Lona-Development/Server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add encryption, fix table deleting

Browse Source
This commit is contained in:
Collin 2024-03-15 10:46:39 +00:00
parent d37553f02d
commit afe6f30b3d
4 changed files with 16 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/LonaDB/Actions/check_password.php
View File

@ -9,6 +9,12 @@ return new class {
return;
}
$key = hash('sha256', $data['process'], true);
$parts = explode(':', $data['checkPass']['pass']);
$iv = hex2bin($parts[0]);
$ciphertext = hex2bin($parts[1]);
$password = openssl_decrypt($ciphertext, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
if(!$lona->UserManager->CheckPermission($data['login']['name'], "password_check")) {
$lona->Logger->Error("User '".$data['login']['name']."' tried to check a password without permission");
$response = json_encode(["success" => false, "err" => "no_permission", "process" => $data['process']]);
@ -17,7 +23,7 @@ return new class {
return;
}
$checkPassword = $lona->UserManager->CheckPassword($data['checkPass']['name'], $data['checkPass']['pass']);
$checkPassword = $lona->UserManager->CheckPassword($data['checkPass']['name'], $password);
$response = json_encode(["success" => true, "passCheck" => $checkPassword, "process" => $data['process']]);
socket_write($client, $response);

8
src/LonaDB/Actions/create_user.php
View File

@ -9,6 +9,12 @@ return new class {
return;
}
$key = hash('sha256', $data['process'], true);
$parts = explode(':', $data['user']['password']);
$iv = hex2bin($parts[0]);
$ciphertext = hex2bin($parts[1]);
$password = openssl_decrypt($ciphertext, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
if(!$lona->UserManager->CheckPermission($data['login']['name'], "user_create")){
$lona->Logger->Error("User '".$data['login']['name']."' tried to create a user without permission");
$response = json_encode(["success" => false, "err" => "no_permission", "process" => $data['process']]);
@ -25,7 +31,7 @@ return new class {
return;
}
$result = $lona->UserManager->CreateUser($data['user']['name'], $data['user']['password']);
$result = $lona->UserManager->CreateUser($data['user']['name'], $password);
$response = json_encode(["success" => $result, "process" => $data['process']]);

2
src/LonaDB/Actions/delete_table.php
View File

@ -24,7 +24,7 @@ return new class {
return;
}
if($lona->TableManager->GetTable($data['table']['name'])->GetOwner() !== $data['login']['name']) {
if($lona->TableManager->GetTable($data['table']['name'])->GetOwner() !== $data['login']['name'] && $lona->UserManager->GetRole($data['login']['name']) !== "Administrator" && $lona->UserManager->GetRole($data['login']['name']) !== "Superuser") {
$response = json_encode(["success" => false, "err" => "not_table_owner", "process" => $data['process']]);
socket_write($client, $response);
socket_close($client);

2
src/LonaDB/Tables/TableManager.php
View File

@ -71,7 +71,7 @@ class TableManager{
return false;
}
if($user !== $this->Tables[$name]->GetOwner()) {
if($user !== $this->Tables[$name]->GetOwner() && $this->LonaDB->UserManager->GetRole($user) !== "Administrator" && $this->LonaDB->UserManager->GetRole($user) !== "Superuser") {
$this->LonaDB->Logger->Table("Not the owner! Trying to delete table '" . $name . "', requested by user '" . $user . "'");
return false;
}