diff --git a/ajax.php b/ajax.php index 9dab8381..3902a37b 100644 --- a/ajax.php +++ b/ajax.php @@ -222,6 +222,7 @@ if (isset($_GET['ticket_query_views'])) { if (isset($_GET['share_generate_link'])) { validateTechRole(); + $item_encrypted_username = ''; // Default empty $item_encrypted_credential = ''; // Default empty $client_id = intval($_GET['client_id']); @@ -243,22 +244,27 @@ if (isset($_GET['share_generate_link'])) { } if ($item_type == "Login") { - $login = mysqli_query($mysqli, "SELECT login_name, login_password FROM logins WHERE login_id = '$item_id' AND login_client_id = '$client_id' LIMIT 1"); + $login = mysqli_query($mysqli, "SELECT login_name, login_username, login_password FROM logins WHERE login_id = '$item_id' AND login_client_id = '$client_id' LIMIT 1"); $row = mysqli_fetch_array($login); $item_name = strip_tags(mysqli_real_escape_string($mysqli, $row['login_name'])); - // Decrypt & re-encrypt password for sharing - $login_password_cleartext = decryptLoginEntry($row['login_password']); + // Decrypt & re-encrypt username/password for sharing $login_encryption_key = randomString(); - $iv = randomString(); - $ciphertext = openssl_encrypt($login_password_cleartext, 'aes-128-cbc', $login_encryption_key, 0, $iv); - $item_encrypted_credential = $iv . $ciphertext; + $login_username_cleartext = decryptLoginEntry($row['login_username']); + $iv = randomString(); + $username_ciphertext = openssl_encrypt($login_username_cleartext, 'aes-128-cbc', $login_encryption_key, 0, $iv); + $item_encrypted_username = $iv . $username_ciphertext; + + $login_password_cleartext = decryptLoginEntry($row['login_password']); + $iv = randomString(); + $password_ciphertext = openssl_encrypt($login_password_cleartext, 'aes-128-cbc', $login_encryption_key, 0, $iv); + $item_encrypted_credential = $iv . $password_ciphertext; } // Insert entry into DB - $sql = mysqli_query($mysqli, "INSERT INTO shared_items SET item_active = '1', item_key = '$item_key', item_type = '$item_type', item_related_id = '$item_id', item_encrypted_credential = '$item_encrypted_credential', item_note = '$item_note', item_views = 0, item_view_limit = '$item_view_limit', item_created_at = NOW(), item_expire_at = '$item_expires', item_client_id = '$client_id'"); + $sql = mysqli_query($mysqli, "INSERT INTO shared_items SET item_active = '1', item_key = '$item_key', item_type = '$item_type', item_related_id = '$item_id', item_encrypted_username = '$item_encrypted_username', item_encrypted_credential = '$item_encrypted_credential', item_note = '$item_note', item_views = 0, item_view_limit = '$item_view_limit', item_created_at = NOW(), item_expire_at = '$item_expires', item_client_id = '$client_id'"); $share_id = $mysqli->insert_id; // Return URL diff --git a/database_updates.php b/database_updates.php index e452814e..a58cf5c0 100644 --- a/database_updates.php +++ b/database_updates.php @@ -796,20 +796,28 @@ if(LATEST_DATABASE_VERSION > CURRENT_DATABASE_VERSION){ // Update config.php var with new version var for use with docker file_put_contents("config.php", "\n\$installation_id = '$installation_id';" . PHP_EOL, FILE_APPEND); - + mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '0.3.6'"); } - //if(CURRENT_DATABASE_VERSION == '0.3.6'){ - // Insert queries here required to update to DB version 0.3.7 + if(CURRENT_DATABASE_VERSION == '0.3.6'){ + // Insert queries here required to update to DB version 0.3.7 + mysqli_query($mysqli, "ALTER TABLE `shared_items` ADD `item_encrypted_username` VARCHAR(255) NULL DEFAULT NULL AFTER `item_related_id`"); + + // Then, update the database to the next sequential version + mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '0.3.7'"); + } + + //if(CURRENT_DATABASE_VERSION == '0.3.7'){ + // Insert queries here required to update to DB version 0.3.8 // Then, update the database to the next sequential version - // mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '0.3.7'"); + // mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '0.3.8'"); //} - + } else { // Up-to-date diff --git a/database_version.php b/database_version.php index 9b03b3e5..788930b6 100644 --- a/database_version.php +++ b/database_version.php @@ -5,4 +5,4 @@ * It is used in conjunction with database_updates.php */ -DEFINE("LATEST_DATABASE_VERSION", "0.3.6"); +DEFINE("LATEST_DATABASE_VERSION", "0.3.7"); diff --git a/db.sql b/db.sql index 9a3bae00..9f674642 100644 --- a/db.sql +++ b/db.sql @@ -1098,6 +1098,7 @@ CREATE TABLE `shared_items` ( `item_key` varchar(255) NOT NULL, `item_type` varchar(255) NOT NULL, `item_related_id` int(11) NOT NULL, + `item_encrypted_username` varchar(255) DEFAULT NULL, `item_encrypted_credential` varchar(255) DEFAULT NULL, `item_note` varchar(255) DEFAULT NULL, `item_views` int(11) NOT NULL, diff --git a/guest_view_item.php b/guest_view_item.php index 254d4a46..3ac9240e 100644 --- a/guest_view_item.php +++ b/guest_view_item.php @@ -111,10 +111,15 @@ if ($item_type == "Document") { $login_name = htmlentities($login_row['login_name']); $login_uri = htmlentities($login_row['login_uri']); - $login_username = htmlentities($login_row['login_username']); - $login_iv = substr($row['item_encrypted_credential'], 0, 16); - $login_ciphertext = substr($row['item_encrypted_credential'], 16); - $login_password = openssl_decrypt($login_ciphertext, 'aes-128-cbc', $encryption_key,0, $login_iv); + + $username_iv = substr($row['item_encrypted_username'], 0, 16); + $username_ciphertext = substr($row['item_encrypted_username'], 16); + $login_username = openssl_decrypt($username_ciphertext, 'aes-128-cbc', $encryption_key,0, $username_iv); + + $password_iv = substr($row['item_encrypted_credential'], 0, 16); + $password_ciphertext = substr($row['item_encrypted_credential'], 16); + $login_password = openssl_decrypt($password_ciphertext, 'aes-128-cbc', $encryption_key,0, $password_iv); + $login_otp = $login_row['login_otp_secret']; $login_notes = htmlentities($login_row['login_note']); @@ -143,4 +148,4 @@ if ($item_type == "Document") { echo "

"; echo $config_app_name; -include("guest_footer.php"); \ No newline at end of file +include("guest_footer.php"); diff --git a/share_modal.php b/share_modal.php index 9248a910..64607efe 100644 --- a/share_modal.php +++ b/share_modal.php @@ -52,7 +52,7 @@ function generateShareLink() { - +
- +
- -

Note: Login passwords are shared "as is" and will not update

+ +

Note: Logins are shared "as is" and will not update


@@ -93,4 +93,4 @@ function generateShareLink() { - \ No newline at end of file +