Attachment #134298 for bug #30649

View | Details | Raw Unified | Return to bug 30649
Collapse All | Expand All




package Koha::Crypt;

# Copyright 2018, 2022 Koha Development Team
#
# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# Koha is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Koha; if not, see <http://www.gnu.org/licenses>.

use Modern::Perl;

use C4::Context;
use Crypt::Simple passfile => C4::Context->config('secret');

=head1 NAME

Koha::Crypt - Class for encrypting data in Koha

=head1 Crypts

=head2 Koha::Crypt

Simple encryption

=head1 Class methods

=head2 encrypt_if_needed

$data = Koha::Crypt->encrypt_if_needed( $data )

If path to a secret file is set in the Koha conf,
the data will be returned encrypted, otherwise the
data will be returned as is.

=cut

sub encrypt_if_needed {
    my ( $class, $data ) = @_;

    if ( C4::Context->config('secret') ) {
        return "___" . encrypt($data);
    }
    else {
        return $data;
    }
}

=head2 decrypt_if_needed

$data = Koha::Crypt->decrypt_if_needed( $data )

If path to a secret file is set in the Koha conf,
the data will be returned decrypted, otherwise the
data will be returned as is.

=cut

sub decrypt_if_needed {
    my ( $class, $data ) = @_;

    if ( C4::Context->config('secret') && $data =~ /^___/ ) {
        return decrypt($data);
    }
    else {
        return $data;
    }
}

1;

Lines 20-35 package Koha::Edifact::Transport; Link Here

(-)a/Koha/Edifact/Transport.pm (-10 / +15 lines)
20	use strict;	20	use strict;
21	use warnings;	21	use warnings;
22	use utf8;	22	use utf8;
23	use DateTime;	23
		24	use C4::Context;
		25	use Koha::Database;
		26	use Koha::DateUtils qw( dt_from_string );
		27	use Koha::Crypt;
		28
24	use Carp qw( carp );	29	use Carp qw( carp );
		30	use Crypt::Simple passfile => C4::Context->config('secret');
		31	use DateTime;
		32	use Encode qw( from_to );
25	use English qw{ -no_match_vars };	33	use English qw{ -no_match_vars };
		34	use File::Copy qw( copy move );
		35	use File::Slurp qw( read_file );
26	use Net::FTP;	36	use Net::FTP;
27	use Net::SFTP::Foreign;	37	use Net::SFTP::Foreign;
28	use File::Slurp qw( read_file );
29	use File::Copy qw( copy move );
30	use Koha::Database;
31	use Koha::DateUtils qw( dt_from_string );
32	use Encode qw( from_to );
33		38
34	sub new {	39	sub new {
35	my ( $class, $account_id ) = @_;	40	my ( $class, $account_id ) = @_;
Lines 136-142 sub sftp_download { Link Here
136	my $sftp = Net::SFTP::Foreign->new(	141	my $sftp = Net::SFTP::Foreign->new(
137	host => $self->{account}->host,	142	host => $self->{account}->host,
138	user => $self->{account}->username,	143	user => $self->{account}->username,
139	password => $self->{account}->password,	144	password => Koha::Crypt->decrypt_if_needed($self->{account}->password),
140	timeout => 10,	145	timeout => 10,
141	);	146	);
142	if ( $sftp->error ) {	147	if ( $sftp->error ) {
Lines 221-227 sub ftp_download { Link Here
221	)	226	)
222	or return $self->_abort_download( undef,	227	or return $self->_abort_download( undef,
223	"Cannot connect to $self->{account}->host: $EVAL_ERROR" );	228	"Cannot connect to $self->{account}->host: $EVAL_ERROR" );
224	$ftp->login( $self->{account}->username, $self->{account}->password )	229	$ftp->login( $self->{account}->username, Koha::Crypt->decrypt_if_needed($self->{account}->password)i )
225	or return $self->_abort_download( $ftp, "Cannot login: $ftp->message()" );	230	or return $self->_abort_download( $ftp, "Cannot login: $ftp->message()" );
226	$ftp->cwd( $self->{account}->download_directory )	231	$ftp->cwd( $self->{account}->download_directory )
227	or return $self->_abort_download( $ftp,	232	or return $self->_abort_download( $ftp,
Lines 262-268 sub ftp_upload { Link Here
262	)	267	)
263	or return $self->_abort_download( undef,	268	or return $self->_abort_download( undef,
264	"Cannot connect to $self->{account}->host: $EVAL_ERROR" );	269	"Cannot connect to $self->{account}->host: $EVAL_ERROR" );
265	$ftp->login( $self->{account}->username, $self->{account}->password )	270	$ftp->login( $self->{account}->username, Koha::Crypt->decrypt_if_needed($self->{account}->password) )
266	or return $self->_abort_download( $ftp, "Cannot login: $ftp->message()" );	271	or return $self->_abort_download( $ftp, "Cannot login: $ftp->message()" );
267	$ftp->cwd( $self->{account}->upload_directory )	272	$ftp->cwd( $self->{account}->upload_directory )
268	or return $self->_abort_download( $ftp,	273	or return $self->_abort_download( $ftp,
Lines 293-299 sub sftp_upload { Link Here
293	my $sftp = Net::SFTP::Foreign->new(	298	my $sftp = Net::SFTP::Foreign->new(
294	host => $self->{account}->host,	299	host => $self->{account}->host,
295	user => $self->{account}->username,	300	user => $self->{account}->username,
296	password => $self->{account}->password,	301	password => Koha::Crypt->decrypt_if_needed($self->{account}->password),
297	timeout => 10,	302	timeout => 10,
298	);	303	);
299	$sftp->die_on_error("Cannot ssh to $self->{account}->host");	304	$sftp->die_on_error("Cannot ssh to $self->{account}->host");

