bitPickups/friendica_2020-09-1_sharedHosting
1
0
Fork 0
Code Pull requests Activity

remove public disclosure risk

Browse source
This commit is contained in:
Friendika 2011-08-27 18:09:43 -07:00
parent e3dbb63393
commit ada8bee70e
3 changed files with 67 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
boot.php
View file

@ -7,7 +7,7 @@ require_once('include/text.php');
require_once("include/pgettext.php"); require_once("include/pgettext.php");
define ( 'FRIENDIKA_VERSION', '2.2.1084' ); define ( 'FRIENDIKA_VERSION', '2.2.1085' );
define ( 'DFRN_PROTOCOL_VERSION', '2.21' ); define ( 'DFRN_PROTOCOL_VERSION', '2.21' );
define ( 'DB_UPDATE_VERSION', 1083 ); define ( 'DB_UPDATE_VERSION', 1083 );

65
include/crypto.php
View file

@ -225,3 +225,68 @@ function pkcs5_unpad($text)
if (strspn($text, chr($pad), strlen($text) - $pad) != $pad) return false; if (strspn($text, chr($pad), strlen($text) - $pad) != $pad) return false;
return substr($text, 0, -1 * $pad); return substr($text, 0, -1 * $pad);
} }
function AES256CBC_encrypt($data,$key,$iv) {
return mcrypt_encrypt(
MCRYPT_RIJNDAEL_128,
str_pad($key,32,"\0"),
pkcs5_pad($data,16),
MCRYPT_MODE_CBC,
str_pad($iv,16,"\0"));
}
function AES256CBC_decrypt($data,$key,$iv) {
return pkcs5_unpad(mcrypt_decrypt(
MCRYPT_RIJNDAEL_128,
str_pad($key,32,"\0"),
$data,
MCRYPT_MODE_CBC,
str_pad($iv,16,"\0")));
}
function aes_encapsulate($data,$pubkey) {
$key = random_string(32,RANDOM_STRING_TEXT);
$iv = random_string(16,RANDOM_STRING_TEXT);
$result['data'] = base64url_encode(AES256CBC_encrypt($data,$key,$iv),true);
openssl_public_encrypt($key,$k,$pubkey);
$result['key'] = base64url_encode($k,true);
openssl_public_encrypt($iv,$i,$pubkey);
$result['iv'] = base64url_encode($i,true);
return $result;
}
function aes_unencapsulate($data,$prvkey) {
openssl_private_decrypt(base64url_decode($data['key']),$k,$prvkey);
openssl_private_decrypt(base64url_decode($data['iv']),$i,$prvkey);
return AES256CBC_decrypt(base64url_decode($data['data']),$k,$i);
}
function zot_encapsulate($data,$sender,$pubkey) {
$res = aes_encapsulate($data,$pubkey);
openssl_public_encrypt($sender,$s,$pubkey);
$s1 = base64url_encode($s,true);
return <<< EOT
<?xml version='1.0' encoding='UTF-8'?>
<zot:env xmlns:zot='http://purl.org/zot/1.0'>
<zot:key>{$res['key']}</zot:key>
<zot:iv>{$res['iv']}</zot:iv>
<zot:sender>$s1</zot:sender>
<zot:alg>AES-256-CBC</zot:alg>
<zot:data type='application/magic-envelope+xml'>{$res['data']}</zot:data>
</zot:env>
EOT;
}
function zot_unencapsulate($data,$prvkey) {
$ret = array();
$c = array();
$x = parse_xml_string($data);
$c = array('key' => $x->key,'iv' => $x->iv,'data' => $x->data);
openssl_private_decrypt(base64url_decode($x->sender),$s,$prvkey);
$ret['sender'] = $s;
$ret['data'] = aes_unencapsulate($x,$prvkey);
return $ret;
}

2
mod/network.php
View file

@ -188,7 +188,7 @@ function network_content(&$a, $update = 0) {
if(count($r)) { if(count($r)) {
$sql_extra = " AND `item`.`parent` IN ( SELECT `parent` FROM `item` WHERE `id` = `parent` $star_sql AND `contact-id` IN ( " . intval($cid) . " )) "; $sql_extra = " AND `item`.`parent` IN ( SELECT `parent` FROM `item` WHERE `id` = `parent` $star_sql AND `contact-id` IN ( " . intval($cid) . " )) ";
$o = '<h2>' . t('Contact: ') . $r[0]['name'] . '</h2>' . $o; $o = '<h2>' . t('Contact: ') . $r[0]['name'] . '</h2>' . $o;
if($r[0]['network'] !== NETWORK_MAIL && $r[0]['network'] !== NETWORK_DFRN && $r[0]['network'] !== NETWORK_FACEBOOK && $r[0]['writable'] && (! get_pconfig(local_user(),'system','nowarn_insecure'))) { if($r[0]['network'] !== NETWORK_MAIL && $r[0]['network'] !== NETWORK_DFRN && $r[0]['network'] !== NETWORK_FACEBOOK && $r[0]['network'] !== NETWORK_DIASPORA && $r[0]['writable'] && (! get_pconfig(local_user(),'system','nowarn_insecure'))) {
notice( t('Private messages to this person are at risk of public disclosure.') . EOL); notice( t('Private messages to this person are at risk of public disclosure.') . EOL);
} }