+ More more more security.

* Don't show login name, password and transaction key at the configuration page.
* RC4Encrypt these fields and move to the config_plugins table from the config table.
* Config page is fully https.

diff --git a/enrol/authorize/authorizenetlib.php b/enrol/authorize/authorizenetlib.php
index 48d586a5ecba6a3429fd77794ea95a86f0c76c0b..a507528738c67c6e279606210b87557a5cf4ca5e 100644 (file)
--- a/enrol/authorize/authorizenetlib.php
+++ b/enrol/authorize/authorizenetlib.php
@@ -97,21 +97,22 @@ function authorize_action(&$order, &$message, &$extra, $action=AN_ACTION_NONE, $
     static $conststring;
 
     if (!isset($conststring)) {
+        $mconfig = get_config('enrol/authorize');
         $constdata = array(
              'x_version'         => '3.1',
              'x_delim_data'      => 'True',
              'x_delim_char'      => AN_DELIM,
              'x_encap_char'      => AN_ENCAP,
              'x_relay_response'  => 'FALSE',
-             'x_login'           => $CFG->an_login
+             'x_login'           => urlencode(rc4decrypt($mconfig->an_login))
         );
         $str = '';
         foreach($constdata as $ky => $vl) {
             $str .= $ky . '=' . urlencode($vl) . '&';
         }
-        $str .= (!empty($CFG->an_tran_key)) ?
-                'x_tran_key=' . urlencode($CFG->an_tran_key):
-                'x_password=' . urlencode($CFG->an_password);
+        $str .= (!empty($mconfig->an_tran_key)) ?
+                'x_tran_key=' . urlencode(rc4decrypt($mconfig->an_tran_key)):
+                'x_password=' . urlencode(rc4decrypt($mconfig->an_password));
 
         $conststring = $str;
         $str = '';

diff --git a/enrol/authorize/config_form.php b/enrol/authorize/config_form.php
index 87f8e0ac8c830f0635288c1f94b6e6e7a14ab0c4..97b7c5a0a6ad6dc55246d2cb3b11fa3f70620323 100755 (executable)
--- a/enrol/authorize/config_form.php
+++ b/enrol/authorize/config_form.php
@@ -84,37 +84,34 @@ if (!isset($frm->acceptechecktypes)) {
 <tr valign="top"><td colspan="2"><h4><?php print_string("adminauthorizesettings", "enrol_authorize") ?></h4></td></tr>
 
 <tr valign="top">
-    <td align="right">an_login:</td>
-    <td><input type="text" name="an_login" value="<?php p($frm->an_login) ?>" /><br />
-        <?php print_string("anlogin", "enrol_authorize") ?></td>
+    <td align="right">&nbsp;&nbsp;</td>
+    <td><?php print_string("logininfo", "enrol_authorize") ?></td>
 </tr>
 
 <tr valign="top">
-    <td align="right">#&nbsp;#&nbsp;</td>
-    <td><?php print_string("chooseone", "enrol_authorize") ?></td>
+    <td align="right">an_login:<br /><?php echo (isset($mconfig->an_login)) ? '<font color=green>'.get_string('ok').'</font>' : ''; ?></td>
+    <td><?php print_string("anlogin", "enrol_authorize") ?><br /><input type="text" name="an_login" size="26" value="" /><sup>*</sup></td>
 </tr>
 
 <tr valign="top">
-    <td align="right">an_tran_key:</td>
-    <td><input type="text" name="an_tran_key" value="<?php p($frm->an_tran_key) ?>" /><sup>#1</sup><br />
-        <?php print_string("antrankey", "enrol_authorize") ?></td>
+    <td align="right">an_tran_key:<br /><?php echo (isset($mconfig->an_tran_key)) ? '<font color=green>'.get_string('ok').'</font>' : ''; ?></td>
+    <td><?php print_string("antrankey", "enrol_authorize") ?><br /><input type="text" name="an_tran_key" size="26" value="" /><sup>#1</sup></td>
 </tr>
 
 <tr valign="top">
-    <td align="right">an_password:</td>
-    <td><input type="text" name="an_password" value="" /><sup>#2</sup><br />
-        <?php print_string("anpassword", "enrol_authorize") ?><br />(<?php print_string("leavetokeep") ?>)</td>
+    <td align="right">an_password:<br /><?php echo (isset($mconfig->an_password)) ? '<font color=green>'.get_string('ok').'</font>' : ''; ?></td>
+    <td><?php print_string("anpassword", "enrol_authorize") ?><br /><input type="text" name="an_password" size="26" value="" /><sup>#2</sup></td>
 </tr>
 