Lines 21-26 use Modern::Perl; Link Here

(-)a/admin/edi_accounts.pl (-5 / +14 lines)
21	use CGI;	21	use CGI;
22	use C4::Auth qw( get_template_and_user );	22	use C4::Auth qw( get_template_and_user );
23	use C4::Output qw( output_html_with_http_headers );	23	use C4::Output qw( output_html_with_http_headers );
		24	use Koha::Crypt;
24	use Koha::Database;	25	use Koha::Database;
25	use Koha::Plugins;	26	use Koha::Plugins;
26		27
Lines 88-100 else { Link Here
88	};	89	};
89		90
90	if ($id) {	91	if ($id) {
91	$schema->resultset('VendorEdiAccount')->search(	92	my $account = $schema->resultset('VendorEdiAccount')->find($id);
92	{	93
93	id => $id,	94	# New password needs encrypted,
94	}	95	# old password is already encrypted and should not be encrypted again
95	)->update_all($fields);	96	if ( $account->password ne $fields->{password} ) {
		97	$fields->{password} =
		98	Koha::Crypt->encrypt_if_needed( $fields->{password} );
		99	}
		100
		101	$account->update($fields);
96	}	102	}
97	else { # new record	103	else { # new record
		104	$fields->{password} =
		105	Koha::Crypt->encrypt_if_needed( $fields->{password} );
		106
98	$schema->resultset('VendorEdiAccount')->create($fields);	107	$schema->resultset('VendorEdiAccount')->create($fields);
99	}	108	}
100	}	109	}

Lines 455-459 __END_SRU_PUBLICSERVER__ Link Here

(-)a/debian/templates/koha-conf-site.xml.in (+4 lines)
455	<do_not_remove_cookie>KohaOpacLanguage</do_not_remove_cookie>	455	<do_not_remove_cookie>KohaOpacLanguage</do_not_remove_cookie>
456	-->	456	-->
457		457
		458	<!-- File path to your passfile for encrypting passwords in Koha
		459	<secret>/path/to/secret</secret>
		460	-->
		461
458	</config>	462	</config>
459	</yazgfs>	463	</yazgfs>

Lines 271-275 Link Here

(-)a/etc/koha-conf.xml (+5 lines)
271	<do_not_remove_cookie>KohaOpacLanguage</do_not_remove_cookie>	271	<do_not_remove_cookie>KohaOpacLanguage</do_not_remove_cookie>
272	-->	272	-->
273		273
		274	<!-- File path to your passfile for encrypting passwords in Koha
		275	<secret>/path/to/secret</secret>
		276	-->
		277
		278
274	</config>	279	</config>
275	</yazgfs>	280	</yazgfs>

