X-Git-Url: https://git.p6c8.net/jirafeau.git/blobdiff_plain/c32806657b3b9e1548d5cf6c84a9d1f96dea0617..82c3971d76360b5f82e01d6e3bc0cbac3085ef1c:/lib/functions.php?ds=inline diff --git a/lib/functions.php b/lib/functions.php index d6f7cb0..805b958 100644 --- a/lib/functions.php +++ b/lib/functions.php @@ -454,13 +454,15 @@ function jirafeau_upload($file, $one_time_download, $key, $time, $ip, $crypt, $l /* Crypt file if option is enabled. */ $crypted = false; $crypt_key = ''; - if ($crypt == true && !(extension_loaded('mcrypt') == true)) { - error_log("PHP extension mcrypt not loaded, won't encrypt in Jirafeau"); + if ($crypt == true && !(extension_loaded('sodium') == true)) { + error_log("PHP extension sodium not loaded, won't encrypt in Jirafeau"); } - if ($crypt == true && extension_loaded('mcrypt') == true) { - $crypt_key = jirafeau_encrypt_file($file['tmp_name'], $file['tmp_name']); + if ($crypt == true && extension_loaded('sodium') == true) { + $crypt_key = jirafeau_encrypt_file($file['tmp_name'], $file['tmp_name'].'crypt'); if (strlen($crypt_key) > 0) { - $crypted = true; + if (rename($file['tmp_name'].'crypt', $file['tmp_name']) === true) { + $crypted = true; + } } } @@ -515,7 +517,7 @@ function jirafeau_upload($file, $one_time_download, $key, $time, $ip, $crypt, $l $handle, $name . NL. $mime_type . NL. $size . NL. $password . NL. $time . NL . $hash. NL . ($one_time_download ? 'O' : 'R') . NL . time() . - NL . $ip . NL. $delete_link_code . NL . ($crypted ? 'C' : 'O') + NL . $ip . NL. $delete_link_code . NL . ($crypted ? 'C2' : 'O') ); fclose($handle); $hash_link = substr(base_16_to_64(md5_file($link_tmp_name)), 0, $link_name_length); @@ -664,7 +666,8 @@ function jirafeau_get_link($hash) $out['upload_date'] = trim($c[7]); $out['ip'] = trim($c[8]); $out['link_code'] = trim($c[9]); - $out['crypted'] = trim($c[10]) == 'C'; + $out['crypted'] = trim($c[10]) == 'C2'; + $out['crypted_legacy'] = trim($c[10]) == 'C'; return $out; } @@ -900,6 +903,7 @@ function jirafeau_admin_bug_report($cfg) $out .= "# PHP options
"; $out .= "- php version: " . phpversion() . "
"; + $out .= "- sodium version: " . phpversion('sodium') . "
"; $out .= "- mcrypt version: " . phpversion('mcrypt') . "
"; $php_options = [ 'post_max_size', @@ -1141,10 +1145,12 @@ function jirafeau_async_end($ref, $code, $crypt, $link_name_length, $file_hash_m $crypted = false; $crypt_key = ''; - if ($crypt == true && extension_loaded('mcrypt') == true) { - $crypt_key = jirafeau_encrypt_file($p, $p); + if ($crypt == true && extension_loaded('sodium') == true) { + $crypt_key = jirafeau_encrypt_file($p, $p.'.crypt'); if (strlen($crypt_key) > 0) { - $crypted = true; + if (rename($p.'.crypt', $p) === true) { + $crypted = true; + } } } @@ -1179,7 +1185,7 @@ function jirafeau_async_end($ref, $code, $crypt, $link_name_length, $file_hash_m $handle, $a['file_name'] . NL . $a['mime_type'] . NL . $size . NL . $a['key'] . NL . $a['time'] . NL . $hash . NL . $a['onetime'] . NL . - time() . NL . $a['ip'] . NL . $delete_link_code . NL . ($crypted ? 'C' : 'O') + time() . NL . $a['ip'] . NL . $delete_link_code . NL . ($crypted ? 'C2' : 'O') ); fclose($handle); $hash_link = substr(base_16_to_64(md5_file($link_tmp_name)), 0, $link_name_length); @@ -1215,35 +1221,34 @@ function jirafeau_crypt_create_iv($base, $size) function jirafeau_encrypt_file($fp_src, $fp_dst) { $fs = filesize($fp_src); - if ($fs === false || $fs == 0 || !(extension_loaded('mcrypt') == true)) { + if ($fs === false || $fs == 0 || !