From fecd1cabfff84db22a02c4c3e39c4041d3040ae5 Mon Sep 17 00:00:00 2001 From: johnnyq Date: Wed, 14 Oct 2026 23:33:29 -0400 Subject: [PATCH] Credentials makeover: rebuilt credentials list with kind icons, username copy, password show/copy and live 2FA code buttons fetched on demand, where it opens, what it is for (asset, contact, vendors, licenses, services), password age pills and last used, filters for Starred, With 2FA, No 2FA, Not changed in 90 days and Shared with counts, search across notes, second link, tags, asset and contact, open straight to a credential with ?open=ID; new credential quick look with login, age, last viewed by, links with unlink, notes, open share links with turn off, and history; tabbed new/edit form with password generator (passphrase or random), strength meter, 2FA secret that accepts spaces or an otpauth:// link and shows the current code to check, copy buttons on both links, prefill from asset, contact or vendor; new Change password window that dates and logs the change; new Share window from anywhere (contact or email, 1 hour to 1 month, gone after opened once by default, link copied); same login controls on asset and contact pages and quick looks, vendor Logins tab, license page and quick look, service quick look, client overview favourites and search; credential pickers show icons and say when a credential moves from another asset or contact; client overview Passwords due for a change attention item and Active share links limited to live links; rotation report with selectable span, per client counts and oldest first; more export columns; demo data gets 2FA secrets, varied password ages and logins attached to their assets. Fixes passwords being blanked when the vault session had expired, other clients' assets, contacts and tags accepted on save, bulk star using the wrong permission, credential links to assets and contacts not checking the client, the edit or link permission, or which asset or contact an unlink was for, credentials left pointing at deleted assets and contacts, share links left open after a credential was deleted, import carrying values between rows and accepting any file type, 2FA secrets saved with spaces or lowercase giving no code, the service quick look listing credentials without credential access and repeating assets, an asset login with only a username being lost, and the API not dating new passwords. Adds functions/credential.php and js/credentials.js; removes credential_model.php and the old credential show password/OTP scripts. No DB change. --- admin/post/demo_data_model.php | 31 +- agent/ajax.php | 19 +- agent/asset.php | 118 +-- agent/client_overview.php | 33 +- agent/contact.php | 94 +-- agent/credentials.php | 741 +++++++++--------- agent/global_search.php | 23 +- agent/js/credential_show_otp_via_id.js | 16 - agent/js/credential_show_password_via_id.js | 40 - agent/license.php | 59 +- agent/modals/asset/asset.php | 48 +- agent/modals/asset/asset_link_credential.php | 69 +- agent/modals/contact/contact.php | 44 +- .../contact/contact_link_credential.php | 67 +- agent/modals/credential/credential.php | 188 +++++ agent/modals/credential/credential_add.php | 248 +----- agent/modals/credential/credential_edit.php | 244 +----- agent/modals/credential/credential_form.php | 375 +++++++++ agent/modals/credential/credential_rotate.php | 103 +++ agent/modals/credential/credential_share.php | 132 ++++ agent/modals/link/link.php | 2 +- agent/modals/service/service.php | 44 +- agent/modals/software/software.php | 27 +- agent/post/asset.php | 47 +- agent/post/contact.php | 24 +- agent/post/credential.php | 564 ++++++------- agent/post/credential_model.php | 22 - agent/post/service.php | 6 +- agent/reports/credential_rotation.php | 149 ++-- agent/vendor.php | 16 +- api/v1/assets/delete.php | 3 + api/v1/contacts/delete.php | 3 + api/v1/credentials/create.php | 2 +- api/v1/credentials/credential_model.php | 4 +- api/v1/credentials/delete.php | 3 + css/itflow_custom.css | 84 ++ functions.php | 1 + functions/asset.php | 5 +- functions/client_overview.php | 17 +- functions/credential.php | 515 ++++++++++++ functions/export.php | 7 + functions/links.php | 17 +- functions/search.php | 5 +- guest/guest_ajax.php | 5 +- includes/footer.php | 1 + js/credentials.js | 155 ++++ post/misc.php | 9 + 47 files changed, 2643 insertions(+), 1786 deletions(-) delete mode 100644 agent/js/credential_show_otp_via_id.js delete mode 100644 agent/js/credential_show_password_via_id.js create mode 100644 agent/modals/credential/credential.php create mode 100644 agent/modals/credential/credential_form.php create mode 100644 agent/modals/credential/credential_rotate.php create mode 100644 agent/modals/credential/credential_share.php delete mode 100644 agent/post/credential_model.php create mode 100644 functions/credential.php create mode 100644 js/credentials.js diff --git a/admin/post/demo_data_model.php b/admin/post/demo_data_model.php index dd116be30..c1b9ee85f 100644 --- a/admin/post/demo_data_model.php +++ b/admin/post/demo_data_model.php @@ -367,6 +367,17 @@ function demoFirstId($mysqli, $table, $id_column, $archived_column = '') { // Deterministic stand-in for a serial number - same input, same serial, so a // reload after a removal does not produce a whole new set of numbers +/** A 2FA seed that comes out the same on every run - 32 base32 characters from the seed. */ +function demoTotpSeed($seed) { + $alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567'; + $bytes = md5('itflow-demo-totp-' . $seed, true) . md5('itflow-demo-totp-2-' . $seed, true); + $out = ''; + for ($i = 0; $i < 32; $i++) { + $out .= $alphabet[ord($bytes[$i]) % 32]; + } + return $out; +} + function demoSerial($seed, $length = 10) { return strtoupper(substr(md5('itflow-demo-' . $seed), 0, $length)); } @@ -1342,9 +1353,12 @@ function demoBuildClient($mysqli, $profile, $index, $context, &$counts) { 'credential_password' => encryptCredentialEntry(demoSerial($profile['abbreviation'] . $credential[0], 14) . '!aA1'), 'credential_note' => $credential[4], 'credential_favorite' => $credential[6], + // A 2FA seed on the logins that have one, so the codes count down like the real thing + 'credential_otp_secret' => !empty($credential[7]) ? demoTotpSeed($profile['abbreviation'] . $credential[0]) : '', 'credential_client_id' => $client_id, 'credential_created_at' => demoMonthDateTime($months, 8, 16, 10), - 'credential_password_changed_at' => demoMonthDateTime(max(0, min(4, $months)), 8, 16, 10), + // Some changed lately, some due, one well over a year - never before the client was taken on + 'credential_password_changed_at' => demoDateTime(min($credential[8] ?? 30, max(0, $months * 30 - 10)), 16, 10), 'credential_accessed_at' => demoDateTime(($index + 2) % 15, 11, 30), ]); $credential_ids[$credential[0]] = $credential_id; @@ -1480,6 +1494,8 @@ function demoBuildClient($mysqli, $profile, $index, $context, &$counts) { foreach ($assets as $asset) { if (!empty($asset['credential']) && $asset['credential'] === $credential_name) { demoLink($mysqli, 'asset_credentials', 'credential_id', $credential_id, 'asset_id', $asset['id']); + // The credential's own asset - what the asset's Credentials tab and the credential show + mysqli_query($mysqli, "UPDATE credentials SET credential_asset_id = " . intval($asset['id']) . " WHERE credential_id = " . intval($credential_id) . " AND credential_asset_id = 0"); } } } @@ -4500,13 +4516,14 @@ function demoExpandProfile($spec) { // Credentials - names line up with demoAssetCredentialName so the vault // entries attach to the kit they actually open $mail_admin_uri = $mail === 'Google Workspace' ? 'https://admin.google.com' : 'https://admin.microsoft.com'; + // [name, description, uri, username, note, tags, starred, has 2FA, password last changed (days ago)] $credentials = [ - ['Firewall Administrator', 'Edge firewall management interface', 'https://192.168.10.1', 'msp-admin', 'Local administrator on the edge firewall. Rotated at every quarterly review.', ['Firewall', 'Local Admin', 'Rotate Quarterly'], 1], - [$mail . ' Administrator', 'Tenant administration for mail and identity', $mail_admin_uri, 'msp-admin@' . $domain, 'Break glass administrator. MFA enforced - the token lives with the on call phone.', ['Microsoft 365', 'Domain Admin', 'Break Glass'], 1], - ['Hypervisor and Storage Administrator', $foss ? 'Proxmox VE and TrueNAS management' : 'Hypervisor and NAS management', 'https://192.168.20.10:8006', 'msp-admin', 'Root equivalent. Use the individual accounts for day to day work and this only for maintenance.', ['Hypervisor', 'Local Admin', 'Break Glass'], 0], - ['Network Controller', 'UniFi controller for switching and wireless', 'https://192.168.10.12', 'msp-' . strtolower($short), 'Controller runs on the management stack, not on site.', ['Switch', 'Wireless', 'Shared'], 0], - ['Backup Console', $foss ? 'Proxmox Backup Server and Synology Active Backup' : 'Backup platform for servers and endpoints', 'https://backup.example', 'msp-' . strtolower($short), 'Console login for restore requests and job monitoring.', ['Backup Console', 'Service Account'], 0], - ['Registrar and DNS', 'Domain registrar and DNS control panel', 'https://registrar.example', 'billing@' . $domain, 'Registrar account is in the client name with us as technical contact.', ['Registrar and DNS', 'Shared'], 0], + ['Firewall Administrator', 'Edge firewall management interface', 'https://192.168.10.1', 'msp-admin', 'Local administrator on the edge firewall. Rotated at every quarterly review.', ['Firewall', 'Local Admin', 'Rotate Quarterly'], 1, 0, 25], + [$mail . ' Administrator', 'Tenant administration for mail and identity', $mail_admin_uri, 'msp-admin@' . $domain, 'Break glass administrator. MFA enforced - the token lives with the on call phone.', ['Microsoft 365', 'Domain Admin', 'Break Glass'], 1, 1, 120], + ['Hypervisor and Storage Administrator', $foss ? 'Proxmox VE and TrueNAS management' : 'Hypervisor and NAS management', 'https://192.168.20.10:8006', 'msp-admin', 'Root equivalent. Use the individual accounts for day to day work and this only for maintenance.', ['Hypervisor', 'Local Admin', 'Break Glass'], 0, 0, 430], + ['Network Controller', 'UniFi controller for switching and wireless', 'https://192.168.10.12', 'msp-' . strtolower($short), 'Controller runs on the management stack, not on site.', ['Switch', 'Wireless', 'Shared'], 0, 0, 60], + ['Backup Console', $foss ? 'Proxmox Backup Server and Synology Active Backup' : 'Backup platform for servers and endpoints', 'https://backup.example', 'msp-' . strtolower($short), 'Console login for restore requests and job monitoring.', ['Backup Console', 'Service Account'], 0, 1, 210], + ['Registrar and DNS', 'Domain registrar and DNS control panel', 'https://registrar.example', 'billing@' . $domain, 'Registrar account is in the client name with us as technical contact.', ['Registrar and DNS', 'Shared'], 0, 1, 15], ]; // Services - the last two entries say which asset types run it and which diff --git a/agent/ajax.php b/agent/ajax.php index aa53fc16d..fa9921bb2 100644 --- a/agent/ajax.php +++ b/agent/ajax.php @@ -817,6 +817,10 @@ if (isset($_GET['share_generate_link'])) { // Logging logAudit("Share", "Create", "$session_name created shared link for $item_type - $item_name", $client_id, $item_id); + // ...and on the credential itself, so its history says who it went out to + if ($item_type == "Credential") { + logAudit("Credential", "Share", "$session_name shared credential $item_name" . ($item_email ? " with $item_email" : '') . ", expiring in $item_expires_friendly", $client_id, $item_id); + } } @@ -1167,13 +1171,19 @@ if (isset($_GET['get_totp_token_via_id'])) { $credential_id = intval($_GET['credential_id']); $sql = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT credential_name, credential_otp_secret, credential_client_id FROM credentials WHERE credential_id = $credential_id")); + if (!$sql) { + echo json_encode(''); + exit; + } $name = escapeSql($sql['credential_name']); $totp_secret = $sql['credential_otp_secret']; $client_id = intval($sql['credential_client_id']); enforceClientAccess(); - $otp = TokenAuth6238::getTokenCode(strtoupper($totp_secret)); + // Seeds saved before they were tidied on save may still carry spaces, dashes or the whole otpauth:// link + $totp_seed = credentialOtpSeed($totp_secret); + $otp = $totp_seed ? TokenAuth6238::getTokenCode($totp_seed) : ''; echo json_encode($otp); // Logging @@ -1816,6 +1826,10 @@ if (isset($_GET['get_credential_via_id'])) { $credential_id = intval($_GET['credential_id']); $sql = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT credential_name, credential_username, credential_password, credential_client_id FROM credentials WHERE credential_id = $credential_id")); + if (!$sql) { + echo json_encode(['error' => 'That credential no longer exists.']); + exit; + } $name = escapeSql($sql['credential_name']); $client_id = intval($sql['credential_client_id']); @@ -1827,6 +1841,9 @@ if (isset($_GET['get_credential_via_id'])) { ); echo json_encode($response); + // When it was last used - the credentials list sorts by it. Kept off the updated date, which means an edit + mysqli_query($mysqli, "UPDATE credentials SET credential_accessed_at = NOW(), credential_updated_at = credential_updated_at WHERE credential_id = $credential_id"); + // Only log if this user hasn't viewed this credential recently (mirrors TOTP dedup) $check_recent_view = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT(log_id) AS recent_view FROM logs WHERE log_type = 'Credential' AND log_action = 'View' AND log_user_id = $session_user_id AND log_entity_id = $credential_id AND log_client_id = $client_id AND log_created_at > (NOW() - INTERVAL 5 MINUTE)")); diff --git a/agent/asset.php b/agent/asset.php index d2b369f2a..72b8e4383 100644 --- a/agent/asset.php +++ b/agent/asset.php @@ -103,6 +103,7 @@ if (mysqli_num_rows($sql) == 0) { $can_edit = lookupUserPermission('module_support') >= 2; $can_delete = lookupUserPermission('module_support') >= 3; $can_credentials = lookupUserPermission('module_credential') >= 1; + $can_credentials_edit = lookupUserPermission('module_credential') >= 2; // The rack it sits in, if any $asset_rack = rackPositionForAsset($asset_id); @@ -211,18 +212,8 @@ if (mysqli_num_rows($sql) == 0) { $document_count = mysqli_num_rows($sql_related_documents); // Credentials - $credential_count = 0; - if ($can_credentials) { - $sql_related_credentials = mysqli_query($mysqli, " - SELECT credential_id, credential_name, credential_description, credential_uri, - credential_username, credential_otp_secret - FROM credentials - WHERE credential_asset_id = $asset_id - AND credential_archived_at IS NULL - ORDER BY credential_name ASC - "); - $credential_count = mysqli_num_rows($sql_related_credentials); - } + $related_credentials = $can_credentials ? credentialRows("credential_asset_id = $asset_id AND credential_client_id = $client_id") : []; + $credential_count = count($related_credentials); // Licenses it holds a seat on, with each one's seats in use and the key it was given $held_software = softwareHeldBy('asset', $asset_id); @@ -337,8 +328,8 @@ if (mysqli_num_rows($sql) == 0) { Recurring Ticket - - + + Credential @@ -365,7 +356,7 @@ if (mysqli_num_rows($sql) == 0) { License - + Credential @@ -734,98 +725,24 @@ if (mysqli_num_rows($sql) == 0) {
Logins for this asset. Passwords and codes are fetched only when you ask for them. - +
-
- -
- - - - - - - - - - - - - - - - - - - - - - - -
NameUsernamePasswordOTPURI
- -
- 		- - - - - - - - - - - - Hover... - - - - - - - - - - - - -
- -
- - Edit - - )"> - Share - -
- - Unlink - - = 3) { ?> - - Delete - - -
-
-
-
+ + false, + 'unlink' => function ($row) use ($asset_id, $can_edit) { + return $can_edit && credentialCan(2) ? "post.php?unlink_credential_from_asset&asset_id=$asset_id&credential_id=" . intval($row['credential_id']) . "&csrf_token=" . $_SESSION['csrf_token'] : ''; + }, + ]) ?>
No credentials for this asset.
