arizon-dev / quickblaze-encrypt

⭐ An extremely simple, one-time view encrypted message system. Send anybody passwords, or secret messages on a one-time view basis.

QuickBlaze Encryption 👋

An extremely simple, one-time view encryption system. Send links anywhere on the internet, and the encrypted message will automatically be destroyed after being viewed once!

✨ Click to view Demo

Requirements

• Accessible webserver with PHP support.
• PHP v7 or higher.
• PHP MBSTRING module for full UTF-8 support.
• PHP JSON module for JSON manipulation

Installation

1. Download the latest version from the releases page.
2. Upload and extract the contents to your web server. You can also pull the repo with git pull.
3. Visit your domain installation directory or subdomain https://example.com/quickblaze-encrypt/

Extra: If using MYSQL as storage method:

• Update the database information in /modules/Database_example.env.
• Rename the configuration file to Database.env. View example configuration.

⚠️ Don't delete the .version, .config, or .cache files once the installation has completed! They contain necessary version data, configuration data; removing them will cause issues!

System Configurations

Example configuration layout of Modules/Database.env:

{
    "HOSTNAME": "mysql.example.com",
    "USERNAME": "admin",
    "PASSWORD": "admin123",
    "DATABASE": "quickblaze_db"
}

Example configuration of .config:

{ 
  "STORAGE_METHOD": "mysql",
  "LANGUAGE": "en",
  "INSTALLATION_PATH": "https://your-site.dev/quickblaze-encrypt"
}

⚠️ Do not include a trailing slash for the installation path!

How it Works

The user enters the message they would like to encrypt. The system then securely encrypts the message and generates, and returns, an encryption key integrated into a shareable URL. The key can be used to decrypt the encrypted message. The system then creates a new record via the chosen storage method, containing the encrypted data and the encryption key. As soon as the decryption function is called upon, the encryption record will automatically be deleted. This means the encrypted data is now permanently lost and cannot be viewed or accessed.

⚠️ Keep your URL safe, it contains the encryption key! Exposing the URL means anybody will be able to view the encrypted message!

Screenshots

Authors and Contributors

👤 axtonprice - Main Author

• Discord: https://discord.gg/dP3MuBATGc
• Twitter: @axtonprice
• Github: @axtonprice

Show your support

If you like this project, give a ⭐️ to support us!

📝 License

Copyright © 2022 axtonprice.
This project is MIT licensed.

---

quickblaze-encrypt's Issues

Fix code scanning alert - Prohibit [] notation when it can be expressed in dot notation

Tracking issue for:

• https://github.com/axtonprice-dev/quickblaze-encrypt/security/code-scanning/11334

Fix code scanning alert - Cross-site Scripting (XSS)

Tracking issue for:

• https://github.com/axtonprice-dev/quickblaze-encrypt/security/code-scanning/4

Additional password protection

Discussed in #71

^{Originally posted by RChutchev April 27, 2023}
I propose to add an additional layer of security - password protection.
When I create a message, I want to be able to add an additional password to decrypt the message.
The people who opened that message then have to provide a password (maybe a pin) to decrypt that message.
The message should only be shown to those who provide the password.

@import prevents parallel downloads, use <link> instead.

Codacy detected an issue:

Message: @import prevents parallel downloads, use <link> instead.

Currently on:

• Commit: 68c9a2d
• File: Public/assets/css/error.css
• LineNum: 1

Fix code scanning alert - Cross-site Scripting (XSS)

Tracking issue for:

• https://github.com/axtonprice-dev/quickblaze-encrypt/security/code-scanning/6

Fix code scanning alert - Prohibits use of expressions where normally you would expect to see assignments or function calls

Tracking issue for:

• https://github.com/axtonprice-dev/quickblaze-encrypt/security/code-scanning/11333

Bug/Issue Report

Describe the bug
Failed to load CSS and JS from external site.

To Reproduce
Steps to reproduce the behavior:

1. Go to main (home) page.
2. Right click and choose Inspect, go to Network tab
3. See errors

Expected behavior
Resources loaded successfully.

