PHP Crypt::symmetricEncryptFileContent方法代码示例

 /**
  * if session is started, check if ownCloud key pair is set up, if not create it
  * @param \OC\Files\View $view
  *
  * @note The ownCloud key pair is used to allow public link sharing even if encryption is enabled
  */
 public function __construct($view)
 {
     $this->view = $view;
     if (!$this->view->is_dir('files_encryption')) {
         $this->view->mkdir('files_encryption');
     }
     $appConfig = \OC::$server->getAppConfig();
     $publicShareKeyId = Helper::getPublicShareKeyId();
     if ($publicShareKeyId === false) {
         $publicShareKeyId = 'pubShare_' . substr(md5(time()), 0, 8);
         $appConfig->setValue('files_encryption', 'publicShareKeyId', $publicShareKeyId);
     }
     if (!Keymanager::publicShareKeyExists($view)) {
         $keypair = Crypt::createKeypair();
         // Save public key
         Keymanager::setPublicKey($keypair['publicKey'], $publicShareKeyId);
         // Encrypt private key empty passphrase
         $cipher = Helper::getCipher();
         $encryptedKey = Crypt::symmetricEncryptFileContent($keypair['privateKey'], '', $cipher);
         if ($encryptedKey) {
             Keymanager::setPrivateSystemKey($encryptedKey, $publicShareKeyId);
         } else {
             \OCP\Util::writeLog('files_encryption', 'Could not create public share keys', \OCP\Util::ERROR);
         }
     }
     if (Helper::isPublicAccess() && !self::getPublicSharePrivateKey()) {
         // Disable encryption proxy to prevent recursive calls
         $proxyStatus = \OC_FileProxy::$enabled;
         \OC_FileProxy::$enabled = false;
         $encryptedKey = Keymanager::getPrivateSystemKey($publicShareKeyId);
         $privateKey = Crypt::decryptPrivateKey($encryptedKey, '');
         self::setPublicSharePrivateKey($privateKey);
         \OC_FileProxy::$enabled = $proxyStatus;
     }
 }

 /**
  * if session is started, check if ownCloud key pair is set up, if not create it
  * @param \OC\Files\View $view
  *
  * @note The ownCloud key pair is used to allow public link sharing even if encryption is enabled
  */
 public function __construct($view)
 {
     $this->view = $view;
     if (!$this->view->is_dir('owncloud_private_key')) {
         $this->view->mkdir('owncloud_private_key');
     }
     $appConfig = \OC::$server->getAppConfig();
     $publicShareKeyId = $appConfig->getValue('files_encryption', 'publicShareKeyId');
     if ($publicShareKeyId === null) {
         $publicShareKeyId = 'pubShare_' . substr(md5(time()), 0, 8);
         $appConfig->setValue('files_encryption', 'publicShareKeyId', $publicShareKeyId);
     }
     if (!$this->view->file_exists("/public-keys/" . $publicShareKeyId . ".public.key") || !$this->view->file_exists("/owncloud_private_key/" . $publicShareKeyId . ".private.key")) {
         $keypair = Crypt::createKeypair();
         // Disable encryption proxy to prevent recursive calls
         $proxyStatus = \OC_FileProxy::$enabled;
         \OC_FileProxy::$enabled = false;
         // Save public key
         if (!$view->is_dir('/public-keys')) {
             $view->mkdir('/public-keys');
         }
         $this->view->file_put_contents('/public-keys/' . $publicShareKeyId . '.public.key', $keypair['publicKey']);
         // Encrypt private key empty passphrase
         $encryptedPrivateKey = Crypt::symmetricEncryptFileContent($keypair['privateKey'], '');
         // Save private key
         $this->view->file_put_contents('/owncloud_private_key/' . $publicShareKeyId . '.private.key', $encryptedPrivateKey);
         \OC_FileProxy::$enabled = $proxyStatus;
     }
     if (\OCA\Encryption\Helper::isPublicAccess()) {
         // Disable encryption proxy to prevent recursive calls
         $proxyStatus = \OC_FileProxy::$enabled;
         \OC_FileProxy::$enabled = false;
         $encryptedKey = $this->view->file_get_contents('/owncloud_private_key/' . $publicShareKeyId . '.private.key');
         $privateKey = Crypt::decryptPrivateKey($encryptedKey, '');
         $this->setPublicSharePrivateKey($privateKey);
         $this->setInitialized(\OCA\Encryption\Session::INIT_SUCCESSFUL);
         \OC_FileProxy::$enabled = $proxyStatus;
     }
 }

