Attachment #134302 for bug #30649

View | Details | Raw Unified | Return to bug 30649
Collapse All | Expand All




package Koha::Crypt;

# Copyright 2018, 2022 Koha Development Team
#
# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# Koha is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Koha; if not, see <http://www.gnu.org/licenses>.

use Modern::Perl;

use C4::Context;
use Crypt::Simple passfile => C4::Context->config('secret');

=head1 NAME

Koha::Crypt - Class for encrypting data in Koha

=head1 Crypts

=head2 Koha::Crypt

Simple encryption

=head1 Class methods

=head2 encrypt_if_needed

$data = Koha::Crypt->encrypt_if_needed( $data )

If path to a secret file is set in the Koha conf,
the data will be returned encrypted, otherwise the
data will be returned as is.

Encrypted data is prefixed with 3 tab characters to denote
that it is encrypted.

=cut

sub encrypt_if_needed {
    my ( $class, $data ) = @_;

    if ( C4::Context->config('secret') ) {
        return "\t\t\t" . encrypt($data);
    }
    else {
        return $data;
    }
}

=head2 decrypt_if_needed

$data = Koha::Crypt->decrypt_if_needed( $data )

If path to a secret file is set in the Koha conf,
the data will be returned decrypted, otherwise the
data will be returned as is.

=cut

sub decrypt_if_needed {
    my ( $class, $data ) = @_;

    if ( C4::Context->config('secret') && $data =~ /^\t\t\t/ ) {
        return decrypt($data);
    }
    else {
        return $data;
    }
}

1;

Lines 20-35 package Koha::Edifact::Transport; Link Here

(-)a/Koha/Edifact/Transport.pm (-10 / +15 lines)
20	use strict;	20	use strict;
21	use warnings;	21	use warnings;
22	use utf8;	22	use utf8;
23	use DateTime;	23
		24	use C4::Context;
		25	use Koha::Database;
		26	use Koha::DateUtils qw( dt_from_string );
		27	use Koha::Crypt;
		28
24	use Carp qw( carp );	29	use Carp qw( carp );
		30	use Crypt::Simple passfile => C4::Context->config('secret');
		31	use DateTime;
		32	use Encode qw( from_to );
25	use English qw{ -no_match_vars };	33	use English qw{ -no_match_vars };
		34	use File::Copy qw( copy move );
		35	use File::Slurp qw( read_file );
26	use Net::FTP;	36	use Net::FTP;
27	use Net::SFTP::Foreign;	37	use Net::SFTP::Foreign;
28	use File::Slurp qw( read_file );
29	use File::Copy qw( copy move );
30	use Koha::Database;
31	use Koha::DateUtils qw( dt_from_string );
32	use Encode qw( from_to );
33		38
34	sub new {	39	sub new {
35	my ( $class, $account_id ) = @_;	40	my ( $class, $account_id ) = @_;
Lines 136-142 sub sftp_download { Link Here
136	my $sftp = Net::SFTP::Foreign->new(	141	my $sftp = Net::SFTP::Foreign->new(
137	host => $self->{account}->host,	142	host => $self->{account}->host,
138	user => $self->{account}->username,	143	user => $self->{account}->username,
139	password => $self->{account}->password,	144	password => Koha::Crypt->decrypt_if_needed($self->{account}->password),
140	timeout => 10,	145	timeout => 10,
141	);	146	);
142	if ( $sftp->error ) {	147	if ( $sftp->error ) {
Lines 221-227 sub ftp_download { Link Here
221	)	226	)
222	or return $self->_abort_download( undef,	227	or return $self->_abort_download( undef,
223	"Cannot connect to $self->{account}->host: $EVAL_ERROR" );	228	"Cannot connect to $self->{account}->host: $EVAL_ERROR" );
224	$ftp->login( $self->{account}->username, $self->{account}->password )	229	$ftp->login( $self->{account}->username, Koha::Crypt->decrypt_if_needed($self->{account}->password)i )
225	or return $self->_abort_download( $ftp, "Cannot login: $ftp->message()" );	230	or return $self->_abort_download( $ftp, "Cannot login: $ftp->message()" );
226	$ftp->cwd( $self->{account}->download_directory )	231	$ftp->cwd( $self->{account}->download_directory )
227	or return $self->_abort_download( $ftp,	232	or return $self->_abort_download( $ftp,
Lines 262-268 sub ftp_upload { Link Here
262	)	267	)
263	or return $self->_abort_download( undef,	268	or return $self->_abort_download( undef,
264	"Cannot connect to $self->{account}->host: $EVAL_ERROR" );	269	"Cannot connect to $self->{account}->host: $EVAL_ERROR" );
265	$ftp->login( $self->{account}->username, $self->{account}->password )	270	$ftp->login( $self->{account}->username, Koha::Crypt->decrypt_if_needed($self->{account}->password) )
266	or return $self->_abort_download( $ftp, "Cannot login: $ftp->message()" );	271	or return $self->_abort_download( $ftp, "Cannot login: $ftp->message()" );
267	$ftp->cwd( $self->{account}->upload_directory )	272	$ftp->cwd( $self->{account}->upload_directory )
268	or return $self->_abort_download( $ftp,	273	or return $self->_abort_download( $ftp,
Lines 293-299 sub sftp_upload { Link Here
293	my $sftp = Net::SFTP::Foreign->new(	298	my $sftp = Net::SFTP::Foreign->new(
294	host => $self->{account}->host,	299	host => $self->{account}->host,
295	user => $self->{account}->username,	300	user => $self->{account}->username,
296	password => $self->{account}->password,	301	password => Koha::Crypt->decrypt_if_needed($self->{account}->password),
297	timeout => 10,	302	timeout => 10,
298	);	303	);
299	$sftp->die_on_error("Cannot ssh to $self->{account}->host");	304	$sftp->die_on_error("Cannot ssh to $self->{account}->host");

