From 7fac11415a60826a9d3ffaaade2058d20e5a17d2 Mon Sep 17 00:00:00 2001 From: Touhidur Rahman Date: Wed, 29 May 2024 13:36:50 +0600 Subject: [PATCH 1/3] pkp/pkp-lib#9895 app key and encryption service integration --- config.TEMPLATE.inc.php | 17 ++++++++++++----- dbscripts/xml/upgrade.xml | 1 + docs/release-notes/README-3.5.0 | 8 +++++++- 3 files changed, 20 insertions(+), 6 deletions(-) diff --git a/config.TEMPLATE.inc.php b/config.TEMPLATE.inc.php index 0e29020240..ff1eb7431e 100644 --- a/config.TEMPLATE.inc.php +++ b/config.TEMPLATE.inc.php @@ -24,6 +24,10 @@ [general] +; An application specific key that is required for the app to run +; Internally this is used for any encryption (specifically cookie encryption if enabled) +app_key = + ; Set this to On once the system has been installed ; (This is generally done automatically by the installer) installed = Off @@ -50,11 +54,6 @@ ; To set the "Secure" attribute for the cookie see the setting force_ssl at the [security] group session_samesite = Lax -; Enable this if want to enable cookie encryption -; The length of the cookie encryption key must be 16 characters -; Note that updating or removing cookie encryption key will result in logout from all devices -; session_cookie_encryption_key = '' - ; Enable support for running scheduled tasks ; Set this to On if you have set up the scheduled tasks script to ; execute periodically @@ -260,6 +259,14 @@ [security] +; Specific cipher algorithm used to generate app key and encryption purpose +; Valid and available algorithms are `aes-128-cbc`, `aes-256-cbc`, `aes-128-gcm` and `aes-256-gcm` +; cipher = 'aes-256-cbc' + +; Define should the cookie at user's end need to be encrypted +; Enabling/Disabling will force all user to re-login +; cookie_encryption = On + ; Force SSL connections site-wide and also sets the "Secure" flag for session cookies ; See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#secure force_ssl = Off diff --git a/dbscripts/xml/upgrade.xml b/dbscripts/xml/upgrade.xml index 088be8df08..d84e09800b 100644 --- a/dbscripts/xml/upgrade.xml +++ b/dbscripts/xml/upgrade.xml @@ -109,6 +109,7 @@ + diff --git a/docs/release-notes/README-3.5.0 b/docs/release-notes/README-3.5.0 index e6eb01b2a6..421db30808 100644 --- a/docs/release-notes/README-3.5.0 +++ b/docs/release-notes/README-3.5.0 @@ -11,9 +11,15 @@ See config.TEMPLATE.inc.php for a description and examples of all supported configuration parameters. New config.inc.php parameters added for general: - - session_cookie_enctyption_key (default value: ''), allow cookie encryption when set + - app_key (default value: ''), application specific key will used internally for encryption/decryption + +New config.inc.php parameters added for security: + - cipher (default value: ''), cipher algorithm used to generate app key and encryption purpose + - cookie_encryption (default value: ''), allow cookie encryption when set + New Features ------------ #9566 : Convert session and cookie management to Laravel + #9895 : Introduce APP KEY feature of Laravel From 16781a89110a14ffc2641c993a7550d46d6e6cf7 Mon Sep 17 00:00:00 2001 From: Touhidur Rahman Date: Wed, 29 May 2024 13:37:01 +0600 Subject: [PATCH 2/3] pkp/pkp-lib#9895 Submodule Update ##touhidurabir/i9895_main## --- lib/pkp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/pkp b/lib/pkp index bee9547b49..4d85c0feee 160000 --- a/lib/pkp +++ b/lib/pkp @@ -1 +1 @@ -Subproject commit bee9547b491353e92e53e5ed2da2d197a24be972 +Subproject commit 4d85c0feee944902581c69d645cc59c5602dc714 From 5be468e118903130ee0de238f2e9dfde38c84f57 Mon Sep 17 00:00:00 2001 From: Touhidur Rahman Date: Fri, 7 Jun 2024 17:58:33 +0600 Subject: [PATCH 3/3] pkp/pkp-lib#9895 readme updated --- docs/release-notes/README-3.5.0 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/release-notes/README-3.5.0 b/docs/release-notes/README-3.5.0 index 421db30808..de023b989c 100644 --- a/docs/release-notes/README-3.5.0 +++ b/docs/release-notes/README-3.5.0 @@ -11,7 +11,7 @@ See config.TEMPLATE.inc.php for a description and examples of all supported configuration parameters. New config.inc.php parameters added for general: - - app_key (default value: ''), application specific key will used internally for encryption/decryption + - app_key (default value: ''), application specific key will used internally for encryption/decryption. This will be automatically added at upgrade. New config.inc.php parameters added for security: - cipher (default value: ''), cipher algorithm used to generate app key and encryption purpose