 /**
  * Sets up user folders and keys for serverside encryption
  *
  * @param string $passphrase to encrypt server-stored private key with
  * @return bool
  */
 public function setupServerSide($passphrase = null)
 {
     // Set directories to check / create
     $setUpDirs = array($this->userDir, $this->publicKeyDir, $this->encryptionDir, $this->keyfilesPath, $this->shareKeysPath);
     // Check / create all necessary dirs
     foreach ($setUpDirs as $dirPath) {
         if (!$this->view->file_exists($dirPath)) {
             $this->view->mkdir($dirPath);
         }
     }
     // Create user keypair
     // we should never override a keyfile
     if (!$this->view->file_exists($this->publicKeyPath) && !$this->view->file_exists($this->privateKeyPath)) {
         // Generate keypair
         $keypair = Crypt::createKeypair();
         if ($keypair) {
             \OC_FileProxy::$enabled = false;
             // Encrypt private key with user pwd as passphrase
             $encryptedPrivateKey = Crypt::symmetricEncryptFileContent($keypair['privateKey'], $passphrase, Helper::getCipher());
             // Save key-pair
             if ($encryptedPrivateKey) {
                 $header = crypt::generateHeader();
                 $this->view->file_put_contents($this->privateKeyPath, $header . $encryptedPrivateKey);
                 $this->view->file_put_contents($this->publicKeyPath, $keypair['publicKey']);
             }
             \OC_FileProxy::$enabled = true;
         }
     } else {
         // check if public-key exists but private-key is missing
         if ($this->view->file_exists($this->publicKeyPath) && !$this->view->file_exists($this->privateKeyPath)) {
             \OCP\Util::writeLog('Encryption library', 'public key exists but private key is missing for "' . $this->keyId . '"', \OCP\Util::FATAL);
             return false;
         } else {
             if (!$this->view->file_exists($this->publicKeyPath) && $this->view->file_exists($this->privateKeyPath)) {
                 \OCP\Util::writeLog('Encryption library', 'private key exists but public key is missing for "' . $this->keyId . '"', \OCP\Util::FATAL);
                 return false;
             }
         }
     }
     return true;
 }

 /**
  * Encrypt and pad data ready for writing to disk
  * @param string $plainData data to be encrypted
  * @param string $key key to use for encryption
  * @return string encrypted data on success, false on failure
  */
 public function preWriteEncrypt($plainData, $key)
 {
     // Encrypt data to 'catfile', which includes IV
     if ($encrypted = Crypt::symmetricEncryptFileContent($plainData, $key)) {
         return $encrypted;
     } else {
         return false;
     }
 }

 /**
  * enable recovery
  *
  * @param string $recoveryKeyId
  * @param string $recoveryPassword
  * @return bool
  */
 public static function adminEnableRecovery($recoveryKeyId, $recoveryPassword)
 {
     $view = new \OC\Files\View('/');
     $appConfig = \OC::$server->getAppConfig();
     if ($recoveryKeyId === null) {
         $recoveryKeyId = 'recovery_' . substr(md5(time()), 0, 8);
         $appConfig->setValue('files_encryption', 'recoveryKeyId', $recoveryKeyId);
     }
     if (!Keymanager::recoveryKeyExists($view)) {
         $keypair = Crypt::createKeypair();
         // Save public key
         Keymanager::setPublicKey($keypair['publicKey'], $recoveryKeyId);
         $cipher = Helper::getCipher();
         $encryptedKey = Crypt::symmetricEncryptFileContent($keypair['privateKey'], $recoveryPassword, $cipher);
         if ($encryptedKey) {
             Keymanager::setPrivateSystemKey($encryptedKey, $recoveryKeyId);
             // Set recoveryAdmin as enabled
             $appConfig->setValue('files_encryption', 'recoveryAdminEnabled', 1);
             $return = true;
         }
     } else {
         // get recovery key and check the password
         $util = new Util(new \OC\Files\View('/'), \OCP\User::getUser());
         $return = $util->checkRecoveryPassword($recoveryPassword);
         if ($return) {
             $appConfig->setValue('files_encryption', 'recoveryAdminEnabled', 1);
         }
     }
     return $return;
 }