Lines 21-26 use Modern::Perl; Link Here

(-)a/admin/edi_accounts.pl (-5 / +14 lines)
21	use CGI;	21	use CGI;
22	use C4::Auth qw( get_template_and_user );	22	use C4::Auth qw( get_template_and_user );
23	use C4::Output qw( output_html_with_http_headers );	23	use C4::Output qw( output_html_with_http_headers );
		24	use Koha::Crypt;
24	use Koha::Database;	25	use Koha::Database;
25	use Koha::Plugins;	26	use Koha::Plugins;
26		27
Lines 88-100 else { Link Here
88	};	89	};
89		90
90	if ($id) {	91	if ($id) {
91	$schema->resultset('VendorEdiAccount')->search(	92	my $account = $schema->resultset('VendorEdiAccount')->find($id);
92	{	93
93	id => $id,	94	# New password needs encrypted,
94	}	95	# old password is already encrypted and should not be encrypted again
95	)->update_all($fields);	96	if ( $account->password ne $fields->{password} ) {
		97	$fields->{password} =
		98	Koha::Crypt->encrypt_if_needed( $fields->{password} );
		99	}
		100
		101	$account->update($fields);
96	}	102	}
97	else { # new record	103	else { # new record
		104	$fields->{password} =
		105	Koha::Crypt->encrypt_if_needed( $fields->{password} );
		106
98	$schema->resultset('VendorEdiAccount')->create($fields);	107	$schema->resultset('VendorEdiAccount')->create($fields);
99	}	108	}
100	}	109	}

Lines 455-459 __END_SRU_PUBLICSERVER__ Link Here

(-)a/debian/templates/koha-conf-site.xml.in (+4 lines)
455	<do_not_remove_cookie>KohaOpacLanguage</do_not_remove_cookie>	455	<do_not_remove_cookie>KohaOpacLanguage</do_not_remove_cookie>
456	-->	456	-->
457		457
		458	<!-- File path to your passfile for encrypting passwords in Koha
		459	<secret>/path/to/secret</secret>
		460	-->
		461
458	</config>	462	</config>
459	</yazgfs>	463	</yazgfs>

Lines 271-275 Link Here

(-)a/etc/koha-conf.xml (+5 lines)
271	<do_not_remove_cookie>KohaOpacLanguage</do_not_remove_cookie>	271	<do_not_remove_cookie>KohaOpacLanguage</do_not_remove_cookie>
272	-->	272	-->
273		273
		274	<!-- File path to your passfile for encrypting passwords in Koha
		275	<secret>/path/to/secret</secret>
		276	-->
		277
		278
274	</config>	279	</config>
275	</yazgfs>	280	</yazgfs>

