Skip to content

Commit 8297c51

Browse files
nilsteampassnetnilsteampassnet
authored
Merge pull request #4465 from nilsteampassnet/crypt_session
Crypt session
2 parents d6937bb + 60b1eaf commit 8297c51

File tree

14 files changed

+257
-67
lines changed

14 files changed

+257
-67
lines changed

‎includes/config/include.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828

2929
define('TP_VERSION', '3.1.2');
3030
define("UPGRADE_MIN_DATE", "1731422875");
31-
define('TP_VERSION_MINOR', '151');
31+
define('TP_VERSION_MINOR', '156');
3232
define('TP_TOOL_NAME', 'Teampass');
3333
define('TP_ONE_DAY_SECONDS', 86400);
3434
define('TP_ONE_WEEK_SECONDS', 604800);

‎includes/core/login.oauth2.php

+2-1
Original file line numberDiff line numberDiff line change
@@ -30,13 +30,14 @@
3030
*/
3131

3232
use TeampassClasses\OAuth2Controller\OAuth2Controller;
33+
use TeampassClasses\SessionManager\SessionManager;
3334

34-
session_start();
3535
require_once __DIR__. '/../../includes/config/include.php';
3636
require_once __DIR__.'/../../sources/main.functions.php';
3737

3838
// init
3939
loadClasses();
40+
$session = SessionManager::getSession();
4041

4142
// Création d'une instance du contrôleur
4243
$OAuth2 = new OAuth2Controller($SETTINGS);

‎includes/libraries/csrfp/libs/csrf/csrfprotector.php

-8
Original file line numberDiff line numberDiff line change
@@ -132,14 +132,6 @@ public static function init($length = null, $action = null, $logger = null)
132132
}
133133

134134

135-
//SessionManager::getSession();
136-
// Start session in case its not, and unit test is not going on
137-
if (session_id() == '' && !defined('__CSRFP_UNIT_TEST__')) {
138-
//session_name('teampass_session');
139-
session_start();
140-
//$_SESSION['CPM'] = 1;
141-
}
142-
143135
// Load configuration file and properties & Check locally for a
144136
// config.php then check for a config/csrf_config.php file in the
145137
// root folder for composer installations

‎includes/libraries/teampassclasses/sessionmanager/src/EncryptedSessionProxy.php

+86
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
<?php
2+
namespace TeampassClasses\SessionManager;
3+
4+
/**
5+
* Teampass - a collaborative passwords manager.
6+
* ---
7+
* This file is part of the TeamPass project.
8+
*
9+
* TeamPass is free software: you can redistribute it and/or modify it
10+
* under the terms of the GNU General Public License as published by
11+
* the Free Software Foundation, version 3 of the License.
12+
*
13+
* TeamPass is distributed in the hope that it will be useful,
14+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
15+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16+
* GNU General Public License for more details.
17+
*
18+
* You should have received a copy of the GNU General Public License
19+
* along with this program. If not, see <https://www.gnu.org/licenses/>.
20+
*
21+
* Certain components of this file may be under different licenses. For
22+
* details, see the `licenses` directory or individual file headers.
23+
* ---
24+
* @file EncryptedSessionProxy.php
25+
* @author Nils Laumaillé ([email protected])
26+
* @copyright 2009-2024 Teampass.net
27+
* @license GPL-3.0
28+
* @see https://www.teampass.net
29+
*/
30+
31+
use Defuse\Crypto\Crypto;
32+
use Defuse\Crypto\Key;
33+
use Symfony\Component\HttpFoundation\Session\Storage\Proxy\SessionHandlerProxy;
34+
35+
class EncryptedSessionProxy extends SessionHandlerProxy
36+
{
37+
protected $handler;
38+
private $key;
39+
40+
/**
41+
* Constructor.
42+
*
43+
* @param \SessionHandlerInterface $handler
44+
* @param Key $key
45+
*/
46+
public function __construct(
47+
\SessionHandlerInterface $handler,
48+
Key $key
49+
) {
50+
parent::__construct($handler);
51+
$this->key = $key;
52+
}
53+
54+
/**
55+
* Decrypt the session data after reading it from the session handler.
56+
*
57+
* @param string $id
58+
*
59+
* @return string
60+
*/
61+
public function read($id): string
62+
{
63+
$data = parent::read($id);
64+
65+
if ($data !== '') {
66+
return Crypto::decrypt($data, $this->key);
67+
}
68+
69+
return '';
70+
}
71+
72+
/**
73+
* Encrypt the session data before writing it to the session handler.
74+
*
75+
* @param string $id
76+
* @param string $data
77+
*
78+
* @return bool
79+
*/
80+
public function write($id, $data): bool
81+
{
82+
$data = Crypto::encrypt($data, $this->key);
83+
84+
return parent::write($id, $data);
85+
}
86+
}

‎includes/libraries/teampassclasses/sessionmanager/src/SessionManager.php

+28-18
Original file line numberDiff line numberDiff line change
@@ -30,15 +30,25 @@
3030

