From 63feff03d27d210c1e848c1e69e5479bfe01b81e Mon Sep 17 00:00:00 2001
From: wrongecho <marcus@itflow.org>
Date: Mon, 19 Aug 2024 21:23:43 +0100
Subject: [PATCH 1/6] Initial WIP: Allow decrypting logins/credentials via the
 API

---
 admin_api_key_add_modal.php             | 142 +++++++++++++++---------
 api/v1/credentials/credential_model.php |   1 +
 api/v1/credentials/read.php             |  20 ++++
 database_updates.php                    |  13 ++-
 db.sql                                  |   1 +
 functions.php                           |   4 +-
 post/api.php                            |   6 +-
 7 files changed, 129 insertions(+), 58 deletions(-)
 create mode 100644 api/v1/credentials/credential_model.php
 create mode 100644 api/v1/credentials/read.php

diff --git a/admin_api_key_add_modal.php b/admin_api_key_add_modal.php
index 799b0088..2d98cd8d 100644
--- a/admin_api_key_add_modal.php
+++ b/admin_api_key_add_modal.php
@@ -1,5 +1,6 @@
 <?php
 $key = randomString(156);
+$decryptPW = randomString(160);
 ?>
 <div class="modal" id="addApiKeyModal" tabindex="-1">
     <div class="modal-dialog">
@@ -13,64 +14,103 @@ $key = randomString(156);
             <form action="post.php" method="post" autocomplete="off">
                 <div class="modal-body bg-white">
 
-                    <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
-                    <input type="hidden" name="key" value="<?php echo $key ?>">
-
-                    <div class="form-group">
-                        <label>API Key <strong class="text-danger">*</strong></label>
-                        <div class="input-group">
-                            <div class="input-group-prepend">
-                                <span class="input-group-text"><i class="fa fa-fw fa-key"></i></span>
-                            </div>
-                            <input type="text" class="form-control" value="<?php echo $key ?>" required disabled>
-                            <div class="input-group-append">
-                                <button class="btn btn-default clipboardjs" type="button" data-clipboard-text="<?php echo $key; ?>"><i class="fa fa-fw fa-copy"></i></button>
-                            </div>
-                        </div>
-                    </div>
-
+                    <ul class="nav nav-pills nav-justified mb-3">
+                        <li class="nav-item">
+                            <a class="nav-link active" data-toggle="pill" href="#pills-api-details">Details</a>
+                        </li>
+                        <li class="nav-item">
+                            <a class="nav-link" data-toggle="pill" href="#pills-api-keys">Keys</a>
+                        </li>
+                    </ul>
                     <hr>
 
-                    <div class="form-group">
-                        <label>Name <strong class="text-danger">*</strong></label>
-                        <div class="input-group">
-                            <div class="input-group-prepend">
-                                <span class="input-group-text"><i class="fa fa-fw fa-sticky-note"></i></span>
+                    <div class="tab-content">
+
+                        <div class="tab-pane fade show active" id="pills-api-details">
+                            <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
+                            <input type="hidden" name="key" value="<?php echo $key ?>">
+                            <input type="hidden" name="password" value="<?php echo $decryptPW ?>">
+
+                            <div class="form-group">
+                                <label>Name <strong class="text-danger">*</strong></label>
+                                <div class="input-group">
+                                    <div class="input-group-prepend">
+                                        <span class="input-group-text"><i class="fa fa-fw fa-sticky-note"></i></span>
+                                    </div>
+                                    <input type="text" class="form-control" name="name" placeholder="Key Name" required autofocus>
+                                </div>
+                            </div>
+
+                            <div class="form-group">
+                                <label>Expiration Date <strong class="text-danger">*</strong></label>
+                                <div class="input-group">
+                                    <div class="input-group-prepend">
+                                        <span class="input-group-text"><i class="fa fa-fw fa-calendar"></i></span>
+                                    </div>
+                                    <input type="date" class="form-control" name="expire" min="<?php echo date('Y-m-d')?>" max="2999-12-31" required>
+                                </div>
+                            </div>
+
+                            <div class="form-group">
+                                <label>Client Access <strong class="text-danger">*</strong></label>
+                                <div class="input-group">
+                                    <div class="input-group-prepend">
+                                        <span class="input-group-text"><i class="fa fa-fw fa-user"></i></span>
+                                    </div>
+                                    <select class="form-control select2" name="client" required>
+                                        <option value="0"> ALL CLIENTS </option>
+                                        <?php
+                                        $sql = mysqli_query($mysqli, "SELECT * FROM clients ORDER BY client_name ASC");
+                                        while ($row = mysqli_fetch_array($sql)) {
+                                            $client_id = intval($row['client_id']);
+                                            $client_name = nullable_htmlentities($row['client_name']); ?>
+                                            <option value="<?php echo $client_id; ?>"><?php echo "$client_name  (Client ID: $client_id)"; ?></option>
+                                        <?php } ?>
+                                    </select>
+                                </div>
                             </div>
-                            <input type="text" class="form-control" name="name" placeholder="Key Name" required autofocus>
                         </div>
+
+                        <div class="tab-pane fade" id="pills-api-keys">
+                            <div class="form-group">
+                                <label>API Key <strong class="text-danger">*</strong></label>
+                                <div class="input-group">
+                                    <div class="input-group-prepend">
+                                        <span class="input-group-text"><i class="fa fa-fw fa-key"></i></span>
+                                    </div>
+                                    <input type="text" class="form-control" value="<?php echo $key ?>" required disabled>
+                                    <div class="input-group-append">
+                                        <button class="btn btn-default clipboardjs" type="button" data-clipboard-text="<?php echo $key; ?>"><i class="fa fa-fw fa-copy"></i></button>
+                                    </div>
+                                </div>
+                            </div>
+
+                            <div class="form-group">
+                                <label>Login credential decryption password <strong class="text-danger">*</strong></label>
+                                <div class="input-group">
+                                    <div class="input-group-prepend">
+                                        <span class="input-group-text"><i class="fa fa-fw fa-unlock-alt"></i></span>
+                                    </div>
+                                    <input type="text" class="form-control" value="<?php echo $decryptPW ?>" required disabled>
+                                    <div class="input-group-append">
+                                        <button class="btn btn-default clipboardjs" type="button" data-clipboard-text="<?php echo $decryptPW; ?>"><i class="fa fa-fw fa-copy"></i></button>
+                                    </div>
+                                </div>
+                            </div>
+                            <br>
+                            <div class="form-group">
+                                <label>I have made a copy of the key(s)<strong class="text-danger">*</strong></label>
+                                <div class="input-group">
+                                    <div class="input-group-prepend">
+                                        <input type="checkbox" name="ack" value="1" required>
+                                    </div>
+                                </div>
+                            </div>
+                        </div>
+
                     </div>
 
