From dfbf0c788a11cfe6337651a33a60790ea60c1b57 Mon Sep 17 00:00:00 2001 From: Marcus Hill Date: Tue, 4 Jan 2022 03:21:04 +0000 Subject: [PATCH 1/3] Check that config.php is writable at the start of setup. --- setup.php | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/setup.php b/setup.php index a9fbc2e5..b7d2cb78 100644 --- a/setup.php +++ b/setup.php @@ -329,6 +329,7 @@ $currencies_array = array( if(isset($_POST['add_database'])){ + // Check if database has been setup already. If it has, direct user to edit directly instead. if(file_exists('config.php')){ $_SESSION['alert_message'] = "Database already configured. Any further changes should be made by editing the config.php file."; header("Location: setup.php?user"); @@ -951,6 +952,16 @@ if(isset($_POST['add_company_settings'])){
  • Get List of Emails in CSV to export to a mailing list
  • Acquire balance can be useful for customer's to get their balance by phone
    • + Warning: config.php is not writable. Ensure Apache has write access. "; + } + else { + // Else, able to write. Tidy up + unlink("config.php"); + } + ?>
    Setup
    From ae98902a96f1a45bae3e1f81b83ce18b86c9e0ae Mon Sep 17 00:00:00 2001 From: Marcus Hill Date: Tue, 4 Jan 2022 03:32:50 +0000 Subject: [PATCH 2/3] Add support for storing client certificate public key --- add_certificate_modal.php | 14 ++++++++++++-- client_certificates.php | 1 + db.sql | 1 + edit_certificate_modal.php | 14 ++++++++++++-- post.php | 26 ++++++++++++++++++++++++-- 5 files changed, 50 insertions(+), 6 deletions(-) diff --git a/add_certificate_modal.php b/add_certificate_modal.php index 9323b168..6bf683c4 100644 --- a/add_certificate_modal.php +++ b/add_certificate_modal.php @@ -32,12 +32,12 @@
    - +
    - +
    @@ -51,6 +51,16 @@ +
    + +
    +
    + +
    + +
    +
    +
    diff --git a/client_certificates.php b/client_certificates.php index f80d306a..99615af9 100644 --- a/client_certificates.php +++ b/client_certificates.php @@ -99,6 +99,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()")); $certificate_issued_by = $row['certificate_issued_by']; $certificate_expire = $row['certificate_expire']; $certificate_updated_at = $row['certificate_updated_at']; + $certificate_public_key = $row['certificate_public_key']; ?> diff --git a/db.sql b/db.sql index 4fdfaddd..75c59cca 100644 --- a/db.sql +++ b/db.sql @@ -190,6 +190,7 @@ CREATE TABLE `certificates` ( `certificate_created_at` datetime NOT NULL, `certificate_updated_at` datetime DEFAULT NULL, `certificate_archived_at` datetime DEFAULT NULL, + `certificate_public_key` varchar(1500) NOT NULL, `certificate_client_id` int(11) NOT NULL, `company_id` int(11) NOT NULL, PRIMARY KEY (`certificate_id`) diff --git a/edit_certificate_modal.php b/edit_certificate_modal.php index 16f5fa67..979122ea 100644 --- a/edit_certificate_modal.php +++ b/edit_certificate_modal.php @@ -32,12 +32,12 @@
    - +
    - +
    @@ -51,6 +51,16 @@ +
    + +
    +
    + +
    + +
    +
    +
    diff --git a/post.php b/post.php index 6418618c..0b2c0f5e 100644 --- a/post.php +++ b/post.php @@ -4567,11 +4567,22 @@ if(isset($_POST['add_certificate'])){ $domain = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['domain']))); $issued_by = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['issued_by']))); $expire = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['expire']))); + $public_key = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['public_key']))); + + if (!empty($public_key)) { + // Parse the public certificate key. If successful, set attributes from the certificate + $public_key_obj = openssl_x509_parse($_POST['public_key']); + if ($public_key_obj) { + $expire = date('Y-m-d', $public_key_obj['validTo_time_t']); + $issued_by = strip_tags($public_key_obj['issuer']['O']); + } + } + if(empty($expire)){ $expire = "0000-00-00"; } - mysqli_query($mysqli,"INSERT INTO certificates SET certificate_name = '$name', certificate_domain = '$domain', certificate_issued_by = '$issued_by', certificate_expire = '$expire', certificate_created_at = NOW(), certificate_client_id = $client_id, company_id = $session_company_id"); + mysqli_query($mysqli,"INSERT INTO certificates SET certificate_name = '$name', certificate_domain = '$domain', certificate_issued_by = '$issued_by', certificate_expire = '$expire', certificate_created_at = NOW(), certificate_public_key = '$public_key', certificate_client_id = $client_id, company_id = $session_company_id"); //Logging mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Certificate', log_action = 'Created', log_description = '$name', log_created_at = NOW(), company_id = $session_company_id, log_user_id = $session_user_id"); @@ -4589,11 +4600,22 @@ if(isset($_POST['edit_certificate'])){ $domain = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['domain']))); $issued_by = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['issued_by']))); $expire = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['expire']))); + $public_key = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['public_key']))); + + if (!empty($public_key)) { + // Parse the public certificate key. If successful, set attributes from the certificate + $public_key_obj = openssl_x509_parse($_POST['public_key']); + if ($public_key_obj) { + $expire = date('Y-m-d', $public_key_obj['validTo_time_t']); + $issued_by = strip_tags($public_key_obj['issuer']['O']); + } + } + if(empty($expire)){ $expire = "0000-00-00"; } - mysqli_query($mysqli,"UPDATE certificates SET certificate_name = '$name', certificate_domain = '$domain', certificate_issued_by = '$issued_by', certificate_expire = '$expire', certificate_updated_at = NOW() WHERE certificate_id = $certificate_id AND company_id = $session_company_id"); + mysqli_query($mysqli,"UPDATE certificates SET certificate_name = '$name', certificate_domain = '$domain', certificate_issued_by = '$issued_by', certificate_expire = '$expire', certificate_updated_at = NOW(), certificate_public_key = '$public_key' WHERE certificate_id = $certificate_id AND company_id = $session_company_id"); //Logging mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Certificate', log_action = 'Modified', log_description = '$name', log_created_at = NOW(), company_id = $session_company_id, log_user_id = $session_user_id"); From 7112463e41464cea2941ff47d83545a8625b4474 Mon Sep 17 00:00:00 2001 From: johnnyq Date: Tue, 4 Jan 2022 11:35:34 -0500 Subject: [PATCH 3/3] Commit Tidy allow public_cert to be null and move public_cert before notes --- add_certificate_modal.php | 12 ++++++------ db.sql | 4 ++-- edit_certificate_modal.php | 12 ++++++------ setup.php | 15 +++++++-------- 4 files changed, 21 insertions(+), 22 deletions(-) diff --git a/add_certificate_modal.php b/add_certificate_modal.php index 6bf683c4..fa1582e1 100644 --- a/add_certificate_modal.php +++ b/add_certificate_modal.php @@ -51,15 +51,15 @@
    -
    +
    -
    - -
    - +
    + +
    +
    -
    +
    diff --git a/db.sql b/db.sql index 75c59cca..9d7d7bdd 100644 --- a/db.sql +++ b/db.sql @@ -186,11 +186,11 @@ CREATE TABLE `certificates` ( `certificate_domain` varchar(200) DEFAULT NULL, `certificate_issued_by` varchar(200) NOT NULL, `certificate_expire` date DEFAULT NULL, + `certificate_public_key` varchar(1500) DEFAULT NULL, `certificate_notes` text DEFAULT NULL, `certificate_created_at` datetime NOT NULL, `certificate_updated_at` datetime DEFAULT NULL, `certificate_archived_at` datetime DEFAULT NULL, - `certificate_public_key` varchar(1500) NOT NULL, `certificate_client_id` int(11) NOT NULL, `company_id` int(11) NOT NULL, PRIMARY KEY (`certificate_id`) @@ -1154,4 +1154,4 @@ CREATE TABLE `vendors` ( /*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */; /*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */; --- Dump completed on 2021-12-27 12:04:12 +-- Dump completed on 2022-01-04 11:34:48 diff --git a/edit_certificate_modal.php b/edit_certificate_modal.php index 979122ea..b6e8c2d7 100644 --- a/edit_certificate_modal.php +++ b/edit_certificate_modal.php @@ -51,15 +51,15 @@
    -
    +
    -
    - -
    - +
    + +
    +
    -
    +
    diff --git a/setup.php b/setup.php index b7d2cb78..06406cf8 100644 --- a/setup.php +++ b/setup.php @@ -953,14 +953,13 @@ if(isset($_POST['add_company_settings'])){
  • Acquire balance can be useful for customer's to get their balance by phone
    • Warning: config.php is not writable. Ensure Apache has write access.
    "; - } - else { - // Else, able to write. Tidy up - unlink("config.php"); - } + // Check that there is access to write config.php + if(!file_put_contents("config.php", "Test")){ + echo "
    Warning: config.php is not writable. Ensure the webserver user has write access.
    "; + }else{ + // Else, able to write. Tidy up + unlink("config.php"); + } ?>
    Setup