vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NEW Add a tool to decrypt data encrypted in database.

Browse source
This commit is contained in:
Laurent Destailleur 2024-10-24 15:34:02 +02:00
parent 2b0859cbe4
commit 808d5ee169
3 changed files with 42 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

36
htdocs/admin/system/security.php
View file

@ -662,8 +662,24 @@ print '<br>';
print '<strong>MAIN_ALWAYS_CREATE_LOCK_AFTER_LAST_UPGRADE</strong> = '.getDolGlobalString('MAIN_ALWAYS_CREATE_LOCK_AFTER_LAST_UPGRADE', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': 1)</span><br>';
print '<br>';
print '<strong>MAIN_SECURITY_ANTI_SSRF_SERVER_IP</strong> = '.getDolGlobalString('MAIN_SECURITY_ANTI_SSRF_SERVER_IP', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span> &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': List of static IPs of server separated with coma - '.$langs->trans("Note").': common loopback ip like 127.*.*.*, [::1] are already added)</span>')."<br>";
print '<br>';
print '<strong>MAIN_SECURITY_CSRF_WITH_TOKEN</strong> = '.getDolGlobalString('MAIN_SECURITY_CSRF_WITH_TOKEN', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': '.$langs->trans("Undefined").' '.$langs->trans("or").' 2)</span>'."<br>";
print '</div>';
print '<br>';
print '<br>';
print load_fiche_titre($langs->trans("DatabaseEncryption"), '', 'folder');
print '<div class="divsection wordbreak">';
//print '<strong>'.$langs->trans("PasswordEncryption").'</strong>: ';
print '<strong>MAIN_SECURITY_HASH_ALGO</strong> = '.getDolGlobalString('MAIN_SECURITY_HASH_ALGO', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>')." &nbsp; ";
print '<strong>'.$langs->trans("AlgorithmFor", $langs->transnoentitiesnoconv("Passwords")).' (non reversible encryption, defined into MAIN_SECURITY_HASH_ALGO)</strong> = '.getDolGlobalString('MAIN_SECURITY_HASH_ALGO', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>')." &nbsp; ";
if (!getDolGlobalString('MAIN_SECURITY_HASH_ALGO')) {
print '<span class="opacitymedium"> &nbsp; &nbsp; (If unset: \'md5\')</span>';
}
@ -683,10 +699,22 @@ if (getDolGlobalString('MAIN_SECURITY_HASH_ALGO') != 'password_hash') {
}
print '<br>';
print '<strong>MAIN_SECURITY_ANTI_SSRF_SERVER_IP</strong> = '.getDolGlobalString('MAIN_SECURITY_ANTI_SSRF_SERVER_IP', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span> &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': List of static IPs of server separated with coma - '.$langs->trans("Note").': common loopback ip like 127.*.*.*, [::1] are already added)</span>')."<br>";
print '<br>';
$action = GETPOST('action');
$exampletodecrypt = GETPOST('exampletodecrypt', 'password');
print '<strong>MAIN_SECURITY_CSRF_WITH_TOKEN</strong> = '.getDolGlobalString('MAIN_SECURITY_CSRF_WITH_TOKEN', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': '.$langs->trans("Undefined").' '.$langs->trans("or").' 2)</span>'."<br>";
print '<strong>'.$langs->trans("AlgorithmFor", $langs->transnoentitiesnoconv("SensitiveData")).' (reversible encryption done with dolEncrypt/dolDecrypt)</strong> = '.constant('MAIN_SECURITY_REVERSIBLE_ALGO').' with key defined into conf.php file in $dolibarr_main_instance_unique_id<br>';
print '<form method="POST" action="'.$_SERVER["PHP_SELF"].'">';
print '<input type="hidden" name="action" value="doldecrypt">';
print '<input type="hidden" name="token" value="'.newToken().'">';
print '<input type="hidden" name="page_y" value="">';
print $langs->trans("ToolToDecryptAString").': ';
print '<input type="text" name="exampletodecrypt" placeholder="dolcrypt:ALGOXXXX:ABCDFEF1234" value="'.$exampletodecrypt.'">';
print '<input type="submit" class="reposition button small smallpaddingimp" name="submit" value="'.$langs->transnoentitiesnoconv("Decrypt").'">';
if ($action == 'doldecrypt' && $user->admin && $exampletodecrypt) {
usleep(200);
print ' => <textarea rows="'.ROWS_1.'" class="valignmiddle">'.dolPrintHTMLForTextArea(dolDecrypt($exampletodecrypt)).'</textarea>';
}
print '</form>';
print '</div>';

7
htdocs/core/lib/security.lib.php
View file

@ -107,6 +107,9 @@ function dolGetRandomBytes($length)
return bin2hex(openssl_random_pseudo_bytes((int) floor($length / 2))); // the bin2hex will double the number of bytes so we take length / 2. May be very slow on Windows.
}
define('MAIN_SECURITY_REVERSIBLE_ALGO', 'AES-256-CTR');
/**
* Encode a string with a symmetric encryption. Used to encrypt sensitive data into database.
* Note: If a backup is restored onto another instance with a different $conf->file->instance_unique_id, then decoded value will differ.
@ -120,7 +123,7 @@ function dolGetRandomBytes($length)
* @since v17
* @see dolDecrypt(), dol_hash()
*/
function dolEncrypt($chain, $key = '', $ciphering = 'AES-256-CTR', $forceseed = '')
function dolEncrypt($chain, $key = '', $ciphering = '', $forceseed = '')
{
global $conf;
global $dolibarr_disable_dolcrypt_for_debug;
@ -139,7 +142,7 @@ function dolEncrypt($chain, $key = '', $ciphering = 'AES-256-CTR', $forceseed =
$key = $conf->file->instance_unique_id;
}
if (empty($ciphering)) {
$ciphering = 'AES-256-CTR';
$ciphering = constant('MAIN_SECURITY_REVERSIBLE_ALGO');
}
$newchain = $chain;

5
htdocs/langs/en_US/admin.lang
View file

@ -2576,3 +2576,8 @@ YouHaveALargeAmountOfRecordOnLists=You have a default max size for lists set to
RoundBorders=Round borders
CheckIfModuleIsNotBlackListed=Block install for modules found into the <b>Remote blacklist</b>
CheckIfModuleIsNotBlackListedHelp=Some modules may be provided by some companies that do not respect the project's rules of goodwill (non-compliance with GDPR, violation of the rules tof use the Dolibarr brand name, etc.). By checking this box, a request will be made to the project server to see if a report was received about this module, and will protect you by blocking the deployment of flagged modules
DatabaseEncryption=Encryption in database
AlgorithmFor=Algorithm for: %s
SensitiveData=Sensitive data
ToolToDecryptAString=Tool to decrypt a string
Decrypt=Decrypt