-                    <div class="form-group">
-                        <label>Expiration Date <strong class="text-danger">*</strong></label>
-                        <div class="input-group">
-                            <div class="input-group-prepend">
-                                <span class="input-group-text"><i class="fa fa-fw fa-calendar"></i></span>
-                            </div>
-                            <input type="date" class="form-control" name="expire" min="<?php echo date('Y-m-d')?>" max="2999-12-31" required>
-                        </div>
                     </div>
-
-                    <div class="form-group">
-                        <label>Client Access <strong class="text-danger">*</strong></label>
-                        <div class="input-group">
-                            <div class="input-group-prepend">
-                                <span class="input-group-text"><i class="fa fa-fw fa-user"></i></span>
-                            </div>
-                            <select class="form-control select2" name="client" required>
-                                <option value="0"> ALL CLIENTS </option>
-                                <?php
-                                $sql = mysqli_query($mysqli, "SELECT * FROM clients ORDER BY client_name ASC");
-                                while ($row = mysqli_fetch_array($sql)) {
-                                    $client_id = intval($row['client_id']);
-                                    $client_name = nullable_htmlentities($row['client_name']); ?>
-                                    <option value="<?php echo $client_id; ?>"><?php echo "$client_name  (Client ID: $client_id)"; ?></option>
-                                <?php } ?>
-                            </select>
-                        </div>
-                    </div>
-
-                </div>
                 <div class="modal-footer bg-white">
                     <button type="submit" name="add_api_key" class="btn btn-primary text-bold"><i class="fa fa-check mr-2"></i>Create</button>
                     <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fas fa-times mr-2"></i>Cancel</button>
diff --git a/api/v1/credentials/credential_model.php b/api/v1/credentials/credential_model.php
new file mode 100644
index 00000000..b3d9bbc7
--- /dev/null
+++ b/api/v1/credentials/credential_model.php
@@ -0,0 +1 @@
+<?php
diff --git a/api/v1/credentials/read.php b/api/v1/credentials/read.php
new file mode 100644
index 00000000..0889abbd
--- /dev/null
+++ b/api/v1/credentials/read.php
@@ -0,0 +1,20 @@
+<?php
+
+require_once '../validate_api_key.php';
+
+require_once '../require_get_method.php';
+
+
+// Specific credential/login via ID (single)
+if (isset($_GET['login_id'])) {
+    $id = intval($_GET['login_id']);
+    $sql = mysqli_query($mysqli, "SELECT * FROM logins WHERE login_id = '$id' AND login_client_id LIKE '$client_id'");
+
+} else {
+    // All credentials ("logins")
+    $sql = mysqli_query($mysqli, "SELECT * FROM logins WHERE login_client_id LIKE '$client_id' ORDER BY login_id LIMIT $limit OFFSET $offset");
+}
+
+// Output
+require_once "../read_output.php";
+
diff --git a/database_updates.php b/database_updates.php
index 76df2e41..2e13d973 100644
--- a/database_updates.php
+++ b/database_updates.php
@@ -2123,13 +2123,18 @@ if (LATEST_DATABASE_VERSION > CURRENT_DATABASE_VERSION) {
          // DB Version
          mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '1.4.4'");
 