3131
use Symfony\Component\HttpFoundation\Session\Session;
3232
use Symfony\Component\HttpFoundation\Request;
33+
use Defuse\Crypto\Key;
34+
use TeampassClasses\SessionManager\EncryptedSessionProxy;
3335

3436
class SessionManager
3537
{
3638
private static $session = null;
3739

3840
public static function getSession()
3941
{
40-
if (null === self::$session) {
41-
self::$session = new Session();
42+
if (null === self::$session) {
43+
// Load the encryption key
44+
$key = Key::loadFromAsciiSafeString(file_get_contents(SECUREPATH . "/" . SECUREFILE));
45+
46+
// Create an instance of EncryptedSessionProxy
47+
$handler = new EncryptedSessionProxy(new \SessionHandler(), $key);
48+
49+
// Create a new session with the encrypted session handler
50+
self::$session = new Session(new \Symfony\Component\HttpFoundation\Session\Storage\NativeSessionStorage([], $handler));
51+
4252
if (session_status() === PHP_SESSION_NONE) {
4353
$request = Request::createFromGlobals();
4454
$isSecure = $request->isSecure();
@@ -58,73 +68,73 @@ public static function getSession()
5868
}
5969

6070
public static function addRemoveFromSessionArray($key, $values = [], $action = 'add') {
61-
// Récupérer le tableau de la session
71+
// Retrieve the array from the session
6272
$sessionArray = self::getSession()->get($key, []);
6373

6474
foreach ($values as $value) {
6575
if ($action === 'add') {
66-
// Ajouter la valeur au tableau
76+
// Add the value to the array
6777
$sessionArray[] = $value;
6878
} elseif ($action === 'remove') {
69-
// Trouver l'index de la valeur dans le tableau
79+
// Find the index of the value in the array
7080
$index = array_search($value, $sessionArray);
7181

72-
// Si la valeur est trouvée dans le tableau, la supprimer
82+
// If the value is found in the array, remove it
7383
if ($index !== false) {
7484
unset($sessionArray[$index]);
7585
}
7686
}
7787
}
7888

79-
// Réaffecter le tableau à la session
89+
// Reassign the array to the session
8090
self::getSession()->set($key, $sessionArray);
8191
}
8292

8393
public static function specificOpsOnSessionArray($key, $action = 'pop', $value = null) {
84-
// Récupérer le tableau de la session
94+
// Retrieve the array from the session
8595
$sessionArray = self::getSession()->get($key, []);
8696

8797
if ($action === 'pop') {
88-
// Supprimer la dernière valeur du tableau
98+
// Remove the last value from the array
8999
array_pop($sessionArray);
90100
} elseif ($action === 'shift') {
91-
// Supprimer la première valeur du tableau
101+
// Remove the first value from the array
92102
array_shift($sessionArray);
93103
} elseif ($action === 'reset') {
94-
// Réinitialiser le tableau
104+
// Reset the array
95105
$sessionArray = [];
96106
} elseif ($action === 'unshift' && is_null($value) === false) {
97-
// Ajouter une valeur au début du tableau
107+
// Add a value to the beginning of the array
98108
array_unshift($sessionArray, $value);
99109
}
100110

101-
// Réaffecter le tableau à la session
111+
// Reassign the array to the session
102112
self::getSession()->set($key, $sessionArray);
103113
}
104114

105115
public static function addRemoveFromSessionAssociativeArray($key, $values = [], $action = 'add') {
106-
// Récupérer le tableau de la session
116+
// Retrieve the array from the session
107117
$sessionArray = self::getSession()->get($key, []);
108118

109119
if ($action === 'add') {
110-
// Ajouter la valeur au tableau
120+
// Add the value to the array
111121
array_push($sessionArray, $values);
112122
} elseif ($action === 'remove') {
113-
// Si la valeur existe dans le tableau, la supprimer
123+
// If the value exists in the array, remove it
114124
if (($key = array_search($values, $sessionArray)) !== false) {
115125
unset($sessionArray[$key]);
116126
}
117127
}
118128

119-
// Réaffecter le tableau à la session
129+
// Reassign the array to the session
120130
self::getSession()->set($key, $sessionArray);
121131
}
122132

123133
public static function getCookieValue($cookieName)
124134
{
125135
$request = Request::createFromGlobals();
126136

127-
// Vérifier si le cookie existe
137+
// Check if the cookie exists
128138
if ($request->cookies->has($cookieName)) {
129139
return $request->cookies->get($cookieName);
130140
}

‎install/install.queries.php

+2-4
Original file line numberDiff line numberDiff line change
@@ -31,13 +31,13 @@
3131
use Defuse\Crypto\Key;
3232
use Defuse\Crypto\Crypto;
3333
use Defuse\Crypto\Exception as CryptoException;
34-
use EZimuel\PHPSecureSession;
3534
use Hackzilla\PasswordGenerator\Generator\ComputerPasswordGenerator;
3635
use Hackzilla\PasswordGenerator\RandomGenerator\Php7RandomGenerator;
3736
use TeampassClasses\SuperGlobal\SuperGlobal;
3837
use TeampassClasses\Language\Language;
3938
use TeampassClasses\PasswordManager\PasswordManager;
4039
use TeampassClasses\ConfigManager\ConfigManager;
40+
use TeampassClasses\SessionManager\SessionManager;
4141
use Encryption\Crypt\aesctr;
4242