Line 0 Link Here

(-)a/installer/data/mysql/atomicupdate/update_edi_vendor_accounts_password.pl (+11 lines)
	1	use Modern::Perl;
	2
	3	return {
	4	bug_number => "BUG_NUMBER",
	5	description => "A single line description",
	6	up => sub {
	7	my ($args) = @_;
	8	my ($dbh, $out) = @$args{qw(dbh out)};
	9	$dbh->do(q{ALTER TABLE vendor_edi_accounts CHANGE COLUMN `password` `password` varchar(128) NULL DEFAULT NULL});
	10	},
	11	};

Lines 5262-5268 CREATE TABLE `vendor_edi_accounts` ( Link Here

(-)a/installer/data/mysql/kohastructure.sql (-1 / +1 lines)
5262	`description` mediumtext COLLATE utf8mb4_unicode_ci NOT NULL,	5262	`description` mediumtext COLLATE utf8mb4_unicode_ci NOT NULL,
5263	`host` varchar(40) COLLATE utf8mb4_unicode_ci DEFAULT NULL,	5263	`host` varchar(40) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
5264	`username` varchar(40) COLLATE utf8mb4_unicode_ci DEFAULT NULL,	5264	`username` varchar(40) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
5265	`password` varchar(40) COLLATE utf8mb4_unicode_ci DEFAULT NULL,	5265	`password` varchar(128) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
5266	`last_activity` date DEFAULT NULL,	5266	`last_activity` date DEFAULT NULL,
5267	`vendor_id` int(11) DEFAULT NULL,	5267	`vendor_id` int(11) DEFAULT NULL,
5268	`download_directory` mediumtext COLLATE utf8mb4_unicode_ci DEFAULT NULL,	5268	`download_directory` mediumtext COLLATE utf8mb4_unicode_ci DEFAULT NULL,

Lines 163-169 EDI accounts &rsaquo; Administration &rsaquo; Koha Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_accounts.tt (-1 / +1 lines)
163	</li>	163	</li>
164	<li>	164	<li>
165	<label for="password">Password: </label>	165	<label for="password">Password: </label>
166	<input type="text" name="password" id="password" size="20" maxlength="40" value="[% account.password \| html %]" />	166	<input type="password" name="password" id="password" size="20" maxlength="40" value="[% account.password \| html %]" />
167	</li>	167	</li>
168	<li>	168	<li>
169	<label for="download_directory">Download directory: </label>	169	<label for="download_directory">Download directory: </label>




#!/usr/bin/perl

# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# Koha is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Koha; if not, see <http://www.gnu.org/licenses>.

use Modern::Perl;

use t::lib::Mocks;

use Test::More tests => 6;

use Cwd qw(abs_path);
use File::Basename;
my $dirname = dirname(__FILE__);
my $secret_path = abs_path("$dirname/secretfile");

t::lib::Mocks::mock_config('secret', $secret_path);

use_ok('Koha::Crypt');

my $data = "some password";
my $encrypted = Koha::Crypt->encrypt_if_needed($data);

isnt($data, $encrypted, "Data appears to be encrypted");

my $decrypted = Koha::Crypt->decrypt_if_needed($encrypted);

is( $decrypted, $data, "Data was decrypted" );

# Test with decryption disabled
t::lib::Mocks::mock_config('secret', "");

use_ok('Koha::Crypt');

$data = "some passwordsadfs897w3r897324978#@#@#";
$encrypted = Koha::Crypt->encrypt_if_needed($data);

is($data, $encrypted, "Data was not encypted");

$decrypted = Koha::Crypt->decrypt_if_needed($encrypted);

is( $decrypted, $data, "Data was never encrypted" );

