AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-08-05 07:07:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Revert vault session key entropy change

Browse Source
This commit is contained in:
johnnyq
2026-07-27 20:13:46 -04:00
parent 8dcb45fc9d
commit 50352fb779
1 changed files with 11 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
functions/security.php
View File

@@ -50,8 +50,8 @@ function encryptUserSpecificKey($user_password) {
// Get the session info.
$user_encryption_session_ciphertext = $_SESSION['user_encryption_session_ciphertext'];
$user_encryption_session_iv = base64_decode($_SESSION['user_encryption_session_iv'] ?? '');
$user_encryption_session_key = base64_decode($_COOKIE['user_encryption_session_key'] ?? '');
$user_encryption_session_iv = $_SESSION['user_encryption_session_iv'];
$user_encryption_session_key = $_COOKIE['user_encryption_session_key'];
// Decrypt the session key to get the master key
$site_encryption_master_key = openssl_decrypt($user_encryption_session_ciphertext, 'aes-128-cbc', $user_encryption_session_key, 0, $user_encryption_session_iv);
@@ -89,21 +89,21 @@ Generates what is probably best described as a session key (ephemeral-ish)
*/
function generateUserSessionKey($site_encryption_master_key) {
$user_encryption_session_key = random_bytes(16);
$user_encryption_session_iv = random_bytes(16);
$user_encryption_session_key = randomString();
$user_encryption_session_iv = randomString();
$user_encryption_session_ciphertext = openssl_encrypt($site_encryption_master_key, 'aes-128-cbc', $user_encryption_session_key, 0, $user_encryption_session_iv);
// Store ciphertext in the user's session
$_SESSION['user_encryption_session_ciphertext'] = $user_encryption_session_ciphertext;
$_SESSION['user_encryption_session_iv'] = base64_encode($user_encryption_session_iv);
$_SESSION['user_encryption_session_iv'] = $user_encryption_session_iv;
// Give the user "their" key as a cookie
include 'config.php';
if ($config_https_only) {
setcookie("user_encryption_session_key", base64_encode($user_encryption_session_key), ['path' => '/', 'secure' => true, 'httponly' => true, 'samesite' => 'None']);
setcookie("user_encryption_session_key", "$user_encryption_session_key", ['path' => '/', 'secure' => true, 'httponly' => true, 'samesite' => 'None']);
} else {
setcookie("user_encryption_session_key", base64_encode($user_encryption_session_key), 0, "/");
setcookie("user_encryption_session_key", $user_encryption_session_key, 0, "/");
$_SESSION['alert_message'] = "Unencrypted connection flag set: Using non-secure cookies.";
}
}
@@ -117,8 +117,8 @@ function decryptCredentialEntry($credential_password_ciphertext) {
// Get the user session info.
$user_encryption_session_ciphertext = $_SESSION['user_encryption_session_ciphertext'];
$user_encryption_session_iv = base64_decode($_SESSION['user_encryption_session_iv'] ?? '');
$user_encryption_session_key = base64_decode($_COOKIE['user_encryption_session_key'] ?? '');
$user_encryption_session_iv = $_SESSION['user_encryption_session_iv'];
$user_encryption_session_key = $_COOKIE['user_encryption_session_key'];
// Decrypt the session key to get the master key
$site_encryption_master_key = openssl_decrypt($user_encryption_session_ciphertext, 'aes-128-cbc', $user_encryption_session_key, 0, $user_encryption_session_iv);
@@ -133,17 +133,12 @@ function encryptCredentialEntry($credential_password_cleartext) {
// Get the user session info.
$user_encryption_session_ciphertext = $_SESSION['user_encryption_session_ciphertext'];
$user_encryption_session_iv = base64_decode($_SESSION['user_encryption_session_iv'] ?? '');
$user_encryption_session_key = base64_decode($_COOKIE['user_encryption_session_key'] ?? '');
$user_encryption_session_iv = $_SESSION['user_encryption_session_iv'];
$user_encryption_session_key = $_COOKIE['user_encryption_session_key'];
//Decrypt the session key to get the master key
$site_encryption_master_key = openssl_decrypt($user_encryption_session_ciphertext, 'aes-128-cbc', $user_encryption_session_key, 0, $user_encryption_session_iv);
// Never write a credential under an empty key if the session didn't open
if (empty($site_encryption_master_key)) {
return false;
}
//Encrypt the website/asset credential using the master key
$ciphertext = openssl_encrypt($credential_password_cleartext, 'aes-128-cbc', $site_encryption_master_key, 0, $iv);