Line 0 Link Here

(-)a/installer/data/mysql/atomicupdate/bug_30649.pl (+11 lines)
	1	use Modern::Perl;
	2
	3	return {
	4	bug_number => "30649",
	5	description => "Add ability to encrypt data in Koha, use for EDI vendor accounts",
	6	up => sub {
	7	my ($args) = @_;
	8	my ($dbh, $out) = @$args{qw(dbh out)};
	9	$dbh->do(q{ALTER TABLE vendor_edi_accounts CHANGE COLUMN `password` `password` varchar(128) NULL DEFAULT NULL});
	10	},
	11	};

Lines 5262-5268 CREATE TABLE `vendor_edi_accounts` ( Link Here

(-)a/installer/data/mysql/kohastructure.sql (-1 / +1 lines)
5262	`description` mediumtext COLLATE utf8mb4_unicode_ci NOT NULL,	5262	`description` mediumtext COLLATE utf8mb4_unicode_ci NOT NULL,
5263	`host` varchar(40) COLLATE utf8mb4_unicode_ci DEFAULT NULL,	5263	`host` varchar(40) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
5264	`username` varchar(40) COLLATE utf8mb4_unicode_ci DEFAULT NULL,	5264	`username` varchar(40) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
5265	`password` varchar(40) COLLATE utf8mb4_unicode_ci DEFAULT NULL,	5265	`password` varchar(128) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
5266	`last_activity` date DEFAULT NULL,	5266	`last_activity` date DEFAULT NULL,
5267	`vendor_id` int(11) DEFAULT NULL,	5267	`vendor_id` int(11) DEFAULT NULL,
5268	`download_directory` mediumtext COLLATE utf8mb4_unicode_ci DEFAULT NULL,	5268	`download_directory` mediumtext COLLATE utf8mb4_unicode_ci DEFAULT NULL,

Lines 163-169 EDI accounts &rsaquo; Administration &rsaquo; Koha Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_accounts.tt (-1 / +1 lines)
163	</li>	163	</li>
164	<li>	164	<li>
165	<label for="password">Password: </label>	165	<label for="password">Password: </label>
166	<input type="text" name="password" id="password" size="20" maxlength="40" value="[% account.password \| html %]" />	166	<input type="password" name="password" id="password" size="20" maxlength="40" value="[% account.password \| html %]" />
167	</li>	167	</li>
168	<li>	168	<li>
169	<label for="download_directory">Download directory: </label>	169	<label for="download_directory">Download directory: </label>




#!/usr/bin/perl

# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# Koha is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Koha; if not, see <http://www.gnu.org/licenses>.

use Modern::Perl;

use t::lib::Mocks;

use Test::More tests => 6;

use Cwd qw(abs_path);
use File::Basename;
my $dirname = dirname(__FILE__);
my $secret_path = abs_path("$dirname/secretfile");

t::lib::Mocks::mock_config('secret', $secret_path);

use_ok('Koha::Crypt');

my $data = "some password";
my $encrypted = Koha::Crypt->encrypt_if_needed($data);

isnt($data, $encrypted, "Data appears to be encrypted");

my $decrypted = Koha::Crypt->decrypt_if_needed($encrypted);

is( $decrypted, $data, "Data was decrypted" );

# Test with decryption disabled
t::lib::Mocks::mock_config('secret', "");

use_ok('Koha::Crypt');

$data = "some other password";
$encrypted = Koha::Crypt->encrypt_if_needed($data);

is($data, $encrypted, "Data was not encrypted");

$decrypted = Koha::Crypt->decrypt_if_needed($encrypted);

is( $decrypted, $data, "Data was never encrypted" );

