[FEATURE] Optional encryption of settings.json to prevent exposing password as cleartext.

src/Libraries/Nop.Core/Data/DataSettings.cs

@@ -1,5 +1,7 @@
-using System;
+using Newtonsoft.Json;
+using System;
 using System.Collections.Generic;
+using System.Reflection;
 
 namespace Nop.Core.Data
 {
@@ -8,12 +10,14 @@ namespace Nop.Core.Data
  /// </summary>
  public partial class DataSettings
  {
+ protected ProtectedDataService ProtectedDataService = new ProtectedDataService();
+
  /// <summary>
  /// Ctor
  /// </summary>
  public DataSettings()
  {
- RawDataSettings=new Dictionary<string, string>();
+ RawDataSettings = new Dictionary<string, string>();
  }
 
  /// <summary>
@@ -26,6 +30,11 @@ public DataSettings()
  /// </summary>
  public string DataConnectionString { get; set; }
 
+ /// <summary>
+ /// Should DataConnectionString be encrypted
+ /// </summary>
+ public bool EncryptStringSettings { get; set; }
+
  /// <summary>
  /// Raw settings file
  /// </summary>
@@ -37,7 +46,90 @@ public DataSettings()
  /// <returns></returns>
  public bool IsValid()
  {
- return !string.IsNullOrEmpty(this.DataProvider) && !string.IsNullOrEmpty(this.DataConnectionString);
+ return !String.IsNullOrEmpty(this.DataProvider) && !String.IsNullOrEmpty(this.DataConnectionString);
+ }
+
+ /// <summary>
+ /// Returns true if any STRING properties are in a decrypted state as determined by ProtectionDataService
+ /// </summary>
+ /// <returns></returns>
+ public bool HasAnyDecryptedDataSettings()
+ {
+ bool retVal = false;
+ PropertyInfo[] properties = this.GetType().GetProperties();
+
+ foreach (var property in properties)
+ {
+ if (property.PropertyType == typeof(string) && property.GetValue(this) != null && !ProtectedDataService.IsCipherText(property.GetValue(this).ToString()))
+ {
+ retVal = true;
+ }
+ }
+ return retVal;
+ }
+
+ /// <summary>
+ /// Returns true if any STRING properties are in an encrypted state as determined by ProtectionDataService
+ /// </summary>
+ /// <returns></returns>
+ public bool HasAnyEncryptedDataSettings()
+ {
+ bool retVal = false;
+ PropertyInfo[] properties = this.GetType().GetProperties();
+
+ foreach (var property in properties)
+ {
+ if (property.PropertyType == typeof(string) && property.GetValue(this) != null && ProtectedDataService.IsCipherText(property.GetValue(this).ToString()))
+ {
+ retVal = true;
+ }
+ }
+ return retVal;
+ }
+
+ /// <summary>
+ /// Decrypts all STRING PROPERTIES. If already decrypted then they are unchanged.
+ /// </summary>
+ /// <returns></returns>
+ public void Decrypt()
+ {
+ PropertyInfo[] properties = this.GetType().GetProperties();
+
+ foreach (var property in properties)
+ {
+ if (property.PropertyType == typeof(string) && property.GetValue(this) != null && ProtectedDataService.IsCipherText(property.GetValue(this).ToString()))
+ {
+ string clearText = ProtectedDataService.GetClearText(property.GetValue(this).ToString());
+ property.SetValue(this, clearText);
+ }
+ }
+ }
+
+ /// <summary>
+ /// Encrypts all STRING PROPERTIES. If already encrypted then they are unchanged.
+ /// </summary>
+ /// <returns></returns>
+ public void Encrypt()
+ {
+ PropertyInfo[] properties = this.GetType().GetProperties();
+
+ foreach (var property in properties)
+ {
+ if (property.PropertyType == typeof(string) && property.GetValue(this) != null && !ProtectedDataService.IsCipherText(property.GetValue(this).ToString()))
+ {
+ string cipherText = ProtectedDataService.GetCipherText(this.ProtectedDataService.GetCipherText(property.GetValue(this).ToString()));
+ property.SetValue(this, cipherText);
+ }
+ }
+ }
+
+ /// <summary>
+ /// 
+ /// </summary>
+ /// <returns></returns>
+ public DataSettings GetClone()
+ {
+ return JsonConvert.DeserializeObject<DataSettings>(JsonConvert.SerializeObject(this, Formatting.None));
  }
  }
-}
+}

