Bugzilla – Attachment 192496 Details for
Bug 41774
Add ability to read encryption key from environment variable
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 41774: Add ability to read encryption key from environment variable
128378e.patch (text/plain), 5.36 KB, created by
Kyle M Hall (khall)
on 2026-02-04 19:59:17 UTC
(
hide
)
Description:
Bug 41774: Add ability to read encryption key from environment variable
Filename:
MIME Type:
Creator:
Kyle M Hall (khall)
Created:
2026-02-04 19:59:17 UTC
Size:
5.36 KB
patch
obsolete
>From 128378ec12a2ddfc48ef2a5a7465843729c80cae Mon Sep 17 00:00:00 2001 >From: Kyle M Hall <kyle@bywatersolutions.com> >Date: Wed, 4 Feb 2026 14:22:40 -0500 >Subject: [PATCH] Bug 41774: Add ability to read encryption key from > environment variable > >From a security standpoint it would be useful to be able to store Koha's encryption key in an environment variable. This is particularly useful in containerized environments, but is not limited to that use case. > >Test plan: >1) Apply this patch >2) Remove or comment out the encryption key in koha-conf.xml >3) Restart plack >4) Browse to the "System information" tab of the about page >5) Note the missing encryption_key warning on the page >6) restart plack again, inject the encryption key as an environment variable: > sudo KOHA_ENCRYPTION_KEY=t0P_secret koha-plack --restart kohadev >7) Reload the about page >8) Note the warning is gone! >--- > Koha/Encryption.pm | 4 ++-- > about.pl | 8 ++++---- > debian/scripts/koha-plack | 1 + > koha-tmpl/intranet-tmpl/prog/en/modules/about.tt | 5 ++++- > members/two_factor_auth.pl | 2 +- > 5 files changed, 12 insertions(+), 8 deletions(-) > >diff --git a/Koha/Encryption.pm b/Koha/Encryption.pm >index 8dbddede334..6f2d1561ff3 100644 >--- a/Koha/Encryption.pm >+++ b/Koha/Encryption.pm >@@ -54,10 +54,10 @@ It's based on Crypt::CBC > > sub new { > my ($class) = @_; >- my $encryption_key = C4::Context->config('encryption_key'); >+ my $encryption_key = C4::Context->config('encryption_key') || $ENV{KOHA_ENCRYPTION_KEY}; > if ( !$encryption_key || $encryption_key eq '__ENCRYPTION_KEY__' ) { > Koha::Exceptions::MissingParameter->throw( >- q{No encryption_key in koha-conf.xml. Please generate a key. We recommend one of at least 32 bytes. (You might use 'pwgen 32' to do so.)} >+ q{No encryption_key in koha-conf.xml or environment variable KOHA_ENCRYPTION_KEY. Please generate a key. We recommend one of at least 32 bytes. (You might use 'pwgen 32' to do so.)} > ); > } > return $class->SUPER::new( >diff --git a/about.pl b/about.pl >index 8cf49485936..063330e1ba4 100755 >--- a/about.pl >+++ b/about.pl >@@ -290,7 +290,7 @@ if ( $tab eq 'sysinfo' ) { > }; > } > >- my $encryption_key = C4::Context->config('encryption_key'); >+ my $encryption_key = C4::Context->config('encryption_key') || $ENV{KOHA_ENCRYPTION_KEY}; > if ( !$encryption_key || $encryption_key eq '__ENCRYPTION_KEY__' ) { > push @xml_config_warnings, { error => 'encryption_key_missing' }; > } >@@ -954,7 +954,7 @@ if ( $tab eq 'database' ) { > > my $bwsbranch_filename = '/usr/share/koha/bin/bwsbranch'; > if ( -r $bwsbranch_filename ) { >- my $bwsbranch = read_file( $bwsbranch_filename ); >+ my $bwsbranch = read_file($bwsbranch_filename); > $template->param( bwsbranch => $bwsbranch ); > } > >@@ -962,8 +962,8 @@ my $url = C4::Context->preference('staffClientBaseURL'); > $url =~ s|https://||; > $url =~ s|http://||; > $template->param( >- inbound_ip => qx{dig $url +short | grep '^[.0-9]*\$'}, >- outbound_ip => qx{curl ipinfo.io/ip}, >+ inbound_ip => qx{dig $url +short | grep '^[.0-9]*\$'}, >+ outbound_ip => qx{curl ipinfo.io/ip}, > ); > > output_html_with_http_headers $query, $cookie, $template->output; >diff --git a/debian/scripts/koha-plack b/debian/scripts/koha-plack >index 9a31d419e42..97c190087ed 100755 >--- a/debian/scripts/koha-plack >+++ b/debian/scripts/koha-plack >@@ -117,6 +117,7 @@ start_plack() > > if ! is_plack_running ${instancename}; then > export KOHA_CONF="/etc/koha/sites/${instancename}/koha-conf.xml" >+ [ -n "$KOHA_ENCRYPTION_KEY" ] && export KOHA_ENCRYPTION_KEY > > log_daemon_msg "Starting Plack daemon for ${instancename}" > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt >index 6ebfc79eabc..c7433a0a1f8 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt >@@ -771,7 +771,10 @@ > [% ELSIF config_entry.error == 'encryption_key_missing' %] > <tr> > <th scope="row"><strong>Warning</strong></th> >- <td> You are missing the <encryption_key> entry in your koha-conf.xml file. Please generate a key. We recommend one of at least 32 bytes. (You might use 'pwgen 32' to do so.) </td> >+ <td> >+ You are missing the <encryption_key> entry in your koha-conf.xml file ( or as an environment variable KOHA_ENCRYPTION_KEY ). Please generate a key. We recommend one of at least 32 bytes. (You might >+ use 'pwgen 32' to do so.) >+ </td> > </tr> > [% END # /IF config_entry.error %] > [% END # /FOREACH config_entry %] >diff --git a/members/two_factor_auth.pl b/members/two_factor_auth.pl >index e163230632b..73b7c985c11 100755 >--- a/members/two_factor_auth.pl >+++ b/members/two_factor_auth.pl >@@ -64,7 +64,7 @@ if ( !$patron ) { > exit; > } > >-if ( !C4::Context->config('encryption_key') ) { >+if ( !( C4::Context->config('encryption_key') || $ENV{KOHA_ENCRYPTION_KEY} ) ) { > $template->param( missing_key => 1 ); > } else { > >-- >2.50.1 (Apple Git-155) >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 41774
: 192496