-
      }
 
-    // if (CURRENT_DATABASE_VERSION == '1.4.4') {
-    //     // Insert queries here required to update to DB version 1.4.5
+     if (CURRENT_DATABASE_VERSION == '1.4.4') {
+         mysqli_query($mysqli, "ALTER TABLE `api_keys` ADD `api_key_credential_decryption_password` VARCHAR(200) NOT NULL AFTER `api_key_secret`");
+
+         mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '1.4.5'");
+     }
+
+    // if (CURRENT_DATABASE_VERSION == '1.4.5') {
+    //     // Insert queries here required to update to DB version 1.4.6
     //     // Then, update the database to the next sequential version
-    //     mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '1.4.5'");
+    //     mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '1.4.6'");
     // }
 
 } else {
diff --git a/db.sql b/db.sql
index 853fb8b2..c3ab550d 100644
--- a/db.sql
+++ b/db.sql
@@ -66,6 +66,7 @@ CREATE TABLE `api_keys` (
   `api_key_id` int(11) NOT NULL AUTO_INCREMENT,
   `api_key_name` varchar(255) NOT NULL,
   `api_key_secret` varchar(255) NOT NULL,
+  `api_key_credential_decryption_password` varchar(255) NULL,
   `api_key_created_at` datetime NOT NULL DEFAULT current_timestamp(),
   `api_key_expire` date NOT NULL,
   `api_key_client_id` int(11) NOT NULL DEFAULT 0,
diff --git a/functions.php b/functions.php
index e165ddfc..f852e0f7 100644
--- a/functions.php
+++ b/functions.php
@@ -271,7 +271,7 @@ function setupFirstUserSpecificKey($user_password, $site_encryption_master_key)
 }
 
 /*
- * For additional users / password changes
+ * For additional users / password changes (and now the API)
  * New Users: Requires the admin setting up their account have a Specific/Session key configured
  * Password Changes: Will use the current info in the session.
 */
@@ -282,7 +282,7 @@ function encryptUserSpecificKey($user_password)
 
     // Get the session info.
     $user_encryption_session_ciphertext = $_SESSION['user_encryption_session_ciphertext'];
-    $user_encryption_session_iv =  $_SESSION['user_encryption_session_iv'];
+    $user_encryption_session_iv = $_SESSION['user_encryption_session_iv'];
     $user_encryption_session_key = $_COOKIE['user_encryption_session_key'];
 
     // Decrypt the session key to get the master key
diff --git a/post/api.php b/post/api.php
index 4ea3c394..16529d77 100644
--- a/post/api.php
+++ b/post/api.php
@@ -11,10 +11,14 @@ if (isset($_POST['add_api_key'])) {
     // CSRF Check
     validateCSRFToken($_POST['csrf_token']);
 
-    $secret = sanitizeInput($_POST['key']);
     $name = sanitizeInput($_POST['name']);
     $expire = sanitizeInput($_POST['expire']);
     $client = intval($_POST['client']);
+    $secret = sanitizeInput($_POST['key']); // API Key
+
+    // Credential decryption password
+    $password = password_hash(trim($_POST['password']), PASSWORD_DEFAULT);
+    $apikey_specific_encryption_ciphertext = encryptUserSpecificKey(trim($_POST['password']));
 
     mysqli_query($mysqli,"INSERT INTO api_keys SET api_key_name = '$name', api_key_secret = '$secret', api_key_expire = '$expire', api_key_client_id = $client");
 

From 0c60ecc32919b270d9cce2834add5b41c8264854 Mon Sep 17 00:00:00 2001
From: wrongecho <marcus@itflow.org>
Date: Thu, 22 Aug 2024 17:46:58 +0100
Subject: [PATCH 2/6] WIP: Allow decrypting logins/credentials via the API

---
 api/v1/credentials/read.php | 44 ++++++++++++++++++++++++++++++++-----
 database_updates.php        |  2 +-
 database_version.php        |  2 +-
 db.sql                      |  2 +-
 functions.php               |  2 +-
 post/api.php                |  2 +-
 6 files changed, 43 insertions(+), 11 deletions(-)

diff --git a/api/v1/credentials/read.php b/api/v1/credentials/read.php
index 0889abbd..51706a1a 100644
--- a/api/v1/credentials/read.php
+++ b/api/v1/credentials/read.php
@@ -4,17 +4,49 @@ require_once '../validate_api_key.php';
 
 require_once '../require_get_method.php';
 
+// Default
+$sql = false;
 
 // Specific credential/login via ID (single)
-if (isset($_GET['login_id'])) {
-    $id = intval($_GET['login_id']);
-    $sql = mysqli_query($mysqli, "SELECT * FROM logins WHERE login_id = '$id' AND login_client_id LIKE '$client_id'");
+if (isset($_GET['login_id']) && isset($_GET['api_key_decrypt_password'])) {
 
-} else {
+    $id = intval($_GET['login_id']);
+    $password = sanitizeInput($_GET['api_key_decrypt_password']);
+
+    $sql = mysqli_query($mysqli, "SELECT * FROM logins WHERE login_id = '$id' AND login_client_id LIKE '$client_id' LIMIT 1");
+
+
+} elseif (isset($_GET['api_key_decrypt_password'])) {
     // All credentials ("logins")
     $sql = mysqli_query($mysqli, "SELECT * FROM logins WHERE login_client_id LIKE '$client_id' ORDER BY login_id LIMIT $limit OFFSET $offset");
+
 }
 
-// Output
-require_once "../read_output.php";
+// Output - Not using the standard API read_output.php
+// Usually we just output what is in the database, but credentials need to be decrypted first.
 
