Repository: privacyidea/privacyidea

Issue:
Fix questionnaire token bug
### Top-level intent

What did you try to achieve?

Fix questionnaire bug when creating a challenge on the following line:
https://github.com/privacyidea/privacyidea/blob/b3c981d8ed1a0b2470a7f3f4a1e1efb551737546/privacyidea/lib/tokens/questionnairetoken.py#L210

### Steps to reproduce

1. Create a security question that includes the characters from `.type`

### Expected outcome

What do you think, how the system should have worked?

The security question should not use `.strip` to remove `.type` from the key in **line 210**.

### Actual outcome

What did actually happen?

It should use `.replace`, but, note, if the user has `.type` inside the security question, the token will not be issued successfully.

### Configuration

* **privacyIDEA version**: 2.23
* **Installation method**: (from Ubuntu packages, github, PyPI, ...)
* **Python version**: 2.7
* **Operating system**: Amazon Linux
* **Webserver**:
* **Token database**: (MySQL, PostgreSQL, ...): PostgreSQL

### Log file

**Set PI_LOGLEVEL = logging.DEBUG in pi.cfg and take a look at the privacyidea.log!**
**If appropriate, attach the log file or paste relevant portions.**



Discussion:
CC: https://github.com/privacyidea/privacyidea/pull/2022
Thanks for pointing this out.

There are problems with using replace, too as you also pointed out.
As it is already tested, if the questions ends with ".type", the safe  behaviour would be

~~~~python
questions.append(question[:-5])
~~~~


Resolving patch:
diff --git a/privacyidea/lib/tokens/questionnairetoken.py b/privacyidea/lib/tokens/questionnairetoken.py
--- a/privacyidea/lib/tokens/questionnairetoken.py
+++ b/privacyidea/lib/tokens/questionnairetoken.py
@@ -207,7 +207,7 @@ def create_challenge(self, transactionid=None, options=None):
                 # This is "Question1?.type" of type "password"
                 # So this is actually a question and we add the question to
                 # the list
-                questions.append(question.strip(".type"))
+                questions.append(question[:-5])
         message = random.choice(questions)
         attributes = None
 


Test patch:
diff --git a/tests/test_lib_tokens_questionnaire.py b/tests/test_lib_tokens_questionnaire.py
--- a/tests/test_lib_tokens_questionnaire.py
+++ b/tests/test_lib_tokens_questionnaire.py
@@ -20,6 +20,8 @@ class QuestionnaireTokenTestCase(MyTestCase):
                  }
     j_questions = json.dumps(questions)
 
+    dumb_questions = {"dumb questiontype": "answer"}
+    j_dumb_questions = json.dumps(dumb_questions)
     # add_user, get_user, reset, set_user_identifiers
 
     def test_00_users(self):
@@ -71,3 +73,15 @@ def test_02_check_challenge(self):
     def test_03_get_setting_type(self):
         r = QuestionnaireTokenClass.get_setting_type("question.question.1")
         self.assertEqual(r, "public")
+
+    def test_04_dumb_question(self):
+        set_privacyidea_config("question.num_answers", 1)
+        token = init_token({"type": "question",
+                            "pin": self.pin,
+                            "serial": "2ndtoken",
+                            "user": "cornelius",
+                            "realm": self.realm1,
+                            "questions": self.j_dumb_questions
+                            })
+        _r, question, _transaction, _none = token.create_challenge()
+        self.assertEqual("dumb questiontype", question)