View | Details | Raw Unified | Return to bug 30649
Collapse All | Expand All

(-)a/Koha/Crypt.pm (+79 lines)
Line 0 Link Here
1
package Koha::Crypt;
2
3
# Copyright 2018, 2022 Koha Development Team
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it
8
# under the terms of the GNU General Public License as published by
9
# the Free Software Foundation; either version 3 of the License, or
10
# (at your option) any later version.
11
#
12
# Koha is distributed in the hope that it will be useful, but
13
# WITHOUT ANY WARRANTY; without even the implied warranty of
14
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
# GNU General Public License for more details.
16
#
17
# You should have received a copy of the GNU General Public License
18
# along with Koha; if not, see <http://www.gnu.org/licenses>.
19
20
use Modern::Perl;
21
22
use C4::Context;
23
use Crypt::Simple passfile => C4::Context->config('secret');
24
25
=head1 NAME
26
27
Koha::Crypt - Class for encrypting data in Koha
28
29
=head1 Crypts
30
31
=head2 Koha::Crypt
32
33
Simple encryption
34
35
=head1 Class methods
36
37
=head2 encrypt_if_needed
38
39
$data = Koha::Crypt->encrypt_if_needed( $data )
40
41
If path to a secret file is set in the Koha conf,
42
the data will be returned encrypted, otherwise the
43
data will be returned as is.
44
45
=cut
46
47
sub encrypt_if_needed {
48
    my ( $class, $data ) = @_;
49
50
    if ( C4::Context->config('secret') ) {
51
        return "___" . encrypt($data);
52
    }
53
    else {
54
        return $data;
55
    }
56
}
57
58
=head2 decrypt_if_needed
59
60
$data = Koha::Crypt->decrypt_if_needed( $data )
61
62
If path to a secret file is set in the Koha conf,
63
the data will be returned decrypted, otherwise the
64
data will be returned as is.
65
66
=cut
67
68
sub decrypt_if_needed {
69
    my ( $class, $data ) = @_;
70
71
    if ( C4::Context->config('secret') && $data =~ /^___/ ) {
72
        return decrypt($data);
73
    }
74
    else {
75
        return $data;
76
    }
77
}
78
79
1;
(-)a/Koha/Edifact/Transport.pm (-10 / +15 lines)
Lines 20-35 package Koha::Edifact::Transport; Link Here
20
use strict;
20
use strict;
21
use warnings;
21
use warnings;
22
use utf8;
22
use utf8;
23
use DateTime;
23
24
use C4::Context;
25
use Koha::Database;
26
use Koha::DateUtils qw( dt_from_string );
27
use Koha::Crypt;
28
24
use Carp qw( carp );
29
use Carp qw( carp );
30
use Crypt::Simple passfile => C4::Context->config('secret');
31
use DateTime;
32
use Encode qw( from_to );
25
use English qw{ -no_match_vars };
33
use English qw{ -no_match_vars };
34
use File::Copy qw( copy move );
35
use File::Slurp qw( read_file );
26
use Net::FTP;
36
use Net::FTP;
27
use Net::SFTP::Foreign;
37
use Net::SFTP::Foreign;
28
use File::Slurp qw( read_file );
29
use File::Copy qw( copy move );
30
use Koha::Database;
31
use Koha::DateUtils qw( dt_from_string );
32
use Encode qw( from_to );
33
38
34
sub new {
39
sub new {
35
    my ( $class, $account_id ) = @_;
40
    my ( $class, $account_id ) = @_;
Lines 136-142 sub sftp_download { Link Here
136
    my $sftp = Net::SFTP::Foreign->new(
141
    my $sftp = Net::SFTP::Foreign->new(
137
        host     => $self->{account}->host,
142
        host     => $self->{account}->host,
138
        user     => $self->{account}->username,
143
        user     => $self->{account}->username,
139
        password => $self->{account}->password,
144
        password => Koha::Crypt->decrypt_if_needed($self->{account}->password),
140
        timeout  => 10,
145
        timeout  => 10,
141
    );
146
    );
142
    if ( $sftp->error ) {
147
    if ( $sftp->error ) {
Lines 221-227 sub ftp_download { Link Here
221
      )
226
      )
222
      or return $self->_abort_download( undef,
227
      or return $self->_abort_download( undef,
223
        "Cannot connect to $self->{account}->host: $EVAL_ERROR" );
228
        "Cannot connect to $self->{account}->host: $EVAL_ERROR" );
224
    $ftp->login( $self->{account}->username, $self->{account}->password )
229
    $ftp->login( $self->{account}->username, Koha::Crypt->decrypt_if_needed($self->{account}->password)i )
