Merge #20092 - Add warning message if URLQueryEncryptionSecretKey is not valid

Pull-request: #20092
Signed-off-by: William Desportes <williamdes@wdes.fr>

libraries/classes/Controllers/HomeController.php

@@ -347,6 +347,40 @@ class HomeController extends AbstractController
             }
         }
 
+        /**
+         * Check if user does not have defined query encryption key and it is being used.
+         */
+        if ($cfg['URLQueryEncryption']) {
+            $encryptionKeyLength = 0;
+            // This can happen if the user did use getenv() to set URLQueryEncryptionSecretKey
+            if (is_string($cfg['URLQueryEncryptionSecretKey'])) {
+                $encryptionKeyLength = mb_strlen($cfg['URLQueryEncryptionSecretKey'], '8bit');
+            }
+
+            if ($encryptionKeyLength < SODIUM_CRYPTO_SECRETBOX_KEYBYTES) {
+                $this->errors[] = [
+                    'message' => __(
+                        'The configuration file needs a valid key for query encryption.'
+                        . ' A temporary key was automatically generated for you.'
+                        . ' Please refer to the [doc@cfg_URLQueryEncryptionSecretKey]documentation[/doc].'
+                    ),
+                    'severity' => 'warning',
+                ];
+            } elseif ($encryptionKeyLength > SODIUM_CRYPTO_SECRETBOX_KEYBYTES) {
+                $this->errors[] = [
+                    'message' => sprintf(
+                        __(
+                            'The query encryption key in the configuration file is longer than necessary.'
+                            . ' It should only be %d bytes long.'
+                            . ' Please refer to the [doc@cfg_URLQueryEncryptionSecretKey]documentation[/doc].'
+                        ),
+                        SODIUM_CRYPTO_SECRETBOX_KEYBYTES
+                    ),
+                    'severity' => 'warning',
+                ];
+            }
+        }
+
         /**
          * Check for existence of config directory which should not exist in
          * production environment.

phpstan-baseline.neon

@@ -6105,6 +6105,16 @@ parameters:
 			count: 1
 			path: libraries/classes/Controllers/HomeController.php
 
+		-
+			message: "#^Cannot access offset 'URLQueryEncryption' on mixed\\.$#"
+			count: 1
+			path: libraries/classes/Controllers/HomeController.php
+
+		-
+			message: "#^Cannot access offset 'URLQueryEncryptionS…' on mixed\\.$#"
+			count: 1
+			path: libraries/classes/Controllers/HomeController.php
+
 		-
 			message: "#^Cannot access offset 'VersionCheck' on mixed\\.$#"
 			count: 1

psalm-baseline.xml

@@ -2091,6 +2091,10 @@
     </MixedArrayAssignment>
   </file>
   <file src="libraries/classes/Controllers/HomeController.php">
+    <InvalidArrayOffset occurrences="2">
+      <code>$cfg['URLQueryEncryption']</code>
+      <code>$cfg['URLQueryEncryptionSecretKey']</code>
+    </InvalidArrayOffset>
     <MixedArgument occurrences="3">
       <code>$message</code>
       <code>$this-&gt;config-&gt;get('ShowGitRevision') ?? true</code>