Twig, Tests, AES,

2021-12-08 16:53:43 +01:00
parent 25d47f7528
commit 918244125c
74 changed files with 5350 additions and 1515 deletions
--- a/core/Objects/AesStream.class.php
+++ b/core/Objects/AesStream.class.php
@@ -24,11 +24,11 @@ class AesStream {
    }
  }

-  public function setInput($file) {
+  public function setInputFile(string $file) {
    $this->inputFile = $file;
  }

-  public function setOutput($callback) {
+  public function setOutput(callable $callback) {
    $this->callback = $callback;
  }

@@ -36,51 +36,13 @@ class AesStream {
    $this->outputFile = $file;
  }

-  private function add(string $a, int $b): string {
-    // counter $b is n = PHP_INT_SIZE bytes large
-    $b_arr = pack('I', $b);
-    $b_size = strlen($b_arr);
-    $a_size = strlen($a);
-
-    $prefix = "";
-    if ($a_size > $b_size) {
-      $prefix = substr($a, 0, $a_size - $b_size);
-    }
-
-    // xor last n bytes of $a with $b
-    $xor = substr($a, strlen($prefix), $b_size);
-    if (strlen($xor) !== strlen($b_arr)) {
-      var_dump($xor);
-      var_dump($b_arr);
-      die();
-    }
-    $xor = $this->xor($xor, $b_arr);
-    return $prefix . $xor;
-  }
-
-  private function xor(string $a, string $b): string {
-    $arr_a = str_split($a);
-    $arr_b = str_split($b);
-    if (strlen($a) !== strlen($b)) {
-      var_dump($a);
-      var_dump($b);
-      var_dump(range(0, strlen($a) - 1));
-      die();
-    }
-
-    return implode("", array_map(function($i) use ($arr_a, $arr_b) {
-      return chr(ord($arr_a[$i]) ^ ord($arr_b[$i]));
-    }, range(0, strlen($a) - 1)));
-  }
-
  public function start(): bool {
    if (!$this->inputFile) {
      return false;
    }

    $blockSize = 16;
-    $bitStrength = strlen($this->key) * 8;
-    $aesMode   = "AES-$bitStrength-ECB";
+    $aesMode   = $this->getCipherMode();

    $outputHandle = null;
    $inputHandle = fopen($this->inputFile, "rb");
@@ -91,25 +53,30 @@ class AesStream {
    if ($this->outputFile !== null) {
      $outputHandle = fopen($this->outputFile, "wb");
      if (!$outputHandle) {
+        fclose($inputHandle);
        return false;
      }
    }

-    $counter = 0;
-    while (!feof($inputHandle)) {
-      $chunk = fread($inputHandle, 4096);
-      $chunkSize = strlen($chunk);
-      for ($offset = 0; $offset < $chunkSize; $offset += $blockSize) {
-        $block = substr($chunk, $offset, $blockSize);
-        if (strlen($block) !== $blockSize) {
-          $padding = ($blockSize - strlen($block));
-          $block .= str_repeat(chr($padding), $padding);
-        }
+    set_time_limit(0);

-        $ivCounter = $this->add($this->iv, $counter + 1);
-        $encrypted = substr(openssl_encrypt($ivCounter, $aesMode, $this->key, OPENSSL_RAW_DATA), 0, $blockSize);
-        $encrypted = $this->xor($encrypted, $block);
-        if (is_callable($this->callback)) {
+    $ivCounter = $this->iv;
+    $modulo = \gmp_init("0x1" . str_repeat("00", $blockSize), 16);
+
+    while (!feof($inputHandle)) {
+      $chunk = fread($inputHandle, 65536);
+      $chunkSize = strlen($chunk);
+      if ($chunkSize > 0) {
+        $blockCount = intval(ceil($chunkSize / $blockSize));
+        $encrypted = openssl_encrypt($chunk, $aesMode, $this->key, OPENSSL_RAW_DATA | OPENSSL_NO_PADDING, $ivCounter);
+
+        $ivNumber = \gmp_init(bin2hex($ivCounter), 16);
+        $ivNumber = \gmp_add($ivNumber, $blockCount);
+        $ivNumber = \gmp_mod($ivNumber, $modulo);
+        $ivNumber = str_pad(\gmp_strval($ivNumber, 16), $blockSize * 2, "0", STR_PAD_LEFT);
+        $ivCounter = hex2bin($ivNumber);
+
+        if ($this->callback !== null) {
          call_user_func($this->callback, $encrypted);
        }

