d8-contrib-modules / encrypt Goto Github PK
View Code? Open in Web Editor NEWDEPRECATED - D8 Encrypt moved to http://drupal.org/project/encrypt
Home Page: http://drupal.org/project/encrypt
DEPRECATED - D8 Encrypt moved to http://drupal.org/project/encrypt
Home Page: http://drupal.org/project/encrypt
Exceptions are thrown when no key exists or requirements for encryption are not met.
This shouldn't throw a PHP fatal. This should log a message and possibly throw a site message.
-Look at Key module for example
While this is fairly standard, some PHP versions may not have this
-Should categorize to "security", like other modules (e.g. Password Policy). /admin/config/security/encryption for SettingsForm
-Need to expose the route from within the admin/config page
Default cannot be used as a key's machine name
When the user is presented with the list of available keys to use for encryption, it should be filtered so that only keys that match their encryption method are shown. As a first step, we can just filter by key type group ("encryption") and make further adjustments later to improve the behavior. Implementing this means that we will not be able to use the Key Select Form API element yet, since it's not currently possible to filter the key list by key type group.
https://github.com/nerdstein/encrypt/blob/master/help/encrypt.help.ini
Not sure this is to be used. Is this correct?
It is generally recommended not to use MCrypt in modern web applications and the implementation that currently exists in Encrypt is not secure, so we should remove the MCrypt encryption method from the module. Tests are using this method, so we will need to add some sort of method to the tests. I will create a separate issue for that.
Exception Warning McryptAES256Encry 47 Drupal\encrypt\Plugin\EncryptionMet
mcrypt_encrypt(): Key of size 17 not supported by this algorithm. Only keys
of sizes 16, 24 or 32 supportedmcrypt_encrypt('rijndael-256', 'test this
key out', 'S|9/>&Ysu', 'ecb', '')
Drupal\encrypt\Plugin\EncryptionMethod\McryptAES256Encryption->encrypt('S|9/>&Ysu',
'test this key out')
Drupal\encrypt\EncryptService->encrypt('S|9/_>&Ysu')
Drupal\encrypt\Tests\EncryptEncryptDecryptTest->testDefaultEncryptDecrypt()
Drupal\simpletest\TestBase->run(Array)
simpletest_script_run_one_test('1',
'Drupal\encrypt\Tests\EncryptEncryptDecryptTest')
Need to do two things:
Ties to Encryption entity. Entity should have settings. Settings should be pulled in from the EntityMethod plugin.
The encryption profile configuration entity should take advantage of the benefits of plugin collections by adding a plugin collection for the encryption method plugin type. Key already does this for its three plugin types, so the code can largely be copied from Key.
In this PR, OpenSSL / Defuse is mentioned and I second this motion. Has there been any effort to making this happen and what can I do to help?
I have standardized on using Real AES for D7 but as far as I know, there is no D8 port yet. This should be the recommended default for D8 Encrypt and not require a separate module.
We may want to wrap the test in if (!function_exists('mcrypt_encrypt')) {} and output a message that the php module isn't installed if it fails.
I dont understand why it's there
I've previously expressed the opinion that we shouldn't create a profile automatically when Encrypt is installed. I still think that's the case and I'd like to be clear about my arguments:
Can copy the current AES plugin and refactor AES
TBD
More info found here: https://docs.google.com/document/d/1cKWZbeHdDSMD4eOJeGp8lrJ-im0VtlWoM-hKv_LNteE/edit
LICENSE.txt gets added automatically by the Drupal.org packaging script, so it shouldn't be included in the Git repository.
https://github.com/nerdstein/encrypt/tree/master/includes
These look like D7 artifacts
See password policy code, which does this
$->encrypt($text, $encryptionMethod, $keyType);
The "Basic" encryption method is being deprecated in the Drupal 7 version of Encrypt, and it does not need to be included at all in the Drupal 8 version.
Since Encrypt will not include any bundled encryption methods, we will need to have some sort of simple method for tests to use. It doesn't even need to actually involve encryption; it just needs to modify a plaintext value in a reversible way. I propose a basic Rot13 method, because it will fulfill that need and will be easy to write.
Doesn't look like there is much worth keeping in there.
There are two really important scenarios to consider.
Key is naive - it assumes someone knows how to invoke its service.
Encrypt is less naive - it references a key instance within it's Encryption Profiles. We may need to store or reference a specific revision of a Key entity.
We also should consider a "key change" service that decrypts a string with one Encryption Profile and encrypts the string with a second Encryption Profile.
Not needed
We are not going to be bundling any encryption methods with Encrypt (for more information, see #60), so the PHPSecLib method should be removed from the project.
Use case: mcrypt. Consider either separate plugin types or one plugin type with the settings below.
-Separate submodule of Encrypt
-mcrypt plugin type
-look at cyphers (aes, rjindal, blowfish)
-look at mode (cbc)
https://github.com/nerdstein/encrypt/blob/master/config/schema/encrypt.schema.yml
This will be replaced by entity
Ensure that Encryption method dependencies are met before they can be used. This should probably take place on the settings form when the item is selected or on the form validate.
Page just has a text field to encrypt and decrypt text. Let you easily test out your key and encryption method configuration.
The same would apply for the drush comand just without the UI drush encryption encrypt "Test"
and drush encryption decrypt "avv9wervwen!d"
https://github.com/nerdstein/encrypt/blob/master/src/Form/EncryptAddConfigurationForm.php
I'd recommend removing this and refactoring.
-Create actual entity
-Remove database logic
-Integrate with Key entity / plugin system
Looks like a possible D7 artifact
https://github.com/nerdstein/encrypt/tree/master/tests/plugins/key_providers
Drupal.org's packaging script automatically adds lines for project and datestamp, so they should be removed from our .info.yml files.
When I originally wrote the existing system for managing bundles of encryption settings, I used the label "configuration" to refer to them. Since that term has a specific meaning within Drupal 8, we should consider changing it to "profile."
-File
-File Path
This then restricts the use of configuration based key types (e.g. SimpleKey) which are not advantageous for security
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.