View | Details | Raw Unified | Return to bug 30649
Collapse All | Expand All

(-)a/Koha/Crypt.pm (+82 lines)
Line 0 Link Here
1
package Koha::Crypt;
2
3
# Copyright 2018, 2022 Koha Development Team
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it
8
# under the terms of the GNU General Public License as published by
9
# the Free Software Foundation; either version 3 of the License, or
10
# (at your option) any later version.
11
#
12
# Koha is distributed in the hope that it will be useful, but
13
# WITHOUT ANY WARRANTY; without even the implied warranty of
14
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
# GNU General Public License for more details.
16
#
17
# You should have received a copy of the GNU General Public License
18
# along with Koha; if not, see <http://www.gnu.org/licenses>.
19
20
use Modern::Perl;
21
22
use C4::Context;
23
use Crypt::Simple passfile => C4::Context->config('secret');
24
25
=head1 NAME
26
27
Koha::Crypt - Class for encrypting data in Koha
28
29
=head1 Crypts
30
31
=head2 Koha::Crypt
32
33
Simple encryption
34
35
=head1 Class methods
36
37
=head2 encrypt_if_needed
38
39
$data = Koha::Crypt->encrypt_if_needed( $data )
40
41
If path to a secret file is set in the Koha conf,
42
the data will be returned encrypted, otherwise the
43
data will be returned as is.
44
45
Encrypted data is prefixed with 3 tab characters to denote
46
that it is encrypted.
47
48
=cut
49
50
sub encrypt_if_needed {
51
    my ( $class, $data ) = @_;
52
53
    if ( C4::Context->config('secret') ) {
54
        return "\t\t\t" . encrypt($data);
55
    }
56
    else {
57
        return $data;
58
    }
59
}
60
61
=head2 decrypt_if_needed
62
63
$data = Koha::Crypt->decrypt_if_needed( $data )
64
65
If path to a secret file is set in the Koha conf,
66
the data will be returned decrypted, otherwise the
67
data will be returned as is.
68
69
=cut
70
71
sub decrypt_if_needed {
72
    my ( $class, $data ) = @_;
73
74
    if ( C4::Context->config('secret') && $data =~ /^\t\t\t/ ) {
75
        return decrypt($data);
76
    }
77
    else {
78
        return $data;
79
    }
80
}
81
82
1;
(-)a/Koha/Edifact/Transport.pm (-10 / +15 lines)
Lines 20-35 package Koha::Edifact::Transport; Link Here
20
use strict;
20
use strict;
21
use warnings;
21
use warnings;
22
use utf8;
22
use utf8;
23
use DateTime;
23
24
use C4::Context;
25
use Koha::Database;
26
use Koha::DateUtils qw( dt_from_string );
27
use Koha::Crypt;
28
24
use Carp qw( carp );
29
use Carp qw( carp );
30
use Crypt::Simple passfile => C4::Context->config('secret');
31
use DateTime;
32
use Encode qw( from_to );
25
use English qw{ -no_match_vars };
33
use English qw{ -no_match_vars };
34
use File::Copy qw( copy move );
35
use File::Slurp qw( read_file );
26
use Net::FTP;
36
use Net::FTP;
27
use Net::SFTP::Foreign;
37
use Net::SFTP::Foreign;
28
use File::Slurp qw( read_file );
29
use File::Copy qw( copy move );
30
use Koha::Database;
31
use Koha::DateUtils qw( dt_from_string );
32
use Encode qw( from_to );
33
38
34
sub new {
39
sub new {
35
    my ( $class, $account_id ) = @_;
40
    my ( $class, $account_id ) = @_;
Lines 136-142 sub sftp_download { Link Here
136
    my $sftp = Net::SFTP::Foreign->new(
141
    my $sftp = Net::SFTP::Foreign->new(
137
        host     => $self->{account}->host,
142
        host     => $self->{account}->host,
138
        user     => $self->{account}->username,
143
        user     => $self->{account}->username,
139
        password => $self->{account}->password,
144
        password => Koha::Crypt->decrypt_if_needed($self->{account}->password),
140
        timeout  => 10,
145
        timeout  => 10,
141
    );
146
    );
142
    if ( $sftp->error ) {
147
    if ( $sftp->error ) {
Lines 221-227 sub ftp_download { Link Here
221
      )
226
      )
222
      or return $self->_abort_download( undef,
227
      or return $self->_abort_download( undef,
223
        "Cannot connect to $self->{account}->host: $EVAL_ERROR" );
228
        "Cannot connect to $self->{account}->host: $EVAL_ERROR" );
224
    $ftp->login( $self->{account}->username, $self->{account}->password )
229