@@ -123,4 +90,17 @@ class AesStream {
    if ($outputHandle) fclose($outputHandle);
    return true;
  }
+
+  public function getCipherMode(): string {
+    $bitStrength = strlen($this->key) * 8;
+    return "aes-$bitStrength-ctr";
+  }
+
+  public function getKey(): string {
+    return $this->key;
+  }
+
+  public function getIV(): string {
+    return $this->iv;
+  }
 }
--- a/core/Objects/Language.class.php
+++ b/core/Objects/Language.class.php
@@ -27,9 +27,6 @@ namespace Objects {
    public function getCode(): string { return $this->langCode; }
    public function getShortCode() { return substr($this->langCode, 0, 2); }
    public function getName() { return $this->langName; }
-    public function getIconPath() { return "/img/icons/lang/$this->langCode.gif"; }
-    public function getEntries() { return $this->entries; }
-    public function getModules() { return $this->modules; }

      /**
       * @param $module LanguageModule class or object
--- a/core/Objects/Session.class.php
+++ b/core/Objects/Session.class.php
@@ -4,6 +4,7 @@ namespace Objects;

 use DateTime;
 use \Driver\SQL\Condition\Compare;
+use Driver\SQL\Expression\CurrentTimeStamp;
 use Exception;
 use External\JWT;

@@ -118,7 +119,7 @@ class Session extends ApiObject {
    return false;
  }

-  public function destroy() {
+  public function destroy(): bool {
    return $this->user->getSQL()->update("Session")
      ->set("active", false)
      ->where(new Compare("Session.uid", $this->sessionId))
@@ -126,21 +127,26 @@ class Session extends ApiObject {
      ->execute();
  }

-  public function update() {
+  public function update(): bool {
    $this->updateMetaData();
    $minutes = Session::DURATION;

    $sql = $this->user->getSQL();
-    return $sql->update("Session")
-      ->set("Session.expires", (new DateTime())->modify("+$minutes minute"))
-      ->set("Session.ipAddress", $this->ipAddress)
-      ->set("Session.os", $this->os)
-      ->set("Session.browser", $this->browser)
-      ->set("Session.data", json_encode($_SESSION))
-      ->set("Session.csrf_token", $this->csrfToken)
-      ->where(new Compare("Session.uid", $this->sessionId))
-      ->where(new Compare("Session.user_id", $this->user->getId()))
-      ->execute();
+    return
+      $sql->update("User")
+        ->set("last_online", new CurrentTimeStamp())
+        ->where(new Compare("uid", $this->user->getId()))
+        ->execute() &&
+      $sql->update("Session")
+        ->set("Session.expires", (new DateTime())->modify("+$minutes minute"))
+        ->set("Session.ipAddress", $this->ipAddress)
+        ->set("Session.os", $this->os)
+        ->set("Session.browser", $this->browser)
+        ->set("Session.data", json_encode($_SESSION))
+        ->set("Session.csrf_token", $this->csrfToken)
+        ->where(new Compare("Session.uid", $this->sessionId))
+        ->where(new Compare("Session.user_id", $this->user->getId()))
+        ->execute();
  }

  public function getCsrfToken(): string {
--- a/core/Objects/User.class.php
+++ b/core/Objects/User.class.php
@@ -17,7 +17,9 @@ class User extends ApiObject {
  private ?Session $session;
  private int $uid;
  private string $username;
+  private string $fullName;
  private ?string $email;
+  private ?string $profilePicture;
  private Language $language;
  private array $groups;

@@ -55,6 +57,7 @@ class User extends ApiObject {
  public function getId(): int { return $this->uid; }
  public function isLoggedIn(): bool { return $this->loggedIn; }
  public function getUsername(): string { return $this->username; }
+  public function getFullName(): string { return $this->fullName; }
  public function getEmail(): ?string { return $this->email; }
  public function getSQL(): ?SQL { return $this->sql; }
  public function getLanguage(): Language { return $this->language; }
@@ -63,6 +66,7 @@ class User extends ApiObject {
  public function getConfiguration(): Configuration { return $this->configuration; }
  public function getGroups(): array { return $this->groups; }
  public function hasGroup(int $group): bool { return isset($this->groups[$group]); }
+  public function getProfilePicture() : ?string { return $this->profilePicture; }

