Commit 883004b7 authored by Luc Didry's avatar Luc Didry
Browse files

Use random Initialization Vector for encryption

+ now use Mojo::SQLite instead of ORLite

This commit is dedicated to Antonio Ferreira, who is supporting me with Ǧ1.
Many thanks :-)
parent 5a5e629e
Pipeline #42105 passed with stages
in 5 minutes and 12 seconds
......@@ -5,13 +5,13 @@ requires 'Net::SSLeay', '>= 1.81';
requires 'Data::Validate::URI';
requires 'Net::Domain::TLD', '>= 1.73'; # Must have the last version to handle (at least) .xyz and .link
requires 'Mojo::Pg';
requires 'Mojo::SQLite';
requires 'Mojolicious::Plugin::I18N';
requires 'Mojolicious::Plugin::DebugDumperHelper';
requires 'Mojolicious::Plugin::PgURLHelper';
requires 'Mojolicious::Plugin::StaticCache';
requires "Minion", "== 4.06";
requires 'Minion::Backend::SQLite', "== 0.009";
requires 'ORLite';
requires 'Text::Unidecode';
requires 'DateTime';
requires 'Filesys::DiskUsage';
......
This diff is collapsed.
......@@ -444,9 +444,9 @@ sub add {
}
}
my $key;
my ($key, $iv);
if ($c->param('crypt') || $c->config('always_encrypt')) {
($upload, $key) = $c->crypt($upload, $filename);
($upload, $key, $iv) = $c->crypt($upload, $filename);
}
$upload->move_to($path);
......@@ -461,6 +461,7 @@ sub add {
->created_by($ip)
->width($width)
->height($height)
->iv($iv)
->write;
# Log image creation
......@@ -617,12 +618,7 @@ sub short {
);
return $c->redirect_to('/');
} else {
my $expires = ($image->delete_at_day) ? $image->delete_at_day : 360;
my $dt = DateTime->from_epoch( epoch => $expires * 86400 + $image->created_at);
$dt->set_time_zone('GMT');
$expires = $dt->strftime("%a, %d %b %Y %H:%M:%S GMT");
$test = $c->render_file($im_loaded, $image->filename, $image->path, $image->mediatype, $dl, $expires, $image->delete_at_first_view, $key, $thumb);
$test = $c->render_file($im_loaded, $image, $dl, $key, $thumb);
}
}
......
......@@ -17,6 +17,7 @@ has 'last_access_at';
has 'mod_token';
has 'width';
has 'height';
has 'iv';
has 'app';
=head1 NAME
......@@ -64,6 +65,8 @@ Have a look at Lutim::DB::Image::SQLite's code: it's simple and may be more unde
=item B<height> : integer
=item B<iv> : initialization vector for the file encryption
=item B<app> : a mojolicious object
=back
......@@ -125,7 +128,8 @@ sub to_hash {
last_access_at => $c->last_access_at,
mod_token => $c->mod_token,
width => $c->width,
height => $c->height
height => $c->height,
height => $c->iv
};
}
......