    $ftp->login( $self->{account}->username, Koha::Crypt->decrypt_if_needed($self->{account}->password)i )
225
      or return $self->_abort_download( $ftp, "Cannot login: $ftp->message()" );
230
      or return $self->_abort_download( $ftp, "Cannot login: $ftp->message()" );
226
    $ftp->cwd( $self->{account}->download_directory )
231
    $ftp->cwd( $self->{account}->download_directory )
227
      or return $self->_abort_download( $ftp,
232
      or return $self->_abort_download( $ftp,
Lines 262-268 sub ftp_upload { Link Here
262
      )
267
      )
263
      or return $self->_abort_download( undef,
268
      or return $self->_abort_download( undef,
264
        "Cannot connect to $self->{account}->host: $EVAL_ERROR" );
269
        "Cannot connect to $self->{account}->host: $EVAL_ERROR" );
265
    $ftp->login( $self->{account}->username, $self->{account}->password )
270
    $ftp->login( $self->{account}->username, Koha::Crypt->decrypt_if_needed($self->{account}->password) )
266
      or return $self->_abort_download( $ftp, "Cannot login: $ftp->message()" );
271
      or return $self->_abort_download( $ftp, "Cannot login: $ftp->message()" );
267
    $ftp->cwd( $self->{account}->upload_directory )
272
    $ftp->cwd( $self->{account}->upload_directory )
268
      or return $self->_abort_download( $ftp,
273
      or return $self->_abort_download( $ftp,
Lines 293-299 sub sftp_upload { Link Here
293
    my $sftp = Net::SFTP::Foreign->new(
298
    my $sftp = Net::SFTP::Foreign->new(
294
        host     => $self->{account}->host,
299
        host     => $self->{account}->host,
295
        user     => $self->{account}->username,
300
        user     => $self->{account}->username,
296
        password => $self->{account}->password,
301
        password => Koha::Crypt->decrypt_if_needed($self->{account}->password),
297
        timeout  => 10,
302
        timeout  => 10,
298
    );
303
    );
299
    $sftp->die_on_error("Cannot ssh to $self->{account}->host");
304
    $sftp->die_on_error("Cannot ssh to $self->{account}->host");
(-)a/admin/edi_accounts.pl (-5 / +14 lines)
Lines 21-26 use Modern::Perl; Link Here
21
use CGI;
21
use CGI;
22
use C4::Auth qw( get_template_and_user );
22
use C4::Auth qw( get_template_and_user );
23
use C4::Output qw( output_html_with_http_headers );
23
use C4::Output qw( output_html_with_http_headers );
24
use Koha::Crypt;
24
use Koha::Database;
25
use Koha::Database;
25
use Koha::Plugins;
26
use Koha::Plugins;
26
27
Lines 88-100 else { Link Here
88
        };
89
        };
89
90
90
        if ($id) {
91
        if ($id) {
91
            $schema->resultset('VendorEdiAccount')->search(
92
            my $account = $schema->resultset('VendorEdiAccount')->find($id);
92
                {
93
93
                    id => $id,
94
           # New password needs encrypted,
94
                }
95
           # old password is already encrypted and should not be encrypted again
95
            )->update_all($fields);
96
            if ( $account->password ne $fields->{password} ) {
97
                $fields->{password} =
98
                  Koha::Crypt->encrypt_if_needed( $fields->{password} );
99
            }
100
101
            $account->update($fields);
96
        }
102
        }
97
        else {    # new record
103
        else {    # new record
104
            $fields->{password} =
105
              Koha::Crypt->encrypt_if_needed( $fields->{password} );
106
98
            $schema->resultset('VendorEdiAccount')->create($fields);
107
            $schema->resultset('VendorEdiAccount')->create($fields);
99
        }
108
        }
100
    }
109
    }
(-)a/debian/templates/koha-conf-site.xml.in (+4 lines)
Lines 455-459 __END_SRU_PUBLICSERVER__ Link Here
455
     <do_not_remove_cookie>KohaOpacLanguage</do_not_remove_cookie>
455
     <do_not_remove_cookie>KohaOpacLanguage</do_not_remove_cookie>
456
 -->
456
 -->
457
457
458
 <!-- File path to your passfile for encrypting passwords in Koha
459
   <secret>/path/to/secret</secret>
460
 -->
461
458
</config>
462
</config>
459
</yazgfs>
463
</yazgfs>
(-)a/etc/koha-conf.xml (+5 lines)
Lines 271-275 Link Here