  public function __debugInfo(): array {
    $debugInfo = array(
@@ -83,6 +87,8 @@ class User extends ApiObject {
      return array(
        'uid' => $this->uid,
        'name' => $this->username,
+        'fullName' => $this->fullName,
+        'profilePicture' => $this->profilePicture,
        'email' => $this->email,
        'groups' => $this->groups,
        'language' => $this->language->jsonSerialize(),
@@ -99,8 +105,10 @@ class User extends ApiObject {
    $this->uid = 0;
    $this->username = '';
    $this->email = '';
+    $this->groups = [];
    $this->loggedIn = false;
    $this->session = null;
+    $this->profilePicture = null;
  }

  public function logout(): bool {
@@ -137,9 +145,9 @@ class User extends ApiObject {
   * @param bool $sessionUpdate update session information, including session's lifetime and browser information
   * @return bool true, if the data could be loaded
   */
-  public function readData($userId, $sessionId, $sessionUpdate = true): bool {
+  public function readData($userId, $sessionId, bool $sessionUpdate = true): bool {

-    $res = $this->sql->select("User.name", "User.email",
+    $res = $this->sql->select("User.name", "User.email", "User.fullName", "User.profilePicture",
        "Language.uid as langId", "Language.code as langCode", "Language.name as langName",
        "Session.data", "Session.stay_logged_in", "Session.csrf_token", "Group.uid as groupId", "Group.name as groupName")
        ->from("User")
@@ -162,7 +170,10 @@ class User extends ApiObject {
        $csrfToken = $row["csrf_token"];
        $this->username = $row['name'];
        $this->email = $row["email"];
+        $this->fullName = $row["fullName"];
        $this->uid = $userId;
+        $this->profilePicture = $row["profilePicture"];
+
        $this->session = new Session($this, $sessionId, $csrfToken);
        $this->session->setData(json_decode($row["data"] ?? '{}'));
        $this->session->stayLoggedIn($this->sql->parseBool(["stay_logged_in"]));
@@ -183,16 +194,14 @@ class User extends ApiObject {
  }

  private function parseCookies() {
-    if(isset($_COOKIE['session'])
-      && is_string($_COOKIE['session'])
-      && !empty($_COOKIE['session'])) {
+    if(isset($_COOKIE['session']) && is_string($_COOKIE['session']) && !empty($_COOKIE['session'])) {
      try {
        $token = $_COOKIE['session'];
        $settings = $this->configuration->getSettings();
        $decoded = (array)JWT::decode($token, $settings->getJwtSecret());
        if(!is_null($decoded)) {
-          $userId = (isset($decoded['userId']) ? $decoded['userId'] : NULL);
-          $sessionId = (isset($decoded['sessionId']) ? $decoded['sessionId'] : NULL);
+          $userId = ($decoded['userId'] ?? NULL);
+          $sessionId = ($decoded['sessionId'] ?? NULL);
          if(!is_null($userId) && !is_null($sessionId)) {
            $this->readData($userId, $sessionId);
          }
@@ -226,7 +235,8 @@ class User extends ApiObject {
      return true;
    }

-    $res = $this->sql->select("ApiKey.user_id as uid", "User.name", "User.email", "User.confirmed",
+    $res = $this->sql->select("ApiKey.user_id as uid", "User.name", "User.fullName", "User.email",
+      "User.confirmed", "User.profilePicture",
      "Language.uid as langId", "Language.code as langCode", "Language.name as langName",
      "Group.uid as groupId", "Group.name as groupName")
      ->from("ApiKey")
@@ -240,8 +250,8 @@ class User extends ApiObject {
      ->execute();

    $success = ($res !== FALSE);
-    if($success) {
-      if(empty($res)) {
+    if ($success) {
+      if (empty($res) || !is_array($res)) {
        $success = false;
      } else {
        $row = $res[0];
@@ -251,7 +261,9 @@ class User extends ApiObject {

        $this->uid = $row['uid'];
        $this->username = $row['name'];
+        $this->fullName = $row["fullName"];
        $this->email = $row['email'];
+        $this->profilePicture = $row["profilePicture"];

        if(!is_null($row['langId'])) {
          $this->setLanguage(Language::newInstance($row['langId'], $row['langCode'], $row['langName']));