@@ -1213,7 +1130,6 @@ if (mysqli_num_rows($sql) == 0) {
- - - -
- - - - - - - - - - - - OTP - - - + + + + + + + + + +
@@ -378,6 +373,10 @@ $money_format = function ($amount) use ($currency_format, $client_currency_code, } elseif ($item['item_type'] === 'File') { $item_tile = fileTypeTile($item['file_ext'], 'sm'); $item_label = "$item_label"; + } elseif ($item['item_type'] === 'Credential' && $item['item_name']) { + // Its tile, opening its quick look - with the password and 2FA there for whoever may see them + $item_tile = credentialTile(['credential_name' => $item['item_name'], 'credential_uri' => $item['credential_uri'], 'credential_description' => $item['credential_description']], 'sm'); + $item_label = $access['credentials'] ? "$item_label" : $item_label; } else { $item_tile = ''; } @@ -547,8 +546,6 @@ $money_format = function ($amount) use ($currency_format, $client_currency_code, - - diff --git a/agent/contact.php b/agent/contact.php index deee03f74..9891f2fdc 100644 --- a/agent/contact.php +++ b/agent/contact.php @@ -72,6 +72,7 @@ $contact_role_line = implode(' · ', array_filter([$contact_title, $contac $can_edit = lookupUserPermission('module_client') >= 2; $can_delete = lookupUserPermission('module_client') >= 3; $can_credentials = lookupUserPermission('module_credential') >= 1; +$can_credentials_edit = lookupUserPermission('module_credential') >= 2; $can_support = lookupUserPermission('module_support') >= 1; $can_support_edit = lookupUserPermission('module_support') >= 2; @@ -93,17 +94,8 @@ $sql_related_assets = mysqli_query($mysqli, "SELECT asset_id, asset_name, asset_ $asset_count = mysqli_num_rows($sql_related_assets); // Credentials - only for agents who may see them -$credential_count = 0; -if ($can_credentials) { - $sql_related_credentials = mysqli_query($mysqli, "SELECT credential_id, credential_name, credential_description, credential_uri, - credential_username, credential_otp_secret - FROM credentials - WHERE credential_contact_id = $contact_id - AND credential_archived_at IS NULL - ORDER BY credential_name ASC" - ); - $credential_count = mysqli_num_rows($sql_related_credentials); -} +$related_credentials = $can_credentials ? credentialRows("credential_contact_id = $contact_id AND credential_client_id = $client_id") : []; +$credential_count = count($related_credentials); // Tickets they raised or are the contact on - open ones first $related_tickets = []; @@ -276,8 +268,8 @@ if (!$can_support) { Asset - - + + Credential @@ -303,7 +295,7 @@ if (!$can_support) { Asset - + Credential @@ -531,75 +523,23 @@ if (!$can_support) {
Their logins. Passwords and codes are fetched only when you ask for them. - +
-
- -
- - - - - - - - - - - - - - - - -
NameUsernamePasswordOTPURI
- -
- 		- - - - - Hover... - - - - - - -
- -
- - Edit - - )"> - Share - - -
- - Unlink - - - = 3) { ?> - - Delete - - -
-
-
-
+ + function ($row) use ($contact_id, $can_edit) { + return $can_edit && credentialCan(2) ? "post.php?unlink_credential_from_contact&contact_id=$contact_id&credential_id=" . intval($row['credential_id']) . "&csrf_token=" . $_SESSION['csrf_token'] : ''; + }, + ]) ?>
No credentials for .
@@ -897,8 +837,6 @@ if (!$can_support) {
- - - - - - = 2; + +// Client Filter (all clients) +$client = ''; +if (!$client_url && !empty($_GET['client'])) { + $client = intval($_GET['client']); + $client_query = "AND credential_client_id = $client"; +} + +// Location Filter (one client) - credentials for the assets at a site +$location_filter = $client_url ? intval($_GET['location'] ?? 0) : 0; +$location_query = $location_filter ? "AND c.credential_asset_id IN (SELECT asset_id FROM assets WHERE asset_location_id = $location_filter)" : ''; + +// Tags Filter - a credential with any of them if (isset($_GET['tags']) && is_array($_GET['tags']) && !empty($_GET['tags'])) { - // Sanitize each element of the tags array - $sanitizedTags = array_map('intval', $_GET['tags']); - // Convert the sanitized tags into a comma-separated string - $tag_filter = implode(",", $sanitizedTags); - $tag_query = "AND tags.tag_id IN ($tag_filter)"; + $tag_filter = implode(",", array_map('intval', $_GET['tags'])); + $tag_query = "AND c.credential_id IN (SELECT credential_id FROM credential_tags WHERE tag_id IN ($tag_filter))"; } else { $tag_filter = 0; $tag_query = ''; } -if (!$client_url) { - // Client Filter - if (isset($_GET['client']) & !empty($_GET['client'])) { - $client_query = 'AND (credential_client_id = ' . intval($_GET['client']) . ')'; - $client = intval($_GET['client']); - } else { - // Default - any - $client_query = ''; - $client = ''; - } -} +// Which ones - the pills along the top +$rotate_days = CREDENTIAL_ROTATE_DAYS; +$shows = [ + '' => ['label' => 'All', 'where' => ''], + 'starred' => ['label' => 'Starred', 'icon' => 'fa-star', 'where' => 'c.credential_favorite = 1'], + 'otp' => ['label' => 'With 2FA', 'icon' => 'fa-clock', 'where' => "c.credential_otp_secret <> ''"], + 'nootp' => ['label' => 'No 2FA', 'icon' => 'fa-unlock', 'where' => "(c.credential_otp_secret IS NULL OR c.credential_otp_secret = '')"], + 'due' => ['label' => "Not changed in $rotate_days days", 'icon' => 'fa-history', 'where' => "(c.credential_password_changed_at IS NULL OR c.credential_password_changed_at < NOW() - INTERVAL $rotate_days DAY)"], + 'shared' => ['label' => 'Shared', 'icon' => 'fa-share-alt', 'where' => "c.credential_id IN (SELECT item_related_id FROM shared_items WHERE item_type = 'Credential' AND item_active = 1 AND item_expire_at > NOW() AND (COALESCE(item_view_limit, 0) = 0 OR item_views < item_view_limit))"], +]; +$show = isset($shows[$_GET['show'] ?? '']) ? ($_GET['show'] ?? '') : ''; +$show_query = $shows[$show]['where'] ? 'AND ' . $shows[$show]['where'] : ''; -// Location Filter -if ($client_url && isset($_GET['location']) && !empty($_GET['location'])) { - $location_query = 'AND (a.asset_location_id = ' . intval($_GET['location']) . ')'; - $location_query_innerjoin = 'INNER JOIN assets a on a.asset_id = c.credential_asset_id '; - $location_filter = intval($_GET['location']); -} else { - // Default - any - $location_query_innerjoin = ''; - $location_query = ''; - $location_filter = ''; +// Only these sort - filter_header.php will hand through any lowercase word, and +// an unknown column takes the page down with a mysqli exception +$sortable_columns = ['credential_name', 'credential_uri', 'credential_password_changed_at', 'credential_accessed_at', 'client_name', 'credential_created_at']; +if (!in_array($sort, $sortable_columns, true)) { + $sort = 'credential_name'; } +$sort_column = $sort === 'client_name' ? 'client_name' : "c.$sort"; + +$search_query = "AND (c.credential_name LIKE '%$q%' OR c.credential_description LIKE '%$q%' OR c.credential_uri LIKE '%$q%' OR c.credential_uri_2 LIKE '%$q%' + OR c.credential_note LIKE '%$q%' OR client_name LIKE '%$q%' OR asset_name LIKE '%$q%' OR contact_name LIKE '%$q%' + OR c.credential_id IN (SELECT credential_id FROM credential_tags JOIN tags USING (tag_id) WHERE tag_name LIKE '%$q%'))"; +$scope_query = clientScopeSql('credential_client_id'); $sql = mysqli_query( $mysqli, - "SELECT SQL_CALC_FOUND_ROWS c.credential_id AS c_credential_id, c.*, credential_tags.*, tags.*, clients.*, contacts.*, assets.* + "SELECT SQL_CALC_FOUND_ROWS c.credential_id, c.credential_name, c.credential_description, c.credential_uri, c.credential_uri_2, c.credential_username, + c.credential_otp_secret, c.credential_favorite, c.credential_archived_at, c.credential_password_changed_at, c.credential_accessed_at, + c.credential_client_id, client_name, contact_id, contact_name, contact_photo, contact_archived_at, asset_id, asset_name, asset_type, asset_archived_at FROM credentials c - LEFT JOIN credential_tags ON credential_tags.credential_id = c.credential_id - LEFT JOIN tags ON tags.tag_id = credential_tags.tag_id LEFT JOIN clients ON client_id = credential_client_id - LEFT JOIN contacts ON contact_id = credential_contact_id - LEFT JOIN assets ON asset_id = credential_asset_id - $location_query_innerjoin + LEFT JOIN contacts ON contact_id = credential_contact_id AND contact_client_id = credential_client_id + LEFT JOIN assets ON asset_id = credential_asset_id AND asset_client_id = credential_client_id WHERE $archive_query $tag_query - AND (c.credential_name LIKE '%$q%' OR c.credential_description LIKE '%$q%' OR c.credential_uri LIKE '%$q%' OR tag_name LIKE '%$q%' OR client_name LIKE '%$q%') + $search_query $location_query - " . clientScopeSql('credential_client_id') . " + $show_query + $scope_query $client_query - GROUP BY c.credential_id - ORDER BY c.credential_favorite DESC, $sort $order LIMIT $record_from, $record_to" + ORDER BY c.credential_favorite DESC, $sort_column $order, c.credential_name ASC LIMIT $record_from, $record_to" ); $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); +$credentials = []; +while ($row = mysqli_fetch_assoc($sql)) { + $credentials[intval($row['credential_id'])] = $row; +} + +// Tags, links and share links for the whole page at once, not per row +$credentials_tags = tagsForRecords('credential', array_keys($credentials)); +$credentials_links = credentialLinks(array_keys($credentials)); +$credentials_shares = credentialShares(array_keys($credentials)); + +// How many of each, for the pills - everything in scope, before the pill itself +$counts = ['' => 0]; +$count_sql = []; +foreach ($shows as $key => $s) { + $count_sql[] = $key === '' ? 'COUNT(*)' : "COALESCE(SUM({$s['where']}), 0)"; +} +$row = mysqli_fetch_row(mysqli_query($mysqli, "SELECT " . implode(', ', $count_sql) . " + FROM credentials c + LEFT JOIN clients ON client_id = credential_client_id + LEFT JOIN contacts ON contact_id = credential_contact_id AND contact_client_id = credential_client_id + LEFT JOIN assets ON asset_id = credential_asset_id AND asset_client_id = credential_client_id + WHERE $archive_query $tag_query $search_query $location_query $scope_query $client_query")); +foreach (array_keys($shows) as $i => $key) { + $counts[$key] = intval($row[$i]); +} + +$filter_url = function ($changes) use ($client_url) { + $params = array_merge($_GET, $changes); + unset($params['page']); + return '?' . http_build_query(array_filter($params, function ($v) { return $v !== '' && $v !== null; })); +}; + ?>

Credentials

- = 2) { ?> -
- - -
- - - Import - -
+ +
+ + + + +
+ + + Import + 0) { ?> Export + + Rotation report +
@@ -135,67 +184,48 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); +
- -
+
- - + +
- -
-
- -
+
+
- - -
-
+
+ -
-
- -
-
+ -
+
- - -
-
- "> - Archived +
+
+ + Archived - -
+ +
- - text-nowrap"> - - - - - - - - - - - - - +
-
- -
- 		- - Name - - Username / IDPassword / KeyOTP - - URI - - - - Client - - Action
+ text-nowrap table-light"> + + + + + + + + + + + + + - " . truncate($credential_uri,40) . ""; - } - $credential_uri_2 = escapeUrl($row['credential_uri_2']); - $credential_username = escapeHtml(decryptCredentialEntry($row['credential_username'])); - if (empty($credential_username)) { - $credential_username_display = "-"; - } else { - $credential_username_display = "$credential_username"; - } - $credential_otp_secret = escapeHtml($row['credential_otp_secret']); - if (empty($credential_otp_secret)) { - $otp_display = "-"; - } else { - $otp_display = " Hover.."; - } - $credential_note = escapeHtml($row['credential_note']); - $credential_created_at = escapeHtml($row['credential_created_at']); - $credential_archived_at = escapeHtml($row['credential_archived_at']); - $credential_favorite = intval($row['credential_favorite']); - $credential_contact_id = intval($row['credential_contact_id']); - $contact_name = escapeHtml($row['contact_name']); - $credential_asset_id = intval($row['credential_asset_id']); - $asset_name = escapeHtml($row['asset_name']); - - // Tags - $credential_tags = tagsForRecord('credential', $credential_id); - - if ($credential_contact_id) { - // Their avatar, the size of the asset pill beside it - $credential_contact_display = "" - . contactAvatar($row['credential_client_id'], $credential_contact_id, $row['contact_name'], $row['contact_photo'], 'md') . ""; - } else { - $credential_contact_display = ''; - } - - if ($credential_asset_id) { - $credential_asset_display = " - "; - } else { - $credential_asset_display = ''; - } - - // Check if shared - $sql_shared = mysqli_query( - $mysqli, - "SELECT item_active, item_created_at, item_expire_at, item_id, item_key, item_note, item_recipient, - item_related_id, item_type, item_view_limit, item_views FROM shared_items - WHERE item_client_id = $client_id - AND item_active = 1 - AND (COALESCE(item_view_limit, 0) = 0 OR item_views < item_view_limit) - AND item_expire_at > NOW() - AND item_type = 'Credential' - AND item_related_id = $credential_id - LIMIT 1" - ); - if (mysqli_num_rows($sql_shared) > 0) { - $row = mysqli_fetch_assoc($sql_shared); - $item_id = intval($row['item_id']); - $item_active = escapeHtml($row['item_active']); - $item_key = escapeHtml($row['item_key']); - $item_type = escapeHtml($row['item_type']); - $item_related_id = intval($row['item_related_id']); - $item_note = escapeHtml($row['item_note']); - $item_recipient = escapeHtml($row['item_recipient']); - $item_views = escapeHtml($row['item_views']); - $item_view_limit = escapeHtml($row['item_view_limit']); - $item_created_at = escapeHtml($row['item_created_at']); - $item_expire_at = escapeHtml($row['item_expire_at']); - $item_expire_at_human = timeAgo($row['item_expire_at']); - } + $row) { + $row_client_id = intval($row['credential_client_id']); + $credential_name = escapeHtml($row['credential_name']); + $credential_description = escapeHtml($row['credential_description']); + $credential_favorite = intval($row['credential_favorite']); + $credential_archived_at = escapeHtml($row['credential_archived_at']); + $credential_tags = $credentials_tags[$credential_id] ?? []; + $credential_links = $credentials_links[$credential_id] ?? []; + $credential_shares = $credentials_shares[$credential_id] ?? []; + $has_otp = trim((string) $row['credential_otp_secret']) !== ''; + $age = credentialAge($row['credential_password_changed_at']); + $quick_url = "modals/credential/credential.php?id=$credential_id"; ?> - "> - - - - - - - - - - - - + + + + - + + + + + + + + + + - +
+
+ +
+ 		+ + Credential + + LoginFor + + Changed + + + + Client + +
-
- -
- 		-
- -
- "; } ?> -
- = 2) { ?> -
- -
-
- 		- - - - 0) { ?> -
- -
Shared -
- -
-
- - 		-
- -
- -
- - - - - - -
- - - - -
-
+
+
+ +
+ 		+
+ +
+ + + Shared + Archived + +
+ + +
-
- -
- - Edit - -
- - )"> - Share - - - = 2) { ?> - -
- - Restore - - = 3) { ?> -
- - Delete - - - -
- - Archive - - - -
-
-
+
+
+ + +
+ +
+ + 		+
+ + + + + + + + + 2) { ?> + + more + + - +
+ 		+ -' ?> +
Used
+ 		+
+ +
+ + Quick look + + + + Edit + + + Change password + + + + + Share + + + + + + + + +
+ + + Restore + + + + Delete + + + + + Archive + + + +
+
+
+ +
+ +
+
+
- - - + + + + -
+
- +
-
- +
+ +
@@ -234,9 +235,5 @@ function searchResultBadge($badge) {
- - - - ['label' => 'Seats', 'icon' => 'fa-users', 'count' => $seats['used']], 'keys' => ['label' => 'Keys', 'icon' => 'fa-key', 'count' => count($keys) + ($software_key ? 1 : 0)], - 'credentials' => ['label' => 'Credentials', 'icon' => 'fa-lock', 'count' => count($credentials)], + 'credentials' => ['label' => 'Credentials', 'icon' => 'fa-key', 'count' => count($credentials)], 'documents' => ['label' => 'Documents', 'icon' => 'fa-file-alt', 'count' => count($documents)], 'files' => ['label' => 'Files', 'icon' => 'fa-paperclip', 'count' => count($files)], 'history' => ['label' => 'History', 'icon' => 'fa-history', 'count' => count($history)], @@ -510,50 +510,12 @@ if (!$license || ($client_url && intval($license['software_client_id']) !== intv
-
- - - - - - - - - - - - - - - -
NameUsernamePasswordOTP
- - -
- 		- - - - - - - - - - - - Hover... - - - - - - - - -
-
+ true, + 'unlink' => function ($row) use ($unlink_url, $can_link_credentials) { + return $can_link_credentials ? $unlink_url('credential', $row['credential_id']) : ''; + }, + ]) ?>
No credentials linked.
