Commit 883004b7 authored by Luc Didry's avatar Luc Didry

Use random Initialization Vector for encryption

+ now use Mojo::SQLite instead of ORLite This commit is dedicated to Antonio Ferreira, who is supporting me with Ǧ1. Many thanks :-)
parent 5a5e629e
Pipeline #42105 passed with stages
in 5 minutes 12 seconds
......@@ -5,13 +5,13 @@ requires 'Net::SSLeay', '>= 1.81';
requires 'Data::Validate::URI';
requires 'Net::Domain::TLD', '>= 1.73'; # Must have the last version to handle (at least) .xyz and .link
requires 'Mojo::Pg';
requires 'Mojo::SQLite';
requires 'Mojolicious::Plugin::I18N';
requires 'Mojolicious::Plugin::DebugDumperHelper';
requires 'Mojolicious::Plugin::PgURLHelper';
requires 'Mojolicious::Plugin::StaticCache';
requires "Minion", "== 4.06";
requires 'Minion::Backend::SQLite', "== 0.009";
requires 'ORLite';
requires 'Text::Unidecode';
requires 'DateTime';
requires 'Filesys::DiskUsage';
......
This diff is collapsed.
......@@ -444,9 +444,9 @@ sub add {
}
}
my $key;
my ($key, $iv);
if ($c->param('crypt') || $c->config('always_encrypt')) {
($upload, $key) = $c->crypt($upload, $filename);
($upload, $key, $iv) = $c->crypt($upload, $filename);
}
$upload->move_to($path);
......@@ -461,6 +461,7 @@ sub add {
->created_by($ip)
->width($width)
->height($height)
->iv($iv)
->write;
# Log image creation
......@@ -617,12 +618,7 @@ sub short {
);
return $c->redirect_to('/');
} else {
my $expires = ($image->delete_at_day) ? $image->delete_at_day : 360;
my $dt = DateTime->from_epoch( epoch => $expires * 86400 + $image->created_at);
$dt->set_time_zone('GMT');
$expires = $dt->strftime("%a, %d %b %Y %H:%M:%S GMT");
$test = $c->render_file($im_loaded, $image->filename, $image->path, $image->mediatype, $dl, $expires, $image->delete_at_first_view, $key, $thumb);
$test = $c->render_file($im_loaded, $image, $dl, $key, $thumb);
}
}
......
......@@ -17,6 +17,7 @@ has 'last_access_at';
has 'mod_token';
has 'width';
has 'height';
has 'iv';
has 'app';
=head1 NAME
......@@ -64,6 +65,8 @@ Have a look at Lutim::DB::Image::SQLite's code: it's simple and may be more unde
=item B<height> : integer
=item B<iv> : initialization vector for the file encryption
=item B<app> : a mojolicious object
=back
......@@ -125,7 +128,8 @@ sub to_hash {
last_access_at => $c->last_access_at,
mod_token => $c->mod_token,
width => $c->width,
height => $c->height
height => $c->height,
height => $c->iv
};
}
......
......@@ -81,9 +81,9 @@ sub write {
my $c = shift;
if ($c->record) {
$c->app->pg->db->query('UPDATE lutim SET counter = ?, created_at = ?, created_by = ?, delete_at_day = ?, delete_at_first_view = ?, enabled = ?, filename = ?, footprint = ?, height = ?, last_access_at = ?, mediatype = ?, mod_token = ?, path = ?, short = ?, width = ? WHERE short = ?', $c->counter, $c->created_at, $c->created_by, $c->delete_at_day, $c->delete_at_first_view, $c->enabled, $c->filename, $c->footprint, $c->height, $c->last_access_at, $c->mediatype, $c->mod_token, $c->path, $c->short, $c->width, $c->short);
$c->app->pg->db->query('UPDATE lutim SET counter = ?, created_at = ?, created_by = ?, delete_at_day = ?, delete_at_first_view = ?, enabled = ?, filename = ?, footprint = ?, height = ?, last_access_at = ?, mediatype = ?, mod_token = ?, path = ?, short = ?, width = ?, iv = ? WHERE short = ?', $c->counter, $c->created_at, $c->created_by, $c->delete_at_day, $c->delete_at_first_view, $c->enabled, $c->filename, $c->footprint, $c->height, $c->last_access_at, $c->mediatype, $c->mod_token, $c->path, $c->short, $c->width, $c->iv, $c->short);
} else {
$c->app->pg->db->query('INSERT INTO lutim (counter, created_at, created_by, delete_at_day, delete_at_first_view, enabled, filename, footprint, height, last_access_at, mediatype, mod_token, path, short, width) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)', $c->counter, $c->created_at, $c->created_by, $c->delete_at_day, $c->delete_at_first_view, $c->enabled, $c->filename, $c->footprint, $c->height, $c->last_access_at, $c->mediatype, $c->mod_token, $c->path, $c->short, $c->width);
$c->app->pg->db->query('INSERT INTO lutim (counter, created_at, created_by, delete_at_day, delete_at_first_view, enabled, filename, footprint, height, last_access_at, mediatype, mod_token, path, short, width, iv) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)', $c->counter, $c->created_at, $c->created_by, $c->delete_at_day, $c->delete_at_first_view, $c->enabled, $c->filename, $c->footprint, $c->height, $c->last_access_at, $c->mediatype, $c->mod_token, $c->path, $c->short, $c->width, $c->iv);
$c->record(1);
}
......@@ -220,6 +220,7 @@ sub _slurp {
$c->mod_token($image->{mod_token});
$c->width($image->{width});
$c->height($image->{height});
$c->iv($image->{iv});
$c->record(1);
}
......
