Encrypt Fabrik Connection Password

[hvarun]

Hi..In what format is the fabrik connection password encrypted and stored in the database? is there a reference php code for encrypting it and storing in database manually?

Thanks in advance

Regards,
Varun

 

[cheesegrits]

Interesting you should ask that, I was actually in the middle of working on some changes to it, to use a more secure crypto method.

When you say "storing it manually", do you mean outside of J! entirely?

We currently do this:

$crypt = FabrikWorker::getCrypt();
$data['password'] = $crypt->encrypt($data['password']);

... prior to storing the #__fabrik_connections data.

The FabrikWorker::getCrypt() does this:

    public static function getCrypt()
    {
        jimport('joomla.crypt.crypt');
        jimport('joomla.crypt.key');
        $config = JFactory::getConfig();
        $secret = $config->get('secret', '');

        if (trim($secret) == '')
        {
            throw new RuntimeException('You must supply a secret code in your Joomla configuration.php file');
        }

        $key   = new JCryptKey('simple', $secret, $secret);
        $crypt = new JCrypt(new JCryptCipherSimple, $key);

        return $crypt;
    }

... which is obviously suboptimal, as it stores using the (very!) deprecated and insecure JCryptCipherSimple. Although if someone is reading your #__fabrik_connections table, you probably already have bigger problems to worry about.

So anyway, as long as you are within J!, you can use the code form that helper function to encrypt your password such that we can then decrypt it. If you are running in a Fabrik context, you could use that helper function directly.

If you are outside of J!, you'd have to emulate the JCrypt / JCryptCipherSimple encoding, using the 'secret' from your J! configuration.php.

-- hugh