Line 0 Link Here

(-)a/t/secretfile (-1 / +1 lines)
0	-	1	secret

Return to bug 30649

Line 0 Link Here

(-)a/Koha/Crypt.pm (+79 lines)
		1	package Koha::Crypt;
		2
		3	# Copyright 2018, 2022 Koha Development Team
		4	#
		5	# This file is part of Koha.
		6	#
		7	# Koha is free software; you can redistribute it and/or modify it
		8	# under the terms of the GNU General Public License as published by
		9	# the Free Software Foundation; either version 3 of the License, or
		10	# (at your option) any later version.
		11	#
		12	# Koha is distributed in the hope that it will be useful, but
		13	# WITHOUT ANY WARRANTY; without even the implied warranty of
		14	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
		15	# GNU General Public License for more details.
		16	#
		17	# You should have received a copy of the GNU General Public License
		18	# along with Koha; if not, see <http://www.gnu.org/licenses>.
		19
		20	use Modern::Perl;
		21
		22	use C4::Context;
		23	use Crypt::Simple passfile => C4::Context->config('secret');
		24
		25	=head1 NAME
		26
		27	Koha::Crypt - Class for encrypting data in Koha
		28
		29	=head1 Crypts
		30
		31	=head2 Koha::Crypt
		32
		33	Simple encryption
		34
		35	=head1 Class methods
		36
		37	=head2 encrypt_if_needed
		38
		39	$data = Koha::Crypt->encrypt_if_needed( $data )
		40
		41	If path to a secret file is set in the Koha conf,
		42	the data will be returned encrypted, otherwise the
		43	data will be returned as is.
		44
		45	=cut
		46
		47	sub encrypt_if_needed {
		48	my ( $class, $data ) = @_;
		49
		50	if ( C4::Context->config('secret') ) {
		51	return "___" . encrypt($data);
		52	}
		53	else {
		54	return $data;
		55	}
		56	}
		57
		58	=head2 decrypt_if_needed
		59
		60	$data = Koha::Crypt->decrypt_if_needed( $data )
		61
		62	If path to a secret file is set in the Koha conf,
		63	the data will be returned decrypted, otherwise the
		64	data will be returned as is.
65
66	=cut
67
68	sub decrypt_if_needed {
69	my ( $class, $data ) = @_;
70
71	if ( C4::Context->config('secret') && $data =~ /^___/ ) {
72	return decrypt($data);
73	}
74	else {
75	return $data;
76	}
77	}
78
79	1;

Line 0 Link Here

(-)a/t/Crypt.t (+54 lines)
	1	#!/usr/bin/perl
	2
	3	# This file is part of Koha.
	4	#
	5	# Koha is free software; you can redistribute it and/or modify it
	6	# under the terms of the GNU General Public License as published by
	7	# the Free Software Foundation; either version 3 of the License, or
	8	# (at your option) any later version.
	9	#
	10	# Koha is distributed in the hope that it will be useful, but
	11	# WITHOUT ANY WARRANTY; without even the implied warranty of
	12	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	13	# GNU General Public License for more details.
	14	#
	15	# You should have received a copy of the GNU General Public License
	16	# along with Koha; if not, see <http://www.gnu.org/licenses>.
	17
	18	use Modern::Perl;
	19
	20	use t::lib::Mocks;
	21
	22	use Test::More tests => 6;
	23
	24	use Cwd qw(abs_path);
	25	use File::Basename;
	26	my $dirname = dirname(__FILE__);
	27	my $secret_path = abs_path("$dirname/secretfile");
	28
	29	t::lib::Mocks::mock_config('secret', $secret_path);
	30
	31	use_ok('Koha::Crypt');
	32
	33	my $data = "some password";
	34	my $encrypted = Koha::Crypt->encrypt_if_needed($data);
	35
	36	isnt($data, $encrypted, "Data appears to be encrypted");
	37
	38	my $decrypted = Koha::Crypt->decrypt_if_needed($encrypted);
	39
	40	is( $decrypted, $data, "Data was decrypted" );
	41
	42	# Test with decryption disabled
	43	t::lib::Mocks::mock_config('secret', "");
	44
	45	use_ok('Koha::Crypt');
	46
	47	$data = "some passwordsadfs897w3r897324978#@#@#";
	48	$encrypted = Koha::Crypt->encrypt_if_needed($data);
	49
	50	is($data, $encrypted, "Data was not encypted");
	51
	52	$decrypted = Koha::Crypt->decrypt_if_needed($encrypted);
	53
	54	is( $decrypted, $data, "Data was never encrypted" );