@@ -684,11 +646,6 @@ if (!$license || ($client_url && intval($license['software_client_id']) !== intv }); - - - - -
-
- - - - - - - - - - - - -
NameUsernamePasswordOTP
- - - - - - - - - Hover... - - - - -
-
+
- - - diff --git a/agent/modals/asset/asset_link_credential.php b/agent/modals/asset/asset_link_credential.php index a4b7beaff..5e9bff37a 100644 --- a/agent/modals/asset/asset_link_credential.php +++ b/agent/modals/asset/asset_link_credential.php @@ -1,65 +1,66 @@ 'That asset no longer exists.']); + exit; +} $asset_name = escapeHtml($row['asset_name']); $client_id = intval($row['asset_client_id']); enforceClientAccess(); +$choices = credentialRows("credential_client_id = $client_id AND credential_asset_id <> $asset_id"); +// Free ones first, then the ones that would move from another asset +uasort($choices, function ($a, $b) { + return [empty($a['asset_id']) ? 0 : 1, strtolower($a['credential_name'])] <=> [empty($b['asset_id']) ? 0 : 1, strtolower($b['credential_name'])]; +}); + ob_start(); ?>
-
Link Credential to
+
Link a credential to
- -
+
- - + + $choice) { + $where_now = !empty($choice['asset_id']) ? 'On ' . $choice['asset_name'] . ' - moves here' : ($choice['credential_description'] ?: $choice['credential_uri']); ?> + +
-
+
A credential belongs to one asset - one already on another asset moves here.
+ +

This client has no other credentials to link - make a new one instead.

+
- + + +
diff --git a/agent/modals/contact/contact.php b/agent/modals/contact/contact.php index 7a9cdc05a..9b180f631 100644 --- a/agent/modals/contact/contact.php +++ b/agent/modals/contact/contact.php @@ -65,16 +65,8 @@ $sql_related_assets = mysqli_query($mysqli, "SELECT asset_id, asset_name, asset_ $asset_count = mysqli_num_rows($sql_related_assets); // Credentials - only for agents who may see them -$credential_count = 0; -if ($can_credentials) { - $sql_related_credentials = mysqli_query($mysqli, "SELECT credential_id, credential_name, credential_uri, credential_username, credential_otp_secret - FROM credentials - WHERE credential_contact_id = $contact_id - AND credential_archived_at IS NULL - ORDER BY credential_name ASC" - ); - $credential_count = mysqli_num_rows($sql_related_credentials); -} +$related_credentials = $can_credentials ? credentialRows("credential_contact_id = $contact_id AND credential_client_id = $client_id") : []; +$credential_count = count($related_credentials); // Tickets - open ones first; the most recent few here, the rest on the contact page $quick_ticket_limit = 8; @@ -291,38 +283,8 @@ ob_start();
-
- - - - - - - - - - - - -
NameUsernamePasswordOTP
- - - - - - - - Hover... - - -
-
+
- - - diff --git a/agent/modals/contact/contact_link_credential.php b/agent/modals/contact/contact_link_credential.php index 44ce2c016..3a3d88edd 100644 --- a/agent/modals/contact/contact_link_credential.php +++ b/agent/modals/contact/contact_link_credential.php @@ -1,61 +1,66 @@ 'That contact no longer exists.']); + exit; +} $contact_name = escapeHtml($row['contact_name']); $client_id = intval($row['contact_client_id']); enforceClientAccess(); +$choices = credentialRows("credential_client_id = $client_id AND credential_contact_id <> $contact_id"); +// Nobody's first, then the ones that would move from someone else +uasort($choices, function ($a, $b) { + return [empty($a['contact_id']) ? 0 : 1, strtolower($a['credential_name'])] <=> [empty($b['contact_id']) ? 0 : 1, strtolower($b['credential_name'])]; +}); + ob_start(); ?>
-
Link Credential to
+
Link a credential to
- -
+
- - + + $choice) { + $whose_now = !empty($choice['contact_id']) ? $choice['contact_name'] . "'s - moves to " . html_entity_decode($contact_name, ENT_QUOTES, 'UTF-8') : ($choice['credential_description'] ?: $choice['credential_uri']); ?> + +
-
+
A credential belongs to one person - one that is someone else's moves to .
+ +

This client has no other credentials to link - make a new one instead.

+
- + + +
diff --git a/agent/modals/credential/credential.php b/agent/modals/credential/credential.php new file mode 100644 index 000000000..d75b772cf --- /dev/null +++ b/agent/modals/credential/credential.php @@ -0,0 +1,188 @@ + 'That credential no longer exists.']); + exit; +} +$client_id = intval($credential['credential_client_id']); +enforceClientAccess(); + +$credential_name = escapeHtml($credential['credential_name']); +$credential_archived = !empty($credential['credential_archived_at']); +$can_edit = credentialCan(2) && !$credential_archived; +// Making a share link is a support action as well as a credential one (agent/ajax.php share_generate_link) +$can_share = !$credential_archived && lookupUserPermission('module_support') >= 2; +$age = credentialAge($credential['credential_password_changed_at']); +$last_viewed = credentialLastViewed($credential_id); +$links = credentialLinks([$credential_id])[$credential_id]; +$shares = credentialShares([$credential_id])[$credential_id]; +$history = credentialHistory($credential_id, 8); +$tags = tagsForRecord('credential', $credential_id); +$has_otp = trim((string) $credential['credential_otp_secret']) !== ''; +$link_types = linkTypesFor('credential'); + +ob_start(); + +?> + +
+
+ +
+
+ + + Archived +
+
+ + +
+
+
+ +
+ +
+ + +
+
Username
+
+
Password
+
+ +
2FA code
+
+ + +
Opens at
+
+ +
+ +
+ +
+ +
+ + + Last looked at by , + + +
+ + + +
+ For + + Link a vendor or license + +
+
    + +
  • + +
    Asset
    +
    • + + +
  • + +
    Contact
    +
    • + + +
  • + + +
    Vendor
    + + +
    License
    + + +
    Service
    + + + + +
    • + + +
  • Not linked to anything yet.
    • + +
+ + + +
Notes
+
+ + + + +
Shared
+
    + +
  • + +
    +
    +
    view, expires
    +
    + +
    • + +
+ + + + +
+ History +
    + +
  • + + +
    • + +
+
+ + +
+ +
+ + + + + + + + +
+ +
-
New Credential for
+
New Credential for
+ + +
- - - -
- -
- -
- - - - - -
- -
- - -
-
- - - -
- -
- - -
- -
-
-
- -
- -
- - -
-
- -
- -
- - -
-
- -
- -
- - - - -
-
- -
- -
- - - -
-
- -
- -
- - -
-
- -
- -
- - -
-
- -
- - -
-
- -
- - -
-
- -
- -
- - -
-
-
- - -
- -
- -
- -
- -
- - - -
-
- -
- -
+ +
Your vault session has expired, so a new login cannot be encrypted. Sign out and back in first.
+ +
- +
- - 'That credential no longer exists.']); + exit; } - +$client_id = intval($credential['credential_client_id']); enforceClientAccess(); -logAudit("Credential", "View", "$session_name viewed credential $credential_name (edit)", $client_id, $credential_id); +// The form shows the password, so opening it counts as a view +logAudit("Credential", "View", "$session_name viewed credential " . escapeSql($credential['credential_name']) . " (edit)", $client_id, $credential_id); + +$credential_form_mode = 'edit'; +$credential_name = escapeHtml($credential['credential_name']); +$credential_description = escapeHtml($credential['credential_description']); +$credential_username = escapeHtml(credentialUsername($credential)); +$credential_password = escapeHtml((string) decryptCredentialEntry($credential['credential_password'])); +$credential_otp_secret = escapeHtml($credential['credential_otp_secret']); +$credential_uri = escapeHtml($credential['credential_uri']); +$credential_uri_2 = escapeHtml($credential['credential_uri_2']); +$credential_note = escapeHtml($credential['credential_note']); +$credential_favorite = intval($credential['credential_favorite']); +$credential_contact_id = intval($credential['credential_contact_id']); +$credential_asset_id = intval($credential['credential_asset_id']); +$credential_tag_ids = array_map(function ($tag) { + return intval($tag['tag_id']); +}, tagsForRecord('credential', $credential_id)); + +// Without the vault open the password shows blank and would be saved back blank - stop that here +$vault_open = encryptCredentialEntry('') !== false; ob_start(); ?>
-
Editing credential:
+
Editing credential:
@@ -54,185 +48,13 @@ ob_start();
- - - -
- -
> - -
- -
- -
- - -
- -
-
-
- -
- -
- - -
-
- -
- -
- - -
-
- -
- -
- - - - -
-
- -
- -
- - - -
-
- -
- -
- - - - - -
-
- -
- -
- - - - -
-
- -
- -
- -
- -
- - -
-
- -
- -
- - -
-
- -
- -
- -
- -
- -
- -
- - - -
-
- -
- -
+ +
Your vault session has expired, so this login cannot be read or saved. Sign out and back in first.
+ +
- +
diff --git a/agent/modals/credential/credential_form.php b/agent/modals/credential/credential_form.php new file mode 100644 index 000000000..96c8292ce --- /dev/null +++ b/agent/modals/credential/credential_form.php @@ -0,0 +1,375 @@ + + + + +
+ + +
+
+ +
+ +
+ + +
+
Pick the asset and contact it belongs to once it's saved.
+
+ +
+ +
+ + > +
+
+
+ +
+ > + +
+
+
+ +
+ + +
+
+
+ +
+ + + + + +
+ Passphrase easy to read out + Random, 20 characters + Random, 32 characters +
+
+ +
+
+ +
+ + + +
+
Every agent who can see this credential gets the current code, so nobody needs the phone.
+
+
+ +
+ + + +
+
+
+ +
+ + + +
+
+
+
+ + +
+ +
+
+ +
+ + +
+
The device this login is for - it shows on the asset's Credentials tab.
+
+
+ +
+ + +
+
Whose login it is - it shows on their contact page.
+
+
+
Vendors and licenses link from the credential's quick look, or from the vendor or license itself.
+
+
+ +
Pick the client first - the asset and contact are theirs.
+ +
+ + +
+
+
+ +
+ + +
+
+
+ + +
+ + + + + +
+
+
+ +

Credential ID

+ +
+ + +
+ + +
Notes are not encrypted - keep recovery codes and second passwords in their own credential.
+
+ +
+ + diff --git a/agent/modals/credential/credential_rotate.php b/agent/modals/credential/credential_rotate.php new file mode 100644 index 000000000..4de046dde --- /dev/null +++ b/agent/modals/credential/credential_rotate.php @@ -0,0 +1,103 @@ + 'That credential no longer exists.']); + exit; +} +$client_id = intval($credential['credential_client_id']); +enforceClientAccess(); + +$age = credentialAge($credential['credential_password_changed_at']); +$vault_open = encryptCredentialEntry('') !== false; + +ob_start(); + +?> +
+
Change password:
+ +
+
+ + +
+ +
Your vault session has expired, so the new password cannot be encrypted. Sign out and back in first.
+ +
+ + + + +
+ +
+ + + + +
+ Passphrase + Random, 20 characters + Random, 32 characters +
+
+
Set it on the device or site first, then save it here - the old one is gone once you do.
+
+
+ + +
+
+ + + + 'That credential no longer exists.']); + exit; +} +$client_id = intval($credential['credential_client_id']); +enforceClientAccess(); + +// Who it might go to - the client's people with an email, or anyone typed in +$recipients = []; +$sql = mysqli_query($mysqli, "SELECT contact_id, contact_name, contact_email, contact_title, contact_photo, contact_client_id FROM contacts + WHERE contact_client_id = $client_id AND contact_email <> '' AND contact_archived_at IS NULL ORDER BY contact_name ASC"); +while ($row = mysqli_fetch_assoc($sql)) { + $recipients[] = $row; +} + +ob_start(); + +?> +
+
Share
+ +
+
+ + + +
+
+
+ +
+ + +
+
They get an email with the link. Leave it empty to just copy the link.
+
+ +
+ '1 hour', 24 => '1 day', 168 => '1 week', 730 => '1 month'] as $hours => $label) { ?> + > + + +
+
+ + +
+ + +
+ +
+
+ + +
+
+ + + + 'fas ' . softwareTypeStyle($row['software_type'])['icon'], 'description' => implode(' · ', array_filter([$row['software_license_type'], $seat_text, $row['software_version']]))]); case 'credential': - return selectOptionData(['icon' => 'fas fa-key', 'description' => $row['credential_description'] ?: $row['credential_uri']]); + return selectOptionCredential(['credential_name' => $row['name'], 'credential_description' => $row['credential_description'], 'credential_uri' => $row['credential_uri']], $row['credential_description'] ?: $row['credential_uri']); case 'location': return selectOptionData(['icon' => 'fas fa-' . (intval($row['location_primary']) ? 'building' : 'map-marker-alt'), 'description' => implode(' · ', array_filter([intval($row['location_primary']) ? 'Primary' : '', locationAddressText($row)]))]); case 'vendor': diff --git a/agent/modals/service/service.php b/agent/modals/service/service.php index 84ccc833d..20ed88f3b 100644 --- a/agent/modals/service/service.php +++ b/agent/modals/service/service.php @@ -34,25 +34,22 @@ if ($service_importance == "High") { $service_importance_display = "-"; } -// Associated Assets (and their credentials/networks/locations) +// Associated Assets (and their networks/locations) - one row each, their credentials come below $sql_assets = mysqli_query( $mysqli, "SELECT * FROM service_assets LEFT JOIN assets ON service_assets.asset_id = assets.asset_id LEFT JOIN asset_interfaces ON interface_asset_id = assets.asset_id AND interface_primary = 1 - LEFT JOIN credentials ON service_assets.asset_id = credentials.credential_asset_id LEFT JOIN networks ON interface_network_id = networks.network_id LEFT JOIN locations ON assets.asset_location_id = locations.location_id WHERE service_id = $service_id" ); -// Associated credentials -$sql_credentials = mysqli_query( - $mysqli, - "SELECT * FROM service_credentials - LEFT JOIN credentials ON service_credentials.credential_id = credentials.credential_id - WHERE service_id = $service_id" -); +// Its credentials - the ones linked to it and the ones on its assets - for those who may see credentials +$service_credentials = lookupUserPermission('module_credential') >= 1 + ? credentialRows("credential_client_id = $client_id AND (credential_id IN (SELECT credential_id FROM service_credentials WHERE service_id = $service_id) + OR credential_asset_id IN (SELECT asset_id FROM service_assets WHERE service_id = $service_id))") + : []; // Associated Domains $sql_domains = mysqli_query( @@ -247,34 +244,15 @@ ob_start(); ?> - 0 || mysqli_num_rows($sql_credentials) > 0) { - echo "
Credentials
    "; - // Credentials linked to assets - mysqli_data_seek($sql_assets, 0); - while ($row = mysqli_fetch_assoc($sql_assets)) { - $credential_name = escapeHtml($row['credential_name']); - if (!empty($credential_name)) { - echo "
  • $credential_name
    • "; - } - } - // Explicitly linked credentials - mysqli_data_seek($sql_credentials, 0); - while ($row = mysqli_fetch_assoc($sql_credentials)) { - $credential_name = escapeHtml($row['credential_name']); - if (!empty($credential_name)) { - echo "
  • $credential_name
    • "; - } - } - echo "
"; - } - ?> + +
Credentials
+
+ = 1; $holders = softwareSeatHolders($software_id); $keys = softwareKeys($software_id); -$credentials = $can_credentials ? linkedRecords('software', $software_id, 'credential') : []; +$credentials = $can_credentials ? credentialRows("credential_id IN (SELECT credential_id FROM software_credentials WHERE software_id = $software_id)") : []; $documents = linkedRecords('software', $software_id, 'document'); $files = linkedRecords('software', $software_id, 'file'); @@ -216,31 +216,8 @@ ob_start();
-
- - - - - - - - - - -
- - - - - - -
-
+