......@@ -81,9 +81,9 @@ sub write {
my $c = shift;
if ($c->record) {
$c->app->pg->db->query('UPDATE lutim SET counter = ?, created_at = ?, created_by = ?, delete_at_day = ?, delete_at_first_view = ?, enabled = ?, filename = ?, footprint = ?, height = ?, last_access_at = ?, mediatype = ?, mod_token = ?, path = ?, short = ?, width = ? WHERE short = ?', $c->counter, $c->created_at, $c->created_by, $c->delete_at_day, $c->delete_at_first_view, $c->enabled, $c->filename, $c->footprint, $c->height, $c->last_access_at, $c->mediatype, $c->mod_token, $c->path, $c->short, $c->width, $c->short);
$c->app->pg->db->query('UPDATE lutim SET counter = ?, created_at = ?, created_by = ?, delete_at_day = ?, delete_at_first_view = ?, enabled = ?, filename = ?, footprint = ?, height = ?, last_access_at = ?, mediatype = ?, mod_token = ?, path = ?, short = ?, width = ?, iv = ? WHERE short = ?', $c->counter, $c->created_at, $c->created_by, $c->delete_at_day, $c->delete_at_first_view, $c->enabled, $c->filename, $c->footprint, $c->height, $c->last_access_at, $c->mediatype, $c->mod_token, $c->path, $c->short, $c->width, $c->iv, $c->short);
} else {
$c->app->pg->db->query('INSERT INTO lutim (counter, created_at, created_by, delete_at_day, delete_at_first_view, enabled, filename, footprint, height, last_access_at, mediatype, mod_token, path, short, width) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)', $c->counter, $c->created_at, $c->created_by, $c->delete_at_day, $c->delete_at_first_view, $c->enabled, $c->filename, $c->footprint, $c->height, $c->last_access_at, $c->mediatype, $c->mod_token, $c->path, $c->short, $c->width);
$c->app->pg->db->query('INSERT INTO lutim (counter, created_at, created_by, delete_at_day, delete_at_first_view, enabled, filename, footprint, height, last_access_at, mediatype, mod_token, path, short, width, iv) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)', $c->counter, $c->created_at, $c->created_by, $c->delete_at_day, $c->delete_at_first_view, $c->enabled, $c->filename, $c->footprint, $c->height, $c->last_access_at, $c->mediatype, $c->mod_token, $c->path, $c->short, $c->width, $c->iv);
$c->record(1);
}
......@@ -220,6 +220,7 @@ sub _slurp {
$c->mod_token($image->{mod_token});
$c->width($image->{width});
$c->height($image->{height});
$c->iv($image->{iv});
$c->record(1);
}
......
# vim:set sw=4 ts=4 sts=4 ft=perl expandtab:
package Lutim::DB::Image::SQLite;
use Mojo::Base 'Lutim::DB::Image';
use Lutim::DB::SQLite;
use Mojo::Collection 'c';
has 'record';
has 'record' => 0;
sub new {
my $c = shift;
......@@ -19,13 +18,10 @@ sub accessed {
my $c = shift;
my $time = shift;
$c->record->update(
counter => $c->counter + 1,
last_access_at => $time
);
$c->counter($c->record->counter);
$c->last_access_at($c->record->last_access_at);
$c->app->sqlite->db->query('UPDATE lutim SET counter = counter + 1, last_access_at = ? WHERE short = ?', $time, $c->short);
my $h = $c->app->sqlite->db->query('SELECT counter, last_access_at FROM lutim WHERE short = ?', $c->short)->hashes->first;
$c->counter($h->{counter});
$c->last_access_at($h->{last_access_at});
return $c;
}
......@@ -37,9 +33,9 @@ sub count_delete_at_day_endis {
my $created = shift;
if (defined $created) {
return Lutim::DB::SQLite::Lutim->count('WHERE path IS NOT NULL AND delete_at_day = ? AND enabled = ? AND created_at < ?', $day, $enabled, $created);
return $c->app->sqlite->db->query('SELECT count(short) AS count FROM lutim WHERE path IS NOT NULL AND delete_at_day = ? AND enabled = ? AND created_at < ?', $day, $enabled, $created)->hashes->first->{count};
} else {
return Lutim::DB::SQLite::Lutim->count('WHERE path IS NOT NULL AND delete_at_day = ? AND enabled = ?', $day, $enabled);
return $c->app->sqlite->db->query('SELECT count(short) AS count FROM lutim WHERE path IS NOT NULL AND delete_at_day = ? AND enabled = ?', $day, $enabled)->hashes->first->{count};
}
}
......@@ -47,7 +43,7 @@ sub count_created_before {
my $c = shift;
my $time = shift;
return Lutim::DB::SQLite::Lutim->count('WHERE path IS NOT NULL AND created_at < ?', $time);
