Custom Component load data

Question

I'm fairly new to Joomla and I'm taking over a project from a previous developer.

In a custom component we are capturing user data in a form. Before the name and address is entered into the database the data is encrypted using a method from the component's helper file. The encryption works fine as I can see the encrypted entries in the database. The problem seems to be happening in the decryption process. In the edit view in the backend the form should load the data from the item. In the loadFormData() in the model right after $data = $this->getItem() each of the fields gets decrypted by calling the method from the helper file. However, none of the data that was encrypted is shown.

I did some debuggin by calling var_dump($data) before the decryption happens to make sure all the fields were there. And this is where I'm stuck. I was expecting to see the encrypted fields, instead the fields are already decrypted by this point. So this is why it fails; I'm trying to decrypt fields that have already been decrypted. If I remove the decryption method calls then the fields display correctly.

My question is where else would the decryption be made if it's not inside loadFormData()? I looked inside the table file and there's nothing there. I can't find any other place where the fields are being decrypted. I don't want to remove the decryption calls without knowing for sure where the decryptions are being made. The code was created in late 2015 so I'm wondering if Joomla now does the decryption automatically.

Any help would be appreciated.

UPDATED

This is an example entry in the database after the encryption, it's saved as as a BLOB type with a .bin file extension: xmELeYzgHFeyEctROCnNnvAKtl16Jmb6c9xUCsvhYvLYA4EFXZwc5mHRDiRiZ+hjQ8MNBil3UvjSDrnBayGjTizRl0FkMI5efB9RuoOkJftg7fxck/Rx4wDTYmlvyxzx|Ge5PqIhKgZFLcNRhS1OCwNxm1e89icnpgRPQ6B9SJm8=

And this is the ecrypt method:

public static function encrypt($value){
    if(empty($value)){
        return $value;
    }

  $value = serialize($value);

  $iv = mcrypt_create_iv(mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_CBC), MCRYPT_RAND);

  $key = pack('H*', self::$key);

  $mac = hash_hmac('sha256', $value, substr(bin2hex($key), -32));

  $passcrypt = mcrypt_encrypt(MCRYPT_RIJNDAEL_256, $key, $value.$mac, MCRYPT_MODE_CBC, $iv);

  $value = base64_encode($passcrypt).'|'.base64_encode($iv);

  return $value;
}

Even if I remove the decrypt method the field still renders decrypted. So it's being decrypted using some other method besides the custom one.

Answer 1

What you need is to search all files of component to find places where Decrypt function is called.

You can open Nodepad++ , then press CTRL+SHIFT+F, next in field "Find" insert - decrypt or decode

Next in "Folder" field insert - your_site_path\administrator\components\com_yourcomponent or just yourcomponent_developer_folder_path

Then press "Find all".

Then at the bottom you will see a window with all results.

Answer 2

If it is just a form, and not doing anything special, I'd recommend creating a new form using something off the shelf like RSForm, or ChronoForms.

As the current form is custom, you'd likely spend too much time hunting something down that you didn't develop.

Both of the above suggestions have a large and active user base, as well as developers who keep their code secure.

Can you provide a URL for us to take a look at ?