This diff is collapsed.
......@@ -45,7 +45,8 @@ use ORLite {
last_access_at INTEGER,
mod_token TEXT,
width INTEGER,
height INTEGER)'
height INTEGER,
iv TEXT)'
);
return 1;
}
......
......@@ -4,6 +4,7 @@ use Mojo::Base 'Mojolicious::Plugin';
use Mojo::Util qw(quote);
use Crypt::CBC;
use Data::Entropy qw(entropy_source);
use DateTime;
sub register {
my ($self, $app) = @_;
......@@ -17,9 +18,21 @@ sub register {
# Database migration
my $migrations = Mojo::Pg::Migrations->new(pg => $app->pg);
if ($app->mode eq 'development' && $ENV{LUTIM_DEBUG}) {
$migrations->from_file('utilities/migrations.sql')->migrate(0)->migrate(1);
$migrations->from_file('utilities/migrations/postgresql.sql')->migrate(0)->migrate(2);
} else {
$migrations->from_file('utilities/migrations.sql')->migrate(1);
$migrations->from_file('utilities/migrations/postgresql.sql')->migrate(2);
}
} elsif ($app->config('dbtype') eq 'sqlite') {
# SQLite database migration if needed
use Mojo::SQLite;
$app->helper(sqlite => \&_sqlite);
my $sql = Mojo::SQLite->new('sqlite:'.$app->config('db_path'));
my $migrations = $sql->migrations;
if ($app->mode eq 'development' && $ENV{LUTIM_DEBUG}) {
$migrations->from_file('utilities/migrations/sqlite.sql')->migrate(0)->migrate(2);
} else {
$migrations->from_file('utilities/migrations/sqlite.sql')->migrate(2);
}
}
......@@ -43,9 +56,23 @@ sub _pg {
return $pg;
}
sub _sqlite {
my $c = shift;
state $sqlite = Mojo::SQLite->new('sqlite:'.$c->app->config('db_path'));
return $sqlite;
}
sub _render_file {
my $c = shift;
my ($im_loaded, $filename, $path, $mediatype, $dl, $expires, $nocache, $key, $thumb) = @_;
my ($im_loaded, $img, $dl, $key, $thumb) = @_;
my ($filename, $path, $iv, $mediatype, $no_cache) = ($img->filename, $img->path, $img->iv, $img->mediatype, $img->delete_at_first_view);
my $expires = ($img->delete_at_day) ? $img->delete_at_day : 360;
my $dt = DateTime->from_epoch( epoch => $expires * 86400 + $img->created_at);
$dt->set_time_zone('GMT');
$expires = $dt->strftime("%a, %d %b %Y %H:%M:%S GMT");
$dl = 'attachment' if ($mediatype =~ m/svg/);
$filename = quote($filename);
......@@ -62,7 +89,7 @@ sub _render_file {
$mediatype =~ s/x-//;
my $headers = Mojo::Headers->new();
if ($nocache || defined($thumb)) {
if ($no_cache || defined($thumb)) {
$headers->add('Cache-Control' => 'no-cache, no-store, max-age=0, must-revalidate');
} else {
$headers->add('Expires' => $expires);
......@@ -72,7 +99,7 @@ sub _render_file {
$c->res->content->headers($headers);
if ($key) {
$asset = $c->decrypt($key, $path);
$asset = $c->decrypt($key, $path, $iv);
} else {
$asset = Mojo::Asset::File->new(path => $path);
}
......@@ -191,12 +218,13 @@ sub _crypt {
my $filename = shift;
my $key = $c->shortener($c->config('crypto_key_length'));
my $iv = $c->shortener(8);
my $cipher = Crypt::CBC->new(
-key => $key,
-cipher => 'Blowfish',
-header => 'none',
-iv => 'dupajasi'
-iv => $iv
);
$cipher->start('encrypting');
......@@ -210,19 +238,21 @@ sub _crypt {
$crypt_upload->filename($filename);
$crypt_upload->asset($crypt_asset);
return ($crypt_upload, $key);
return ($crypt_upload, $key, $iv);
}
sub _decrypt {
my $c = shift;
my $key = shift;
my $file = shift;
my $iv = shift;
$iv = 'dupajasi' unless $iv;
my $cipher = Crypt::CBC->new(
-key => $key,
-cipher => 'Blowfish',
-header => 'none',
-iv => 'dupajasi'
-iv => $iv
);
$cipher->start('decrypting');
......