+if ($sql && mysqli_num_rows($sql) > 0) {
+    $return_arr['success'] = "True";
+    $return_arr['count'] = mysqli_num_rows($sql);
+
+    $row = array();
+    while ($row = mysqli_fetch_array($sql)) {
+        //$row['login_username'] = //decrypt
+        $return_arr['data'][] = $row;
+    }
+
+    echo json_encode($return_arr);
+    exit();
+}
+else {
+    $return_arr['success'] = "False";
+    $return_arr['message'] = "No resource (for this client and company) with the specified parameter(s).";
+
+    // Log any database/schema related errors to the PHP Error log
+    if (mysqli_error($mysqli)) {
+        error_log("API Database Error: " . mysqli_error($mysqli));
+    }
+
+    echo json_encode($return_arr);
+    exit();
+}
\ No newline at end of file
diff --git a/database_updates.php b/database_updates.php
index 2e13d973..257b7c6b 100644
--- a/database_updates.php
+++ b/database_updates.php
@@ -2126,7 +2126,7 @@ if (LATEST_DATABASE_VERSION > CURRENT_DATABASE_VERSION) {
      }
 
      if (CURRENT_DATABASE_VERSION == '1.4.4') {
-         mysqli_query($mysqli, "ALTER TABLE `api_keys` ADD `api_key_credential_decryption_password` VARCHAR(200) NOT NULL AFTER `api_key_secret`");
+         mysqli_query($mysqli, "ALTER TABLE `api_keys` ADD `api_key_decrypt_hash` VARCHAR(200) NOT NULL AFTER `api_key_secret`");
 
          mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '1.4.5'");
      }
diff --git a/database_version.php b/database_version.php
index 97947f7b..02ae2a6a 100644
--- a/database_version.php
+++ b/database_version.php
@@ -5,4 +5,4 @@
  * It is used in conjunction with database_updates.php
  */
 
-DEFINE("LATEST_DATABASE_VERSION", "1.4.4");
+DEFINE("LATEST_DATABASE_VERSION", "1.4.5");
diff --git a/db.sql b/db.sql
index c3ab550d..2b4ba70f 100644
--- a/db.sql
+++ b/db.sql
@@ -66,7 +66,7 @@ CREATE TABLE `api_keys` (
   `api_key_id` int(11) NOT NULL AUTO_INCREMENT,
   `api_key_name` varchar(255) NOT NULL,
   `api_key_secret` varchar(255) NOT NULL,
-  `api_key_credential_decryption_password` varchar(255) NULL,
+  `api_key_decrypt_hash` varchar(255) NULL,
   `api_key_created_at` datetime NOT NULL DEFAULT current_timestamp(),
   `api_key_expire` date NOT NULL,
   `api_key_client_id` int(11) NOT NULL DEFAULT 0,
diff --git a/functions.php b/functions.php
index f852e0f7..3e39c957 100644
--- a/functions.php
+++ b/functions.php
@@ -297,7 +297,7 @@ function encryptUserSpecificKey($user_password)
     return $salt . $iv . $ciphertext;
 }
 
-// Given a ciphertext (incl. IV) and the user's password, returns the site master key
+// Given a ciphertext (incl. IV) and the user's (or API key) password, returns the site master key
 // Ran at login, to facilitate generateUserSessionKey
 function decryptUserSpecificKey($user_encryption_ciphertext, $user_password)
 {
diff --git a/post/api.php b/post/api.php
index 16529d77..1224a59e 100644
--- a/post/api.php
+++ b/post/api.php
@@ -20,7 +20,7 @@ if (isset($_POST['add_api_key'])) {
     $password = password_hash(trim($_POST['password']), PASSWORD_DEFAULT);
     $apikey_specific_encryption_ciphertext = encryptUserSpecificKey(trim($_POST['password']));
 
-    mysqli_query($mysqli,"INSERT INTO api_keys SET api_key_name = '$name', api_key_secret = '$secret', api_key_expire = '$expire', api_key_client_id = $client");
+    mysqli_query($mysqli,"INSERT INTO api_keys SET api_key_name = '$name', api_key_secret = '$secret', api_key_decrypt_hash = '$apikey_specific_encryption_ciphertext', api_key_expire = '$expire', api_key_client_id = $client");
 
     $api_key_id = mysqli_insert_id($mysqli);
 

