Merge branch 'feature-25563/PV21_Verschlüsselung_Gehaltsdaten' into feature-25562/PV21_Datenbankstruktur_fuer_Vertraege_und_Gehaelter

include/basis_db.class.php

@@ -163,6 +163,43 @@ abstract class db extends basis
 		return $rows;
 	}
 
+	/**
+	 * Replace the password names with the related passwords in a SQL string, to decrypt data from the DB
+	 */
+	protected function replaceSQLDecryptionPassword($sql)
+	{
+		$newSQL = null;
+
+		// If the global constant CI_ENVIRONMENT is not defined then return a failure
+		if (!defined('CI_ENVIRONMENT')) return null;
+
+		define('BASEPATH', 'LEGACY_WORKAROUND'); // little trick to load a CI config file
+
+		// Tries to include the CI config file that contains password for the database encryption
+		// If the include fails then return a failure
+		if (!include_once(dirname(__FILE__).'/../application/config/'.CI_ENVIRONMENT.'/db_crypt.php')) return null;
+
+		// Array that will contains all the DB decryption password
+		$decryptionPasswordsArray = array();
+		// Array that will contains all the DB decryption password names
+		$decryptionPasswordNamesArray = array();
+
+		// For each password found in the config array
+		foreach ($config['encryption_passwords'] as $name => $password)
+		{
+			// Copy the password name using this template: '{$'<password name>'}'
+			$decryptionPasswordArray[] = $password;
+			$decryptionPasswordNamesArray[] = '${'.$name.'}';
+		}
+
+		// Replace the password names with the password values
+		$newSQL = str_replace($decryptionPasswordNamesArray, $decryptionPasswordArray, $sql);
+
+		// In case the replacement is a failure
+		if ($newSQL == '' || $newSQL == null) return null;
+
+		return $newSQL; // OK
+	}
 }
 require_once(dirname(__FILE__).'/'.DB_SYSTEM.'.class.php');
 

include/filter.class.php

@@ -230,9 +230,11 @@ class filter extends basis_db
 	 */
 	public function loadValues($sql, $valuename, $showvalue)
 	{
-
 		$this->values = array();
 
+		// In case a decryption function is used then perform password substitution
+		$sql = $this->replaceSQLDecryptionPassword($sql);
+
 		if($this->db_query($sql))
 		{
 			while($row = $this->db_fetch_row())

include/functions.inc.php

@@ -1197,6 +1197,26 @@ function anzahlTage($date1, $date2)
 	return round($diff / 86400);
 }
 
+/**
+ * Checks if the provided SQL string contains PostgreSQL functions to decrypt data, returns a boolean
+ */
+function hasSQLDecryption($sql)
+{
+	return stripos($sql, 'PGP_SYM_DECRYPT') !== false;
+}
+
+/**
+ * Checks if the provided SQL string contains PostgreSQL functions to decrypt data,
+ * and if it is used a variable instead of a readable password. Returns a boolean
+ */
+function isSQLDecryptionValid($sql)
+{
+	// If the SQL string contains decryption functions and there are _no_ password variables
+	if (hasSQLDecryption($sql) && strpos($sql, '${') === false) return false; // then return false
+
+	return true; // in any other case return true
+}
+
 /**
  * Gibt zurück, ob ein String ausschließlich erlaubte Zeichen enthält
  * erlaubt: Buchstaben a-z, A-Z, 0-9, -, _
@@ -1205,10 +1225,10 @@ function anzahlTage($date1, $date2)
  */
 function hasOnlyAllowedChars($stringToCheck)
 {
-		if (!preg_match("#^[a-zA-Z0-9_-]+$#", $stringToCheck))
-			return false;
-		else
-			return true;
+	if (!preg_match("#^[a-zA-Z0-9_-]+$#", $stringToCheck))
+		return false;
+	else
+		return true;
 }
 
 ?>

include/statistik.class.php

@@ -514,6 +514,9 @@ class statistik extends basis_db
 		$this->countRows=0;
 		set_time_limit(120);
 
+		// In case a decryption function is used then perform password substitution
+		$this->sql = $this->replaceSQLDecryptionPassword($this->sql);
+
 		if($this->sql!='')
 		{
 			$sql = $this->sql;