......@@ -118,7 +118,7 @@
# you can define it relative to lutim directory or set an absolute path
# remember that it has to be in a directory writable by Lutim user
# optional, default is lutim.db
db_path => 'testdqlite1.db',
db_path => 'testsqlite1.db',
# PostgreSQL ONLY - only used if dbtype is set to postgresql
# these are the credentials to access the PostgreSQL database
......
......@@ -196,7 +196,7 @@ msgstr ""
msgid "Image delay"
msgstr ""
#: lib/Lutim/Controller.pm:752
#: lib/Lutim/Controller.pm:748
msgid "Image not found."
msgstr ""
......@@ -314,7 +314,7 @@ msgid "Something bad happened"
msgstr ""
#. ($c->config('contact')
#: lib/Lutim/Controller.pm:759
#: lib/Lutim/Controller.pm:755
msgid "Something went wrong when creating the zip file. Try again later or contact the administrator (%1)."
msgstr ""
......@@ -355,7 +355,7 @@ msgid "The delete token is invalid."
msgstr ""
#. ($upload->filename)
#: lib/Lutim/Controller.pm:485
#: lib/Lutim/Controller.pm:486
msgid "The file %1 is not an image."
msgstr ""
......@@ -393,7 +393,7 @@ msgid "The images you post on Lutim can be stored indefinitely or be deleted at
msgstr ""
#. ($c->config->{contact})
#: lib/Lutim/Controller.pm:482
#: lib/Lutim/Controller.pm:483
msgid "There is no more available URL. Retry or contact the administrator. %1"
msgstr ""
......@@ -418,7 +418,7 @@ msgstr ""
msgid "Unable to find the image %1."
msgstr ""
#: lib/Lutim/Controller.pm:571 lib/Lutim/Controller.pm:616 lib/Lutim/Controller.pm:658 lib/Lutim/Controller.pm:701 lib/Lutim/Controller.pm:713 lib/Lutim/Controller.pm:724 lib/Lutim/Controller.pm:749 lib/Lutim/Plugin/Helpers.pm:57
#: lib/Lutim/Controller.pm:572 lib/Lutim/Controller.pm:617 lib/Lutim/Controller.pm:654 lib/Lutim/Controller.pm:697 lib/Lutim/Controller.pm:709 lib/Lutim/Controller.pm:720 lib/Lutim/Controller.pm:745 lib/Lutim/Plugin/Helpers.pm:84
msgid "Unable to find the image: it has been deleted."
msgstr ""
......@@ -443,7 +443,7 @@ msgid "Uploaded files by days"
msgstr ""
#. ($c->app->config('contact')
#: lib/Lutim/Plugin/Helpers.pm:156
#: lib/Lutim/Plugin/Helpers.pm:183
msgid "Uploading is currently disabled, please try later or contact the administrator (%1)."
msgstr ""
......
......@@ -18,3 +18,7 @@ CREATE TABLE IF NOT EXISTS lutim (
);
-- 1 down
DROP TABLE lutim;
-- 2 up
ALTER TABLE lutim ADD COLUMN iv text;
-- 2 down
ALTER TABLE lutim DROP COLUMN iv;
-- 1 up
CREATE TABLE IF NOT EXISTS lutim (
short TEXT PRIMARY KEY,
path TEXT,
footprint TEXT,
enabled INTEGER,
mediatype TEXT,
filename TEXT,
counter INTEGER,
delete_at_first_view INTEGER,
delete_at_day INTEGER,
created_at INTEGER,
created_by TEXT,
last_access_at INTEGER,
mod_token TEXT,
width INTEGER,
height INTEGER
);
-- 1 down
DROP TABLE lutim;
-- 2 up
ALTER TABLE lutim ADD COLUMN iv TEXT;
-- 2 down
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment