2. PHPRunner General questions
  3. [SOLVED]  Encrypt mysql information
This topic is locked
[SOLVED]

 Encrypt mysql information

 		7/4/2005 5:52:56 AM
PHPRunner General questions
J
 johnww author

In file include/dbcommon.php, the mysql account and password is in plain text. This is a security risk that I would like to solve. Other PHP systems such as Postnuke offer the option for storing the password encrypted or "en clair". Surely this can be done here also.
While awaiting a fix from Sergei, I would like to do the following:

  1. Create hash of password, store hash in dbcommon.php
  2. Somehow indicate to the system that the password is already encrypted so that the hash is encrypted a second time.
    Can anyone help me with this?
Sergey Kornilov admin 7/4/2005

Hi,
when PHP page connects to MySQL password is sent to MySQL as a plain text. This means in dbcommon.php password cannot be encrypted.
I guess Postnuke encrypts passwords that are in the database (user passwords, admin password etc) however MySQL password is not encrypted.
J
 		johnww author 7/5/2005

No. For Postnuke, the file that stores the MySQL userID and password stores the password in an encrypted form (actually the user has the choice to store it encrypted or clear).
How exactly it presents this data to mySQL I do not know but it must be possible.
Sergey Kornilov admin 7/8/2005

John,
Postnuke doesn't really encrypt passwords. It just encodes them with base64_encode function.
You can easily achieve the real mysql password with base64_decode function.

I.e. if you have following lines in your Postnuke config.php file:

$pnconfig['dbuname'] = 'cm9vdA==';

$pnconfig['dbpass'] = 'c2VjcmV0';



then you can decode them with the following snippet:

echo base64_decode('cm9vdA==');

echo base64_decode('c2VjcmV0');
J
 		johnww author 7/11/2005

You are right. The Postnuke method is not extremely secure. Nevertheless, the way phprunner stores the info is even less secure.
Even some "encryption", even if it is bad, is better than none at all.
Sergey Kornilov admin 7/11/2005

John,
having this kind of security most times is much worse because you believe it works while it doesn't. To make your website secured make sure nobody can access source code of your PHP files. Use SSH instead of FTP to upload PHP files to the webrsever. Do not use your phone number or kids name as a password. Do not write down your passwords anywhere.
These simple rules really work. Please note that all above is just my personal opinion.
Anyway here is how you can implement Postnuke-like passwords encryption.
To hide a plain-text username and password from PHPRunner generated pages you can do the following.

  1. Create a php page, put the following text there then open it in browser and replace username and password in dbcommon.php file with the browser contents.
    <?php

    echo '$user="'.base64_encode("username").'";
    ';

    echo '$pwd="'.base64_encode("password").'";
    ';

    ?>


where username and password are your MySQL connection parameters.
2. Replace the following line in dbconnection.php file

$conn = mysql_connect($strhost,$user,$pwd);


with the following

$conn = mysql_connect($strhost,base64_decode($user),base64_decode($pwd));


To make it a bit more difficult to break you can use global variables defined in another PHP file that store decrypted username and password. Make sure you decrypt it before calling mysql_connect.
prleo1 7/13/2005

Are dbcommon.php and dbconnect.php the only files that need to be modified in order to setup this up or is there additional work?
Sergey Kornilov admin 7/14/2005

Hi,
dbcommon.php and dbconnection.php are the only files if you use the last version of PHPRunner.

In previous versions you should modify ..._variables.php files also.
lukey 8/6/2005

right now i created a project and the login.php info points to the postnuke user id and password
the problem is i have to enter the hashed info for password in order to login.
what do i have to change in order to use cleartext password. in the login.php
thanks.
Sergey Kornilov admin 8/8/2005

Hi,
please open login.php in text editor, find the following snippet:

$strSQL = "select * from ".AddTableWrappers($cLoginTable)." where ".AddFieldWrappers($cUserNameField).

  "=".$strUsername." and ".AddFieldWrappers($cPasswordField).

  "=".$strPassword;



and replace it with:

$strSQL = "select * from ".AddTableWrappers($cLoginTable)." where ".AddFieldWrappers($cUserNameField).

  "=".$strUsername." and ".AddFieldWrappers($cPasswordField).

  "=".md5($strPassword);
lukey 8/8/2005

it doesnt work
the md5 output is different from the one in the mysql table.
i guess postnuke is using a different method to encrypt its password.
Sergey Kornilov admin 8/8/2005

Hi,
please try base64_encode function instead of md5.
lukey 8/10/2005

here's the md5 error i got

Fatal error: Unknown column 'XXXXXXXXXXXXHASHVALUEXXXXXXXX' in 'where clause' in /path/to/include/dbconnection.php on line 26


i compared the hash value from the error output and it is not the same as the one stored in the postnuke user table.
and this is the base64_encode error

Fatal error: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near '==' at line 1 in /path/to/include/dbconnection.php on line 26


any ideas?
Sergey Kornilov admin 8/11/2005

Hi,
please remove previous modification and try the following.

Find this snippet in login.php file:

 if(NeedQuotes(db_fieldtype($rstemp,$cPasswordField)))

 $strPassword="'".db_addslashes($strPassword)."'";

 else

 $strPassword=(0+$strPassword);
 $strSQL = "select * from ".AddTableWrappers($cLoginTable)." where ".AddFieldWrappers($cUserNameField).

 "=".$strUsername." and ".AddFieldWrappers($cPasswordField).

 "=".$strPassword;

   $rs=db_query($strSQL,$conn);



and replace it with

 if(NeedQuotes(db_fieldtype($rstemp,$cPasswordField)))

 $strPassword="'".db_addslashes(md5($strPassword))."'";

 else

 $strPassword=(0+$strPassword);
 $strSQL = "select * from ".AddTableWrappers($cLoginTable)." where ".AddFieldWrappers($cUserNameField).

 "=".$strUsername." and ".AddFieldWrappers($cPasswordField).

 "=".$strPassword;

   $rs=db_query($strSQL,$conn);


If this doesn't help, please contact Postnuke team to learn how do they store passwords in database. When you privide me with this info I will show you how to use it with PHPRunner.
prleo1 8/19/2005

Admin,
Will that code snippet work for my environment? MySQL5, PHP5?

As of now, my pwds are cleartext. Would I write a loop to change all passwords to md5, then insert them in the database column?
Sergey Kornilov admin 8/23/2005

Hi,
yes, this will work with your configuration.

Yes, to use thsi workaround you need to encrypt your existing passwords in database with md5 function.
prleo1 8/26/2005

Thanks again, Admin.
Will I have to add any code to the changepassword page after encrypting the passwords?
Sergey Kornilov admin 8/29/2005

Hi,
you should modify two lines to get changepwd.php work.

Replace

$passvalue = $_POST["newpass"];

with

$passvalue = md5($_POST["newpass"]);

and

if($_POST["opass"] == $row[$cPasswordField])

with

if(md5($_POST["opass"]) == $row[$cPasswordField])
prleo1 3/9/2006

Sergey,
I have rebuilt an old project using V3; after doing so, the users are not able to change their password. I have used Sha1 to encrypt them in the database and am not sure how to change the code to get this feature working correctly.
prleo1 3/9/2006

Sergey,

I have rebuilt an old project using V3; after doing so, the users are not able to change their password. I have used Sha1 to encrypt them in the database and am not sure how to change the code to get this feature working correctly.


I changed all occurrences of MD5 to sha1, and it works now. Thanks.