- - ['document', $documents], 'files' => ['file', $files]] as $pane => [$to, $linked]) { diff --git a/agent/post/asset.php b/agent/post/asset.php index f7c3480d5..dfc4a3a6b 100644 --- a/agent/post/asset.php +++ b/agent/post/asset.php @@ -72,17 +72,26 @@ if (isset($_POST['add_asset'])) { // Add Primary Interface mysqli_query($mysqli,"INSERT INTO asset_interfaces SET interface_name = '01', interface_mac = '$mac', interface_ip = '$ip', interface_nat_ip = '$nat_ip', interface_ipv6 = '$ipv6', interface_primary = 1, interface_network_id = $network, interface_asset_id = $asset_id"); - if (!empty($_POST['password'])) { - $username = trim(mysqli_real_escape_string($mysqli, encryptCredentialEntry($_POST['username']))); - $password = trim(mysqli_real_escape_string($mysqli, encryptCredentialEntry($_POST['password']))); + // A username or a password on its own is enough to keep + if (trim((string) ($_POST['username'] ?? '')) !== '' || trim((string) ($_POST['password'] ?? '')) !== '') { + $username = encryptCredentialEntry(trim((string) ($_POST['username'] ?? ''))); + $password = encryptCredentialEntry(trim((string) ($_POST['password'] ?? ''))); - mysqli_query($mysqli,"INSERT INTO credentials SET credential_name = '$name', credential_username = '$username', credential_password = '$password', credential_asset_id = $asset_id, credential_client_id = $client_id"); + // A vault session that didn't open encrypts to nothing - better no login than one that can never be read + if ($username === false || $password === false) { + $alert_extended = ", but not its login - your vault session has expired, so sign in again and add it from the asset"; + } else { + $username = escapeSql($username); + $password = escapeSql($password); - $credential_id = mysqli_insert_id($mysqli); + mysqli_query($mysqli,"INSERT INTO credentials SET credential_name = '$name', credential_username = '$username', credential_password = '$password', credential_password_changed_at = NOW(), credential_asset_id = $asset_id, credential_client_id = $client_id"); - logAudit("Credential", "Create", "$session_name created login credential for asset $name", $client_id, $credential_id); + $credential_id = mysqli_insert_id($mysqli); - $alert_extended = " along with login credentials"; + logAudit("Credential", "Create", "$session_name created login credential for asset $name", $client_id, $credential_id); + + $alert_extended = " along with login credentials"; + } } @@ -91,7 +100,7 @@ if (isset($_POST['add_asset'])) { logAudit("Asset", "Create", "$session_name created asset $name", $client_id, $asset_id); - flashAlert("Asset $name created $alert_extended"); + flashAlert("Asset $name created$alert_extended"); redirect(); @@ -256,6 +265,9 @@ if (isset($_GET['delete_asset'])) { // Out of whatever rack it was in - an item pointing at a deleted asset draws as nothing mysqli_query($mysqli,"DELETE FROM rack_units WHERE unit_asset_id = $asset_id"); + // Its logins stay with the client, no longer pointing at an asset that is gone + credentialsForget('asset', $asset_id); + logAudit("Asset", "Delete", "$session_name deleted asset $asset_name", $client_id); flashAlert("Asset $asset_name deleted"); @@ -841,6 +853,7 @@ if (isset($_POST['bulk_delete_assets'])) { mysqli_query($mysqli,"DELETE FROM assets WHERE asset_id = $asset_id"); mysqli_query($mysqli,"DELETE FROM rack_units WHERE unit_asset_id = $asset_id"); + credentialsForget('asset', $asset_id); logAudit("Asset", "Delete", "$session_name deleted asset $asset_name", $client_id, $asset_id); } @@ -864,6 +877,8 @@ if (isset($_POST['link_asset_to_credential'])) { validateCSRFToken(); enforceUserPermission('module_support', 2); + // It changes the credential, so it takes credential edit rights too + enforceUserPermission('module_credential', 2); $credential_id = intval($_POST['credential_id']); $asset_id = intval($_POST['asset_id']); @@ -871,11 +886,21 @@ if (isset($_POST['link_asset_to_credential'])) { // Get credential Name and Client ID for logging $sql_credential = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id"); $row = mysqli_fetch_assoc($sql_credential); + if (!$row) { + flashAlert("That credential no longer exists", 'error'); + redirect(); + } $credential_name = escapeSql($row['credential_name']); $client_id = intval($row['credential_client_id']); enforceClientAccess(); + // Only to one of the same client's assets + if (!assetClientOwnedId('asset', $asset_id, $client_id)) { + flashAlert("That asset isn't one of this client's", 'error'); + redirect(); + } + // Get Asset Name for logging $asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name')); @@ -894,6 +919,7 @@ if (isset($_GET['unlink_credential_from_asset'])) { validateCSRFToken(); enforceUserPermission('module_support', 2); + enforceUserPermission('module_credential', 2); $asset_id = intval($_GET['asset_id']); $credential_id = intval($_GET['credential_id']); @@ -909,11 +935,12 @@ if (isset($_GET['unlink_credential_from_asset'])) { // Get Asset Name for logging $asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name')); - mysqli_query($mysqli,"UPDATE credentials SET credential_asset_id = 0 WHERE credential_id = $credential_id"); + // Only if it is this asset's - an old link can't unpick a newer one + mysqli_query($mysqli,"UPDATE credentials SET credential_asset_id = 0 WHERE credential_id = $credential_id AND credential_asset_id = $asset_id"); logAudit("Credential", "Unlink", "$session_name unlinked asset $asset_name from credential $credential_name", $client_id, $credential_id); - flashAlert("Credential $credential_name unlinked from Asset $asset_name", 'errpr'); + flashAlert("Credential $credential_name unlinked from Asset $asset_name"); redirect(); diff --git a/agent/post/contact.php b/agent/post/contact.php index 96db39d70..52a163ca0 100644 --- a/agent/post/contact.php +++ b/agent/post/contact.php @@ -713,6 +713,7 @@ if (isset($_POST['bulk_delete_contacts'])) { } mysqli_query($mysqli, "DELETE FROM contacts WHERE contact_id = $contact_id AND contact_client_id = $client_id"); + credentialsForget('contact', $contact_id); logAudit("Contact", "Delete", "$session_name deleted $contact_name", $client_id); @@ -922,6 +923,9 @@ if (isset($_GET['delete_contact'])) { mysqli_query($mysqli,"DELETE FROM contacts WHERE contact_id = $contact_id"); + // Their logins stay with the client, no longer pointing at a contact that is gone + credentialsForget('contact', $contact_id); + logAudit("Contact", "Delete", "$session_name deleted contact $contact_name", $client_id); flashAlert("Contact $contact_name has been deleted.", 'error'); @@ -997,6 +1001,8 @@ if (isset($_POST['link_contact_to_credential'])) { validateCSRFToken(); enforceUserPermission('module_client', 2); + // It changes the credential, so it takes credential edit rights too + enforceUserPermission('module_credential', 2); $credential_id = intval($_POST['credential_id']); $contact_id = intval($_POST['contact_id']); @@ -1004,17 +1010,27 @@ if (isset($_POST['link_contact_to_credential'])) { // Get credential Name and Client ID for logging $sql_credential = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id"); $row = mysqli_fetch_assoc($sql_credential); + if (!$row) { + flashAlert("That credential no longer exists", 'error'); + redirect(); + } $credential_name = escapeSql($row['credential_name']); $client_id = intval($row['credential_client_id']); enforceClientAccess(); + // Only to one of the same client's people + if (!assetClientOwnedId('contact', $contact_id, $client_id)) { + flashAlert("That contact isn't one of this client's", 'error'); + redirect(); + } + // Get Contact Name for logging $contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name')); mysqli_query($mysqli,"UPDATE credentials SET credential_contact_id = $contact_id WHERE credential_id = $credential_id"); - logAudit("Asset", "Link", "$session_name linked credential $credential_name to contact $contact_name", $client_id, $credential_id); + logAudit("Credential", "Link", "$session_name linked credential $credential_name to contact $contact_name", $client_id, $credential_id); flashAlert("Contact $contact_name linked with credential $credential_name"); @@ -1027,6 +1043,7 @@ if (isset($_GET['unlink_credential_from_contact'])) { validateCSRFToken(); enforceUserPermission('module_client', 2); + enforceUserPermission('module_credential', 2); $contact_id = intval($_GET['contact_id']); $credential_id = intval($_GET['credential_id']); @@ -1042,11 +1059,12 @@ if (isset($_GET['unlink_credential_from_contact'])) { // Get Contact Name for logging $contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name')); - mysqli_query($mysqli,"UPDATE credentials SET credential_contact_id = 0 WHERE credential_id = $credential_id"); + // Only if it is this contact's - an old link can't unpick a newer one + mysqli_query($mysqli,"UPDATE credentials SET credential_contact_id = 0 WHERE credential_id = $credential_id AND credential_contact_id = $contact_id"); logAudit("Credential", "Unlink", "$session_name unlinked contact $contact_name from credential $credential_name", $client_id, $credential_id); - flashAlert("Credential $credential_name unlinked from Contact $contact_name", 'error'); + flashAlert("Credential $credential_name unlinked from Contact $contact_name"); redirect(); diff --git a/agent/post/credential.php b/agent/post/credential.php index ae7c18a20..6a1f6548e 100644 --- a/agent/post/credential.php +++ b/agent/post/credential.php @@ -2,41 +2,82 @@ /* * ITFlow - GET/POST request handler for client credentials + * + * Every handler checks the credential module and the credential's own client; + * anything a form names - the asset, the contact, the tags, a vendor to link + * to - must be that client's. Usernames and passwords are encrypted with the + * session's vault key (credentialFormSet() in functions/credential.php), and + * nothing is saved when the vault did not open, rather than writing an empty + * password over the real one. Vendors and licenses link through post/link.php. */ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); +/** The credential a request names, after the module and client checks - or back with an error if it is gone. */ +function credentialForRequest($credential_id, $level) { + global $client_id; + enforceUserPermission('module_credential', $level); + $row = credentialRow($credential_id); + if (!$row) { + flashAlert('That credential no longer exists.', 'error'); + redirect(); + } + $client_id = intval($row['credential_client_id']); + enforceClientAccess(); + return $row; +} + +/** The credentials a bulk action names that this agent may act on - [id => row]. */ +function credentialsForBulk($level) { + global $client_id; + enforceUserPermission('module_credential', $level); + $rows = []; + foreach (array_unique(array_map('intval', (array) ($_POST['credential_ids'] ?? []))) as $credential_id) { + $row = credentialRow($credential_id); + if (!$row) { + continue; + } + $client_id = intval($row['credential_client_id']); + enforceClientAccess(); + $rows[$credential_id] = $row; + } + return $rows; +} + if (isset($_POST['add_credential'])) { validateCSRFToken(); enforceUserPermission('module_credential', 2); - require_once 'credential_model.php'; - - $client_id = intval($_POST['client_id']); + $client_id = intval($_POST['client_id'] ?? 0); enforceClientAccess(); - mysqli_query($mysqli,"INSERT INTO credentials SET credential_name = '$name', credential_description = '$description', credential_uri = '$uri', credential_uri_2 = '$uri_2', credential_username = '$username', credential_password = '$password', credential_otp_secret = '$otp_secret', credential_note = '$note', credential_favorite = $favorite, credential_contact_id = $contact_id, credential_asset_id = $asset_id, credential_client_id = $client_id"); + if (!$client_id || !getFieldById('clients', $client_id, 'client_name')) { + flashAlert('Pick the client this credential is for.', 'error'); + redirect(); + } + $set = credentialFormSet($_POST, $client_id, $error); + if ($set === null) { + flashAlert($error, 'error'); + redirect(); + } + + mysqli_query($mysqli, "INSERT INTO credentials SET $set, credential_password_changed_at = NOW(), credential_client_id = $client_id"); $credential_id = mysqli_insert_id($mysqli); + credentialSetTags($credential_id, $_POST['tags'] ?? []); + // Made from a vendor's page - linked to that vendor, if it is the same client's $vendor_id = assetClientOwnedId('vendor', $_POST['vendor_id'] ?? 0, $client_id); if ($vendor_id) { mysqli_query($mysqli, "INSERT IGNORE INTO vendor_credentials SET vendor_id = $vendor_id, credential_id = $credential_id"); } - // Add Tags - if (isset($_POST['tags'])) { - foreach($_POST['tags'] as $tag) { - $tag = intval($tag); - mysqli_query($mysqli, "INSERT INTO credential_tags SET credential_id = $credential_id, tag_id = $tag"); - } - } - - logAudit("Credential", "Create", "$session_name created credential $name", $client_id, $credential_id); + $name = trim($_POST['name']); + logAudit("Credential", "Create", "$session_name created credential " . escapeSql($name), $client_id, $credential_id); flashAlert("Credential $name created"); @@ -48,94 +89,112 @@ if (isset($_POST['edit_credential'])) { validateCSRFToken(); - enforceUserPermission('module_credential', 2); + $row = credentialForRequest($_POST['credential_id'] ?? 0, 2); + $credential_id = intval($row['credential_id']); - require_once 'credential_model.php'; - - $credential_id = intval($_POST['credential_id']); - - $client_id = intval(getFieldById('credentials', $credential_id, 'credential_client_id')); - - enforceClientAccess(); - - // Determine if the password has actually changed (salt is rotated on all updates, so have to dencrypt both and compare) - $current_password = decryptCredentialEntry(mysqli_fetch_row(mysqli_query($mysqli, "SELECT credential_password FROM credentials WHERE credential_id = $credential_id"))[0]); // Get current credential password - $new_password = decryptCredentialEntry($password); // Get the new password being set (already encrypted by the credential model) - if ($current_password !== $new_password) { - // The password has been changed - update the DB to track - mysqli_query($mysqli, "UPDATE credentials SET credential_password_changed_at = NOW() WHERE credential_id = $credential_id"); + $set = credentialFormSet($_POST, $client_id, $error); + if ($set === null) { + flashAlert($error, 'error'); + redirect(); } - // Update the credential entry with the new details - mysqli_query($mysqli,"UPDATE credentials SET credential_name = '$name', credential_description = '$description', credential_uri = '$uri', credential_uri_2 = '$uri_2', credential_username = '$username', credential_password = '$password', credential_otp_secret = '$otp_secret', credential_note = '$note', credential_favorite = $favorite, credential_contact_id = $contact_id, credential_asset_id = $asset_id WHERE credential_id = $credential_id"); + // Changed password - record when, for the rotation report and the age shown everywhere + $password_changed = trim((string) ($_POST['password'] ?? '')) !== (string) decryptCredentialEntry($row['credential_password']); - // Tags - // Delete existing tags - mysqli_query($mysqli, "DELETE FROM credential_tags WHERE credential_id = $credential_id"); + mysqli_query($mysqli, "UPDATE credentials SET $set" . ($password_changed ? ", credential_password_changed_at = NOW()" : '') . " WHERE credential_id = $credential_id"); - // Add new tags - if(isset($_POST['tags'])) { - foreach($_POST['tags'] as $tag) { - $tag = intval($tag); - mysqli_query($mysqli, "INSERT INTO credential_tags SET credential_id = $credential_id, tag_id = $tag"); - } + // Only a form that showed the tags changes them + if (isset($_POST['tags_form'])) { + credentialSetTags($credential_id, $_POST['tags'] ?? []); } - logAudit("Credential", "Edit", "$session_name edited credential $name", $client_id, $credential_id); + $name = trim($_POST['name']); + logAudit("Credential", "Edit", "$session_name edited credential " . escapeSql($name) . ($password_changed ? ' and changed its password' : ''), $client_id, $credential_id); - flashAlert("Credential $name edited"); + flashAlert("Credential $name updated"); redirect(); } -if(isset($_GET['archive_credential'])){ +// A new password and nothing else - the rotation +if (isset($_POST['rotate_credential'])) { validateCSRFToken(); - enforceUserPermission('module_credential', 2); + $row = credentialForRequest($_POST['credential_id'] ?? 0, 2); + $credential_id = intval($row['credential_id']); - $credential_id = intval($_GET['archive_credential']); + $password = trim((string) ($_POST['password'] ?? '')); + if ($password === '') { + flashAlert('Type or make up the new password.', 'error'); + redirect(); + } + if (checkCredentialLengths(['password' => $password])) { + flashAlert('That password is too long to store.', 'error'); + redirect(); + } + $encrypted = encryptCredentialEntry($password); + if ($encrypted === false) { + flashAlert('Your vault session has expired, so the password could not be encrypted - sign out and back in, then try again.', 'error'); + redirect(); + } - // Get Name and Client ID for logging and alert message - $sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id"); - $row = mysqli_fetch_assoc($sql); - $credential_name = escapeSql($row['credential_name']); - $client_id = intval($row['credential_client_id']); + mysqli_query($mysqli, "UPDATE credentials SET credential_password = '" . escapeSql($encrypted) . "', credential_password_changed_at = NOW() WHERE credential_id = $credential_id"); - enforceClientAccess(); + logAudit("Credential", "Rotate", "$session_name changed the password on credential " . escapeSql($row['credential_name']), $client_id, $credential_id); - mysqli_query($mysqli,"UPDATE credentials SET credential_archived_at = NOW() WHERE credential_id = $credential_id"); - - logAudit("Credential", "Archive", "$session_name archived credential $credential_name", $client_id, $credential_id); - - flashAlert("Credential $credential_name archived", 'error'); + flashAlert("Password changed on {$row['credential_name']}"); redirect(); } -if(isset($_GET['restore_credential'])){ +if (isset($_GET['favorite_credential']) || isset($_GET['unfavorite_credential'])) { validateCSRFToken(); - enforceUserPermission('module_credential', 2); + $favorite = isset($_GET['favorite_credential']) ? 1 : 0; + $row = credentialForRequest($favorite ? $_GET['favorite_credential'] : $_GET['unfavorite_credential'], 2); + $credential_id = intval($row['credential_id']); - $credential_id = intval($_GET['restore_credential']); + mysqli_query($mysqli, "UPDATE credentials SET credential_favorite = $favorite WHERE credential_id = $credential_id"); - // Get Name and Client ID for logging and alert message - $sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id"); - $row = mysqli_fetch_assoc($sql); - $credential_name = escapeSql($row['credential_name']); - $client_id = intval($row['credential_client_id']); + logAudit("Credential", "Edit", "$session_name " . ($favorite ? 