From a6113dc37100e2a72e91cf836a10e7909021f20a Mon Sep 17 00:00:00 2001
From: wrongecho <marcus@itflow.org>
Date: Thu, 22 Aug 2024 18:22:20 +0100
Subject: [PATCH 3/6] WIP: Allow decrypting logins/credentials via the API

---
 api/v1/credentials/read.php |  6 ++++--
 api/v1/validate_api_key.php |  1 +
 functions.php               | 15 +++++++++++++++
 3 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/api/v1/credentials/read.php b/api/v1/credentials/read.php
index 51706a1a..b0e041f5 100644
--- a/api/v1/credentials/read.php
+++ b/api/v1/credentials/read.php
@@ -11,7 +11,7 @@ $sql = false;
 if (isset($_GET['login_id']) && isset($_GET['api_key_decrypt_password'])) {
 
     $id = intval($_GET['login_id']);
-    $password = sanitizeInput($_GET['api_key_decrypt_password']);
+    $api_key_decrypt_password = $_GET['api_key_decrypt_password']; // No sanitization
 
     $sql = mysqli_query($mysqli, "SELECT * FROM logins WHERE login_id = '$id' AND login_client_id LIKE '$client_id' LIMIT 1");
 
@@ -26,12 +26,14 @@ if (isset($_GET['login_id']) && isset($_GET['api_key_decrypt_password'])) {
 // Usually we just output what is in the database, but credentials need to be decrypted first.
 
 if ($sql && mysqli_num_rows($sql) > 0) {
+
     $return_arr['success'] = "True";
     $return_arr['count'] = mysqli_num_rows($sql);
 
     $row = array();
     while ($row = mysqli_fetch_array($sql)) {
-        //$row['login_username'] = //decrypt
+        $row['login_username'] = apiDecryptLoginEntry($row['login_username'], $api_key_decrypt_hash, $api_key_decrypt_password);
+        $row['login_password'] = apiDecryptLoginEntry($row['login_password'], $api_key_decrypt_hash, $api_key_decrypt_password);
         $return_arr['data'][] = $row;
     }
 
diff --git a/api/v1/validate_api_key.php b/api/v1/validate_api_key.php
index 010bab0a..9cec942c 100644
--- a/api/v1/validate_api_key.php
+++ b/api/v1/validate_api_key.php
@@ -88,6 +88,7 @@ if (isset($api_key)) {
         // Set client ID, company ID & key name
         $row = mysqli_fetch_array($sql);
         $api_key_name = htmlentities($row['api_key_name']);
+        $api_key_decrypt_hash = $row['api_key_decrypt_hash']; // No sanitization
         $client_id = intval($row['api_key_client_id']);
 
         // Set limit & offset for queries
diff --git a/functions.php b/functions.php
index 3e39c957..4f3850f4 100644
--- a/functions.php
+++ b/functions.php
@@ -380,6 +380,21 @@ function encryptLoginEntry($login_password_cleartext)
     return $iv . $ciphertext;
 }
 
+function apiDecryptLoginEntry($login_ciphertext, $api_key_decrypt_hash, $api_key_decrypt_password)
+{
+    // TODO: try marking $api_key_decrypt_password as sensitive
+
+    // Split the login entry (username/password) into IV and Ciphertext
+    $login_iv =  substr($login_ciphertext, 0, 16);
+    $login_ciphertext = $salt = substr($login_ciphertext, 16);
+
+    // Decrypt the api hash to get the master key
+    $site_encryption_master_key = decryptUserSpecificKey($api_key_decrypt_hash, $api_key_decrypt_password);
+
+    // Decrypt the login password using the master key
+    return openssl_decrypt($login_ciphertext, 'aes-128-cbc', $site_encryption_master_key, 0, $login_iv);
+}
+
 // Get domain general info (whois + NS/A/MX records)
 function getDomainRecords($name)
 {

From d37bdcdbcb7f061aece3057ca0d9bee9e3e7e7f0 Mon Sep 17 00:00:00 2001
From: wrongecho <marcus@itflow.org>
Date: Sun, 25 Aug 2024 12:31:15 +0100
Subject: [PATCH 4/6] WIP: Allow decrypting logins/credentials via the API

---
 api/v1/credentials/create.php           |  30 ++++++
 api/v1/credentials/credential_model.php | 119 ++++++++++++++++++++++++
 api/v1/credentials/read.php             |  14 ++-
 api/v1/credentials/update.php           |  38 ++++++++
 functions.php                           |  15 ++-
 5 files changed, 211 insertions(+), 5 deletions(-)
 create mode 100644 api/v1/credentials/create.php
 create mode 100644 api/v1/credentials/update.php