 <tr valign="top">
     <td align="right">delete_current:</td>
     <td><?php print_checkbox('delete_current', '1', !empty($frm->delete_current)) ?> <br />
-        <?php print_string("deletecheck", "moodle", get_string('oldpassword')) ?><br /><br /></td>
+        <?php print_string("deletecheck", "moodle", get_string('oldpassword')) ?><br /><hr size="1" width="100%" noshade /></td>
 </tr>
 
 <tr valign="top">
     <td align="right">an_referer:</td>
-    <td><input type="text" name="an_referer" value="<?php p($frm->an_referer) ?>" /><br />
+    <td><input type="text" name="an_referer" size="35" value="<?php p($frm->an_referer) ?>" /><br />
         <?php print_string("anreferer", "enrol_authorize") ?></td>
 </tr>
 

diff --git a/enrol/authorize/db/upgrade.php b/enrol/authorize/db/upgrade.php
index 214f7262fbc6e1d7aa0b6f9fd66610782a8bb987..5a4ec888312cadd07f139853d166482321f737dc 100644 (file)
--- a/enrol/authorize/db/upgrade.php
+++ b/enrol/authorize/db/upgrade.php
@@ -32,6 +32,33 @@ function xmldb_enrol_authorize_upgrade($oldversion=0) {
         }
     }
 
+    if ($result && $oldversion < 2006112900) {
+        if (isset($CFG->an_login)) {
+            if (empty($CFG->an_login)) {
+               unset_config('an_login');
+            }
+            else {
+               $result = $result && set_config('an_login', rc4encrypt($CFG->an_login), 'enrol/authorize') && unset_config('an_login');
+            }
+        }
+        if (isset($CFG->an_tran_key)) {
+            if (empty($CFG->an_tran_key)) {
+               unset_config('an_tran_key');
+            }
+            else {
+               $result = $result && set_config('an_tran_key', rc4encrypt($CFG->an_tran_key), 'enrol/authorize') && unset_config('an_tran_key');
+            }
+        }
+        if (isset($CFG->an_password)) {
+            if (empty($CFG->an_password)) {
+               unset_config('an_password');
+            }
+            else {
+                $result = $result && set_config('an_password', rc4encrypt($CFG->an_password), 'enrol/authorize') && unset_config('an_password');
+            }
+        }
+    }
+
     return $result;
 }
 

diff --git a/enrol/authorize/enrol.php b/enrol/authorize/enrol.php
index f2cc02a5638ea5a54251f166e5a022f0c41b6fec..c32e22c9e32f3954f5046b809756394f7e2592f3 100755 (executable)
--- a/enrol/authorize/enrol.php
+++ b/enrol/authorize/enrol.php
@@ -405,6 +405,7 @@ class enrolment_plugin_authorize
     function config_form($frm)
     {
         global $CFG;
+        $mconfig = get_config('enrol/authorize');
 
         if (! check_openssl_loaded()) {
             notify('PHP must be compiled with SSL support (--with-openssl)');
@@ -427,7 +428,6 @@ class enrolment_plugin_authorize
             $captureday = intval($frm->an_capture_day);
             $emailexpired = intval($frm->an_emailexpired);
             if ($captureday > 0 || $emailexpired > 0) {
-                $mconfig = get_config('enrol/authorize');
                 if ((time() - intval($mconfig->an_lastcron) > 3600 * 24)) {
                     notify(get_string('admincronsetup', 'enrol_authorize'));
                 }
@@ -442,10 +442,10 @@ class enrolment_plugin_authorize
         }
 
         if (data_submitted()) {
-            if (empty($frm->an_login)) {
+            if (empty($mconfig->an_login)) {
                 notify("an_login required");
             }
-            if (empty($frm->an_tran_key) && empty($frm->an_password)) {
+            if (empty($mconfig->an_tran_key) && empty($mconfig->an_password)) {
                 notify("an_tran_key or an_password required");
             }
         }
@@ -464,6 +464,7 @@ class enrolment_plugin_authorize
     function process_config($config)
     {
         global $CFG;
+        $mconfig = get_config('enrol/authorize');
 
         // site settings
         if (($cost = optional_param('enrol_cost', 5, PARAM_INT)) > 0) {
@@ -502,7 +503,6 @@ class enrolment_plugin_authorize
         $emailexpired = ($emailexpired > 5) ? 5 : (($emailexpired < 0) ? 0 : $emailexpired);
 
         if (!empty($reviewval) && ($captureday > 0 || $emailexpired > 0)) {
-            $mconfig = get_config('enrol/authorize');
             if (time() - intval($mconfig->an_lastcron) > 3600 * 24) {
                 return false;
             }
@@ -520,30 +520,35 @@ class enrolment_plugin_authorize
             return false;
         }
 