'starred' : 'unstarred') . " credential " . escapeSql($row['credential_name']), $client_id, $credential_id); - enforceClientAccess(); + redirect(); - mysqli_query($mysqli,"UPDATE credentials SET credential_archived_at = NULL WHERE credential_id = $credential_id"); +} - logAudit("Credential", "Restore", "$session_name restored credential $credential_name", $client_id, $credential_id); +if (isset($_GET['archive_credential'])) { - flashAlert("Credential $credential_name restored"); + validateCSRFToken(); + + $row = credentialForRequest($_GET['archive_credential'], 2); + $credential_id = intval($row['credential_id']); + + mysqli_query($mysqli, "UPDATE credentials SET credential_archived_at = NOW() WHERE credential_id = $credential_id"); + + logAudit("Credential", "Archive", "$session_name archived credential " . escapeSql($row['credential_name']), $client_id, $credential_id); + + flashAlert("Credential {$row['credential_name']} archived", 'error'); + + redirect(); + +} + +if (isset($_GET['restore_credential'])) { + + validateCSRFToken(); + + $row = credentialForRequest($_GET['restore_credential'], 2); + $credential_id = intval($row['credential_id']); + + mysqli_query($mysqli, "UPDATE credentials SET credential_archived_at = NULL WHERE credential_id = $credential_id"); + + logAudit("Credential", "Restore", "$session_name restored credential " . escapeSql($row['credential_name']), $client_id, $credential_id); + + flashAlert("Credential {$row['credential_name']} restored"); redirect(); @@ -145,99 +204,31 @@ if (isset($_GET['delete_credential'])) { validateCSRFToken(); - enforceUserPermission('module_credential', 3); + $row = credentialForRequest($_GET['delete_credential'], 3); - $credential_id = intval($_GET['delete_credential']); + credentialDeleteForGood($row['credential_id']); - // Get Credential Name and Client ID for logging and alert message - $sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id"); - $row = mysqli_fetch_assoc($sql); - $credential_name = escapeSql($row['credential_name']); - $client_id = intval($row['credential_client_id']); + logAudit("Credential", "Delete", "$session_name deleted credential " . escapeSql($row['credential_name']), $client_id); - enforceClientAccess(); - - mysqli_query($mysqli,"DELETE FROM credentials WHERE credential_id = $credential_id"); - - logAudit("Credential", "Delete", "$session_name deleted credential $credential_name", $client_id); - - flashAlert("Credential $credential_name deleted", 'error'); + flashAlert("Credential {$row['credential_name']} deleted", 'error'); redirect(); } -if (isset($_POST['bulk_favorite_credentials'])) { +if (isset($_POST['bulk_favorite_credentials']) || isset($_POST['bulk_unfavorite_credentials'])) { validateCSRFToken(); - enforceUserPermission('module_support', 2); - - if (isset($_POST['credential_ids'])) { - - $count = count($_POST['credential_ids']); - - foreach ($_POST['credential_ids'] as $credential_id) { - - $credential_id = intval($credential_id); - - // Get Asset Name and Client ID for logging and alert message - $sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id"); - $row = mysqli_fetch_assoc($sql); - $credential_name = escapeSql($row['credential_name']); - $client_id = intval($row['credential_client_id']); - - enforceClientAccess(); - - mysqli_query($mysqli,"UPDATE credentials SET credential_favorite = 1 WHERE credential_id = $credential_id"); - - logAudit("Credential", "Edit", "$session_name marked credential $credential_name a favorite", $client_id, $credential_id); - - } - - logAudit("Credential", "Bulk Edit", "$session_name favorited $count credentials", $client_id); - - flashAlert("Favorited $count credential(s)"); - + $favorite = isset($_POST['bulk_favorite_credentials']) ? 1 : 0; + $count = 0; + foreach (credentialsForBulk(2) as $credential_id => $row) { + mysqli_query($mysqli, "UPDATE credentials SET credential_favorite = $favorite WHERE credential_id = $credential_id"); + logAudit("Credential", "Edit", "$session_name " . ($favorite ? 'starred' : 'unstarred') . " credential " . escapeSql($row['credential_name']), intval($row['credential_client_id']), $credential_id); + $count++; } - redirect(); - -} - -if (isset($_POST['bulk_unfavorite_credentials'])) { - - validateCSRFToken(); - - enforceUserPermission('module_support', 2); - - if (isset($_POST['credential_ids'])) { - - $count = count($_POST['credential_ids']); - - foreach ($_POST['credential_ids'] as $credential_id) { - - $credential_id = intval($credential_id); - - // Get Asset Name and Client ID for logging and alert message - $sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id"); - $row = mysqli_fetch_assoc($sql); - $credential_name = escapeSql($row['credential_name']); - $client_id = intval($row['credential_client_id']); - - enforceClientAccess(); - - mysqli_query($mysqli,"UPDATE credentials SET credential_favorite = 0 WHERE credential_id = $credential_id"); - - logAudit("Credential", "Edit", "$session_name unfavorited credential $credential_name", $client_id, $credential_id); - - } - - logAudit("Crednetial", "Bulk Edit", "$session_name unfavorited $count credentials", $client_id); - - flashAlert("Unfavorited $count credential(s)"); - - } + flashAlert(($favorite ? 'Starred' : 'Unstarred') . " $count credential" . ($count === 1 ? '' : 's')); redirect(); @@ -247,37 +238,15 @@ if (isset($_POST['bulk_archive_credentials'])) { validateCSRFToken(); - enforceUserPermission('module_credential', 2); - - if (isset($_POST['credential_ids'])) { - - // Get Selected Credential Count - $count = count($_POST['credential_ids']); - - // Cycle through array and archive each record - foreach ($_POST['credential_ids'] as $credential_id) { - - $credential_id = intval($credential_id); - - // Get Name and Client ID for logging and alert message - $sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id"); - $row = mysqli_fetch_assoc($sql); - $credential_name = escapeSql($row['credential_name']); - $client_id = intval($row['credential_client_id']); - - enforceClientAccess(); - - mysqli_query($mysqli,"UPDATE credentials SET credential_archived_at = NOW() WHERE credential_id = $credential_id"); - - logAudit("Credential", "Archive", "$session_name archived credential $credential_name", $client_id, $credential_id); - } - - logAudit("Credential", "Bulk Archive", "$session_name archived $count credentials", $client_id); - - flashAlert("Archived $count credential(s)", 'error'); - + $count = 0; + foreach (credentialsForBulk(2) as $credential_id => $row) { + mysqli_query($mysqli, "UPDATE credentials SET credential_archived_at = NOW() WHERE credential_id = $credential_id"); + logAudit("Credential", "Archive", "$session_name archived credential " . escapeSql($row['credential_name']), intval($row['credential_client_id']), $credential_id); + $count++; } + flashAlert("Archived $count credential" . ($count === 1 ? '' : 's'), 'error'); + redirect(); } @@ -286,38 +255,15 @@ if (isset($_POST['bulk_restore_credentials'])) { validateCSRFToken(); - enforceUserPermission('module_credential', 2); - - if (isset($_POST['credential_ids'])) { - - // Get Selected Credential Count - $count = count($_POST['credential_ids']); - - // Cycle through array and restore - foreach ($_POST['credential_ids'] as $credential_id) { - - $credential_id = intval($credential_id); - - // Get Name and Client ID for logging and alert message - $sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id"); - $row = mysqli_fetch_assoc($sql); - $credential_name = escapeSql($row['credential_name']); - $client_id = intval($row['credential_client_id']); - - enforceClientAccess(); - - mysqli_query($mysqli,"UPDATE credentials SET credential_archived_at = NULL WHERE credential_id = $credential_id"); - - logAudit("Credential", "Restore", "$session_name restored credential $credential_name", $client_id, $credential_id); - - } - - logAudit("Credential", "Bulk Restore", "$session_name restored $count credential(s)", $client_id); - - flashAlert("Restored $count credential(s)"); - + $count = 0; + foreach (credentialsForBulk(2) as $credential_id => $row) { + mysqli_query($mysqli, "UPDATE credentials SET credential_archived_at = NULL WHERE credential_id = $credential_id"); + logAudit("Credential", "Restore", "$session_name restored credential " . escapeSql($row['credential_name']), intval($row['credential_client_id']), $credential_id); + $count++; } + flashAlert("Restored $count credential" . ($count === 1 ? '' : 's')); + redirect(); } @@ -326,38 +272,15 @@ if (isset($_POST['bulk_delete_credentials'])) { validateCSRFToken(); - enforceUserPermission('module_credential', 3); - - if (isset($_POST['credential_ids'])) { - - // Get Selected Credential Count - $count = count($_POST['credential_ids']); - - // Cycle through array and delete each record - foreach ($_POST['credential_ids'] as $credential_id) { - - $credential_id = intval($credential_id); - - // Get Name and Client ID for logging and alert message - $sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id"); - $row = mysqli_fetch_assoc($sql); - $credential_name = escapeSql($row['credential_name']); - $client_id = intval($row['credential_client_id']); - - enforceClientAccess(); - - mysqli_query($mysqli, "DELETE FROM credentials WHERE credential_id = $credential_id AND credential_client_id = $client_id"); - - logAudit("Credential", "Delete", "$session_name deleted credential $credential_name", $client_id); - - } - - logAudit("Credential", "Bulk Delete", "$session_name deleted $count credential(s)", $client_id); - - flashAlert("Deleted $count credential(s)", 'error'); - + $count = 0; + foreach (credentialsForBulk(3) as $credential_id => $row) { + credentialDeleteForGood($credential_id); + logAudit("Credential", "Delete", "$session_name deleted credential " . escapeSql($row['credential_name']), intval($row['credential_client_id'])); + $count++; } + flashAlert("Deleted $count credential" . ($count === 1 ? '' : 's'), 'error'); + redirect(); } @@ -405,10 +328,11 @@ if (isExportRequest('export_credentials')) { $archive_query = $archived ? "(client_archived_at IS NOT NULL OR credential_archived_at IS NOT NULL)" : "(client_archived_at IS NULL AND credential_archived_at IS NULL)"; } - // Tags Filter + // Tags Filter - a credential with any of them + $tag_query = ''; if (isset($_POST['tags']) && is_array($_POST['tags']) && !empty($_POST['tags'])) { $tag_filter = implode(",", array_map('intval', $_POST['tags'])); - $tag_query = "AND tags.tag_id IN ($tag_filter)"; + $tag_query = "AND c.credential_id IN (SELECT credential_id FROM credential_tags WHERE tag_id IN ($tag_filter))"; $tag_names = []; $sql_tags = mysqli_query($mysqli, "SELECT tag_name FROM tags WHERE tag_id IN ($tag_filter) ORDER BY tag_name ASC"); @@ -416,9 +340,6 @@ if (isExportRequest('export_credentials')) { $tag_names[] = $tag_row['tag_name']; } $filter_summary['Tags'] = implode(', ', $tag_names); - } else { - // Default - any - $tag_query = ''; } // Search Filter @@ -429,20 +350,20 @@ if (isExportRequest('export_credentials')) { $sql = mysqli_query( $mysqli, - "SELECT c.*, clients.*, contacts.*, assets.* + "SELECT c.*, client_name, contact_name, asset_name, + (SELECT GROUP_CONCAT(tag_name ORDER BY tag_name SEPARATOR ', ') FROM credential_tags ct JOIN tags t ON t.tag_id = ct.tag_id WHERE ct.credential_id = c.credential_id) AS credential_tags, + DATE(c.credential_password_changed_at) AS credential_password_changed FROM credentials c - LEFT JOIN credential_tags ON credential_tags.credential_id = c.credential_id - LEFT JOIN tags ON tags.tag_id = credential_tags.tag_id LEFT JOIN clients ON client_id = credential_client_id LEFT JOIN contacts ON contact_id = credential_contact_id LEFT JOIN assets ON asset_id = credential_asset_id WHERE $archive_query $tag_query - AND (c.credential_name LIKE '%$q%' OR c.credential_description LIKE '%$q%' OR c.credential_uri LIKE '%$q%' OR tag_name LIKE '%$q%' OR client_name LIKE '%$q%') + AND (c.credential_name LIKE '%$q%' OR c.credential_description LIKE '%$q%' OR c.credential_uri LIKE '%$q%' OR c.credential_note LIKE '%$q%' OR client_name LIKE '%$q%' + OR c.credential_id IN (SELECT credential_id FROM credential_tags JOIN tags USING (tag_id) WHERE tag_name LIKE '%$q%')) " . clientScopeSql('credential_client_id') . " $client_query - GROUP BY c.credential_id - ORDER BY c.credential_name ASC" + ORDER BY client_name ASC, c.credential_name ASC" ); $num_rows = mysqli_num_rows($sql); @@ -478,111 +399,80 @@ if (isset($_POST["import_credentials_csv"])) { enforceClientAccess(); - $error = false; - - if (!empty($_FILES["file"]["tmp_name"])) { - $file_name = $_FILES["file"]["tmp_name"]; - } else { + if (empty($_FILES["file"]["tmp_name"])) { flashAlert("Please select a file to upload.", 'error'); redirect(); } + $file_name = $_FILES["file"]["tmp_name"]; - //Check file is CSV - $file_extension = strtolower(end(explode('.',$_FILES['file']['name']))); - $allowed_file_extensions = array('csv'); - if (in_array($file_extension,$allowed_file_extensions) === false){ - $error = true; + if (strtolower(pathinfo((string) $_FILES['file']['name'], PATHINFO_EXTENSION)) !== 'csv') { flashAlert("Bad file extension", 'error'); + redirect(); } - - //Check file isn't empty - elseif ($_FILES["file"]["size"] < 1){ - $error = true; + if ($_FILES["file"]["size"] < 1) { flashAlert("Bad file size (empty?)", 'error'); + redirect(); } - //(Else)Check column count - $f = fopen($file_name, "r"); - $f_columns = fgetcsv($f, 1000, ","); - if (!$error & count($f_columns) != 6) { - $error = true; - flashAlert("Bad column count.", 'error'); - } - - //Else, parse the file - if (!$error){ - $file = fopen($file_name, "r"); - fgetcsv($file, 1000, ","); // Skip first line - $row_count = 0; - $duplicate_count = 0; - $too_long_count = 0; - while(($column = fgetcsv($file, 1000, ",")) !== false){ - $duplicate_detect = 0; - - // Nothing client-side guards an uploaded file, and an overlong value is a hard - // MySQL error - skip the row and report it rather than losing the whole import - if (checkCredentialLengths([ - 'name' => $column[0] ?? null, - 'description' => $column[1] ?? null, - 'username' => $column[2] ?? null, - 'password' => $column[3] ?? null, - 'otp_secret' => $column[4] ?? null, - 'uri' => $column[5] ?? null, - ])) { - $too_long_count = $too_long_count + 1; - continue; - } - - // Name - if (isset($column[0])) { - $name = escapeSql($column[0]); - if (mysqli_num_rows(mysqli_query($mysqli,"SELECT 1 FROM credentials WHERE credential_name = '$name' AND credential_client_id = $client_id")) > 0){ - $duplicate_detect = 1; - } - } - // Desc - if (isset($column[1])) { - $description = escapeSql($column[1]); - } - // User - if (isset($column[2])) { - $username = escapeSql(encryptCredentialEntry($column[2])); - } - // Pass - if (isset($column[3])) { - $password = escapeSql(encryptCredentialEntry($column[3])); - } - // OTP - if (isset($column[4])) { - $totp = escapeSql($column[4]); - } - // URL - if (isset($column[5])) { - $uri = escapeSql($column[5]); - } - - // Check if duplicate was detected - if ($duplicate_detect == 0){ - //Add - mysqli_query($mysqli,"INSERT INTO credentials SET credential_name = '$name', credential_description = '$description', credential_uri = '$uri', credential_username = '$username', credential_password = '$password', credential_otp_secret = '$totp', credential_client_id = $client_id"); - $row_count = $row_count + 1; - } else { - $duplicate_count = $duplicate_count + 1; - } - } + $file = fopen($file_name, "r"); + $f_columns = fgetcsv($file, 1000, ","); + if (!is_array($f_columns) || count($f_columns) != 6) { fclose($file); - - logAudit("Credential", "Import", "$session_name imported $row_count credential(s) via CSV file. $duplicate_count duplicate(s) found and not imported, $too_long_count row(s) skipped for over-length fields", $client_id); - - flashAlert("$row_count credential(s) imported, $duplicate_count duplicate(s) detected and not imported, $too_long_count row(s) skipped for over-length fields", 'warning'); - + flashAlert("Bad column count.", 'error'); redirect(); } - //Check for any errors, if there are notify user and redirect - if ($error) { + + // The vault must be open, or every imported password would be saved empty + if (encryptCredentialEntry('') === false) { + fclose($file); + flashAlert('Your vault session has expired, so nothing could be encrypted - sign out and back in, then import again.', 'error'); redirect(); } + $row_count = $duplicate_count = $too_long_count = $bad_otp_count = 0; + while (($column = fgetcsv($file, 1000, ",")) !