gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Encrypt the URL query when sensitive data is present

Browse Source 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
This commit is contained in:
Maurício Meneghini Fauth 2021-10-13 11:51:56 -03:00
parent 0c34fc85c4
commit eb9bcbc040
No known key found for this signature in database
GPG Key ID: 6A16FD38AFC89CC8
2 changed files with 65 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

53
libraries/classes/Url.php
View File

@ -7,6 +7,9 @@
*/
namespace PhpMyAdmin;
use phpseclib\Crypt\AES;
use phpseclib\Crypt\Random;
/**
* Static methods for URL/hidden inputs generating
*
@ -220,6 +223,11 @@ class Url
$query = http_build_query($params, null, $separator);
if (isset($params['db'])) {
$encryptedQuery = self::encryptQuery($query);
$query = http_build_query(['eq' => $encryptedQuery], null, $separator);
}
if ($divider != '?' || strlen($query) > 0) {
return $divider . $query;
}
@ -227,6 +235,51 @@ class Url
return '';
}
/**
* @param string $query
* @return string
*/
public static function encryptQuery($query)
{
global $PMA_Config;
$key = $_SESSION[' HMAC_secret '] . $PMA_Config->get('blowfish_secret');
$cipher = new AES(AES::MODE_CBC);
$iv = Random::string(16);
$cipher->setIV($iv);
$cipher->setKey($key);
$ciphertext = $cipher->encrypt($query);
$hmac = hash_hmac('sha256', $iv . $ciphertext, $key, true);
return strtr(base64_encode($hmac . $iv . $ciphertext), '+/', '-_');
}
/**
* @param string $query
* @return string|null
*/
public static function decryptQuery($query)
{
global $PMA_Config;
$encryptedQuery = base64_decode(strtr($query, '-_', '+/'));
$hmac = mb_substr($encryptedQuery, 0, 32, '8bit');
$iv = mb_substr($encryptedQuery, 32, 16, '8bit');
$ciphertext = mb_substr($encryptedQuery, 48, null, '8bit');
$key = $_SESSION[' HMAC_secret '] . $PMA_Config->get('blowfish_secret');
$calculated = hash_hmac('sha256', $iv . $ciphertext, $key, true);
if (! hash_equals($hmac, $calculated)) {
return null;
}
$cipher = new AES(AES::MODE_CBC);
$cipher->setIV($iv);
$cipher->setKey($key);
return $cipher->decrypt($ciphertext);
}
/**
* Returns url separator
*

12
libraries/common.inc.php
View File

@ -43,6 +43,7 @@ use PhpMyAdmin\Response;
use PhpMyAdmin\Session;
use PhpMyAdmin\ThemeManager;
use PhpMyAdmin\Tracker;
use PhpMyAdmin\Url;
use PhpMyAdmin\Util;
/**
@ -132,6 +133,17 @@ if (! defined('PMA_NO_SESSION')) {
Session::setUp($GLOBALS['PMA_Config'], $GLOBALS['error_handler']);
}
if (isset($_GET['eq']) && is_string($_GET['eq'])) {
$decryptedQuery = Url::decryptQuery($_GET['eq']);
if ($decryptedQuery !== null) {
parse_str($decryptedQuery, $urlQueryParams);
foreach ($urlQueryParams as $urlQueryParamKey => $urlQueryParamValue) {
$_GET[$urlQueryParamKey] = $urlQueryParamValue;
$_REQUEST[$urlQueryParamKey] = $urlQueryParamValue;
}
}
}
/**
* init some variables LABEL_variables_init
*/