(extension_loaded('sodium') == true)) { return ''; } - /* Prepare module. */ - $m = mcrypt_module_open('rijndael-256', '', 'ofb', ''); /* Generate key. */ - $crypt_key = jirafeau_gen_random(10); - $hash_key = md5($crypt_key); - $iv = jirafeau_crypt_create_iv($hash_key, mcrypt_enc_get_iv_size($m)); + $crypt_key = bin2hex(random_bytes(SODIUM_CRYPTO_STREAM_XCHACHA20_KEYBYTES / 2)); /* Init module. */ - mcrypt_generic_init($m, $hash_key, $iv); + [$crypt_state, $crypt_header] = sodium_crypto_secretstream_xchacha20poly1305_init_push($crypt_key); /* Crypt file. */ - $r = fopen($fp_src, 'r'); - $w = fopen($fp_dst, 'c'); - while (!feof($r)) { - $to_enc = fread($r, 1024); - if (strlen($to_enc) > 0) { - $enc = mcrypt_generic($m, $to_enc); - if (fwrite($w, $enc) === false) { - return ''; - } + $r = fopen($fp_src, 'rb'); + $w = fopen($fp_dst, 'wb'); + fwrite($w, $crypt_header); + + for ($i = 0; $i < $fs; $i += JIRAFEAU_SODIUM_CHUNKSIZE) { + $to_enc = fread($r, JIRAFEAU_SODIUM_CHUNKSIZE); + $enc = sodium_crypto_secretstream_xchacha20poly1305_push($crypt_state, $to_enc); + + if (fwrite($w, $enc) === false) { + return ''; } } + fclose($r); fclose($w); + /* Cleanup. */ - mcrypt_generic_deinit($m); - mcrypt_module_close($m); + sodium_memzero($crypt_state); + return $crypt_key; } @@ -1255,6 +1260,44 @@ function jirafeau_encrypt_file($fp_src, $fp_dst) * @return key used to decrypt. a string of length 0 is returned if failed. */ function jirafeau_decrypt_file($fp_src, $fp_dst, $k) +{ + $fs = filesize($fp_src); + if ($fs === false || $fs == 0 || extension_loaded('sodium') == false) { + return false; + } + + /* Decrypt file. */ + $r = fopen(VAR_FILES . $p . $link['hash'], 'rb'); + + $crypt_header = fread($r, SODIUM_CRYPTO_SECRETSTREAM_XCHACHA20POLY1305_HEADERBYTES); + + /* Init module. */ + $crypt_state = sodium_crypto_secretstream_xchacha20poly1305_init_pull($crypt_header, $crypt_key); + + /* Decrypt file. */ + + for ($i = SODIUM_CRYPTO_SECRETSTREAM_XCHACHA20POLY1305_HEADERBYTES; $i < $fs; $i += JIRAFEAU_SODIUM_CHUNKSIZE + SODIUM_CRYPTO_SECRETSTREAM_XCHACHA20POLY1305_ABYTES) { + $to_dec = fread($r, JIRAFEAU_SODIUM_CHUNKSIZE + SODIUM_CRYPTO_SECRETSTREAM_XCHACHA20POLY1305_ABYTES); + [$dec, $crypt_tag] = sodium_crypto_secretstream_xchacha20poly1305_pull($crypt_state, $to_dec); + echo $dec; + } + + fclose($r); + + /* Cleanup. */ + sodium_memzero($crypt_state); + + return true; +} + +/** + * Decrypt file. + * @param $fp_src file path to the file to decrypt. + * @param $fp_dst file path to the file to write decrypted file (could be the same). + * @param $k string composed of the key and the iv separated by a point ('.') + * @return key used to decrypt. a string of length 0 is returned if failed. + */ +function jirafeau_decrypt_file_legacy($fp_src, $fp_dst, $k) { $fs = filesize($fp_src); if ($fs === false || $fs == 0 || extension_loaded('mcrypt') == false) { @@ -1385,6 +1428,31 @@ function jirafeau_challenge_upload($cfg, $ip, $password) (jirafeau_challenge_upload_password($cfg, $password) && jirafeau_challenge_upload_ip($cfg, $ip)); } +/** + * Check if Jirafeau has a restriction on the IP address for accessing the admin interface. + * @return true if admin interface is IP restricted, false otherwise. + */ +function jirafeau_admin_has_ip_restriction($cfg) +{ + return count($cfg['admin_ip']) > 0; +} + +/** + * Test if visitor's IP is authorized to access the admin interface. + * + * @param $cfg configuration + * @param $challengedIp IP to be challenged + * @return true if IP is authorized, false otherwise. + */ +function jirafeau_challenge_admin_ip($cfg, $challengedIp) +{ + // If no IP address have been listed, allow upload from any IP + if (!jirafeau_admin_has_ip_restriction($cfg)) { + return true; + } + return jirafeau_challenge_ip($cfg['admin_ip'], $challengedIp); +} + /** Tell if we have some HTTP headers generated by a proxy */ function has_http_forwarded() { @@ -1613,7 +1681,8 @@ function jirafeau_add_ending_slash($path) function jirafeau_default_web_root() { - return $_SERVER['HTTP_HOST'] . str_replace('install.php', '', $_SERVER['REQUEST_URI']); + $url_scheme = (isset($_SERVER['HTTPS'])) ? 'https://' : 'http://'; + return $url_scheme . $_SERVER['HTTP_HOST'] . str_replace('install.php', '', $_SERVER['REQUEST_URI']); } function jirafeau_get_download_stats($hash)