== false) { + // Every row stands alone - a column missing on one row must not take the last row's value + $column = array_pad($column, 6, ''); + [$name, $description, $username, $password, $totp, $uri] = array_map(function ($value) { + return trim((string) $value); + }, array_slice($column, 0, 6)); + + if ($name === '') { + continue; + } + + // Nothing client-side guards an uploaded file, and an overlong value is a hard + // MySQL error - skip the row and report it rather than losing the whole import + if (checkCredentialLengths(['name' => $name, 'description' => $description, 'username' => $username, 'password' => $password, 'otp_secret' => $totp, 'uri' => $uri])) { + $too_long_count++; + continue; + } + + $otp = credentialOtpSeed($totp); + if ($otp === false) { + $bad_otp_count++; + $otp = ''; + } + + $name_sql = escapeSql($name); + if (mysqli_num_rows(mysqli_query($mysqli, "SELECT 1 FROM credentials WHERE credential_name = '$name_sql' AND credential_client_id = $client_id"))) { + $duplicate_count++; + continue; + } + + mysqli_query($mysqli, "INSERT INTO credentials SET credential_name = '$name_sql', credential_description = '" . escapeSql($description) . "', credential_uri = '" . escapeSql($uri) . "', + credential_username = '" . escapeSql(encryptCredentialEntry($username)) . "', credential_password = '" . escapeSql(encryptCredentialEntry($password)) . "', + credential_otp_secret = '" . escapeSql($otp) . "', credential_password_changed_at = NOW(), credential_client_id = $client_id"); + $row_count++; + } + fclose($file); + + logAudit("Credential", "Import", "$session_name imported $row_count credential(s) via CSV file. $duplicate_count duplicate(s) found and not imported, $too_long_count row(s) skipped for over-length fields", $client_id); + + flashAlert("$row_count credential(s) imported, $duplicate_count duplicate(s) detected and not imported, $too_long_count row(s) skipped for over-length fields" . ($bad_otp_count ? ", $bad_otp_count 2FA secret(s) left off - they were not secrets" : ''), 'warning'); + + redirect(); + } if (isset($_GET['download_credentials_csv_template'])) { diff --git a/agent/post/credential_model.php b/agent/post/credential_model.php deleted file mode 100644 index 806814a44..000000000 --- a/agent/post/credential_model.php +++ /dev/null @@ -1,22 +0,0 @@ -$credential_field_too_long is too long to store", 'error'); - redirect(); - exit; -} - -$name = escapeSql($_POST['name']); -$description = escapeSql($_POST['description']); -$uri = escapeSql($_POST['uri']); -$uri_2 = escapeSql($_POST['uri_2']); -$username = encryptCredentialEntry(trim($_POST['username'])); -$password = encryptCredentialEntry(trim($_POST['password'])); -$otp_secret = escapeSql($_POST['otp_secret']); -$note = escapeSql($_POST['note']); -$favorite = intval($_POST['favorite'] ?? 0); -$contact_id = intval($_POST['contact'] ?? 0); -$asset_id = intval($_POST['asset'] ?? 0); diff --git a/agent/post/service.php b/agent/post/service.php index dfad7c566..ca5fc80c6 100644 --- a/agent/post/service.php +++ b/agent/post/service.php @@ -60,7 +60,8 @@ if (isset($_POST['add_service'])) { if (isset($_POST['credentials'])) { foreach($_POST['credentials'] as $credential_id) { $credential_id = intval($credential_id); - mysqli_query($mysqli, "INSERT INTO service_credentials SET service_id = $service_id, credential_id = $credential_id"); + // Only the client's own credentials + mysqli_query($mysqli, "INSERT INTO service_credentials (service_id, credential_id) SELECT $service_id, credential_id FROM credentials WHERE credential_id = $credential_id AND credential_client_id = $client_id"); } } @@ -148,7 +149,8 @@ if (isset($_POST['edit_service'])) { if (isset($_POST['credentials'])) { foreach($_POST['credentials'] as $credential_id) { $credential_id = intval($credential_id); - mysqli_query($mysqli, "INSERT INTO service_credentials SET service_id = $service_id, credential_id = $credential_id"); + // Only the client's own credentials + mysqli_query($mysqli, "INSERT INTO service_credentials (service_id, credential_id) SELECT $service_id, credential_id FROM credentials WHERE credential_id = $credential_id AND credential_client_id = $client_id"); } } diff --git a/agent/reports/credential_rotation.php b/agent/reports/credential_rotation.php index 42b936413..8f76803ea 100644 --- a/agent/reports/credential_rotation.php +++ b/agent/reports/credential_rotation.php @@ -1,73 +1,128 @@ '30 days', 60 => '60 days', 90 => '90 days', 180 => '6 months', 365 => 'A year']; +$days = intval($_GET['days'] ?? CREDENTIAL_ROTATE_DAYS); +if (!isset($day_options[$days])) { + $days = CREDENTIAL_ROTATE_DAYS; } -$passwords_not_rotated_sql = mysqli_query($mysqli, - "SELECT credential_id, credential_name, credential_description, credential_password_changed_at, credential_client_id, client_id, client_name +$sql = mysqli_query($mysqli, + "SELECT credential_id, credential_name, credential_description, credential_uri, credential_password_changed_at, credential_accessed_at, + credential_client_id, client_name FROM credentials - LEFT JOIN clients ON credential_client_id = client_id - WHERE DATE(credential_password_changed_at) < DATE_SUB(CURDATE(), INTERVAL $days DAY) + JOIN clients ON credential_client_id = client_id + WHERE credential_archived_at IS NULL AND client_archived_at IS NULL + AND (credential_password_changed_at IS NULL OR credential_password_changed_at < NOW() - INTERVAL $days DAY) " . clientScopeSql('credential_client_id') . " - ORDER BY client_name" + ORDER BY client_name ASC, credential_password_changed_at IS NOT NULL, credential_password_changed_at ASC, credential_name ASC" ); +$credentials = []; +$by_client = []; +while ($row = mysqli_fetch_assoc($sql)) { + $credentials[] = $row; + $client = intval($row['credential_client_id']); + $by_client[$client] = $by_client[$client] ?? ['name' => $row['client_name'], 'count' => 0, 'year' => 0]; + $by_client[$client]['count']++; + $age = credentialAge($row['credential_password_changed_at']); + if (!$age || $age['state'] === 'overdue') { + $by_client[$client]['year']++; + } +} + ?>
-

Client credentials not changed/rotated in the last 90 days

+

Credentials not changed in

- -
- - - - - - - - - - - - - - - - - - - - + + + + credential across client + - -
ClientCredential NameCredential DescriptionCredential Password Last Changed
-
+ +
Every password has changed in the last .
+ + +
By client
+
+ + + + $client) { ?> + + + + + + + +
ClientDueOver a year or never
' . $client['year'] . '' : '0' ?>
+
+ +
Credentials, oldest first
+
+ + + + + + + + + + + + + + + + + + + +
ClientCredentialPassword last changedLast used
+
+ +
+ +
+
+
+ 		+ + +
+ + Never recorded + +
+
+
diff --git a/agent/vendor.php b/agent/vendor.php index 3413fedbb..8e97b58bd 100644 --- a/agent/vendor.php +++ b/agent/vendor.php @@ -130,7 +130,8 @@ if (!$vendor || (isset($_GET['client_id']) && $vendor_client_id !== intval($clie } } if ($can_credentials && !$is_ours) { - $logins = linkedRecords('vendor', $vendor_id, 'credential'); + // The whole credential, so the password and 2FA code are right there to use + $logins = credentialRows("credential_id IN (SELECT credential_id FROM vendor_credentials WHERE vendor_id = $vendor_id)"); } // What we spend with one of ours @@ -276,7 +277,7 @@ if (!$vendor || (isset($_GET['client_id']) && $vendor_client_id !== intval($clie - + Portal login @@ -630,7 +631,7 @@ if (!$vendor || (isset($_GET['client_id']) && $vendor_client_id !== intval($clie Link - @@ -645,7 +646,14 @@ if (!$vendor || (isset($_GET['client_id']) && $vendor_client_id !== intval($clie
- + + true, + 'unlink' => function ($row) use ($unlink_url, $can_link) { + return $can_link ? $unlink_url('credential', $row['credential_id']) : ''; + }, + ]) ?> +
  • diff --git a/api/v1/assets/delete.php b/api/v1/assets/delete.php index 704812dd6..aa58bbf72 100644 --- a/api/v1/assets/delete.php +++ b/api/v1/assets/delete.php @@ -27,6 +27,9 @@ if (!empty($asset_id)) { // And take it out of any rack mysqli_query($mysqli,"DELETE FROM rack_units WHERE unit_asset_id = $asset_id"); + // Its logins stay with the client, no longer pointing at it + credentialsForget('asset', $asset_id); + // Logging logAudit("Asset", "Delete", "$asset_name via API ($api_key_name)", $client_id); } diff --git a/api/v1/contacts/delete.php b/api/v1/contacts/delete.php index 84af06ee0..e95fca4dc 100644 --- a/api/v1/contacts/delete.php +++ b/api/v1/contacts/delete.php @@ -21,6 +21,9 @@ if (!empty($contact_id)) { if ($delete_sql && !empty($contact_name)) { $delete_count = mysqli_affected_rows($mysqli); + // Their logins stay with the client, no longer pointing at them + credentialsForget('contact', $contact_id); + // Logging logAudit("Contact", "Delete", "$contact_name via API ($api_key_name)", $client_id); } diff --git a/api/v1/credentials/create.php b/api/v1/credentials/create.php index 17e4d159b..cf01073d2 100644 --- a/api/v1/credentials/create.php +++ b/api/v1/credentials/create.php @@ -13,7 +13,7 @@ $insert_id = false; if (!empty($api_key_decrypt_password) && !empty($name) && !(empty($password))) { // Add credential - $insert_sql = mysqli_query($mysqli,"INSERT INTO credentials SET credential_name = '$name', credential_description = '$description', credential_uri = '$uri', credential_uri_2 = '$uri_2', credential_username = '$username', credential_password = '$password', credential_otp_secret = '$otp_secret', credential_note = '$note', credential_favorite = $favorite, credential_contact_id = $contact_id, credential_asset_id = $asset_id, credential_client_id = $client_id"); + $insert_sql = mysqli_query($mysqli,"INSERT INTO credentials SET credential_name = '$name', credential_description = '$description', credential_uri = '$uri', credential_uri_2 = '$uri_2', credential_username = '$username', credential_password = '$password', credential_password_changed_at = NOW(), credential_otp_secret = '$otp_secret', credential_note = '$note', credential_favorite = $favorite, credential_contact_id = $contact_id, credential_asset_id = $asset_id, credential_client_id = $client_id"); // Check insert & get insert ID if ($insert_sql) { diff --git a/api/v1/credentials/credential_model.php b/api/v1/credentials/credential_model.php index 24562f63e..39f7f9c42 100644 --- a/api/v1/credentials/credential_model.php +++ b/api/v1/credentials/credential_model.php @@ -85,7 +85,9 @@ if (isset($_POST['credential_password'])) { } if (isset($_POST['credential_otp_secret'])) { - $otp_secret = escapeSql($_POST['credential_otp_secret']); + // Stored the way the agent side stores it - spaces and dashes out, an otpauth:// link down to its secret + $otp_seed = credentialOtpSeed($_POST['credential_otp_secret']); + $otp_secret = escapeSql($otp_seed === false ? trim((string) $_POST['credential_otp_secret']) : $otp_seed); } elseif (isset($credential_row) && isset($credential_row['credential_otp_secret'])) { $otp_secret = mysqli_real_escape_string($mysqli, $credential_row['credential_otp_secret']); } else { diff --git a/api/v1/credentials/delete.php b/api/v1/credentials/delete.php index b53e3cd23..3be726b79 100644 --- a/api/v1/credentials/delete.php +++ b/api/v1/credentials/delete.php @@ -21,6 +21,9 @@ if (!empty($credential_id)) { if ($delete_sql && !empty($credential_name)) { $delete_count = mysqli_affected_rows($mysqli); + // Any share links still open go with it + mysqli_query($mysqli, "DELETE FROM shared_items WHERE item_type = 'Credential' AND item_related_id = $credential_id"); + // Logging logAudit("Credential", "Delete", "$credential_name via API ($api_key_name)", $client_id, $credential_id); } diff --git a/css/itflow_custom.css b/css/itflow_custom.css index a801bb0c6..dce0246b4 100644 --- a/css/itflow_custom.css +++ b/css/itflow_custom.css @@ -4602,3 +4602,87 @@ img.itflow-contact-avatar { .itflow-vendor-email { max-width: 16rem; } + +/* Credentials - agent/credentials.php, agent/modals/credential/ and every + credential row elsewhere (functions/credential.php, js/credentials.js). + The password is dots until the eye fetches it; the 2FA button counts the + code down and turns red for its last five seconds. */ +.itflow-credential-pw { + display: inline-flex; + align-items: center; + gap: .15rem; + white-space: nowrap; +} +.itflow-credential-pw-mask { + letter-spacing: .05em; + color: var(--bs-secondary-color); +} +.itflow-credential-pw-value { + user-select: all; + background: var(--bs-tertiary-bg); + border-radius: var(--bs-border-radius-sm); + padding: 0 .3rem; +} +.itflow-credential-reveal { + border: 0; + background: none; + padding: 0 .3rem; + color: var(--bs-secondary-color); +} +.itflow-credential-reveal:hover { + color: var(--bs-emphasis-color); +} +.itflow-credential-otp { + display: inline-flex; + align-items: center; + gap: .25rem; + border: 1px solid var(--bs-border-color); + border-radius: 50rem; + background: var(--bs-body-bg); + padding: .05rem .55rem; + font-size: .85em; + color: var(--bs-secondary-color); + white-space: nowrap; +} +.itflow-credential-otp:hover { + color: var(--bs-emphasis-color); + border-color: var(--bs-secondary-color); +} +.itflow-credential-otp.is-live { + color: var(--bs-emphasis-color); + font-family: var(--bs-font-monospace); + font-weight: 600; +} +.itflow-credential-otp-time { + font-size: .8em; + font-weight: 400; + color: var(--bs-secondary-color); +} +.itflow-credential-otp.is-ending .itflow-credential-otp-time { + color: var(--bs-danger); +} +.itflow-credential-user { + max-width: 14rem; + display: inline-block; + vertical-align: bottom; +} +.itflow-credential-dl dd { + min-height: 1.5rem; +} +.itflow-credential-note { + white-space: normal; + max-height: 10rem; + overflow-y: auto; + padding: .5rem .75rem; + background: var(--bs-tertiary-bg); + border-radius: var(--bs-border-radius); +} +/* The list's "For" column - an asset, a contact and the first links, kept to one width */ +.itflow-credential-for { + max-width: 15rem; +} +/* Credentials listed on an asset, contact, vendor or license (credentialTableHtml) */ +.itflow-credential-name-cell { + min-width: 12rem; + max-width: 22rem; +} diff --git a/functions.php b/functions.php index 8140e9d3f..e8a5c27e9 100644 --- a/functions.php +++ b/functions.php @@ -24,6 +24,7 @@ require_once __DIR__ . '/functions/contact.php'; require_once __DIR__ . '/functions/software.php'; require_once __DIR__ . '/functions/location.php'; require_once __DIR__ . '/functions/vendor.php'; +require_once __DIR__ . '/functions/credential.php'; require_once __DIR__ . '/functions/links.php'; require_once __DIR__ . '/functions/auth.php'; require_once __DIR__ . '/functions/logging.php'; diff --git a/functions/asset.php b/functions/asset.php index df8c28a8c..3c4a43657 100644 --- a/functions/asset.php +++ b/functions/asset.php @@ -231,8 +231,8 @@ function assetLinkIcon($url) { } /** - * $id if that location / contact / vendor / network belongs to the client, - * else 0. The asset handlers run their picks through this so a hand-edited + * $id if that location / contact / vendor / network / asset belongs to the + * client, else 0. The handlers run their picks through this so a hand-edited * POST can't hang another client's contact or location off an asset. */ function assetClientOwnedId($kind, $id, $client_id) { @@ -243,6 +243,7 @@ function assetClientOwnedId($kind, $id, $client_id) { 'contact' => ['contacts', 'contact_id', 'contact_client_id'], 'vendor' => ['vendors', 'vendor_id', 'vendor_client_id'], 'network' => ['networks', 'network_id', 'network_client_id'], + 'asset' => ['assets', 'asset_id', 'asset_client_id'], ]; $id = intval($id); $client_id = intval($client_id); diff --git a/functions/client_overview.php b/functions/client_overview.php index dda72f432..09fa6ee3c 100644 --- a/functions/client_overview.php +++ b/functions/client_overview.php @@ -91,6 +91,17 @@ function clientOverviewAttention($client_id, $access, $renewals) { ]; } + if ($access['credentials']) { + // Logins nobody has changed in a while - the same rule as credentials.php?show=due + $items[] = [ + 'count' => dashboardCount("SELECT COUNT(credential_id) FROM credentials WHERE credential_client_id = $client_id AND credential_archived_at IS NULL + AND (credential_password_changed_at IS NULL OR credential_password_changed_at < NOW() - INTERVAL " . CREDENTIAL_ROTATE_DAYS . " DAY)"), + 'label' => 'Passwords due for a change', 'icon' => 'history', 'tone' => 'warning', + 'detail' => 'Not changed in ' . CREDENTIAL_ROTATE_DAYS . ' days', + 'url' => "/agent/credentials.php?client_id=$client_id&show=due&sort=credential_password_changed_at&order=ASC", + ]; + } + if ($access['docs'] && $renewals) { $expired = count(array_filter($renewals['items'], function ($r) { return $r['days'] < 0; })); $soon = count($renewals['items']) - $expired; @@ -181,7 +192,7 @@ function clientOverviewFavorites($client_id, $access) { } if ($access['credentials']) { - $sql = mysqli_query($mysqli, "SELECT credential_id, credential_name, credential_username, credential_otp_secret, credential_uri + $sql = mysqli_query($mysqli, "SELECT credential_id, credential_name, credential_description, credential_username, credential_otp_secret, credential_uri, credential_password_changed_at FROM credentials WHERE credential_client_id = $client_id AND credential_favorite = 1 AND credential_archived_at IS NULL ORDER BY credential_name"); @@ -358,12 +369,14 @@ function clientOverviewSharedItems($client_id) { global $mysqli; $sql = mysqli_query($mysqli, "SELECT item_id, item_type, item_related_id, item_recipient, item_views, item_view_limit, item_expire_at, - COALESCE(credential_name, document_name, file_name) AS item_name, file_ext + COALESCE(credential_name, document_name, file_name) AS item_name, file_ext, credential_uri, credential_description FROM shared_items LEFT JOIN credentials ON item_type = 'Credential' AND credential_id = item_related_id AND credential_client_id = $client_id LEFT JOIN documents ON item_type = 'Document' AND document_id = item_related_id AND document_client_id = $client_id LEFT JOIN files ON item_type = 'File' AND file_id = item_related_id AND file_client_id = $client_id WHERE item_client_id = $client_id AND item_active = 1 + -- Still openable: not expired, views not used up (functions/credential.php credentialShares) + AND item_expire_at > NOW() AND (COALESCE(item_view_limit, 0) = 0 OR item_views < item_view_limit) ORDER BY item_created_at DESC LIMIT 10"); diff --git a/functions/credential.php b/functions/credential.php new file mode 100644 index 000000000..c9e6bd1b9 --- /dev/null +++ b/functions/credential.php @@ -0,0 +1,515 @@ += $level; +} + +/** One credential by id with its client, contact and asset - raw, or null. */ +function credentialRow($credential_id) { + global $mysqli; + $credential_id = intval($credential_id); + if (!