4343
// Do initial test
@@ -58,11 +58,9 @@
5858

5959
// init
6060
loadClasses('DB');
61+
$session = SessionManager::getSession();
6162
$superGlobal = new SuperGlobal();
6263
$lang = new Language();
63-
if (session_status() == PHP_SESSION_NONE) {
64-
session_start();
65-
}
6664

6765
// Load config
6866
$configManager = new ConfigManager();

‎install/migrate_users_to_v3.php

+7-3
Original file line numberDiff line numberDiff line change
@@ -27,12 +27,16 @@
2727
* @see https://www.teampass.net
2828
*/
2929

30+
use TeampassClasses\SessionManager\SessionManager;
3031
set_time_limit(600);
3132

32-
3333
require_once './libs/SecureHandler.php';
34-
session_name('teampass_session');
35-
session_start();
34+
require_once '../sources/main.functions.php';
35+
36+
// init
37+
loadClasses();
38+
$session = SessionManager::getSession();
39+
3640
error_reporting(E_ERROR | E_PARSE);
3741
$_SESSION['db_encoding'] = 'utf8';
3842
$_SESSION['CPM'] = 1;

‎install/upgrade.php

+7-1
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
* @see https://www.teampass.net
2727
*/
2828

29+
use TeampassClasses\SessionManager\SessionManager;
2930

3031
header('X-XSS-Protection: 1; mode=block');
3132
header('X-Frame-Options: SameOrigin');
@@ -42,7 +43,12 @@
4243
ini_set('session.cookie_secure', 0);
4344

4445
require_once './libs/SecureHandler.php';
45-
session_start();
46+
require_once '../sources/main.functions.php';
47+
48+
// init
49+
loadClasses();
50+
$session = SessionManager::getSession();
51+
4652
//Session teampass tag
4753
$_SESSION['CPM'] = 1;
4854
define('MIN_PHP_VERSION', 8.1);

‎install/upgrade_scripts_manager.php

+7-3
Original file line numberDiff line numberDiff line change
@@ -26,12 +26,16 @@
2626
* @see https://www.teampass.net
2727
*/
2828

29+
use TeampassClasses\SessionManager\SessionManager;
2930
set_time_limit(600);
3031

31-
3232
require_once './libs/SecureHandler.php';
33-
session_name('teampass_session');
34-
session_start();
33+
require_once '../sources/main.functions.php';
34+
35+
// init
36+
loadClasses();
37+
$session = SessionManager::getSession();
38+
3539
error_reporting(E_ERROR | E_PARSE);
3640
$_SESSION['db_encoding'] = 'utf8';
3741
$_SESSION['CPM'] = 1;

‎sources/identify.php

-4
Original file line numberDiff line numberDiff line change
@@ -30,15 +30,11 @@
3030
*/
3131

3232
use voku\helper\AntiXSS;
33-
use EZimuel\PHPSecureSession;
3433
use TeampassClasses\SessionManager\SessionManager;
3534
use Symfony\Component\HttpFoundation\Request as SymfonyRequest;
3635
use TeampassClasses\Language\Language;
3736
use TeampassClasses\PerformChecks\PerformChecks;
3837
use TeampassClasses\ConfigManager\ConfigManager;
39-
use LdapRecord\Connection;
40-
use LdapRecord\Container;
41-
use LdapRecord\Auth\Events\Failed;
4238
use TeampassClasses\NestedTree\NestedTree;
4339
use TeampassClasses\PasswordManager\PasswordManager;
4440
use Duo\DuoUniversal\Client;

‎sources/oauth.php

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,13 @@
11
<?php
22
use TeampassClasses\OAuth2Controller\OAuth2Controller;
3-
session_start();
3+
use TeampassClasses\SessionManager\SessionManager;
4+
45
require_once __DIR__. '/../includes/config/include.php';
56
require_once __DIR__.'/../sources/main.functions.php';
67

78
// init
89
loadClasses();
10+
$session = SessionManager::getSession();
911

1012
// MDP teampss.user c@mx5q^tL6
1113
// MDP teampass.admin Goh@u939!879

‎vendor/owasp/csrf-protector-php/libs/csrf/csrfprotector.php

-5
Original file line numberDiff line numberDiff line change
@@ -129,11 +129,6 @@ public static function init($length = null, $action = null, $logger = null)
129129
return;
130130
}
131131

132-
// Start session in case its not, and unit test is not going on
133-
if (session_id() == '' && !defined('__CSRFP_UNIT_TEST__')) {
134-
session_start();
135-
}
136-
137132
// Load configuration file and properties & Check locally for a
138133
// config.php then check for a config/csrf_config.php file in the
139134
// root folder for composer installations

0 commit comments

Comments
 (0)