 /**
  * @brief Sets up user folders and keys for serverside encryption
  *
  * @param string $passphrase to encrypt server-stored private key with
  * @return bool
  */
 public function setupServerSide($passphrase = null)
 {
     // Set directories to check / create
     $setUpDirs = array($this->userDir, $this->userFilesDir, $this->publicKeyDir, $this->encryptionDir, $this->keyfilesPath, $this->shareKeysPath);
     // Check / create all necessary dirs
     foreach ($setUpDirs as $dirPath) {
         if (!$this->view->file_exists($dirPath)) {
             $this->view->mkdir($dirPath);
         }
     }
     // Create user keypair
     // we should never override a keyfile
     if (!$this->view->file_exists($this->publicKeyPath) && !$this->view->file_exists($this->privateKeyPath)) {
         // Generate keypair
         $keypair = Crypt::createKeypair();
         if ($keypair) {
             \OC_FileProxy::$enabled = false;
             // Encrypt private key with user pwd as passphrase
             $encryptedPrivateKey = Crypt::symmetricEncryptFileContent($keypair['privateKey'], $passphrase);
             // Save key-pair
             if ($encryptedPrivateKey) {
                 $this->view->file_put_contents($this->privateKeyPath, $encryptedPrivateKey);
                 $this->view->file_put_contents($this->publicKeyPath, $keypair['publicKey']);
             }
             \OC_FileProxy::$enabled = true;
         }
     } else {
         // check if public-key exists but private-key is missing
         if ($this->view->file_exists($this->publicKeyPath) && !$this->view->file_exists($this->privateKeyPath)) {
             \OCP\Util::writeLog('Encryption library', 'public key exists but private key is missing for "' . $this->keyId . '"', \OCP\Util::FATAL);
             return false;
         } else {
             if (!$this->view->file_exists($this->publicKeyPath) && $this->view->file_exists($this->privateKeyPath)) {
                 \OCP\Util::writeLog('Encryption library', 'private key exists but public key is missing for "' . $this->keyId . '"', \OCP\Util::FATAL);
                 return false;
             }
         }
     }
     // If there's no record for this user's encryption preferences
     if (false === $this->recoveryEnabledForUser()) {
         // create database configuration
         $sql = 'INSERT INTO `*PREFIX*encryption` (`uid`,`mode`,`recovery_enabled`,`migration_status`) VALUES (?,?,?,?)';
         $args = array($this->userId, 'server-side', 0, self::MIGRATION_OPEN);
         $query = \OCP\DB::prepare($sql);
         $query->execute($args);
     }
     return true;
 }

 /**
  * Change a user's encryption passphrase
  * @param array $params keys: uid, password
  */
 public static function setPassphrase($params)
 {
     if (\OCP\App::isEnabled('files_encryption') === false) {
         return true;
     }
     // Only attempt to change passphrase if server-side encryption
     // is in use (client-side encryption does not have access to
     // the necessary keys)
     if (Crypt::mode() === 'server') {
         $view = new \OC\Files\View('/');
         $session = new Session($view);
         // Get existing decrypted private key
         $privateKey = $session->getPrivateKey();
         if ($params['uid'] === \OCP\User::getUser() && $privateKey) {
             // Encrypt private key with new user pwd as passphrase
             $encryptedPrivateKey = Crypt::symmetricEncryptFileContent($privateKey, $params['password'], Helper::getCipher());
             // Save private key
             if ($encryptedPrivateKey) {
                 Keymanager::setPrivateKey($encryptedPrivateKey, \OCP\User::getUser());
             } else {
                 \OCP\Util::writeLog('files_encryption', 'Could not update users encryption password', \OCP\Util::ERROR);
             }
             // NOTE: Session does not need to be updated as the
             // private key has not changed, only the passphrase
             // used to decrypt it has changed
         } else {
             // admin changed the password for a different user, create new keys and reencrypt file keys
             $user = $params['uid'];
             $util = new Util($view, $user);
             $recoveryPassword = isset($params['recoveryPassword']) ? $params['recoveryPassword'] : null;
             // we generate new keys if...
             // ...we have a recovery password and the user enabled the recovery key
             // ...encryption was activated for the first time (no keys exists)
             // ...the user doesn't have any files
             if ($util->recoveryEnabledForUser() && $recoveryPassword || !$util->userKeysExists() || !$view->file_exists($user . '/files')) {
                 // backup old keys
                 $util->backupAllKeys('recovery');
                 $newUserPassword = $params['password'];
                 // make sure that the users home is mounted
                 \OC\Files\Filesystem::initMountPoints($user);
                 $keypair = Crypt::createKeypair();
                 // Disable encryption proxy to prevent recursive calls
                 $proxyStatus = \OC_FileProxy::$enabled;
                 \OC_FileProxy::$enabled = false;
                 // Save public key
                 Keymanager::setPublicKey($keypair['publicKey'], $user);
                 // Encrypt private key with new password
                 $encryptedKey = Crypt::symmetricEncryptFileContent($keypair['privateKey'], $newUserPassword, Helper::getCipher());
                 if ($encryptedKey) {
                     Keymanager::setPrivateKey($encryptedKey, $user);
                     if ($recoveryPassword) {
                         // if recovery key is set we can re-encrypt the key files
                         $util = new Util($view, $user);
                         $util->recoverUsersFiles($recoveryPassword);
                     }
                 } else {
                     \OCP\Util::writeLog('files_encryption', 'Could not update users encryption password', \OCP\Util::ERROR);
                 }
                 \OC_FileProxy::$enabled = $proxyStatus;
             }
         }
     }
 }