return $c->app->sqlite->db->query('SELECT count(short) AS count FROM lutim WHERE path IS NOT NULL AND created_at < ?', $time)->hashes->first->{count};
}
sub select_created_after {
......@@ -56,15 +52,17 @@ sub select_created_after {
my @images;
my @records = Lutim::DB::SQLite::Lutim->select('WHERE path IS NOT NULL AND created_at >= ?', $time);
my $records = $c->app->sqlite->db->query('SELECT * FROM lutim WHERE path IS NOT NULL AND created_at >= ?', $time)->hashes;
for my $e (@records) {
my $i = Lutim::DB::Image->new(app => $c->app);
$i->record($e);
$i->_slurp;
$records->each(
sub {
my ($e, $num) = @_;
my $i = Lutim::DB::Image->new(app => $c->app);
$i->_slurp($e);
push @images, $i;
}
push @images, $i;
}
);
return c(@images);
}
......@@ -72,11 +70,10 @@ sub select_created_after {
sub select_empty {
my $c = shift;
my $record = c(Lutim::DB::SQLite::Lutim->select('WHERE path IS NULL'))->shuffle->first;
$record->update(path => 'used');
my $record = $c->app->sqlite->db->query('SELECT * FROM lutim WHERE path IS NULL')->hashes->shuffle->first;
$c->app->sqlite->db->query('UPDATE lutim SET path = ? WHERE short = ?', 'used', $record->{short});
$c->record($record);
$c = $c->_slurp;
$c = $c->_slurp($record);
return $c;
}
......@@ -85,42 +82,10 @@ sub write {
my $c = shift;
if ($c->record) {
$c->record->update(
counter => $c->counter,
created_at => $c->created_at,
created_by => $c->created_by,
delete_at_day => $c->delete_at_day,
delete_at_first_view => $c->delete_at_first_view,
enabled => $c->enabled,
filename => $c->filename,
footprint => $c->footprint,
height => $c->height,
last_access_at => $c->last_access_at,
mediatype => $c->mediatype,
mod_token => $c->mod_token,
path => $c->path,
short => $c->short,
width => $c->width
);
$c->app->sqlite->db->query('UPDATE lutim SET counter = ?, created_at = ?, created_by = ?, delete_at_day = ?, delete_at_first_view = ?, enabled = ?, filename = ?, footprint = ?, height = ?, last_access_at = ?, mediatype = ?, mod_token = ?, path = ?, short = ?, width = ?, iv = ? WHERE short = ?', $c->counter, $c->created_at, $c->created_by, $c->delete_at_day, $c->delete_at_first_view, $c->enabled, $c->filename, $c->footprint, $c->height, $c->last_access_at, $c->mediatype, $c->mod_token, $c->path, $c->short, $c->width, $c->iv, $c->short);
} else {
my $record = Lutim::DB::SQLite::Lutim->create(
counter => $c->counter,
created_at => $c->created_at,
created_by => $c->created_by,
delete_at_day => $c->delete_at_day,
delete_at_first_view => $c->delete_at_first_view,
enabled => $c->enabled,
filename => $c->filename,
footprint => $c->footprint,
height => $c->height,
last_access_at => $c->last_access_at,
mediatype => $c->mediatype,
mod_token => $c->mod_token,
path => $c->path,
short => $c->short,
width => $c->width
);
$c->record($record);
$c->app->sqlite->db->query('INSERT INTO lutim (counter, created_at, created_by, delete_at_day, delete_at_first_view, enabled, filename, footprint, height, last_access_at, mediatype, mod_token, path, short, width, iv) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)', $c->counter, $c->created_at, $c->created_by, $c->delete_at_day, $c->delete_at_first_view, $c->enabled, $c->filename, $c->footprint, $c->height, $c->last_access_at, $c->mediatype, $c->mod_token, $c->path, $c->short, $c->width, $c->iv);
$c->record(1);
}
return $c;
......@@ -130,30 +95,26 @@ sub count_short {
my $c = shift;
my $short = shift;
return Lutim::DB::SQLite::Lutim->count('WHERE short IS ?', $short);
return $c->app->sqlite->db->query('SELECT count(short) AS count FROM lutim WHERE short = ?', $short)->hashes->first->{count};
}
sub count_empty {
my $c = shift;
return Lutim::DB::SQLite::Lutim->count('WHERE path IS NULL');
return $c->app->sqlite->db->query('SELECT count(short) AS count FROM lutim WHERE path IS NULL')->hashes->first->{count};
}
sub count_not_empty {
my $c = shift;
return Lutim::DB::SQLite::Lutim->count('WHERE path IS NOT NULL');
return $c->app->sqlite->db->query('SELECT count(short) AS count FROM lutim WHERE path IS NOT NULL')->hashes->first->{count};