Screenshots

Desktop (please complete the following information):

• OS: MacOS
• Browser: Chrome, Safari
• Chrome version - Version 114.0.5735.133 (Official Build) (x86_64)
• Safari version - Version 16.5 (18615.2.9.11.4)

Fix code scanning alert - Requires each line to end in a semicolon

Tracking issue for:

• https://github.com/axtonprice-dev/quickblaze-encrypt/security/code-scanning/11332

Using height with border can sometimes make elements larger than you expect.

Codacy detected an issue:

Message: Using height with border can sometimes make elements larger than you expect.

Currently on:

• Commit: 68c9a2d
• File: Public/assets/css/error.css
• LineNum: 44

The box-sizing property isn't supported in IE6 and IE7.

Codacy detected an issue:

Message: The box-sizing property isn't supported in IE6 and IE7.

Currently on:

• Commit: 68c9a2d
• File: Public/assets/css/error.css
• LineNum: 7

Fix code scanning alert - Prohibits the use of __iterator__ property due to compatibility issues

Tracking issue for:

• https://github.com/axtonprice-dev/quickblaze-encrypt/security/code-scanning/11335

Copy Button

have a copy button, that copies the url once the encryption has occurred. or auto copy, on encryption.

Fix code scanning alert - Use of Insufficiently Random Values

Tracking issue for:

• https://github.com/axtonprice-dev/quickblaze-encrypt/security/code-scanning/5853

Fix code scanning alert - SQL Injection

Tracking issue for:

• https://github.com/axtonprice-dev/quickblaze-encrypt/security/code-scanning/2

Fix code scanning alert - Prohibit [] notation when it can be expressed in dot notation

Tracking issue for:

• https://github.com/axtonprice-dev/quickblaze-encrypt/security/code-scanning/11331

[Ongoing] Codebase Refactor - Nexshare Release

Nexshare Release 💎

Announcing the official release of Quickblaze Encrypt: Nexshare, our latest and most advanced version yet. Packed with cutting-edge new features, and an industry-standard layout with more widely used structures and frameworks, this release marks a significant milestone in the project's development. 🎉

• The functions file will be removed and separated into individual files and folders, adhering to the industry standard. Each system function will be categorized into a respective PHP class and method.
• The OpenSSL functions will be enhanced for improved security.
• The approach made to system initialization and rendering will be overhauled and improved.
• New UI features to be announced soon!

Using width with border-left can sometimes make elements larger than you expect.

Codacy detected an issue:

Message: Using width with border-left can sometimes make elements larger than you expect.

Currently on:

• Commit: 68c9a2d
• File: Public/assets/css/error.css
• LineNum: 36

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$mysqli'.

Codacy detected an issue:

Message: All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$mysqli'.

Occurred on:

• Commit: 87c0fbc
• File: Modules/Functions.php
• LineNum: 163
• Code: die($mysqli->error);

Currently on:

• Commit: 37b153d
• File: Modules/Functions.php
• LineNum: 159

Fix code scanning alert - Cross-site Scripting (XSS)

Tracking issue for:

• https://github.com/axtonprice-dev/quickblaze-encrypt/security/code-scanning/11373

Docker Image

Will there be an official Docker image?

The universal selector (*) is known to be slow.

Codacy detected an issue:

Message: The universal selector (*) is known to be slow.

Currently on:

• Commit: 68c9a2d
• File: Public/assets/css/error.css
• LineNum: 3

Fix code scanning alert - Cross-site Scripting (XSS)

Tracking issue for:

• https://github.com/axtonprice-dev/quickblaze-encrypt/security/code-scanning/11372

The use of function file_get_contents() is discouraged

Codacy detected an issue:

Message: The use of function file_get_contents() is discouraged

Currently on:

• Commit: 37b153d
• File: Modules/Functions.php
• LineNum: 108

The use of function file_exists() is discouraged

Codacy detected an issue:

Message: The use of function file_exists() is discouraged

Currently on:

• Commit: 37b153d
• File: Modules/Functions.php
• LineNum: 107

The function setupDatabase() contains an exit expression.

