diff --git a/clients.php b/clients.php index 95be2301..92cfad24 100644 --- a/clients.php +++ b/clients.php @@ -89,14 +89,14 @@ if($_GET['canned_date'] == "custom" AND !empty($_GET['date_from'])){ $url_query_strings_sortby = http_build_query(array_merge($_GET,array('sortby' => $sortby, 'order' => $order))); $sql = mysqli_query($mysqli,"SELECT SQL_CALC_FOUND_ROWS * FROM clients - LEFT JOIN contacts ON clients.primary_contact = contacts.contact_id AND contact_archived_at IS NULL + LEFT JOIN contacts ON clients.primary_contact = contacts.contact_id AND contact_archived_at IS NULL LEFT JOIN locations ON clients.primary_location = locations.location_id AND location_archived_at IS NULL WHERE (client_name LIKE '%$query%' OR client_type LIKE '%$query%' OR contact_email LIKE '%$query%' OR contact_name LIKE '%$query%' OR contact_phone LIKE '%$query%' OR contact_mobile LIKE '%$query%' OR location_address LIKE '%$query%' OR location_city LIKE '%$query%' OR location_state LIKE '%$query%' OR location_zip LIKE '%$query%') AND DATE(client_created_at) BETWEEN '$date_from' AND '$date_to' - AND clients.company_id = $session_company_id $permission_sql - ORDER BY $sortby $order LIMIT $record_from, $record_to" -); + AND clients.company_id = $session_company_id $permission_sql + ORDER BY $sortby $order LIMIT $record_from, $record_to +"); $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()")); diff --git a/db.sql b/db.sql index 025047a5..17bcf965 100644 --- a/db.sql +++ b/db.sql @@ -1040,7 +1040,6 @@ DROP TABLE IF EXISTS `settings`; /*!40101 SET character_set_client = utf8 */; CREATE TABLE `settings` ( `company_id` int(11) NOT NULL, - `config_aes_key` varchar(250) DEFAULT NULL, `config_base_url` varchar(200) DEFAULT NULL, `config_smtp_host` varchar(200) DEFAULT NULL, `config_smtp_port` int(5) DEFAULT NULL, @@ -1367,4 +1366,4 @@ CREATE TABLE `vendors` ( /*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */; /*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */; --- Dump completed on 2022-02-04 15:58:24 +-- Dump completed on 2022-02-05 16:40:40 diff --git a/get_settings.php b/get_settings.php index 12840648..285f1ba3 100644 --- a/get_settings.php +++ b/get_settings.php @@ -5,7 +5,6 @@ $sql_settings = mysqli_query($mysqli,"SELECT * FROM settings WHERE company_id = $row = mysqli_fetch_array($sql_settings); //General -$config_aes_key = $row['config_aes_key']; //Legacy $config_base_url = $row['config_base_url']; //Mail diff --git a/post.php b/post.php index 5a2a4131..ac926e30 100644 --- a/post.php +++ b/post.php @@ -1087,83 +1087,6 @@ if(isset($_GET['update_db'])){ header("Location: " . $_SERVER["HTTP_REFERER"]); } -if(isset($_POST['encryption_update'])){ - $password = $_POST['password']; - - //Get user details - $sql = mysqli_query($mysqli,"SELECT * FROM users WHERE user_id = '$session_user_id'"); - $row = mysqli_fetch_array($sql); - - //Verify the users password - if(!password_verify($password, $row['user_password'])){ - $_SESSION['alert_message'] = "User password incorrect."; - header("Location: " . $_SERVER["HTTP_REFERER"]); - exit(); - } - - //First, check if this user is setup for the new encryption setup - if(isset($row['user_specific_encryption_ciphertext'])){ - echo "Ciphertext data already exists, using it.
"; - $user_encryption_ciphertext = $row['user_specific_encryption_ciphertext']; - $site_encryption_master_key = decryptUserSpecificKey($user_encryption_ciphertext, $password); - } - else{ - echo "User ciphertext data not found, attempting to add it.
"; - $update_table = mysqli_query($mysqli, "ALTER TABLE `users` ADD `user_specific_encryption_ciphertext` VARCHAR(200) NULL AFTER `user_avatar`; "); - - if(!$update_table){ - echo "Error adding ciphertext column (user_specific_encryption_ciphertext) to users table.
"; - echo "Either there was a connection/permissions issue or the column already exists (due to a upgrade already taking place?)
