{"action":"created","issue":{"url":"https://api.github.com/repos/civicrm/civicrm-core/issues/12697","repository_url":"https://api.github.com/repos/civicrm/civicrm-core","labels_url":"https://api.github.com/repos/civicrm/civicrm-core/issues/12697/labels{/name}","comments_url":"https://api.github.com/repos/civicrm/civicrm-core/issues/12697/comments","events_url":"https://api.github.com/repos/civicrm/civicrm-core/issues/12697/events","html_url":"https://github.com/civicrm/civicrm-core/pull/12697","id":352011136,"node_id":"MDExOlB1bGxSZXF1ZXN0MjA5NDMwMDE1","number":12697,"title":"Add support for an encryption provider in an extension","user":{"login":"eileenmcnaughton","id":336308,"node_id":"MDQ6VXNlcjMzNjMwOA==","avatar_url":"https://avatars2.githubusercontent.com/u/336308?v=4","gravatar_id":"","url":"https://api.github.com/users/eileenmcnaughton","html_url":"https://github.com/eileenmcnaughton","followers_url":"https://api.github.com/users/eileenmcnaughton/followers","following_url":"https://api.github.com/users/eileenmcnaughton/following{/other_user}","gists_url":"https://api.github.com/users/eileenmcnaughton/gists{/gist_id}","starred_url":"https://api.github.com/users/eileenmcnaughton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eileenmcnaughton/subscriptions","organizations_url":"https://api.github.com/users/eileenmcnaughton/orgs","repos_url":"https://api.github.com/users/eileenmcnaughton/repos","events_url":"https://api.github.com/users/eileenmcnaughton/events{/privacy}","received_events_url":"https://api.github.com/users/eileenmcnaughton/received_events","type":"User","site_admin":false},"labels":[{"id":246037889,"node_id":"MDU6TGFiZWwyNDYwMzc4ODk=","url":"https://api.github.com/repos/civicrm/civicrm-core/labels/master","name":"master","color":"0052cc","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":17,"created_at":"2018-08-20T07:11:50Z","updated_at":"2018-08-22T19:26:48Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/civicrm/civicrm-core/pulls/12697","html_url":"https://github.com/civicrm/civicrm-core/pull/12697","diff_url":"https://github.com/civicrm/civicrm-core/pull/12697.diff","patch_url":"https://github.com/civicrm/civicrm-core/pull/12697.patch"},"body":"Overview\r\n----------------------------------------\r\nThis is a proposal for https://lab.civicrm.org/dev/core/issues/236 - it doesn't seek to answer the question of how to provide encryption - only how to move that decision out of core.\r\n\r\nI threw together https://github.com/eileenmcnaughton/org.civicrm.mcrypt and ran through the functions in a unit test.\r\n\r\nNote that we ONLY ACTUALLY ENCRYPT ONE FIELD in core! That field is smtp_provider & if an imap account is set up it won't be encrypted there - so this feels kinda optional. I am guessing from @adixon interest there might be some usage outside of core & hence this has been written to provide no breakage & with the expecation that we would later deprecate & remove the lines that still handled mcrypt for people without the extension. We'd also need to consider shipping the extension until such time as we have a preferred extension for new builds.\r\n\r\nThis also punts any upgrade / migration related issues.\r\n\r\n\r\nBefore\r\n----------------------------------------\r\nOnly Mcrypt possible\r\n\r\nAfter\r\n----------------------------------------\r\nExtensions could add other providers. Only mcrypt exists as an extension provided encrypter :-)\r\n\r\nTechnical Details\r\n----------------------------------------\r\nThe approach is simply to add a setting - which can be [set by an extension](https://github.com/eileenmcnaughton/org.civicrm.mcrypt/blob/master/CRM/Mcrypt/Upgrader.php#L16) and an interface.\r\n\r\nNot sure if any inputs / outputs other than string make sense\r\n\r\nComments\r\n----------------------------------------\r\nI'm not actually vested in this - it just seemed like 40 minutes spent demonstrating in code would be easier than 40 mins spent explaining in a comment https://lab.civicrm.org/dev/core/issues/236 & it seems merging this would unblock stuff.\r\n\r\nThis looks like a good plugin https://github.com/defuse/php-encryption/blob/master/docs/Tutorial.md\r\n"},"comment":{"url":"https://api.github.com/repos/civicrm/civicrm-core/issues/comments/415150658","html_url":"https://github.com/civicrm/civicrm-core/pull/12697#issuecomment-415150658","issue_url":"https://api.github.com/repos/civicrm/civicrm-core/issues/12697","id":415150658,"node_id":"MDEyOklzc3VlQ29tbWVudDQxNTE1MDY1OA==","user":{"login":"nganivet","id":3435067,"node_id":"MDQ6VXNlcjM0MzUwNjc=","avatar_url":"https://avatars0.githubusercontent.com/u/3435067?v=4","gravatar_id":"","url":"https://api.github.com/users/nganivet","html_url":"https://github.com/nganivet","followers_url":"https://api.github.com/users/nganivet/followers","following_url":"https://api.github.com/users/nganivet/following{/other_user}","gists_url":"https://api.github.com/users/nganivet/gists{/gist_id}","starred_url":"https://api.github.com/users/nganivet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nganivet/subscriptions","organizations_url":"https://api.github.com/users/nganivet/orgs","repos_url":"https://api.github.com/users/nganivet/repos","events_url":"https://api.github.com/users/nganivet/events{/privacy}","received_events_url":"https://api.github.com/users/nganivet/received_events","type":"User","site_admin":false},"created_at":"2018-08-22T19:26:48Z","updated_at":"2018-08-22T19:26:48Z","author_association":"CONTRIBUTOR","body":"Thanks. I really think providing encryption for passwords that are stored in the database makes sense to have in core. We all do backups and ship these off-site, having passwords in clear text in these backups is definitely a security risk. We should on the opposite try to encrypt more passwords rather than remove encryption service from core. I am very surprised IMAP passwords are not encrypted. And what about payment processor keys? Are these not encrypted?"}}
{"actor":{"display_login":"nganivet"}}