225
      or return $self->_abort_download( $ftp, "Cannot login: $ftp->message()" );
230
      or return $self->_abort_download( $ftp, "Cannot login: $ftp->message()" );
226
    $ftp->cwd( $self->{account}->download_directory )
231
    $ftp->cwd( $self->{account}->download_directory )
227
      or return $self->_abort_download( $ftp,
232
      or return $self->_abort_download( $ftp,
Lines 262-268 sub ftp_upload { Link Here
262
      )
267
      )
263
      or return $self->_abort_download( undef,
268
      or return $self->_abort_download( undef,
264
        "Cannot connect to $self->{account}->host: $EVAL_ERROR" );
269
        "Cannot connect to $self->{account}->host: $EVAL_ERROR" );
265
    $ftp->login( $self->{account}->username, $self->{account}->password )
270
    $ftp->login( $self->{account}->username, Koha::Crypt->decrypt_if_needed($self->{account}->password) )
266
      or return $self->_abort_download( $ftp, "Cannot login: $ftp->message()" );
271
      or return $self->_abort_download( $ftp, "Cannot login: $ftp->message()" );
267
    $ftp->cwd( $self->{account}->upload_directory )
272
    $ftp->cwd( $self->{account}->upload_directory )
268
      or return $self->_abort_download( $ftp,
273
      or return $self->_abort_download( $ftp,
Lines 293-299 sub sftp_upload { Link Here
293
    my $sftp = Net::SFTP::Foreign->new(
298
    my $sftp = Net::SFTP::Foreign->new(
294
        host     => $self->{account}->host,
299
        host     => $self->{account}->host,
295
        user     => $self->{account}->username,
300
        user     => $self->{account}->username,
296
        password => $self->{account}->password,
301
        password => Koha::Crypt->decrypt_if_needed($self->{account}->password),
297
        timeout  => 10,
302
        timeout  => 10,
298
    );
303
    );
299
    $sftp->die_on_error("Cannot ssh to $self->{account}->host");
304
    $sftp->die_on_error("Cannot ssh to $self->{account}->host");
(-)a/admin/edi_accounts.pl (-5 / +14 lines)
Lines 21-26 use Modern::Perl; Link Here
21
use CGI;
21
use CGI;
22
use C4::Auth qw( get_template_and_user );
22
use C4::Auth qw( get_template_and_user );
23
use C4::Output qw( output_html_with_http_headers );
23
use C4::Output qw( output_html_with_http_headers );
24
use Koha::Crypt;
24
use Koha::Database;
25
use Koha::Database;
25
use Koha::Plugins;
26
use Koha::Plugins;
26
27
Lines 88-100 else { Link Here
88
        };
89
        };
89
90
90
        if ($id) {
91
        if ($id) {
91
            $schema->resultset('VendorEdiAccount')->search(
92
            my $account = $schema->resultset('VendorEdiAccount')->find($id);
92
                {
93
93
                    id => $id,
94
           # New password needs encrypted,
94
                }
95
           # old password is already encrypted and should not be encrypted again
95
            )->update_all($fields);
96
            if ( $account->password ne $fields->{password} ) {
97
                $fields->{password} =
98
                  Koha::Crypt->encrypt_if_needed( $fields->{password} );
99
            }
100
101
            $account->update($fields);
96
        }
102
        }
97
        else {    # new record
103
        else {    # new record
104
            $fields->{password} =
105
              Koha::Crypt->encrypt_if_needed( $fields->{password} );
106
98
            $schema->resultset('VendorEdiAccount')->create($fields);
107
            $schema->resultset('VendorEdiAccount')->create($fields);
99
        }
108
        }
100
    }
109
    }
(-)a/debian/templates/koha-conf-site.xml.in (+4 lines)
Lines 455-459 __END_SRU_PUBLICSERVER__ Link Here
455
     <do_not_remove_cookie>KohaOpacLanguage</do_not_remove_cookie>
455
     <do_not_remove_cookie>KohaOpacLanguage</do_not_remove_cookie>
456
 -->
456
 -->
457
457
458
 <!-- File path to your passfile for encrypting passwords in Koha
459
   <secret>/path/to/secret</secret>
460
 -->
461
458
</config>
462
</config>
459
</yazgfs>
463
</yazgfs>
(-)a/etc/koha-conf.xml (+5 lines)
Lines 271-275 Link Here
271
     <do_not_remove_cookie>KohaOpacLanguage</do_not_remove_cookie>