271
     <do_not_remove_cookie>KohaOpacLanguage</do_not_remove_cookie>
271
     <do_not_remove_cookie>KohaOpacLanguage</do_not_remove_cookie>
272
 -->
272
 -->
273
273
274
  <!-- File path to your passfile for encrypting passwords in Koha
275
    <secret>/path/to/secret</secret>
276
  -->
277
278
274
</config>
279
</config>
275
</yazgfs>
280
</yazgfs>
(-)a/installer/data/mysql/atomicupdate/bug_30649.pl (+11 lines)
Line 0 Link Here
1
use Modern::Perl;
2
3
return {
4
    bug_number => "30649",
5
    description => "Add ability to encrypt data in Koha, use for EDI vendor accounts",
6
    up => sub {
7
        my ($args) = @_;
8
        my ($dbh, $out) = @$args{qw(dbh out)};
9
        $dbh->do(q{ALTER TABLE vendor_edi_accounts CHANGE COLUMN `password` `password` varchar(128) NULL DEFAULT NULL});
10
    },
11
};
(-)a/installer/data/mysql/kohastructure.sql (-1 / +1 lines)
Lines 5262-5268 CREATE TABLE `vendor_edi_accounts` ( Link Here
5262
  `description` mediumtext COLLATE utf8mb4_unicode_ci NOT NULL,
5262
  `description` mediumtext COLLATE utf8mb4_unicode_ci NOT NULL,
5263
  `host` varchar(40) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
5263
  `host` varchar(40) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
5264
  `username` varchar(40) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
5264
  `username` varchar(40) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
5265
  `password` varchar(40) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
5265
  `password` varchar(128) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
5266
  `last_activity` date DEFAULT NULL,
5266
  `last_activity` date DEFAULT NULL,
5267
  `vendor_id` int(11) DEFAULT NULL,
5267
  `vendor_id` int(11) DEFAULT NULL,
5268
  `download_directory` mediumtext COLLATE utf8mb4_unicode_ci DEFAULT NULL,
5268
  `download_directory` mediumtext COLLATE utf8mb4_unicode_ci DEFAULT NULL,
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_accounts.tt (-1 / +1 lines)
Lines 163-169 EDI accounts &rsaquo; Administration &rsaquo; Koha Link Here
163
  </li>
163
  </li>
164
  <li>
164
  <li>
165
     <label for="password">Password: </label>
165
     <label for="password">Password: </label>
166
     <input type="text" name="password" id="password" size="20" maxlength="40" value="[% account.password | html %]" />
166
     <input type="password" name="password" id="password" size="20" maxlength="40" value="[% account.password | html %]" />
167
  </li>
167
  </li>
168
  <li>
168
  <li>
169
     <label for="download_directory">Download directory: </label>
169
     <label for="download_directory">Download directory: </label>
(-)a/t/Crypt.t (+54 lines)
Line 0 Link Here
1
#!/usr/bin/perl
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it
6
# under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 3 of the License, or
8
# (at your option) any later version.
9
#
10
# Koha is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
# GNU General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with Koha; if not, see <http://www.gnu.org/licenses>.
17
18
use Modern::Perl;
19
20
use t::lib::Mocks;
21
22
use Test::More tests => 6;
23
24
use Cwd qw(abs_path);
25
use File::Basename;
26
my $dirname = dirname(__FILE__);
27
my $secret_path = abs_path("$dirname/secretfile");
28
29
t::lib::Mocks::mock_config('secret', $secret_path);
30
31
use_ok('Koha::Crypt');
32
33
my $data = "some password";
34
my $encrypted = Koha::Crypt->encrypt_if_needed($data);
35
36
isnt($data, $encrypted, "Data appears to be encrypted");
37
38
my $decrypted = Koha::Crypt->decrypt_if_needed($encrypted);
39
40
is( $decrypted, $data, "Data was decrypted" );
41
42
# Test with decryption disabled
43
t::lib::Mocks::mock_config('secret', "");
44
45
use_ok('Koha::Crypt');
46
47
$data = "some other password";
48
$encrypted = Koha::Crypt->encrypt_if_needed($data);
49
50
is($data, $encrypted, "Data was not encrypted");
51
52
$decrypted = Koha::Crypt->decrypt_if_needed($encrypted);
53
54
is( $decrypted, $data, "Data was never encrypted" );
(-)a/t/secretfile (-1 / +1 lines)
Line 0 Link Here
0
- 
1
secret

Return to bug 30649