Codacy detected an issue:

Message: The function setupDatabase() contains an exit expression.

Occurred on:

• Commit: 8f05fd4
• File: Modules/Functions.php
• LineNum: 154
• Code: die();

Currently on:

• Commit: 37b153d
• File: Modules/Functions.php
• LineNum: 88

Direct use of $_GET Superglobal detected.

Codacy detected an issue:

Message: Direct use of $_GET Superglobal detected.

Occurred on:

• Commit: 87c0fbc
• File: Modules/Functions.php
• LineNum: 23
• Code: if (isset($_GET["submitted"])) {

Currently on:

• Commit: 68c9a2d
• File: Modules/Functions.php
• LineNum: 21

Fix code scanning alert - Requires each line to end in a semicolon

Tracking issue for:

• https://github.com/axtonprice-dev/quickblaze-encrypt/security/code-scanning/11370

Detected usage of a possibly undefined superglobal array index: $_SERVER['HTTP_ACCEPT_LANGUAGE']. Use isset() or empty() to check the index exists before using it

Codacy detected an issue:

Message: Detected usage of a possibly undefined superglobal array index: $_SERVER['HTTP_ACCEPT_LANGUAGE']. Use isset() or empty() to check the index exists before using it

Occurred on:

• Commit: 8f05fd4
• File: Modules/Functions.php
• LineNum: 262
• Code: $tl = substr($_SERVER['HTTP_ACCEPT_LANGUAGE'], 0, 2);

Currently on:

• Commit: 37b153d
• File: Modules/Functions.php
• LineNum: 260

Fix code scanning alert - Path Traversal

Tracking issue for:

• https://github.com/axtonprice-dev/quickblaze-encrypt/security/code-scanning/11371

Fix code scanning alert - SQL Injection

Tracking issue for:

• https://github.com/axtonprice-dev/quickblaze-encrypt/security/code-scanning/1

Fix code scanning alert - Use of Insufficiently Random Values

Tracking issue for:

• https://github.com/axtonprice-dev/quickblaze-encrypt/security/code-scanning/5852

Fix code scanning alert - Prohibit [] notation when it can be expressed in dot notation

Tracking issue for:

• https://github.com/axtonprice-dev/quickblaze-encrypt/security/code-scanning/11330

Fix code scanning alert - Path Traversal

Tracking issue for:

• https://github.com/axtonprice-dev/quickblaze-encrypt/security/code-scanning/10

Fix code scanning alert - Cross-site Scripting (XSS)

Tracking issue for:

• https://github.com/axtonprice-dev/quickblaze-encrypt/security/code-scanning/5

Fix code scanning alert - SQL Injection

Tracking issue for:

• https://github.com/axtonprice-dev/quickblaze-encrypt/security/code-scanning/3

The use of function header() is discouraged

Codacy detected an issue:

Message: The use of function header() is discouraged

Occurred on:

• Commit: 32f2791
• File: Modules/Functions.php
• LineNum: 67
• Code: header("Location: ./");

Currently on:

• Commit: 37b153d
• File: Modules/Functions.php
• LineNum: 33

The function setupStorageMethod() has a Cyclomatic Complexity of 17. The configured cyclomatic complexity threshold is 10.

Codacy detected an issue:

Message: The function setupStorageMethod() has a Cyclomatic Complexity of 17. The configured cyclomatic complexity threshold is 10.

Occurred on:

• Commit: 8d2714b
• File: Modules/Functions.php
• LineNum: 126
• Code: function setupStorageMethod()

Currently on:

• Commit: 37b153d
• File: Modules/Functions.php
• LineNum: 78

[DEV] Database Setup Unfinished

After the recent feature update and code rewrite, the database will not be fully set up. Filetree storage method is recommended meanwhile, despite being less secure.