$credential_id) { + return null; + } + $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT credentials.*, client_name, + contact_id, contact_name, contact_title, contact_photo, contact_archived_at, + asset_id, asset_name, asset_type, asset_archived_at + FROM credentials + LEFT JOIN clients ON client_id = credential_client_id + LEFT JOIN contacts ON contact_id = credential_contact_id AND contact_client_id = credential_client_id + LEFT JOIN assets ON asset_id = credential_asset_id AND asset_client_id = credential_client_id + WHERE credential_id = $credential_id + LIMIT 1")); + return $row ?: null; +} + +/** + * What kind of login it is, from where it opens and what it is called - an + * icon and a tone for its tile: an admin account, Wi-Fi, a remote desktop, + * a shell, a database, a mailbox, a web console, or a plain key. + */ +function credentialKind($row) { + $uri = strtolower(trim((string) ($row['credential_uri'] ?? ''))); + $text = strtolower(($row['credential_name'] ?? '') . ' ' . ($row['credential_description'] ?? '')); + $kinds = [ + ['/wi-?fi|wireless|ssid|psk/', '', 'fa-wifi', 'wireless'], + ['/vpn/', '', 'fa-shield-alt', 'firewall'], + ['/\b(admin|administrator|root|break ?glass|domain admin)\b/', '', 'fa-user-shield', 'firewall'], + ['/database|\bsql\b|mysql|postgres/', '', 'fa-database', 'virtual'], + ['/', '#^(rdp|vnc|rustdesk|anydesk|splashtop|connectwise)://#', 'fa-desktop', 'workstation'], + ['/', '#^(ssh|telnet|sftp)://#', 'fa-terminal', 'server'], + ['/', '#^(smb|file|dav|webdav|ftp|ftps)://#', 'fa-folder-open', 'peripheral'], + ['/\b(mail|email|mailbox|365|exchange|workspace)\b/', '', 'fa-envelope', 'phone'], + ['/', '#^https?://#', 'fa-globe', 'network'], + ]; + foreach ($kinds as [$name_match, $uri_match, $icon, $tone]) { + if ($uri_match !== '' && preg_match($uri_match, $uri)) { + return ['icon' => $icon, 'tone' => $tone]; + } + if ($uri_match === '' && $name_match !== '/' && preg_match($name_match, $text)) { + return ['icon' => $icon, 'tone' => $tone]; + } + } + return ['icon' => 'fa-key', 'tone' => 'other']; +} + +/** The credential's tile - its kind's icon on its tone. $size '' | 'sm' | 'lg'. */ +function credentialTile($row, $size = '') { + $kind = credentialKind($row); + $size_class = in_array($size, ['sm', 'lg'], true) ? " itflow-asset-icon-$size" : ''; + return ''; +} + +/** + * How old the password is: 'fresh' (changed in the last 90 days), 'due' + * (90 days to a year) or 'overdue' (over a year), with the days and a line + * to show. Null when it has never been recorded. + */ +function credentialAge($changed_at) { + $changed_at = trim((string) $changed_at); + if ($changed_at === '' || strpos($changed_at, '0000-00-00') === 0) { + return null; + } + $changed = strtotime($changed_at); + if (!$changed) { + return null; + } + $days = max(0, intval(floor((time() - $changed) / 86400))); + if ($days >= CREDENTIAL_OVERDUE_DAYS) { + $state = 'overdue'; + $tone = 'danger'; + } elseif ($days >= CREDENTIAL_ROTATE_DAYS) { + $state = 'due'; + $tone = 'warning'; + } else { + $state = 'fresh'; + $tone = 'success'; + } + $text = $days === 0 ? 'Changed today' : ($days === 1 ? 'Changed yesterday' : ($days < 60 ? "Changed $days days ago" : 'Changed ' . timeAgo(date('Y-m-d', $changed)))); + return ['state' => $state, 'tone' => $tone, 'days' => $days, 'text' => $text, 'date' => date('Y-m-d', $changed)]; +} + +/** The age as a soft pill - green, amber when due for rotation, red when overdue. '' when unknown. */ +function credentialAgePill($age, $short = false) { + if (!$age) { + return ''; + } + $tone = $age['tone']; + $label = $short ? ($age['days'] < 60 ? $age['days'] . 'd' : ($age['days'] < 730 ? round($age['days'] / 30) . 'mo' : round($age['days'] / 365) . 'y')) : $age['text']; + $title = $age['text'] . ($age['state'] === 'fresh' ? '' : ' - due for rotation'); + return '' + . '' . escapeHtml($label) . ''; +} + +/** + * A 2FA seed as it is stored - the base32 secret, uppercase, without spaces + * or dashes - from what was pasted: the secret as an app shows it ("abcd efgh + * ...") or a whole otpauth:// link from the QR code. '' for nothing, false + * when it is not a seed. + */ +function credentialOtpSeed($input) { + $input = trim((string) $input); + if ($input === '') { + return ''; + } + if (stripos($input, 'otpauth://') === 0) { + $query = []; + parse_str((string) parse_url($input, PHP_URL_QUERY), $query); + $input = (string) ($query['secret'] ?? ''); + } + $seed = strtoupper(preg_replace('/[\s\-]+/', '', $input)); + $seed = rtrim($seed, '='); + if ($seed === '' || !preg_match('/^[A-Z2-7]+$/', $seed) || strlen($seed) < 16) { + return false; + } + return $seed; +} + +/** + * The credential fields a New / Edit form posts, as a SQL SET list - the + * username and password encrypted, the 2FA seed tidied, only the client's + * own contact and asset. Null with $error set when it cannot be saved: no + * name, a field too long, a 2FA seed that is not one, or a vault that did + * not open with this session (encrypting would otherwise write nothing over + * the password). + */ +function credentialFormSet($post, $client_id, &$error = '') { + $error = ''; + if (trim((string) ($post['name'] ?? '')) === '') { + $error = 'A credential needs a name.'; + return null; + } + if ($too_long = checkCredentialLengths($post)) { + $error = "The $too_long is too long to store."; + return null; + } + $otp = credentialOtpSeed($post['otp_secret'] ?? ''); + if ($otp === false) { + $error = "That 2FA secret is not one - paste the key the site shows under \"can't scan the code\", or the otpauth:// link."; + return null; + } + $username = encryptCredentialEntry(trim((string) ($post['username'] ?? ''))); + $password = encryptCredentialEntry(trim((string) ($post['password'] ?? ''))); + if ($username === false || $password === false) { + $error = 'Your vault session has expired, so the login could not be encrypted - sign out and back in, then try again.'; + return null; + } + $text = function ($field, $length) use ($post) { + return "'" . escapeSql(mb_substr(trim((string) ($post[$field] ?? '')), 0, $length)) . "'"; + }; + $fields = [ + 'credential_name' => $text('name', 200), + 'credential_description' => $text('description', 500), + 'credential_uri' => $text('uri', 500), + 'credential_uri_2' => $text('uri_2', 500), + 'credential_username' => "'" . escapeSql($username) . "'", + 'credential_password' => "'" . escapeSql($password) . "'", + 'credential_otp_secret' => "'" . escapeSql($otp) . "'", + 'credential_note' => "'" . escapeSql(trim((string) ($post['note'] ?? ''))) . "'", + 'credential_favorite' => intval($post['favorite'] ?? 0) ? 1 : 0, + 'credential_contact_id' => assetClientOwnedId('contact', $post['contact'] ?? 0, $client_id), + 'credential_asset_id' => assetClientOwnedId('asset', $post['asset'] ?? 0, $client_id), + ]; + $set = []; + foreach ($fields as $column => $value) { + $set[] = "$column = $value"; + } + return implode(', ', $set); +} + +/** Replace a credential's tags with these - credential tags (type 4) only. */ +function credentialSetTags($credential_id, $tag_ids) { + global $mysqli; + $credential_id = intval($credential_id); + mysqli_query($mysqli, "DELETE FROM credential_tags WHERE credential_id = $credential_id"); + $tag_ids = array_values(array_unique(array_filter(array_map('intval', (array) $tag_ids)))); + if (!$tag_ids) { + return; + } + mysqli_query($mysqli, "INSERT IGNORE INTO credential_tags (credential_id, tag_id) + SELECT $credential_id, tag_id FROM tags WHERE tag_type = 4 AND tag_id IN (" . implode(',', $tag_ids) . ")"); +} + +/** The username as stored, decrypted - '' when there is none or the vault is closed. */ +function credentialUsername($row) { + $ciphertext = (string) ($row['credential_username'] ?? ''); + if ($ciphertext === '') { + return ''; + } + $plain = decryptCredentialEntry($ciphertext); + return $plain === false ? '' : (string) $plain; +} + +/** The username with its copy button, or a dash. Raw in. */ +function credentialUsernameHtml($username, $empty = '-') { + $username = escapeHtml($username); + if ($username === '') { + return '' . $empty . ''; + } + return '' . $username . ''; +} + +/** + * The password as dots, with an eye that fetches and shows it for a little + * while and a copy button that fetches and copies it - both logged as a view + * by agent/ajax.php. Nothing secret is in the page until asked for. + */ +function credentialPasswordHtml($credential_id) { + $credential_id = intval($credential_id); + // Copying is the point here, so its copy button shows all the time (.itflow-copy-always) + return '' + . '' + . '' + . '' + . '' + . ''; +} + +/** + * The current 2FA code, fetched when clicked, with how long it has left - it + * follows on to the next code while it is on show, and a second click + * copies it. '' when the credential has no 2FA. + */ +function credentialOtpHtml($credential_id, $has_otp) { + if (!$has_otp) { + return ''; + } + $credential_id = intval($credential_id); + return ''; +} + +/** Where the login is used - the link, opening in a new tab, and a copy button. '' without one. Raw in. */ +function credentialUriHtml($uri, $max = 34) { + $uri = trim((string) $uri); + if ($uri === '') { + return ''; + } + $href = escapeUrl($uri); + $label = escapeHtml(truncate(preg_replace('#^https?://#i', '', $uri), $max)); + return '' . $label . '' + . ''; +} + +/** A credential in a picker - its kind's icon and a quieter line under it (functions/format.php selectOptionData). */ +function selectOptionCredential($row, $description = '') { + return selectOptionData(['icon' => 'fas ' . credentialKind($row)['icon'], 'description' => $description, 'keywords' => $row['credential_uri'] ?? '']); +} + +/** + * A credential wherever a page mentions one: its tile and its name, opening + * its quick look. 'class' goes on the link; 'archived' strikes it through. + */ +function credentialLink($row, $options = []) { + $credential_id = intval($row['credential_id'] ?? $row['id'] ?? 0); + $name = escapeHtml($row['credential_name'] ?? $row['name'] ?? ''); + $archived = !empty($options['archived']); + $class = trim('text-truncate ' . ($options['class'] ?? '') . ($archived ? ' text-decoration-line-through text-body-secondary' : '')); + return '' . credentialTile($row, 'sm') + . "$name"; +} + +/** + * Credentials to list somewhere - an asset's, a contact's, a vendor's or a + * license's - each with its client, contact and asset like credentialRow(), + * starred first then by name, keyed by id. $where is SQL the caller built + * from intval'd ids. Archived ones are left out unless asked for. + */ +function credentialRows($where, $include_archived = false) { + global $mysqli; + $sql = mysqli_query($mysqli, "SELECT credentials.*, client_name, + contact_id, contact_name, contact_title, contact_photo, contact_archived_at, + asset_id, asset_name, asset_type, asset_archived_at + FROM credentials + LEFT JOIN clients ON client_id = credential_client_id + LEFT JOIN contacts ON contact_id = credential_contact_id AND contact_client_id = credential_client_id + LEFT JOIN assets ON asset_id = credential_asset_id AND asset_client_id = credential_client_id + WHERE ($where)" . ($include_archived ? '' : ' AND credential_archived_at IS NULL') . " + ORDER BY credential_favorite DESC, credential_name ASC + LIMIT 500"); + $rows = []; + while ($sql && $row = mysqli_fetch_assoc($sql)) { + $rows[intval($row['credential_id'])] = $row; + } + return $rows; +} + +/** The asset and contact a credential belongs to, each as a small link - HTML pieces, maybe none. */ +function credentialOwnersHtml($row) { + $pieces = []; + if (!empty($row['asset_id'])) { + $pieces[] = '' + . '' . escapeHtml($row['asset_name']) . ''; + } + if (!empty($row['contact_id'])) { + $pieces[] = contactLink(intval($row['credential_client_id']), $row['contact_id'], $row['contact_name'], $row['contact_photo'], ['archived' => !empty($row['contact_archived_at'])]); + } + return $pieces; +} + +/** + * Credentials as a table, the same wherever they are listed outside the + * credentials page - an asset's or contact's tab, a vendor's logins, a + * license's: the credential (opening its quick look), the login with the + * password and 2FA code on asking, how old the password is, and the actions. + * Options: 'for' adds the asset and contact it belongs to under its name + * (on a vendor's or license's list, where that differs); 'unlink' is a function + * of the row giving the URL that unlinks it from this page's record ('' for + * none). + */ +function credentialTableHtml(array $rows, array $options = []) { + $can_edit = credentialCan(2); + $can_share = lookupUserPermission('module_support') >= 2; + $show_for = !empty($options['for']); + $unlink = $options['unlink'] ?? null; + $csrf = $_SESSION['csrf_token'] ?? ''; + $html = '
    ' + . ''; + foreach ($rows as $row) { + $id = intval($row['credential_id']); + $name = escapeHtml($row['credential_name']); + $description = escapeHtml($row['credential_description']); + $archived = !empty($row['credential_archived_at']); + $quick = "modals/credential/credential.php?id=$id"; + $has_otp = trim((string) $row['credential_otp_secret']) !== ''; + + $html .= ''; + + $html .= ''; + + $html .= ''; + + $actions = 'Quick look'; + if ($can_edit && !$archived) { + $actions .= 'Edit' + . 'Change password'; + } + if ($can_share && !$archived) { + $actions .= 'Share'; + } + $unlink_url = $unlink ? (string) $unlink($row) : ''; + if ($unlink_url !== '' || ($can_edit && !$archived)) { + $actions .= '
    '; + } + if ($unlink_url !== '') { + $actions .= 'Unlink'; + } + if ($can_edit && !$archived) { + $actions .= 'Archive'; + } + $html .= ''; + } + return $html . '
    CredentialLoginChanged
    ' . credentialTile($row, 'sm') . '
    ' + . '' . $name . '' + . (intval($row['credential_favorite']) ? '' : '') + . ($description !== '' ? '
    ' . $description . '
    ' : ''); + $owners = $show_for ? credentialOwnersHtml($row) : []; + if ($owners) { + $html .= '
    ' . implode('', $owners) . '
    '; + } + $html .= '
    ' . credentialUsernameHtml(credentialUsername($row)) . '
    ' + . '
    ' . credentialPasswordHtml($id) . credentialOtpHtml($id, $has_otp) . '
    '; + foreach (array_filter([$row['credential_uri'] ?? '', $row['credential_uri_2'] ?? '']) as $uri) { + $html .= '
    ' . credentialUriHtml($uri, 34) . '
    '; + } + $html .= '    		' . (credentialAgePill(credentialAge($row['credential_password_changed_at']), true) ?: '-') . '
    ' + . '
    ' . $actions . '
