holm/egroupware
1
1
Fork 0
forked from extern/egroupware
Code Issues Pull Requests Packages Projects Releases Wiki Activity

attempt fix in class crypto, data manipulation in encrypt and decrypt should mirror each other

Browse Source
This commit is contained in:
angles 2001-12-14 21:38:40 +00:00
parent 80162794d8
commit d4b52f9fcb
1 changed files with 44 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
phpgwapi/inc/class.crypto.inc.php
View File

@ -4,7 +4,7 @@
* This file written by Joseph Engo <jengo@phpgroupware.org> *
* Handles encrypting strings based on various encryption schemes *
* Copyright (C) 2000, 2001 Dan Kuykendall *
* -------------------------------------------------------------------------*
* ------------------------------------------------------------------------- *
* This library is part of the phpGroupWare API *
* http://www.phpgroupware.org/api *
* ------------------------------------------------------------------------ *
@ -41,7 +41,7 @@
$this->mcrypt_version = $GLOBALS['phpgw_info']['server']['versions']['mcrypt'];
if ($this->mcrypt_version == 'old')
{
$this->td = false;
$this->td = False;
if (phpversion() > '4.0.2pl1')
{
$keysize = mcrypt_get_key_size(MCRYPT_TRIPLEDES);
@ -99,12 +99,13 @@
function encrypt($data)
{
$data = serialize($data);
$data = addslashes($data);
// Disable all encryption if the admin didn't set it up
if ($this->enabled)
{
// ONLY manipulate data if we are going to encrypt it
// question: why do we sreialize and add slashes before encrypting?? (ed: Angles)
$data = serialize($data);
$data = addslashes($data);
switch ($this->mcrypt_version)
{
// The old code, only works with mcrypt <= 2.2.x
@ -124,7 +125,9 @@
return $encrypteddata;
}
else
{ // No mcrypt == insecure !
{
// No mcrypt == insecure !
// Data should be returned *unmolested* if encryption is not enabled
return $data;
}
}
@ -147,12 +150,21 @@
$data = mdecrypt_generic($this->td, $data);
break;
}
// hey -- since the encrypt() function calls serialize and then addslashes,
// we should always do the reverse -- correct? (ed: Del)
$data = stripslashes($data);
$data = unserialize($data);
// question: was it necessary to serialize and addslashes *before* encryption in the first place? (ed: Angles)
}
else
{
$data = $encrypteddata;
// Data should be returned *unmolested* if encryption is not enabled
return $data;
}
/*
// this is apparently intended to allow encryption of objects
// at this point Dec 14, 2001, we simply need to handle strings correctly
// which was broken previously (ed: Angles)
if(!strpos(' '.$data,'O:8:"stdClass"'))
{
return unserialize($data);
@ -162,6 +174,7 @@
$data = stripslashes($data);
return $data;
}
*/
}
} // class crypto
?>