Leading whitespace in user's first name breaks extension manager for that particular user.

[pcbouman-eur]

Recently we had a case where we were unable to provide an extension to a student who has a first name field in the database containing a leading space (e.g. " P. Bouman"). While the user shows up in the user-search field in the Extension Manager, an attempt to create the extension results in a "No student with id was found for this course." error message. I was able to provide an extension by manually inserting the relevant records into the database, after which the extension did show up in the extension manager.

The problem turned out to be reproducible for all students who have a leading whitespace in their first name field. I recorded the POST data submitted by the browser for such a student, an noticed the "extension[course_user_datum_id]" part of the form data is empty. This suggest something goes wrong in creating the POST request in the browser for such students.

[cg2v]

This also seems to occur if there is a character that's encoded into an HTML entity (like ') in the name

[jbman223]

The root cause of this issue is an issue with how we attach the auto-filled form's input to a student ID. The form input is not HTML safe/encoded while the dictionary relating user ids to user emails is. The fix for this is to base64 encode the raw user values in the array (so that characters like < or ' are maintained) then when searching this dictionary with the value of the student box, also base64 encode that value. This keeps everything safe from script injections.

A separate fix is needed for leading and trailing spaces in student names. Either the HTML safe encoder that rails uses or the form value strips leading and trailing white space on strings, so we must also strip the student name before we encode it in the dictionary.