    '; +} + +/** + * Credentials as a short list for the quick looks (an asset's, a contact's): + * each one's tile and name opening its own quick look, the login with the + * password and 2FA code on asking, and how old the password is. Rows from + * credentialRows(). + */ +function credentialListHtml(array $rows) { + $html = '
      '; + foreach ($rows as $row) { + $link_row = $row + ['id' => $row['credential_id'], 'name' => $row['credential_name']]; + $html .= '
    • ' . linkRowHtml('credential', $link_row, $row['credential_client_id']) + . credentialAgePill(credentialAge($row['credential_password_changed_at']), true) . '
      • '; + } + return $html . '
    '; +} + +/** + * What each credential is linked to beyond its own asset and contact - + * vendors, licenses and services - for the whole page at once: + * [credential_id => [['type', 'id', 'name'], ...]]. + */ +function credentialLinks(array $credential_ids) { + global $mysqli; + $credential_ids = array_values(array_unique(array_filter(array_map('intval', $credential_ids)))); + $links = array_fill_keys($credential_ids, []); + if (!$credential_ids) { + return $links; + } + $in = implode(',', $credential_ids); + $sources = [ + 'vendor' => "SELECT l.credential_id, v.vendor_id, v.vendor_name FROM vendor_credentials l JOIN vendors v ON v.vendor_id = l.vendor_id AND v.vendor_archived_at IS NULL WHERE l.credential_id IN ($in) ORDER BY v.vendor_name", + 'software' => "SELECT l.credential_id, s.software_id, s.software_name FROM software_credentials l JOIN software s ON s.software_id = l.software_id AND s.software_archived_at IS NULL WHERE l.credential_id IN ($in) ORDER BY s.software_name", + 'service' => "SELECT l.credential_id, s.service_id, s.service_name FROM service_credentials l JOIN services s ON s.service_id = l.service_id WHERE l.credential_id IN ($in) ORDER BY s.service_name", + ]; + foreach ($sources as $type => $query) { + $sql = mysqli_query($mysqli, $query); + while ($row = mysqli_fetch_row($sql)) { + $links[intval($row[0])][] = [$type, intval($row[1]), $row[2]]; + } + } + return $links; +} + +/** The share links still open for each credential, for the whole page at once: [credential_id => [share rows]]. */ +function credentialShares(array $credential_ids) { + global $mysqli; + $credential_ids = array_values(array_unique(array_filter(array_map('intval', $credential_ids)))); + $shares = array_fill_keys($credential_ids, []); + if (!$credential_ids) { + return $shares; + } + $sql = mysqli_query($mysqli, "SELECT item_id, item_related_id, item_recipient, item_note, item_views, item_view_limit, item_created_at, item_expire_at + FROM shared_items + WHERE item_type = 'Credential' AND item_active = 1 AND item_expire_at > NOW() + AND (COALESCE(item_view_limit, 0) = 0 OR item_views < item_view_limit) + AND item_related_id IN (" . implode(',', $credential_ids) . ") + ORDER BY item_expire_at ASC"); + while ($row = mysqli_fetch_assoc($sql)) { + $shares[intval($row['item_related_id'])][] = $row; + } + return $shares; +} + +/** + * Who did what with a credential - its audit log entries (views, 2FA code + * views, edits, rotations, links, shares), newest first. + */ +function credentialHistory($credential_id, $limit = 50) { + global $mysqli; + $credential_id = intval($credential_id); + $limit = max(1, intval($limit)); + $sql = mysqli_query($mysqli, "SELECT log_action, log_description, log_created_at, user_name FROM logs + LEFT JOIN users ON user_id = log_user_id + WHERE log_type = 'Credential' AND log_entity_id = $credential_id + ORDER BY log_id DESC LIMIT $limit"); + $rows = []; + while ($row = mysqli_fetch_assoc($sql)) { + $rows[] = $row; + } + return $rows; +} + +/** The last time someone looked at the password or the 2FA code, and who - or null. */ +function credentialLastViewed($credential_id) { + global $mysqli; + $credential_id = intval($credential_id); + $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT log_created_at, user_name FROM logs + LEFT JOIN users ON user_id = log_user_id + WHERE log_type = 'Credential' AND log_entity_id = $credential_id AND log_action IN ('View', 'View TOTP') + ORDER BY log_id DESC LIMIT 1")); + return $row ?: null; +} + +/** + * An asset or contact is going for good - its credentials stay, for no asset + * or no contact, rather than pointing at an id that no longer exists. + */ +function credentialsForget($kind, $id) { + global $mysqli; + $column = ['asset' => 'credential_asset_id', 'contact' => 'credential_contact_id'][$kind] ?? null; + $id = intval($id); + if (!$column || !$id) { + return; + } + mysqli_query($mysqli, "UPDATE credentials SET $column = 0 WHERE $column = $id"); +} + +/** Deleting a credential for good - its open share links go with it. Links and tags cascade. */ +function credentialDeleteForGood($credential_id) { + global $mysqli; + $credential_id = intval($credential_id); + mysqli_query($mysqli, "DELETE FROM shared_items WHERE item_type = 'Credential' AND item_related_id = $credential_id"); + mysqli_query($mysqli, "DELETE FROM credentials WHERE credential_id = $credential_id"); +} diff --git a/functions/export.php b/functions/export.php index 7e875bf3f..575e8e9f3 100644 --- a/functions/export.php +++ b/functions/export.php @@ -198,6 +198,13 @@ function getExportColumns($export_type) { 'credential_password' => ['label' => 'Password'], 'credential_otp_secret' => ['label' => 'TOTP'], 'credential_uri' => ['label' => 'URI', 'weight' => 2], + 'credential_uri_2' => ['label' => 'URI 2', 'default' => false], + 'credential_tags' => ['label' => 'Tags', 'default' => false], + 'asset_name' => ['label' => 'Asset', 'default' => false], + 'contact_name' => ['label' => 'Contact', 'default' => false], + 'credential_password_changed' => ['label' => 'Password Changed', 'default' => false], + 'credential_note' => ['label' => 'Notes', 'weight' => 3, 'default' => false], + 'client_name' => ['label' => 'Client', 'default' => false], ], // seats_used, assigned_to_assets / assigned_to_contacts and software_keys_list are built by the handler's query diff --git a/functions/links.php b/functions/links.php index ef2e92ec1..dbef3750f 100644 --- a/functions/links.php +++ b/functions/links.php @@ -112,7 +112,7 @@ function linkDisplayColumns($type) { 'document' => 'document_description, document_updated_at, document_created_at', 'file' => 'file_ext, file_size, file_mime_type, file_description', 'software' => 'software_type, software_version, software_license_type, software_seats, software_expire, ' . softwareSeatsUsedSql('t.software_id') . ' AS seats_used', - 'credential' => 'credential_description, credential_uri, credential_username, credential_otp_secret, credential_favorite', + 'credential' => 'credential_description, credential_uri, credential_username, credential_otp_secret, credential_favorite, credential_password_changed_at', 'vendor' => 'vendor_description, vendor_account_number, vendor_phone, vendor_phone_country_code, vendor_extension', 'location' => 'location_address, location_city, location_state, location_zip, location_primary, location_photo, location_client_id', ][$type] ?? ''; @@ -288,6 +288,7 @@ function linkRemoveAll($type, $id) { function linkRowHtml($to, $row, $client_id) { $id = intval($row['id']); $name = escapeHtml($row['name']); + $extra = ''; switch ($to) { case 'asset': $lead = ''; @@ -321,9 +322,17 @@ function linkRowHtml($to, $row, $client_id) { ])); break; case 'credential': - $lead = ''; - $link = "$name"; + $credential = ['credential_name' => $row['name'], 'credential_description' => $row['credential_description'] ?? '', 'credential_uri' => $row['credential_uri'] ?? '', 'credential_username' => $row['credential_username'] ?? '']; + $lead = credentialTile($credential, 'sm'); + $link = "$name" + . (intval($row['credential_favorite'] ?? 0) ? '' : ''); $detail = $row['credential_description'] ?: $row['credential_uri']; + // The login itself - username to copy, the password and 2FA code on asking + $username = credentialUsername($credential); + $extra = '
    ' + . ($username !== '' ? '' . credentialUsernameHtml($username) . '' : '') + . credentialPasswordHtml($id) . credentialOtpHtml($id, trim((string) ($row['credential_otp_secret'] ?? '')) !== '') + . '
    '; break; case 'location': $lead = locationTile($row, 'sm'); @@ -339,7 +348,7 @@ function linkRowHtml($to, $row, $client_id) { return ''; } $detail = (string) $detail !== '' ? '
    ' . escapeHtml($detail) . '
    ' : ''; - return "$lead
    $link
    $detail
    "; + return "$lead
    $link
    $detail$extra
    "; } /** diff --git a/functions/search.php b/functions/search.php index 8a0ea00ce..e171addf0 100644 --- a/functions/search.php +++ b/functions/search.php @@ -269,7 +269,7 @@ function globalSearchGroups($terms, $deep) { 'select' => 'credential_id, credential_name, credential_description, credential_client_id, client_name', 'from' => 'credentials LEFT JOIN clients ON credential_client_id = client_id', 'where' => "credential_archived_at IS NULL - AND (credential_name LIKE '%$like%' OR credential_description LIKE '%$like%' OR credential_uri LIKE '%$like%')", + AND (credential_name LIKE '%$like%' OR credential_description LIKE '%$like%' OR credential_uri LIKE '%$like%' OR credential_uri_2 LIKE '%$like%')", 'scope' => 'credential_client_id', 'order' => "(credential_name = '$eq') DESC, (credential_name LIKE '$like%') DESC, credential_name", 'list_url' => '/agent/credentials.php?' . http_build_query(['q' => $q]), @@ -279,7 +279,8 @@ function globalSearchGroups($terms, $deep) { 'title' => $row['credential_name'], 'subtitle' => $row['credential_description'], 'context' => $row['client_name'], - 'url' => globalSearchClientUrl('credentials.php', $row['credential_client_id'], ['q' => $row['credential_name']]), + // Straight to its quick look on the client's credentials page + 'url' => globalSearchClientUrl('credentials.php', $row['credential_client_id'], ['open' => intval($row['credential_id'])]), ]; }, ]; diff --git a/guest/guest_ajax.php b/guest/guest_ajax.php index a405bc1eb..913c0f3a1 100644 --- a/guest/guest_ajax.php +++ b/guest/guest_ajax.php @@ -146,14 +146,15 @@ if (isset($_GET['get_share_totp_token'])) { exit(json_encode(['error' => 'invalid'])); } - $totp_secret = mysqli_fetch_assoc($credential_sql)['credential_otp_secret']; + // Tidied the same way as the agent side - seeds saved with spaces or as an otpauth:// link still work + $totp_secret = credentialOtpSeed(mysqli_fetch_assoc($credential_sql)['credential_otp_secret']); if (empty($totp_secret)) { exit(json_encode(['error' => 'invalid'])); } echo json_encode([ - 'token' => TokenAuth6238::getTokenCode(strtoupper($totp_secret)), + 'token' => TokenAuth6238::getTokenCode($totp_secret), 'expires_in' => 30 - (time() % 30) ]); exit; diff --git a/includes/footer.php b/includes/footer.php index 94ee1148d..ef1d38be2 100644 --- a/includes/footer.php +++ b/includes/footer.php @@ -77,6 +77,7 @@ + diff --git a/js/credentials.js b/js/credentials.js new file mode 100644 index 000000000..0ff6f68db --- /dev/null +++ b/js/credentials.js @@ -0,0 +1,155 @@ +/* + * Credentials - the password, copy and 2FA buttons functions/credential.php + * draws wherever a credential is listed (the credentials list, assets, + * contacts, vendors, licenses, the quick looks). Bound once on document, so + * they work in ajax modals too. + * + * Nothing secret is in the page until it is asked for: the eye and the copy + * button fetch the password from agent/ajax.php (get_credential_via_id), the + * 2FA button fetches the current code (get_totp_token_via_id) - both check the + * module and the client and log the view. + */ + +(function () { + + // How long a shown password stays on screen, and how many codes in a row the 2FA button follows on to + var SHOW_FOR = 30000; + var OTP_ROUNDS = 6; + + function fetchCredential(id, done) { + itflowGet('/agent/ajax.php', { get_credential_via_id: 'true', credential_id: id }, function (data) { + var credential = null; + try { + credential = JSON.parse(data); + } catch (e) {} + if (credential) { + done(credential); + } + }); + } + + function hidePassword(box) { + var value = box.querySelector('.itflow-credential-pw-value'); + var mask = box.querySelector('.itflow-credential-pw-mask'); + var button = box.querySelector('.itflow-credential-reveal'); + clearTimeout(box.itflowHide); + value.textContent = ''; + value.hidden = true; + mask.hidden = false; + if (button) { + button.querySelector('i').className = 'fas fa-eye'; + button.setAttribute('aria-pressed', 'false'); + button.title = 'Show password'; + } + } + + // The eye: show the password for a while, or hide it again + itflowBindOnce('itflowCredentialReveal', 'click', '.itflow-credential-reveal', function (e) { + e.preventDefault(); + var button = this; + var box = button.closest('.itflow-credential-pw'); + if (!box) { + return; + } + var value = box.querySelector('.itflow-credential-pw-value'); + if (!value.hidden) { + hidePassword(box); + return; + } + fetchCredential(box.dataset.credentialId, function (credential) { + value.textContent = credential.password || ''; + value.hidden = false; + box.querySelector('.itflow-credential-pw-mask').hidden = true; + button.querySelector('i').className = 'fas fa-eye-slash'; + button.setAttribute('aria-pressed', 'true'); + button.title = 'Hide password'; + clearTimeout(box.itflowHide); + box.itflowHide = setTimeout(function () { + hidePassword(box); + }, SHOW_FOR); + }); + }); + + // Copy: fetch the password and copy it, without showing it + itflowBindOnce('itflowCredentialCopy', 'click', '.itflow-credential-copy', function (e) { + e.preventDefault(); + var button = this; + var box = button.closest('[data-credential-id]'); + if (!box) { + return; + } + fetchCredential(box.dataset.credentialId, function (credential) { + itflowCopyText(credential.password || '', button).then( + function () { flashTooltip(button, 'Copied!'); }, + function () { flashTooltip(button, 'Failed!'); } + ); + }); + }); + + function resetOtp(button) { + clearInterval(button.itflowTimer); + delete button.dataset.code; + button.classList.remove('is-live', 'is-ending'); + button.querySelector('.itflow-credential-otp-code').textContent = '2FA'; + button.querySelector('.itflow-credential-otp-time').textContent = ''; + button.title = 'Show the 2FA code'; + } + + // 2FA: the first click fetches the code and counts it down, following on to + // the next one for a few minutes; clicking it while it shows copies it + itflowBindOnce('itflowCredentialOtp', 'click', '.itflow-credential-otp', function (e) { + e.preventDefault(); + var button = this; + if (button.dataset.code) { + itflowCopyText(button.dataset.code, button).then( + function () { flashTooltip(button, 'Copied!'); }, + function () { flashTooltip(button, 'Failed!'); } + ); + return; + } + var codeEl = button.querySelector('.itflow-credential-otp-code'); + var timeEl = button.querySelector('.itflow-credential-otp-time'); + var rounds = 0; + var last = 31; + + function load() { + itflowGet('/agent/ajax.php', { get_totp_token_via_id: 'true', credential_id: button.dataset.credentialOtp }, function (data) { + var code = ''; + try { + code = String(JSON.parse(data) || ''); + } catch (err) {} + if (!/^[0-9]{6,8}$/.test(code)) { + resetOtp(button); + codeEl.textContent = 'No code'; + return; + } + button.dataset.code = code; + codeEl.textContent = code.length === 6 ? code.slice(0, 3) + ' ' + code.slice(3) : code; + button.classList.add('is-live'); + button.title = 'Click to copy the code'; + }); + } + + function tick() { + var left = 30 - Math.floor(Date.now() / 1000) % 30; + timeEl.textContent = left + 's'; + button.classList.toggle('is-ending', left <= 5); + // A new period - the next code, for a few rounds, then back to the button + if (left > last) { + rounds++; + if (rounds >= OTP_ROUNDS || !document.body.contains(button)) { + resetOtp(button); + return; + } + load(); + } + last = left; + } + + clearInterval(button.itflowTimer); + load(); + tick(); + button.itflowTimer = setInterval(tick, 1000); + }); + +})(); diff --git a/post/misc.php b/post/misc.php index ad1d67b02..576a2eff7 100644 --- a/post/misc.php +++ b/post/misc.php @@ -32,11 +32,20 @@ if (isset($_GET['deactivate_shared_item'])) { enforceClientAccess(); + // A credential's link is turned off by someone who may see credentials + if ($item_type === 'Credential') { + enforceUserPermission('module_credential'); + } + // Deactivate item id mysqli_query($mysqli, "DELETE FROM shared_items WHERE item_id = $item_id"); // Logging logAudit("Sharing", "Delete", "$session_name deactivated shared $item_type link Item ID: $item_related_id. Share ID $item_id", $client_id, $item_id); + if ($item_type === 'Credential') { + // In the credential's own history too + logAudit("Credential", "Unshare", "$session_name turned off a share link", $client_id, $item_related_id); + } $_SESSION['alert_message'] = "Share Link deactivated";