diff --git a/api/v1/credentials/create.php b/api/v1/credentials/create.php
new file mode 100644
index 00000000..a7df2540
--- /dev/null
+++ b/api/v1/credentials/create.php
@@ -0,0 +1,30 @@
+<?php
+
+require_once '../validate_api_key.php';
+
+require_once '../require_post_method.php';
+
+// Parse info
+require_once 'credential_model.php';
+
+// Default
+$insert_id = false;
+
+if (!empty($api_key_decrypt_password) && !empty($name) && !(empty($password))) {
+
+    // Add credential
+    $insert_sql = mysqli_query($mysqli,"INSERT INTO logins SET login_name = '$name', login_description = '$description', login_uri = '$uri', login_uri_2 = '$uri_2', login_username = '$username', login_password = '$password', login_otp_secret = '$otp_secret', login_note = '$note', login_important = $important, login_contact_id = $contact_id, login_vendor_id = $vendor_id, login_asset_id = $asset_id, login_software_id = $software_id, login_client_id = $client_id");
+
+    // Check insert & get insert ID
+    if ($insert_sql) {
+        $insert_id = mysqli_insert_id($mysqli);
+
+        //Logging
+        mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Credential', log_action = 'Create', log_description = '$name via API ($api_key_name)', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $client_id");
+        mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'API', log_action = 'Success', log_description = 'Created credential $name via API ($api_key_name)', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $client_id");
+    }
+
+}
+
+// Output
+require_once '../create_output.php';
\ No newline at end of file
diff --git a/api/v1/credentials/credential_model.php b/api/v1/credentials/credential_model.php
index b3d9bbc7..4551d35d 100644
--- a/api/v1/credentials/credential_model.php
+++ b/api/v1/credentials/credential_model.php
@@ -1 +1,120 @@
 <?php
+
+
+// Variable assignment from POST (or: blank/from DB is updating)
+
+$api_key_decrypt_password = '';
+if (isset($_POST['api_key_decrypt_password'])) {
+    $api_key_decrypt_password = $_POST['api_key_decrypt_password']; // No sanitization
+}
+
+if (isset($_POST['login_name'])) {
+    $name = sanitizeInput($_POST['login_name']);
+} elseif (isset($credential_row) && isset($credential_row['login_name'])) {
+    $name = $credential_row['login_name'];
+} else {
+    $name = '';
+}
+
+if (isset($_POST['login_description'])) {
+    $description = sanitizeInput($_POST['login_description']);
+} elseif (isset($credential_row) && isset($credential_row['login_description'])) {
+    $description = $credential_row['login_description'];
+} else {
+    $description = '';
+}
+
+if (isset($_POST['login_uri'])) {
+    $uri = sanitizeInput($_POST['login_uri']);
+} elseif (isset($credential_row) && isset($credential_row['login_uri'])) {
+    $uri = $credential_row['login_uri'];
+} else {
+    $uri = '';
+}
+
+if (isset($_POST['login_uri_2'])) {
+    $uri_2 = sanitizeInput($_POST['login_uri_2']);
+} elseif (isset($credential_row) && isset($credential_row['login_uri_2'])) {
+    $uri_2 = $credential_row['login_uri_2'];
+} else {
+    $uri_2 = '';
+}
+
+if (isset($_POST['login_username'])) {
+    $username = $_POST['login_username'];
+    $username = apiEncryptLoginEntry($username, $api_key_decrypt_hash, $api_key_decrypt_password);
+} elseif (isset($credential_row) && isset($credential_row['login_username'])) {
+    $username = $credential_row['login_username'];
+} else {
+    $username = '';
+}
+
+if (isset($_POST['login_password'])) {
+    $password = $_POST['login_password'];
+    $password = apiEncryptLoginEntry($password, $api_key_decrypt_hash, $api_key_decrypt_password);
+    $password_changed = true;
+} elseif (isset($credential_row) && isset($credential_row['login_password'])) {
+    $password = $credential_row['login_password'];
+    $password_changed = false;
+} else {
+    $password = '';
+    $password_changed = false;
+}
+
+
+
+if (isset($_POST['login_otp_secret'])) {
+    $otp_secret = sanitizeInput($_POST['login_otp_secret']);
+} elseif (isset($credential_row) && isset($credential_row['login_otp_secret'])) {
+    $otp_secret = $credential_row['login_otp_secret'];
+} else {
+    $otp_secret = '';
+}
+
+if (isset($_POST['login_note'])) {
+    $note = sanitizeInput($_POST['login_note']);
+} elseif (isset($credential_row) && isset($credential_row['login_note'])) {
+    $note = $credential_row['login_note'];
+} else {
+    $note = '';
+}
+
+if (isset($_POST['login_important'])) {
+    $important = intval($_POST['login_important']);
+} elseif (isset($credential_row) && isset($credential_row['login_important'])) {
+    $important = $credential_row['login_important'];
+} else {
+    $important = '';
+}
+
+if (isset($_POST['login_contact_id'])) {
+    $contact_id = intval($_POST['login_contact_id']);
+} elseif (isset($credential_row) && isset($credential_row['login_contact_id'])) {
+    $contact_id = $credential_row['login_contact_id'];
+} else {
+    $contact_id = '';
+}
+
+if (isset($_POST['login_vendor_id'])) {
+    $vendor_id = intval($_POST['login_vendor_id']);
+} elseif (isset($credential_row) && isset($credential_row['login_vendor_id'])) {
+    $vendor_id = $credential_row['login_vendor_id'];
+} else {
+    $vendor_id = '';
+}
+
+if (isset($_POST['login_asset_id'])) {
+    $asset_id = intval($_POST['login_asset_id']);
+} elseif (isset($credential_row) && isset($credential_row['login_asset_id'])) {
+    $asset_id = $credential_row['login_asset_id'];
+} else {
+    $asset_id = '';
+}
+
+if (isset($_POST['login_software_id'])) {
+    $software_id = intval($_POST['login_software_id']);
+} elseif (isset($credential_row) && isset($credential_row['login_software_id'])) {
+    $software_id = $credential_row['login_software_id'];
+} else {
+    $software_id = '';
+}
\ No newline at end of file
diff --git a/api/v1/credentials/read.php b/api/v1/credentials/read.php
index b0e041f5..86903e95 100644
--- a/api/v1/credentials/read.php
+++ b/api/v1/credentials/read.php
@@ -4,20 +4,26 @@ require_once '../validate_api_key.php';
 
