From 128378ec12a2ddfc48ef2a5a7465843729c80cae Mon Sep 17 00:00:00 2001 From: Kyle M Hall Date: Wed, 4 Feb 2026 14:22:40 -0500 Subject: [PATCH] Bug 41774: Add ability to read encryption key from environment variable From a security standpoint it would be useful to be able to store Koha's encryption key in an environment variable. This is particularly useful in containerized environments, but is not limited to that use case. Test plan: 1) Apply this patch 2) Remove or comment out the encryption key in koha-conf.xml 3) Restart plack 4) Browse to the "System information" tab of the about page 5) Note the missing encryption_key warning on the page 6) restart plack again, inject the encryption key as an environment variable: sudo KOHA_ENCRYPTION_KEY=t0P_secret koha-plack --restart kohadev 7) Reload the about page 8) Note the warning is gone! --- Koha/Encryption.pm | 4 ++-- about.pl | 8 ++++---- debian/scripts/koha-plack | 1 + koha-tmpl/intranet-tmpl/prog/en/modules/about.tt | 5 ++++- members/two_factor_auth.pl | 2 +- 5 files changed, 12 insertions(+), 8 deletions(-) diff --git a/Koha/Encryption.pm b/Koha/Encryption.pm index 8dbddede334..6f2d1561ff3 100644 --- a/Koha/Encryption.pm +++ b/Koha/Encryption.pm @@ -54,10 +54,10 @@ It's based on Crypt::CBC sub new { my ($class) = @_; - my $encryption_key = C4::Context->config('encryption_key'); + my $encryption_key = C4::Context->config('encryption_key') || $ENV{KOHA_ENCRYPTION_KEY}; if ( !$encryption_key || $encryption_key eq '__ENCRYPTION_KEY__' ) { Koha::Exceptions::MissingParameter->throw( - q{No encryption_key in koha-conf.xml. Please generate a key. We recommend one of at least 32 bytes. (You might use 'pwgen 32' to do so.)} + q{No encryption_key in koha-conf.xml or environment variable KOHA_ENCRYPTION_KEY. Please generate a key. We recommend one of at least 32 bytes. (You might use 'pwgen 32' to do so.)} ); } return $class->SUPER::new( diff --git a/about.pl b/about.pl index 8cf49485936..063330e1ba4 100755 --- a/about.pl +++ b/about.pl @@ -290,7 +290,7 @@ if ( $tab eq 'sysinfo' ) { }; } - my $encryption_key = C4::Context->config('encryption_key'); + my $encryption_key = C4::Context->config('encryption_key') || $ENV{KOHA_ENCRYPTION_KEY}; if ( !$encryption_key || $encryption_key eq '__ENCRYPTION_KEY__' ) { push @xml_config_warnings, { error => 'encryption_key_missing' }; } @@ -954,7 +954,7 @@ if ( $tab eq 'database' ) { my $bwsbranch_filename = '/usr/share/koha/bin/bwsbranch'; if ( -r $bwsbranch_filename ) { - my $bwsbranch = read_file( $bwsbranch_filename ); + my $bwsbranch = read_file($bwsbranch_filename); $template->param( bwsbranch => $bwsbranch ); } @@ -962,8 +962,8 @@ my $url = C4::Context->preference('staffClientBaseURL'); $url =~ s|https://||; $url =~ s|http://||; $template->param( - inbound_ip => qx{dig $url +short | grep '^[.0-9]*\$'}, - outbound_ip => qx{curl ipinfo.io/ip}, + inbound_ip => qx{dig $url +short | grep '^[.0-9]*\$'}, + outbound_ip => qx{curl ipinfo.io/ip}, ); output_html_with_http_headers $query, $cookie, $template->output; diff --git a/debian/scripts/koha-plack b/debian/scripts/koha-plack index 9a31d419e42..97c190087ed 100755 --- a/debian/scripts/koha-plack +++ b/debian/scripts/koha-plack @@ -117,6 +117,7 @@ start_plack() if ! is_plack_running ${instancename}; then export KOHA_CONF="/etc/koha/sites/${instancename}/koha-conf.xml" + [ -n "$KOHA_ENCRYPTION_KEY" ] && export KOHA_ENCRYPTION_KEY log_daemon_msg "Starting Plack daemon for ${instancename}" diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt index 6ebfc79eabc..c7433a0a1f8 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt @@ -771,7 +771,10 @@ [% ELSIF config_entry.error == 'encryption_key_missing' %] Warning - You are missing the <encryption_key> entry in your koha-conf.xml file. Please generate a key. We recommend one of at least 32 bytes. (You might use 'pwgen 32' to do so.) + + You are missing the <encryption_key> entry in your koha-conf.xml file ( or as an environment variable KOHA_ENCRYPTION_KEY ). Please generate a key. We recommend one of at least 32 bytes. (You might + use 'pwgen 32' to do so.) + [% END # /IF config_entry.error %] [% END # /FOREACH config_entry %] diff --git a/members/two_factor_auth.pl b/members/two_factor_auth.pl index e163230632b..73b7c985c11 100755 --- a/members/two_factor_auth.pl +++ b/members/two_factor_auth.pl @@ -64,7 +64,7 @@ if ( !$patron ) { exit; } -if ( !C4::Context->config('encryption_key') ) { +if ( !( C4::Context->config('encryption_key') || $ENV{KOHA_ENCRYPTION_KEY} ) ) { $template->param( missing_key => 1 ); } else { -- 2.50.1 (Apple Git-155)