}
sub clean_ips_until {
my $c = shift;
my $time = shift;
Lutim::DB::SQLite->do(
'UPDATE lutim SET created_by = "" WHERE path IS NOT NULL AND created_at < ?',
{},
$time
);
$c->app->sqlite->db->query('UPDATE lutim SET created_by = NULL WHERE path IS NOT NULL AND created_at < ?', $time);
return $c;
}
......@@ -164,15 +125,18 @@ sub get_no_longer_viewed_files {
my @images;
my @records = Lutim::DB::SQLite::Lutim->select('WHERE enabled = 1 AND last_access_at < ?', $time);
my $records = $c->app->sqlite->db->query('SELECT * FROM lutim WHERE enabled = 1 AND last_access_at < ?', $time)->{hashes};
for my $e (@records) {
my $i = Lutim::DB::Image->new(app => $c->app);
$i->record($e);
$i->_slurp;
$records->each(
sub {
my ($e, $num) = @_;
my $i = Lutim::DB::Image->new(app => $c->app);
$i->record(1);
$i->_slurp($e);
push @images, $i;
}
push @images, $i;
}
);
return c(@images);
}
......@@ -182,15 +146,17 @@ sub get_images_to_clean {
my @images;
my @records = Lutim::DB::SQLite::Lutim->select('WHERE enabled = 1 AND (delete_at_day * 86400) < (? - created_at) AND delete_at_day != 0', time());
my $records = $c->app->sqlite->db->query('SELECT * FROM lutim WHERE enabled = 1 AND (delete_at_day * 86400) < (? - created_at) AND delete_at_day != 0', time())->hashes;
for my $e (@records) {
my $i = Lutim::DB::Image->new(app => $c->app);
$i->record($e);
$i->_slurp;
$records->each(
sub {
my ($e, $num) = @_;
my $i = Lutim::DB::Image->new(app => $c->app);
$i->_slurp($e);
push @images, $i;
}
push @images, $i;
}
);
return c(@images);
}
......@@ -200,15 +166,17 @@ sub get_50_oldest {
my @images;
my @records = Lutim::DB::SQLite::Lutim->select('WHERE path IS NOT NULL AND enabled = 1 ORDER BY created_at ASC LIMIT 50');
my $records = $c->app->sqlite->db->query('SELECT * FROM lutim WHERE path IS NOT NULL AND enabled = 1 ORDER BY created_at ASC LIMIT 50')->hashes;
for my $e (@records) {
my $i = Lutim::DB::Image->new(app => $c->app);
$i->record($e);
$i->_slurp;
$records->each(
sub {
my ($e, $num) = @_;
my $i = Lutim::DB::Image->new(app => $c->app);
$i->_slurp($e);
push @images, $i;
}
push @images, $i;
}
);
return c(@images);
}
......@@ -216,7 +184,7 @@ sub get_50_oldest {
sub disable {
my $c = shift;
$c->record->update(enabled => 0);
$c->app->sqlite->db->query('UPDATE lutim SET enabled = 0 WHERE short = ?', $c->short);
$c->enabled(0);
return $c;
......@@ -224,34 +192,38 @@ sub disable {
sub _slurp {
my $c = shift;
my $r = shift;
my @images;
if ($c->record) {
@images = ($c->record);
} elsif ($c->short) {
@images = Lutim::DB::SQLite::Lutim->select('WHERE short = ?', $c->short);
my $image;
if (defined $r) {
$image = $r;
} else {
my $images = $c->app->sqlite->db->query('SELECT * FROM lutim WHERE short = ?', $c->short)->hashes;
if ($images->size) {
$image = $images->first;
}
}
if (scalar @images) {
my $image = $images[0];
$c->short($image->short);
$c->path($image->path);
$c->footprint($image->footprint);
$c->enabled($image->enabled);
$c->mediatype($image->mediatype);
$c->filename($image->filename);
$c->counter($image->counter);
$c->delete_at_first_view($image->delete_at_first_view);
$c->delete_at_day($image->delete_at_day);
$c->created_at($image->created_at);
$c->created_by($image->created_by);
$c->last_access_at($image->last_access_at);
$c->mod_token($image->mod_token);
$c->width($image->width);
$c->height($image->height);
$c->record($image) unless $c->record;
if ($image) {
$c->short($image->{short});
$c->path($image->{path});
$c->footprint($image->{footprint});
$c->enabled($image->{enabled});
$c->mediatype($image->{mediatype});
$c->filename($image->{filename});
$c->counter($image->{counter});
$c->delete_at_first_view($image->{delete_at_first_view});
$c->delete_at_day($image->{delete_at_day});
$c->created_at($image->{created_at});
$c->created_by($image->{created_by});
$c->last_access_at($image->{last_access_at});
$c->mod_token($image->{mod_token});
$c->width($image->{width});
$c->height($image->{height});
$c->iv($image->{iv});
$c->record(1);
}
return $c;
......
