2

I'm fairly new to Joomla and I'm taking over a project from a previous developer.

In a custom component we are capturing user data in a form. Before the name and address is entered into the database the data is encrypted using a method from the component's helper file. The encryption works fine as I can see the encrypted entries in the database. The problem seems to be happening in the decryption process. In the edit view in the backend the form should load the data from the item. In the loadFormData() in the model right after $data = $this->getItem() each of the fields gets decrypted by calling the method from the helper file. However, none of the data that was encrypted is shown.

I did some debuggin by calling var_dump($data) before the decryption happens to make sure all the fields were there. And this is where I'm stuck. I was expecting to see the encrypted fields, instead the fields are already decrypted by this point. So this is why it fails; I'm trying to decrypt fields that have already been decrypted. If I remove the decryption method calls then the fields display correctly.

My question is where else would the decryption be made if it's not inside loadFormData()? I looked inside the table file and there's nothing there. I can't find any other place where the fields are being decrypted. I don't want to remove the decryption calls without knowing for sure where the decryptions are being made. The code was created in late 2015 so I'm wondering if Joomla now does the decryption automatically.

Any help would be appreciated.

UPDATED

This is an example entry in the database after the encryption, it's saved as as a BLOB type with a .bin file extension: xmELeYzgHFeyEctROCnNnvAKtl16Jmb6c9xUCsvhYvLYA4EFXZwc5mHRDiRiZ+hjQ8MNBil3UvjSDrnBayGjTizRl0FkMI5efB9RuoOkJftg7fxck/Rx4wDTYmlvyxzx|Ge5PqIhKgZFLcNRhS1OCwNxm1e89icnpgRPQ6B9SJm8=

And this is the ecrypt method:

public static function encrypt($value){
    if(empty($value)){
        return $value;
    }

  $value = serialize($value);

  $iv = mcrypt_create_iv(mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_CBC), MCRYPT_RAND);

  $key = pack('H*', self::$key);

  $mac = hash_hmac('sha256', $value, substr(bin2hex($key), -32));

  $passcrypt = mcrypt_encrypt(MCRYPT_RIJNDAEL_256, $key, $value.$mac, MCRYPT_MODE_CBC, $iv);

  $value = base64_encode($passcrypt).'|'.base64_encode($iv);

  return $value;
}

Even if I remove the decrypt method the field still renders decrypted. So it's being decrypted using some other method besides the custom one.

  • Joomla isn't doing any encypting or decrypting automatically. Taking a total stab in the dark i'll guess that the field is custom and the decryption is in the field definition. If the form is built as a jform with an xml then the field path it's using should be declared in the form's xml. – jamesgarrett Aug 13 '17 at 2:41
  • Thanx for the reply. Yeah, the form is built as a Jform. I just looked in the fields directory inside the models directory and there isn't a custom field that is being decrypted. Funny thing is that I just removed the decrypt method from my helper file and it's still being decrypted. So it's definitely not using the custom decrypted method. As I said, the entries in the DB are .bin files and BLOB types so I assume the encryption is working. You have any other suggestions?? Thanx – chavab_1 Aug 14 '17 at 17:02
  • I've updated my original question with a sample encrypted data field and also the method that does the encryption. – chavab_1 Aug 14 '17 at 17:22
  • Joomla won't do anything like that - actually it doesn't know or care about your component. Hard to say where this could be happening in your custom component that much- you have to go step by step following the flow, searching for this in the code. – FFrewin Aug 14 '17 at 20:53
1

What you need is to search all files of component to find places where Decrypt function is called.

You can open Nodepad++ , then press CTRL+SHIFT+F, next in field "Find" insert - decrypt or decode

Next in "Folder" field insert - your_site_path\administrator\components\com_yourcomponent or just yourcomponent_developer_folder_path

Then press "Find all".

Then at the bottom you will see a window with all results.

0

If it is just a form, and not doing anything special, I'd recommend creating a new form using something off the shelf like RSForm, or ChronoForms.

As the current form is custom, you'd likely spend too much time hunting something down that you didn't develop.

Both of the above suggestions have a large and active user base, as well as developers who keep their code secure.

Can you provide a URL for us to take a look at ?

  • Yeah, it's more than just a simple form and we're dealing with sensitive data. Also, it's not that difficult, I just need to know where in the server process is the decoding happening. I'm familiar with the MVC pattern, I'm just not too familiar with Joomla so I was hoping there was some step in there that I'm missing where the decryption could be happening. I could provide the link, but nothing is happening client-side; all the encryption and decryption is being done on the server so I thought you'd find anything there. Thanx – chavab_1 Aug 14 '17 at 17:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.