Line 0 Link Here

(-)a/t/secretfile (-1 / +1 lines)
0	-	1	secret

Return to bug 30649

Line 0 Link Here

(-)a/Koha/Crypt.pm (+82 lines)
		1	package Koha::Crypt;
		2
		3	# Copyright 2018, 2022 Koha Development Team
		4	#
		5	# This file is part of Koha.
		6	#
		7	# Koha is free software; you can redistribute it and/or modify it
		8	# under the terms of the GNU General Public License as published by
		9	# the Free Software Foundation; either version 3 of the License, or
		10	# (at your option) any later version.
		11	#
		12	# Koha is distributed in the hope that it will be useful, but
		13	# WITHOUT ANY WARRANTY; without even the implied warranty of
		14	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
		15	# GNU General Public License for more details.
		16	#
		17	# You should have received a copy of the GNU General Public License
		18	# along with Koha; if not, see <http://www.gnu.org/licenses>.
		19
		20	use Modern::Perl;
		21
		22	use C4::Context;
		23	use Crypt::Simple passfile => C4::Context->config('secret');
		24
		25	=head1 NAME
		26
		27	Koha::Crypt - Class for encrypting data in Koha
		28
		29	=head1 Crypts
		30
		31	=head2 Koha::Crypt
		32
		33	Simple encryption
		34
		35	=head1 Class methods
		36
		37	=head2 encrypt_if_needed
		38
		39	$data = Koha::Crypt->encrypt_if_needed( $data )
		40
		41	If path to a secret file is set in the Koha conf,
		42	the data will be returned encrypted, otherwise the
		43	data will be returned as is.
		44
		45	Encrypted data is prefixed with 3 tab characters to denote
		46	that it is encrypted.
		47
		48	=cut
		49
		50	sub encrypt_if_needed {
		51	my ( $class, $data ) = @_;
		52
		53	if ( C4::Context->config('secret') ) {
		54	return "\t\t\t" . encrypt($data);
		55	}
		56	else {
		57	return $data;
		58	}
		59	}
		60
		61	=head2 decrypt_if_needed
		62
		63	$data = Koha::Crypt->decrypt_if_needed( $data )
		64
65	If path to a secret file is set in the Koha conf,
66	the data will be returned decrypted, otherwise the
67	data will be returned as is.
68
69	=cut
70
71	sub decrypt_if_needed {
72	my ( $class, $data ) = @_;
73
74	if ( C4::Context->config('secret') && $data =~ /^\t\t\t/ ) {
75	return decrypt($data);
76	}
77	else {
78	return $data;
79	}
80	}
81
82	1;

Line 0 Link Here

(-)a/t/Crypt.t (+54 lines)
	1	#!/usr/bin/perl
	2
	3	# This file is part of Koha.
	4	#
	5	# Koha is free software; you can redistribute it and/or modify it
	6	# under the terms of the GNU General Public License as published by
	7	# the Free Software Foundation; either version 3 of the License, or
	8	# (at your option) any later version.
	9	#
	10	# Koha is distributed in the hope that it will be useful, but
	11	# WITHOUT ANY WARRANTY; without even the implied warranty of
	12	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	13	# GNU General Public License for more details.
	14	#
	15	# You should have received a copy of the GNU General Public License
	16	# along with Koha; if not, see <http://www.gnu.org/licenses>.
	17
	18	use Modern::Perl;
	19
	20	use t::lib::Mocks;
	21
	22	use Test::More tests => 6;
	23
	24	use Cwd qw(abs_path);
	25	use File::Basename;
	26	my $dirname = dirname(__FILE__);
	27	my $secret_path = abs_path("$dirname/secretfile");
	28
	29	t::lib::Mocks::mock_config('secret', $secret_path);
	30
	31	use_ok('Koha::Crypt');
	32
	33	my $data = "some password";
	34	my $encrypted = Koha::Crypt->encrypt_if_needed($data);
	35
	36	isnt($data, $encrypted, "Data appears to be encrypted");
	37
	38	my $decrypted = Koha::Crypt->decrypt_if_needed($encrypted);
	39
	40	is( $decrypted, $data, "Data was decrypted" );
	41
	42	# Test with decryption disabled
	43	t::lib::Mocks::mock_config('secret', "");
	44
	45	use_ok('Koha::Crypt');
	46
	47	$data = "some other password";
	48	$encrypted = Koha::Crypt->encrypt_if_needed($data);
	49
	50	is($data, $encrypted, "Data was not encrypted");
	51
	52	$decrypted = Koha::Crypt->decrypt_if_needed($encrypted);
	53
	54	is( $decrypted, $data, "Data was never encrypted" );