 require_once '../require_get_method.php';
 
-// Default
+// Defaults
 $sql = false;
 
+$api_key_decrypt_password = '';
+if (isset($_GET['api_key_decrypt_password'])) {
+    $api_key_decrypt_password = $_GET['api_key_decrypt_password']; // No sanitization
+}
+
 // Specific credential/login via ID (single)
-if (isset($_GET['login_id']) && isset($_GET['api_key_decrypt_password'])) {
+if (isset($_GET['login_id']) && !empty($api_key_decrypt_password)) {
 
     $id = intval($_GET['login_id']);
-    $api_key_decrypt_password = $_GET['api_key_decrypt_password']; // No sanitization
 
     $sql = mysqli_query($mysqli, "SELECT * FROM logins WHERE login_id = '$id' AND login_client_id LIKE '$client_id' LIMIT 1");
 
 
-} elseif (isset($_GET['api_key_decrypt_password'])) {
+} elseif (!empty($api_key_decrypt_password)) {
     // All credentials ("logins")
+    $api_key_decrypt_password = $_GET['api_key_decrypt_password']; // No sanitization
+
     $sql = mysqli_query($mysqli, "SELECT * FROM logins WHERE login_client_id LIKE '$client_id' ORDER BY login_id LIMIT $limit OFFSET $offset");
 
 }
diff --git a/api/v1/credentials/update.php b/api/v1/credentials/update.php
new file mode 100644
index 00000000..a7237a35
--- /dev/null
+++ b/api/v1/credentials/update.php
@@ -0,0 +1,38 @@
+<?php
+
+require_once '../validate_api_key.php';
+
+require_once '../require_post_method.php';
+
+// Parse ID
+$login_id = intval($_POST['login_id']);
+
+// Default
+$update_count = false;
+
+if (!empty($_POST['api_key_decrypt_password']) && !empty($login_id)) {
+
+    $credential_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM logins WHERE login_id = '$login_id' AND login_client_id = $client_id LIMIT 1"));
+
+    // Variable assignment from POST - assigning the current database value if a value is not provided
+    require_once 'credential_model.php';
+
+    $update_sql = mysqli_query($mysqli,"UPDATE logins SET login_name = '$name', login_description = '$description', login_uri = '$uri', login_uri_2 = '$uri_2', login_username = '$username', login_password = '$password', login_otp_secret = '$otp_secret', login_note = '$note', login_important = $important, login_contact_id = $contact_id, login_vendor_id = $vendor_id, login_asset_id = $asset_id, login_software_id = $software_id, login_client_id = $client_id WHERE login_id = '$login_id' AND login_client_id = $client_id LIMIT 1");
+
+    // Check insert & get insert ID
+    if ($update_sql) {
+        $update_count = mysqli_affected_rows($mysqli);
+
+        if ($password_changed) {
+            mysqli_query($mysqli, "UPDATE logins SET login_password_changed_at = NOW() WHERE login_id = $login_id LIMIT 1");
+        }
+
+        //Logging
+        mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Credential', log_action = 'Update', log_description = '$name via API ($api_key_name)', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $client_id");
+        mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'API', log_action = 'Success', log_description = 'Updated credential $name via API ($api_key_name)', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $client_id");
+    }
+
+}
+
+// Output
+require_once '../update_output.php';
\ No newline at end of file
diff --git a/functions.php b/functions.php
index 4f3850f4..1d6b6300 100644
--- a/functions.php
+++ b/functions.php
@@ -382,7 +382,7 @@ function encryptLoginEntry($login_password_cleartext)
 
 function apiDecryptLoginEntry($login_ciphertext, $api_key_decrypt_hash, $api_key_decrypt_password)
 {
-    // TODO: try marking $api_key_decrypt_password as sensitive
+    // TODO: try marking $api_key_decrypt_password as sensitive - new in PHP 8.2
 