"; - echo "Quitting to prevent compromising data integrity. Delete the column if you are sure you need to upgrade (presuming it contains no data).
"; - exit(); - } - - echo "Ciphertext column added successfully!
"; - - echo "Generating new master key.
"; - $site_encryption_master_key = keygen(); - echo "New master key is: $site_encryption_master_key
"; - $user_encryption_ciphertext = setupFirstUserSpecificKey($password, $site_encryption_master_key); - - $set_user_specific_key = mysqli_query($mysqli, "UPDATE users SET user_specific_encryption_ciphertext = '$user_encryption_ciphertext' WHERE user_id = '$session_user_id'"); - if(!$set_user_specific_key){ - echo "Something went wrong adding your user specific key.
"; - exit(); - } - - //Setup the user session key - generateUserSessionKey($site_encryption_master_key); - - //Invalidate user passwords - //If we don't do this, users won't be able to see the new passwords properly, and could potentially add passwords that can never be decrypted - mysqli_query($mysqli, "UPDATE users SET user_password = 'Invalid due to upgrade' WHERE user_id NOT IN ($session_user_id)"); - $extended_log_description = ", invalidated all user passwords"; - echo "Invalidated all user passwords. You must re-set them from this user account.
"; - } - - //Either way, if we got here we now have the master key as $site_encryption_master_key - - //Get & upgrade user login encryption - $sql_logins = mysqli_query($mysqli,"SELECT *, AES_DECRYPT(login_password, '$config_aes_key') AS login_password FROM logins WHERE (company_id = '$session_company_id' AND login_password IS NOT NULL)"); - $count = 0; - foreach ($sql_logins as $row){ - $login_id = $row['login_id']; - $new_encrypted_password = encryptUpgradeLoginEntry($row['login_password'], $site_encryption_master_key); - mysqli_query($mysqli, "UPDATE logins SET login_password = '$new_encrypted_password' WHERE login_id = '$login_id'"); - $count++; - } - echo "Upgraded $count records.
"; - - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Settings', log_action = 'Migrate', log_description = '$session_name upgraded company ID $session_company_id logins ($count total) to the new encryption scheme$extended_log_description', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_created_at = NOW(), log_user_id = $session_user_id, company_id = $session_company_id"); - - echo "Migration for company successful.
"; - $_SESSION['alert_message'] = "Migration for company successful."; - - echo "Back to settings."; - -} - if(isset($_POST['add_client'])){ $name = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['name']))); diff --git a/settings-update.php b/settings-update.php index 05f740cb..b0f54a20 100644 --- a/settings-update.php +++ b/settings-update.php @@ -61,61 +61,4 @@ $git_log = shell_exec("git log master..origin/master --pretty=format:'%h - -
-
-

Update AES Key

-
-
-
-
- -
-"; -echo "Current User ID: $session_user_id
"; - -if ($config_aes_key) { - echo "Current (legacy) AES key: $config_aes_key

"; - echo "Below are the decrypted credentials for five login entries, please confirm they show and are correct before continuing.
Do NOT continue if no entries are shown or if the decrypted passwords are incorrect.
"; - $sql = mysqli_query($mysqli,"SELECT *, AES_DECRYPT(login_password, '$config_aes_key') AS login_password FROM logins WHERE (company_id = '$session_company_id' AND login_password IS NOT NULL) LIMIT 5"); - foreach ($sql as $row){ - echo $row['login_username'] . ":" . $row['login_password']; - echo "
"; - } - echo "
"; - ?> - -
-
-
- -
-
-

Warning: This action is irreversible. Do NOT proceed without a backup.

- -
-
-"; - echo "Please ensure upgrade is required. If you are sure you need to update, ensure the AES key is set correctly for this company."; -} - -?> -
-
-
-