Integrate CI_Encryption into the framework
TODO: Add documentation in user_guide_src/source/libraries/encryption.rst
diff --git a/system/libraries/Session/drivers/Session_cookie.php b/system/libraries/Session/drivers/Session_cookie.php
index 971dfea..5d338fc 100644
--- a/system/libraries/Session/drivers/Session_cookie.php
+++ b/system/libraries/Session/drivers/Session_cookie.php
@@ -240,7 +240,7 @@
// Do we need encryption? If so, load the encryption class
if ($this->sess_encrypt_cookie === TRUE)
{
- $this->CI->load->library('encrypt');
+ $this->CI->load->library('encryption');
}
// Check for database
@@ -383,30 +383,33 @@
return FALSE;
}
- $len = strlen($session) - 40;
-
- if ($len < 0)
- {
- log_message('debug', 'The session cookie was not signed.');
- return FALSE;
- }
-
- // Check cookie authentication
- $hmac = substr($session, $len);
- $session = substr($session, 0, $len);
-
- if ($hmac !== hash_hmac('sha1', $session, $this->encryption_key))
- {
- log_message('error', 'The session cookie data did not match what was expected.');
- $this->sess_destroy();
- return FALSE;
- }
-
- // Check for encryption
if ($this->sess_encrypt_cookie === TRUE)
{
- // Decrypt the cookie data
- $session = $this->CI->encrypt->decode($session);
+ $session = $this->CI->encryption->decrypt($session);
+ if ($session === FALSE)
+ {
+ log_message('error', 'Session: Unable to decrypt the session cookie, possibly due to a HMAC mismatch.');
+ return FALSE;
+ }
+ }
+ else
+ {
+ if (($len = strlen($session) - 40) <= 0)
+ {
+ log_message('error', 'Session: The session cookie was not signed.');
+ return FALSE;
+ }
+
+ // Check cookie authentication
+ $hmac = substr($session, $len);
+ $session = substr($session, 0, $len);
+
+ if ($hmac !== hash_hmac('sha1', $session, $this->encryption_key))
+ {
+ log_message('error', 'Session: HMAC mismatch. The session cookie data did not match what was expected.');
+ $this->sess_destroy();
+ return FALSE;
+ }
}
// Unserialize the session array
@@ -723,11 +726,13 @@
if ($this->sess_encrypt_cookie === TRUE)
{
- $cookie_data = $this->CI->encrypt->encode($cookie_data);
+ $cookie_data = $this->CI->encryption->encrypt($cookie_data);
}
-
- // Require message authentication
- $cookie_data .= hash_hmac('sha1', $cookie_data, $this->encryption_key);
+ else
+ {
+ // Require message authentication
+ $cookie_data .= hash_hmac('sha1', $cookie_data, $this->encryption_key);
+ }
$expire = ($this->sess_expire_on_close === TRUE) ? 0 : $this->sess_expiration + time();
diff --git a/user_guide_src/source/changelog.rst b/user_guide_src/source/changelog.rst
index 3124dea..5f45f42 100644
--- a/user_guide_src/source/changelog.rst
+++ b/user_guide_src/source/changelog.rst
@@ -257,6 +257,14 @@
- Libraries
+ - Added a new :doc:`Encryption Library <libraries/encryption>` to replace the old, largely insecure :doc:`Encrypt Library <libraries/encrypt>`.
+
+ - :doc:`Encrypt Library <libraries/encrypt>` changes include:
+
+ - Deprecated the library in favor of the new :doc:`Encryption Library <libraries/encryption>`.
+ - Added support for hashing algorithms other than SHA1 and MD5.
+ - Removed previously deprecated ``sha1()`` method.
+
- :doc:`Session Library <libraries/sessions>` changes include:
- Library changed to :doc:`Driver <general/drivers>` with classic 'cookie' driver as the default.
@@ -358,11 +366,6 @@
- Added $config['reuse_query_string'] to allow automatic repopulation of query string arguments, combined with normal URI segments.
- Removed the default `` `` from a number of the configuration variables.
- - :doc:`Encryption Library <libraries/encryption>` changes include:
-
- - Added support for hashing algorithms other than SHA1 and MD5.
- - Removed previously deprecated ``sha1()`` method.
-
- :doc:`Profiler Library <general/profiling>` changes include:
- Database object names are now being displayed.
@@ -574,7 +577,7 @@
- Fixed a bug (#1264) - :doc:`Database Forge <database/forge>` and :doc:`Database Utilities <database/utilities>` didn't update/reset the databases and tables list cache when a table or a database is created, dropped or renamed.