     // Split the login entry (username/password) into IV and Ciphertext
     $login_iv =  substr($login_ciphertext, 0, 16);
@@ -395,6 +395,19 @@ function apiDecryptLoginEntry($login_ciphertext, $api_key_decrypt_hash, $api_key
     return openssl_decrypt($login_ciphertext, 'aes-128-cbc', $site_encryption_master_key, 0, $login_iv);
 }
 
+function apiEncryptLoginEntry($credential_cleartext, $api_key_decrypt_hash, $api_key_decrypt_password)
+{
+    $iv = randomString();
+
+    // Decrypt the api hash to get the master key
+    $site_encryption_master_key = decryptUserSpecificKey($api_key_decrypt_hash, $api_key_decrypt_password);
+
+    // Encrypt the credential using the master key
+    $ciphertext = openssl_encrypt($credential_cleartext, 'aes-128-cbc', $site_encryption_master_key, 0, $iv);
+
+    return $iv . $ciphertext;
+}
+
 // Get domain general info (whois + NS/A/MX records)
 function getDomainRecords($name)
 {

From 9ef30994956682d49a501b53732cfeec802056fd Mon Sep 17 00:00:00 2001
From: wrongecho <marcus@itflow.org>
Date: Sun, 25 Aug 2024 12:32:21 +0100
Subject: [PATCH 5/6] WIP: Allow decrypting logins/credentials via the API

---
 api/v1/credentials/read.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/api/v1/credentials/read.php b/api/v1/credentials/read.php
index 86903e95..b9d757b5 100644
--- a/api/v1/credentials/read.php
+++ b/api/v1/credentials/read.php
@@ -57,4 +57,4 @@ else {
 
     echo json_encode($return_arr);
     exit();
-}
\ No newline at end of file
+}

From 24ff6f5c840249efe5c1f4d947fb863eafa2e4ca Mon Sep 17 00:00:00 2001
From: wrongecho <marcus@itflow.org>
Date: Sun, 25 Aug 2024 12:45:18 +0100
Subject: [PATCH 6/6] WIP: Allow decrypting logins/credentials via the API

---
 api/v1/credentials/create.php           | 2 +-
 api/v1/credentials/credential_model.php | 2 +-
 api/v1/credentials/update.php           | 2 +-
 functions.php                           | 6 ++----
 4 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/api/v1/credentials/create.php b/api/v1/credentials/create.php
index a7df2540..66140df1 100644
--- a/api/v1/credentials/create.php
+++ b/api/v1/credentials/create.php
@@ -27,4 +27,4 @@ if (!empty($api_key_decrypt_password) && !empty($name) && !(empty($password))) {
 }
 
 // Output
-require_once '../create_output.php';
\ No newline at end of file
+require_once '../create_output.php';
diff --git a/api/v1/credentials/credential_model.php b/api/v1/credentials/credential_model.php
index 4551d35d..6397f5f3 100644
--- a/api/v1/credentials/credential_model.php
+++ b/api/v1/credentials/credential_model.php
@@ -117,4 +117,4 @@ if (isset($_POST['login_software_id'])) {
     $software_id = $credential_row['login_software_id'];
 } else {
     $software_id = '';
-}
\ No newline at end of file
+}
diff --git a/api/v1/credentials/update.php b/api/v1/credentials/update.php
index a7237a35..489ef8b0 100644
--- a/api/v1/credentials/update.php
+++ b/api/v1/credentials/update.php
@@ -35,4 +35,4 @@ if (!empty($_POST['api_key_decrypt_password']) && !empty($login_id)) {
 }
 
 // Output
-require_once '../update_output.php';
\ No newline at end of file
+require_once '../update_output.php';
diff --git a/functions.php b/functions.php
index 1d6b6300..e3df27b6 100644
--- a/functions.php
+++ b/functions.php
@@ -380,10 +380,8 @@ function encryptLoginEntry($login_password_cleartext)
     return $iv . $ciphertext;
 }
 
-function apiDecryptLoginEntry($login_ciphertext, $api_key_decrypt_hash, $api_key_decrypt_password)
+function apiDecryptLoginEntry($login_ciphertext, $api_key_decrypt_hash, #[\SensitiveParameter]$api_key_decrypt_password)
 {
-    // TODO: try marking $api_key_decrypt_password as sensitive - new in PHP 8.2
-
     // Split the login entry (username/password) into IV and Ciphertext
     $login_iv =  substr($login_ciphertext, 0, 16);
     $login_ciphertext = $salt = substr($login_ciphertext, 16);
@@ -395,7 +393,7 @@ function apiDecryptLoginEntry($login_ciphertext, $api_key_decrypt_hash, $api_key
     return openssl_decrypt($login_ciphertext, 'aes-128-cbc', $site_encryption_master_key, 0, $login_iv);
 }
 
-function apiEncryptLoginEntry($credential_cleartext, $api_key_decrypt_hash, $api_key_decrypt_password)
+function apiEncryptLoginEntry(#[\SensitiveParameter]$credential_cleartext, $api_key_decrypt_hash, #[\SensitiveParameter]$api_key_decrypt_password)
 {
     $iv = randomString();