......@@ -45,7 +45,8 @@ use ORLite {
last_access_at INTEGER,
mod_token TEXT,
width INTEGER,
height INTEGER)'
height INTEGER,
iv TEXT)'
);
return 1;
}
......
......@@ -4,6 +4,7 @@ use Mojo::Base 'Mojolicious::Plugin';
use Mojo::Util qw(quote);
use Crypt::CBC;
use Data::Entropy qw(entropy_source);
use DateTime;
sub register {
my ($self, $app) = @_;
......@@ -17,9 +18,21 @@ sub register {
# Database migration
my $migrations = Mojo::Pg::Migrations->new(pg => $app->pg);
if ($app->mode eq 'development' && $ENV{LUTIM_DEBUG}) {
$migrations->from_file('utilities/migrations.sql')->migrate(0)->migrate(1);
$migrations->from_file('utilities/migrations/postgresql.sql')->migrate(0)->migrate(2);
} else {
$migrations->from_file('utilities/migrations.sql')->migrate(1);
$migrations->from_file('utilities/migrations/postgresql.sql')->migrate(2);
}
} elsif ($app->config('dbtype') eq 'sqlite') {
# SQLite database migration if needed
use Mojo::SQLite;
$app->helper(sqlite => \&_sqlite);
my $sql = Mojo::SQLite->new('sqlite:'.$app->config('db_path'));
my $migrations = $sql->migrations;
if ($app->mode eq 'development' && $ENV{LUTIM_DEBUG}) {
$migrations->from_file('utilities/migrations/sqlite.sql')->migrate(0)->migrate(2);
} else {
$migrations->from_file('utilities/migrations/sqlite.sql')->migrate(2);
}
}
......@@ -43,9 +56,23 @@ sub _pg {
return $pg;
}
sub _sqlite {
my $c = shift;
state $sqlite = Mojo::SQLite->new('sqlite:'.$c->app->config('db_path'));
return $sqlite;
}
sub _render_file {
my $c = shift;
my ($im_loaded, $filename, $path, $mediatype, $dl, $expires, $nocache, $key, $thumb) = @_;
my ($im_loaded, $img, $dl, $key, $thumb) = @_;
my ($filename, $path, $iv, $mediatype, $no_cache) = ($img->filename, $img->path, $img->iv, $img->mediatype, $img->delete_at_first_view);
my $expires = ($img->delete_at_day) ? $img->delete_at_day : 360;
my $dt = DateTime->from_epoch( epoch => $expires * 86400 + $img->created_at);
$dt->set_time_zone('GMT');
$expires = $dt->strftime("%a, %d %b %Y %H:%M:%S GMT");
$dl = 'attachment' if ($mediatype =~ m/svg/);
$filename = quote($filename);
......@@ -62,7 +89,7 @@ sub _render_file {
$mediatype =~ s/x-//;
my $headers = Mojo::Headers->new();
if ($nocache || defined($thumb)) {
if ($no_cache || defined($thumb)) {
$headers->add('Cache-Control' => 'no-cache, no-store, max-age=0, must-revalidate');
} else {
$headers->add('Expires' => $expires);
......@@ -72,7 +99,7 @@ sub _render_file {
$c->res->content->headers($headers);
if ($key) {
$asset = $c->decrypt($key, $path);
$asset = $c->decrypt($key, $path, $iv);
} else {
$asset = Mojo::Asset::File->new(path => $path);
}
......@@ -191,12 +218,13 @@ sub _crypt {
my $filename = shift;
my $key = $c->shortener($c->config('crypto_key_length'));
my $iv = $c->shortener(8);
my $cipher = Crypt::CBC->new(