- Fixed a bug (#7) - :doc:`Query Builder <database/query_builder>`'s ``join()`` method only escaped one set of conditions.
- Fixed a bug (#1321) - Core Exceptions class couldn't find the errors/ folder in some cases.
-- Fixed a bug (#1202) - :doc:`Encryption Library <libraries/encryption>` encode_from_legacy() didn't set back the encrypt mode on failure.
+- Fixed a bug (#1202) - :doc:`Encrypt Library <libraries/encrypt>` method ``encode_from_legacy()`` didn't set back the encrypt mode on failure.
- Fixed a bug (#145) - compile_binds() failed when the bind marker was present in a literal string within the query.
- Fixed a bug in protect_identifiers() where if passed along with the field names, operators got escaped as well.
- Fixed a bug (#10) - :doc:`URI Library <libraries/uri>` internal method _detect_uri() failed with paths containing a colon.
@@ -1289,7 +1292,7 @@
- Documented append_output() in the :doc:`Output
Class <libraries/output>`.
- Documented a second argument in the decode() function for the
- :doc:`Encryption Class <libraries/encryption>`.
+ :doc:`Encryption Class <libraries/encrypt>`.
- Documented db->close().
- Updated the router to support a default route with any number of
segments.
diff --git a/user_guide_src/source/installation/upgrade_200.rst b/user_guide_src/source/installation/upgrade_200.rst
index 29f44bd..948b1bc 100644
--- a/user_guide_src/source/installation/upgrade_200.rst
+++ b/user_guide_src/source/installation/upgrade_200.rst
@@ -50,11 +50,11 @@
Step 4: Update stored encrypted data
====================================
-.. note:: If your application does not use the Encryption library, does
+.. note:: If your application does not use the Encrypt library, does
not store Encrypted data permanently, or is on an environment that does
not support Mcrypt, you may skip this step.
-The Encryption library has had a number of improvements, some for
+The Encrypt library has had a number of improvements, some for
encryption strength and some for performance, that has an unavoidable
consequence of making it no longer possible to decode encrypted data
produced by the original version of this library. To help with the
@@ -65,7 +65,7 @@
the fly or en masse.
Please read `how to use this
-method <../libraries/encryption.html#legacy>`_ in the Encryption library
+method <../libraries/encrypt.html#legacy>`_ in the Encrypt library
documentation.
Step 5: Remove loading calls for the compatibility helper.
diff --git a/user_guide_src/source/installation/upgrade_300.rst b/user_guide_src/source/installation/upgrade_300.rst
index 88bb111..9438597 100644
--- a/user_guide_src/source/installation/upgrade_300.rst
+++ b/user_guide_src/source/installation/upgrade_300.rst
@@ -318,7 +318,7 @@
The previously deprecated SHA1 library has been removed, alter your code to use PHP's native
``sha1()`` function to generate a SHA1 hash.
-Additionally, the ``sha1()`` method in the :doc:`Encryption Library <../libraries/encryption>` has been removed.
+Additionally, the ``sha1()`` method in the :doc:`Encrypt Library <../libraries/encrypt>` has been removed.
The EXT constant
================
@@ -333,6 +333,23 @@
:doc:`Smiley Helper <../helpers/smiley_helper>` function ``js_insert_smiley()`` has been deprecated
since CodeIgniter 1.7.2 and is now removed. You'll need to switch to ``smiley_js()`` instead.
+The Encrypt library
+===================
+
+Following numerous vulnerability reports, the :doc:`Encrypt Library <../libraries/encrypt>` has
+been deprecated and a new, :doc:`Encryption Library <../libraries/encryption>` is added to take
+its place.
+
+The new library requires either the `MCrypt extension <http://php.net/mcrypt>`_ or PHP 5.3.3 and
+the `OpenSSL extension <http://php.net/openssl>`_. While this might be rather inconvenient, it is
+a requirement that allows us to have properly implemented cryptographic functions.
+
+.. note:: The :doc:`Encrypt Library <../libraries/encrypt>` is still available for the purpose
+ of keeping backwards compatibility.
+
+.. important:: You are strongly encouraged to switch to the new :doc:`Encryption Library
+ <../libraries/encryption>` as soon as possible!
+
Database drivers 'mysql', 'sqlite', 'mssql', 'pdo/dblib'
========================================================
diff --git a/user_guide_src/source/libraries/encryption.rst b/user_guide_src/source/libraries/encrypt.rst
similarity index 100%
rename from user_guide_src/source/libraries/encryption.rst
rename to user_guide_src/source/libraries/encrypt.rst