)
  PV = 0x80124ec58 "\\027AAA\\340\\174\\012\\314\\214\\070\\070\\231\\
+377\\005\\016\\132\\270\\024\\241\\163"\0
  CUR = 71
  LEN = 72
[download]

And I see no utf8 flag for the internal representation?
So back to my real example I receive this chapid, chapchalange and password through CGI. This is what I get as CGI params as result of CGI::Vars();

{
          'username' => 'Ptestuser',
          'password' => '18ed4d4f656255182e771016deb7d23a',
          'chap-id' => '\\027',
          'chap-challenge' => '\\340\\174\\012\\314\\214\\070\\070\\23
+1\\377\\005\\016\\132\\270\\024\\241\\163',
        };
[download]

I try almost everything I have found in internet about reading utf-8 CGI params, and nothing help. I try:

-------------------
Encode::decode('UTF-8'...);
-------------------
utf8::decode();
-------------------
binmode STDIN, ":encoding(utf8)";
-------------------
use CGI qw( -utf8 );
------------
use Encode qw(decode);
use URI::Escape::XS qw(decodeURIComponent);
$_ = decode('UTF-8', decodeURIComponent($_), Encode::FB_CROAK);
-------------
s{%([a-fA-F0-9]{2})}{ pack ("C", hex ($1)) }eg;    # Kept from existin
+g code
s{%u([0-9A-F]{4})}{ pack ('U*', hex ($1)) }eg;     # Added
utf8::decode $_;
---------------
and many others
[download]

Currently I see no way to verify the password.
I must say that the encoding of the HTML page is windows-1251 and so is the encoding of my Perl environment (CP1251).
Any help will be appreciated as I have already lost almost 2 days on this peace of code.
Thanks in advance,
Kaloyan Iliev