-        // required fields
+        // REQUIRED fields;
+        // an_login
         $loginval = optional_param('an_login', '');
-        if (empty($loginval)) {
+        if (empty($loginval) && empty($mconfig->an_login)) {
             return false;
         }
-        set_config('an_login', $loginval);
+        $loginval = !empty($loginval) ? rc4encrypt($loginval) : strval($mconfig->an_login);
+        set_config('an_login', $loginval, 'enrol/authorize');
 
+        // an_tran_key, an_password
         $tranval = optional_param('an_tran_key', '');
+        $tranval = !empty($tranval) ? rc4encrypt($tranval) : (isset($mconfig->an_tran_key)?$mconfig->an_tran_key:'');
         $passwordval = optional_param('an_password', '');
-        $deletecurrent = optional_param('delete_current', '');
-
-        if (!empty($passwordval)) { // password is changing
-            set_config('an_password', $passwordval);
+        $passwordval = !empty($passwordval) ? rc4encrypt($passwordval) :(isset($mconfig->an_password)?$mconfig->an_password:'');
+        $deletecurrent = optional_param('delete_current', '0', PARAM_BOOL);
+        if (!empty($deletecurrent) and !empty($tranval)) {
+            unset_config('an_password', 'enrol/authorize');
+            $passwordval = '';
         }
-        elseif (!empty($deletecurrent) and !empty($tranval)) {
-            set_config('an_password', '');
-            $CFG->an_password = '';
+        elseif (!empty($passwordval)) {
+            set_config('an_password', $passwordval, 'enrol/authorize');
         }
-
-        if (empty($tranval) and empty($CFG->an_password)) {
+        if (empty($tranval) and empty($passwordval)) {
             return false;
         }
+        if (!empty($tranval)) {
+            set_config('an_tran_key', $tranval, 'enrol/authorize');
+        }
 
-        set_config('an_tran_key', $tranval);
         return true;
     }
 

diff --git a/enrol/authorize/version.php b/enrol/authorize/version.php
index 5fb02e57abd1c27baf274737c391d3c65eff10dc..4b8f6c9464b49752e96a82c63c9e93554971ce3f 100755 (executable)
--- a/enrol/authorize/version.php
+++ b/enrol/authorize/version.php
@@ -1,6 +1,6 @@
 <?php // $Id$
 
-$plugin->version  = 2006111700;
+$plugin->version  = 2006112900;
 $plugin->requires = 2006100401;
 
 ?>

diff --git a/lang/en_utf8/enrol_authorize.php b/lang/en_utf8/enrol_authorize.php
index ed4cd794ff4961b5017b5b1445cd463808c0c178..27307b16577f577c980eaa56c6fe8115f011265e 100644 (file)
--- a/lang/en_utf8/enrol_authorize.php
+++ b/lang/en_utf8/enrol_authorize.php
@@ -1,5 +1,5 @@
 <?PHP // $Id$ 
-      // enrol_authorize.php - created with Moodle 1.8 dev (2006112000)
+      // enrol_authorize.php - created with Moodle 1.8 dev (2006112200)
 
 
 $string['adminacceptccs'] = 'Which credit card types will be accepted?';
@@ -106,6 +106,7 @@ $string['invalidaba'] = 'Invalid ABA number';
 $string['invalidaccnum'] = 'Invalid account number';
 $string['invalidacctype'] = 'Invalid account type';
 $string['logindesc'] = 'This option must be ON. <br /><br />Please ensure that you have turned <a href=\"$a->url\">loginhttps ON</a> in Admin >> Variables >> Security.<br /><br />Turning this on will make Moodle use a secure https connection just for the login and payment pages.';
+$string['logininfo'] = 'Login name, password and transaction key aren\'t shown due to security measure. There is no need to enter again if you have configured these fields before. You see a green text near the field if some fields were configured. If you enter first time these fields, the login name (*) is required and you must enter <strong>either</strong> the transaction key (#1) <strong>or</strong> the password (#2) in the appropriate box. We recommend you enter the transaction key due to more security measure. If you want to delete the current password tick the checkbox.';
 $string['methodcc'] = 'Credit Card';
 $string['methodecheck'] = 'eCheck (ACH)';
 $string['missingaba'] = 'Missing ABA number';