cloudlog/install/includes/core_class.php
Peter Goodhall 5a44ef4b4e Per-install encryption key and session checks
Replace hardcoded encryption key in installer with a %encryption_key% placeholder and generate a unique per-install key during installation (uses random_bytes, falls back to openssl_random_pseudo_bytes or sha1(uniqid)). Inject the generated key into config.php. Also tighten User_Model::validate_session(): return early if no user_id, clear session if user_hash is missing, re-read the user from the database to verify user_type before authenticating, and refresh or clear the session accordingly. These changes improve security by using a unique encryption key per install and by validating session state against persisted user data.
2026-06-06 10:25:45 +01:00

140 lines
No EOL
3.2 KiB
PHP

<?php
class Core {
// Function to validate the post data
function validate_post($data)
{
// Counter variable
$counter = 0;
// Validate the hostname
if(isset($data['hostname']) AND !empty($data['hostname'])) {
$counter++;
}
// Validate the username
if(isset($data['username']) AND !empty($data['username'])) {
$counter++;
}
// Validate the password
if(isset($data['password']) AND !empty($data['password'])) {
// pass
}
// Validate the database
if(isset($data['database']) AND !empty($data['database'])) {
$counter++;
}
if($data['directory'] != "") {
if (file_exists($_SERVER['DOCUMENT_ROOT'].$data['directory'])) {
//pass folders real
$counter++;
} else {
echo "Directory ".$data['directory']." cannot be found";
exit;
}
} else {
$counter++;
}
// Check if all the required fields have been entered
if($counter == '4') {
return true;
}
else {
return false;
}
}
// Function to show an error
function show_message($type,$message) {
return $message;
}
// Function to write the config file
function write_config($data) {
// Config path
$template_path = 'config/database.php';
$output_path = $_SERVER['DOCUMENT_ROOT'].$data['directory'].'/application/config/database.php';
// Open the file
$database_file = file_get_contents($template_path);
$new = str_replace("%HOSTNAME%",$data['hostname'],$database_file);
$new = str_replace("%USERNAME%",$data['username'],$new);
$new = str_replace("%PASSWORD%",$data['password'],$new);
$new = str_replace("%DATABASE%",$data['database'],$new);
// Write the new database.php file
$handle = fopen($output_path,'w+');
// Chmod the file, in case the user forgot
@chmod($output_path,0777);
// Verify file permissions
if(is_writable($output_path)) {
// Write the file
if(fwrite($handle,$new)) {
return true;
} else {
return false;
}
} else {
return false;
}
}
// Function to write the config file
function write_configfile($data) {
// Config path
$template_path = 'config/config.php';
$output_path = $_SERVER['DOCUMENT_ROOT'].$data['directory'].'/application/config/config.php';
// Open the file
$database_file = file_get_contents($template_path);
$new = str_replace("%baselocator%",$data['locator'],$database_file);
$new = str_replace("%websiteurl%",$data['websiteurl'],$new);
$new = str_replace("%directory%",$data['directory'],$new);
$new = str_replace("%encryption_key%",$this->generate_encryption_key(),$new);
// Write the new config.php file
$handle = fopen($output_path,'w+');
// Chmod the file, in case the user forgot
@chmod($output_path,0777);
// Verify file permissions
if(is_writable($output_path)) {
// Write the file
if(fwrite($handle,$new)) {
return true;
} else {
return false;
}
} else {
return false;
}
}
// Generate a per-install encryption key for the application config.
private function generate_encryption_key() {
try {
return bin2hex(random_bytes(32));
} catch (Exception $e) {
if (function_exists('openssl_random_pseudo_bytes')) {
return bin2hex(openssl_random_pseudo_bytes(32));
}
return sha1(uniqid('', true) . mt_rand());
}
}
}
?>