-key => $key,
-cipher => 'Blowfish',
-header => 'none',
-iv => 'dupajasi'
-iv => $iv
);
$cipher->start('encrypting');
......@@ -210,19 +238,21 @@ sub _crypt {
$crypt_upload->filename($filename);
$crypt_upload->asset($crypt_asset);
return ($crypt_upload, $key);
return ($crypt_upload, $key, $iv);
}
sub _decrypt {
my $c = shift;
my $key = shift;
my $file = shift;
my $iv = shift;
$iv = 'dupajasi' unless $iv;
my $cipher = Crypt::CBC->new(
-key => $key,
-cipher => 'Blowfish',
-header => 'none',
-iv => 'dupajasi'
-iv => $iv
);
$cipher->start('decrypting');
......
......@@ -118,7 +118,7 @@
# you can define it relative to lutim directory or set an absolute path
# remember that it has to be in a directory writable by Lutim user
# optional, default is lutim.db
db_path => 'testdqlite1.db',
db_path => 'testsqlite1.db',
# PostgreSQL ONLY - only used if dbtype is set to postgresql
# these are the credentials to access the PostgreSQL database
......
......@@ -196,7 +196,7 @@ msgstr ""
msgid "Image delay"
msgstr ""
#: lib/Lutim/Controller.pm:752
#: lib/Lutim/Controller.pm:748
msgid "Image not found."
msgstr ""
......@@ -314,7 +314,7 @@ msgid "Something bad happened"
msgstr ""
#. ($c->config('contact')
#: lib/Lutim/Controller.pm:759
#: lib/Lutim/Controller.pm:755
msgid "Something went wrong when creating the zip file. Try again later or contact the administrator (%1)."
msgstr ""
......@@ -355,7 +355,7 @@ msgid "The delete token is invalid."
msgstr ""
#. ($upload->filename)
#: lib/Lutim/Controller.pm:485
#: lib/Lutim/Controller.pm:486
msgid "The file %1 is not an image."
msgstr ""
......@@ -393,7 +393,7 @@ msgid "The images you post on Lutim can be stored indefinitely or be deleted at
msgstr ""
#. ($c->config->{contact})
#: lib/Lutim/Controller.pm:482
#: lib/Lutim/Controller.pm:483
msgid "There is no more available URL. Retry or contact the administrator. %1"
msgstr ""
......@@ -418,7 +418,7 @@ msgstr ""
msgid "Unable to find the image %1."
msgstr ""
#: lib/Lutim/Controller.pm:571 lib/Lutim/Controller.pm:616 lib/Lutim/Controller.pm:658 lib/Lutim/Controller.pm:701 lib/Lutim/Controller.pm:713 lib/Lutim/Controller.pm:724 lib/Lutim/Controller.pm:749 lib/Lutim/Plugin/Helpers.pm:57
#: lib/Lutim/Controller.pm:572 lib/Lutim/Controller.pm:617 lib/Lutim/Controller.pm:654 lib/Lutim/Controller.pm:697 lib/Lutim/Controller.pm:709 lib/Lutim/Controller.pm:720 lib/Lutim/Controller.pm:745 lib/Lutim/Plugin/Helpers.pm:84
msgid "Unable to find the image: it has been deleted."
msgstr ""
......@@ -443,7 +443,7 @@ msgid "Uploaded files by days"
msgstr ""
#. ($c->app->config('contact')
#: lib/Lutim/Plugin/Helpers.pm:156
#: lib/Lutim/Plugin/Helpers.pm:183
msgid "Uploading is currently disabled, please try later or contact the administrator (%1)."
msgstr ""
......