271
     <do_not_remove_cookie>KohaOpacLanguage</do_not_remove_cookie>
272
 -->
272
 -->
273
273
274
  <!-- File path to your passfile for encrypting passwords in Koha
275
    <secret>/path/to/secret</secret>
276
  -->
277
278
274
</config>
279
</config>
275
</yazgfs>
280
</yazgfs>
(-)a/installer/data/mysql/atomicupdate/bug_30649.pl (+11 lines)
Line 0 Link Here
1
use Modern::Perl;
2
3
return {
4
    bug_number => "30649",
5
    description => "Add ability to encrypt data in Koha, use for EDI vendor accounts",
6
    up => sub {
7
        my ($args) = @_;
8
        my ($dbh, $out) = @$args{qw(dbh out)};
9
        $dbh->do(q{ALTER TABLE vendor_edi_accounts CHANGE COLUMN `password` `password` varchar(128) NULL DEFAULT NULL});
10
    },
11
};
(-)a/installer/data/mysql/kohastructure.sql (-1 / +1 lines)
Lines 5262-5268 CREATE TABLE `vendor_edi_accounts` ( Link Here
5262
  `description` mediumtext COLLATE utf8mb4_unicode_ci NOT NULL,
5262
  `description` mediumtext COLLATE utf8mb4_unicode_ci NOT NULL,
5263
  `host` varchar(40) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
5263
  `host` varchar(40) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
5264
  `username` varchar(40) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
5264
  `username` varchar(40) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
5265
  `password` varchar(40) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
5265
  `password` varchar(128) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
5266
  `last_activity` date DEFAULT NULL,
5266
  `last_activity` date DEFAULT NULL,
5267
  `vendor_id` int(11) DEFAULT NULL,
5267
  `vendor_id` int(11) DEFAULT NULL,
5268
  `download_directory` mediumtext COLLATE utf8mb4_unicode_ci DEFAULT NULL,
5268
  `download_directory` mediumtext COLLATE utf8mb4_unicode_ci DEFAULT NULL,
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_accounts.tt (-1 / +1 lines)
Lines 163-169 EDI accounts &rsaquo; Administration &rsaquo; Koha Link Here
163
  </li>
163
  </li>
164
  <li>
164
  <li>
165
     <label for="password">Password: </label>
165
     <label for="password">Password: </label>
166
     <input type="text" name="password" id="password" size="20" maxlength="40" value="[% account.password | html %]" />
166
     <input type="password" name="password" id="password" size="20" maxlength="40" value="[% account.password | html %]" />
167
  </li>
167
  </li>
168
  <li>
168
  <li>
169
     <label for="download_directory">Download directory: </label>
169
     <label for="download_directory">Download directory: </label>
(-)a/t/Crypt.t (+54 lines)
Line 0 Link Here
1
#!/usr/bin/perl
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it
6
# under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 3 of the License, or
8
# (at your option) any later version.
9
#
10
# Koha is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
# GNU General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with Koha; if not, see <http://www.gnu.org/licenses>.
17
18
use Modern::Perl;
19
20
use t::lib::Mocks;
21
22
use Test::More tests => 6;
23
24
use Cwd qw(abs_path);
25
use File::Basename;
26
my $dirname = dirname(__FILE__);
27
my $secret_path = abs_path("$dirname/secretfile");
28
29
t::lib::Mocks::mock_config('secret', $secret_path);
30
31
use_ok('Koha::Crypt');
32
33
my $data = "some password";
34
my $encrypted = Koha::Crypt->encrypt_if_needed($data);
35
36
isnt($data, $encrypted, "Data appears to be encrypted");
37
38
my $decrypted = Koha::Crypt->decrypt_if_needed($encrypted);
39
40
is( $decrypted, $data, "Data was decrypted" );
41
42
# Test with decryption disabled
43
t::lib::Mocks::mock_config('secret', "");
44
45
use_ok('Koha::Crypt');
46
47
$data = "some passwordsadfs897w3r897324978#@#@#";
48
$encrypted = Koha::Crypt->encrypt_if_needed($data);
49
50
is($data, $encrypted, "Data was not encypted");
51
52
$decrypted = Koha::Crypt->decrypt_if_needed($encrypted);
53
54
is( $decrypted, $data, "Data was never encrypted" );
(-)a/t/secretfile (-1 / +1 lines)
Line 0 Link Here
0
- 
1
secret

Return to bug 30649