src/Libraries/Nop.Core/Data/DataSettingsManager.cs

@@ -1,7 +1,7 @@
-using System;
-using System.IO;
-using Newtonsoft.Json;
+using Newtonsoft.Json;
 using Nop.Core.Infrastructure;
+using System;
+using System.IO;
 
 namespace Nop.Core.Data
 {
@@ -11,23 +11,18 @@ namespace Nop.Core.Data
  public partial class DataSettingsManager
  {
  #region Const
-
  private const string ObsoleteDataSettingsFilePath = "~/App_Data/Settings.txt";
  private const string DataSettingsFilePath_ = "~/App_Data/dataSettings.json";
-
- #endregion
+ #endregion Const
 
  #region Properties
-
  /// <summary>
  /// Gets the path to file that contains data settings
  /// </summary>
  public static string DataSettingsFilePath => DataSettingsFilePath_;
-
- #endregion
+ #endregion Properties
 
  #region Methods
-
  /// <summary>
  /// Load settings
  /// </summary>
@@ -50,41 +45,17 @@ public virtual DataSettings LoadSettings(string filePath = null, bool reloadSett
  return new DataSettings();
 
  //get data settings from the old txt file
- var dataSettings = new DataSettings();
- using (var reader = new StringReader(File.ReadAllText(filePath)))
- {
- var settingsLine = string.Empty;
- while ((settingsLine = reader.ReadLine()) != null)
- {
- var separatorIndex = settingsLine.IndexOf(':');
- if (separatorIndex == -1)
- continue;
-
- var key = settingsLine.Substring(0, separatorIndex).Trim();
- var value = settingsLine.Substring(separatorIndex + 1).Trim();
-
- switch (key)
- {
- case "DataProvider":
- dataSettings.DataProvider = value;
- continue;
- case "DataConnectionString":
- dataSettings.DataConnectionString = value;
- continue;
- default:
- dataSettings.RawDataSettings.Add(key, value);
- continue;
- }
- }
- }
+ var dataSettings = GetSettingsFromLegacyTextFile(filePath);
 
  //save data settings to the new file
  SaveSettings(dataSettings);
 
  //and delete the old one
  File.Delete(filePath);
 
- Singleton<DataSettings>.Instance = dataSettings;
+ var usableDataSettings = dataSettings.GetClone();
+ usableDataSettings.Decrypt();
+ Singleton<DataSettings>.Instance = usableDataSettings;
  return Singleton<DataSettings>.Instance;
  }
 
@@ -93,7 +64,13 @@ public virtual DataSettings LoadSettings(string filePath = null, bool reloadSett
  return new DataSettings();
 
  //get data settings from the JSON file
- Singleton<DataSettings>.Instance = JsonConvert.DeserializeObject<DataSettings>(text);
+ var candidateDataSettings = JsonConvert.DeserializeObject<DataSettings>(text);
+ candidateDataSettings.Decrypt();
+ Singleton<DataSettings>.Instance = candidateDataSettings;
+
+ //Handles resaving the file if the encryption setting has been changed by the user via editing the file
+ ResaveSettingsWhenEncryptionStateMismatch();
+
  return Singleton<DataSettings>.Instance;
  }
 
@@ -104,7 +81,65 @@ public virtual DataSettings LoadSettings(string filePath = null, bool reloadSett
  public virtual void SaveSettings(DataSettings settings)
  {
  Singleton<DataSettings>.Instance = settings ?? throw new ArgumentNullException(nameof(settings));
+ var clonedSettings = settings.GetClone();
+ if (settings.EncryptStringSettings)
+ {
+ clonedSettings.Encrypt();
+ }
+ else
+ {
+ clonedSettings.Decrypt();
+ }
+ string text = JsonConvert.SerializeObject(clonedSettings, Formatting.Indented);
+ SaveFile(text); //encrypt settings file after saving.
+ }
 
+ /// <summary>
+ /// Attempts to load settings from old-style settings.txt file
+ /// </summary>
+ /// <param name="filePath">Path to settings.txt</param>
+ /// <returns>Returns a data settings object</returns>
+ protected DataSettings GetSettingsFromLegacyTextFile(string filePath)
+ {
+ var dataSettings = new DataSettings();
+ using (var reader = new StringReader(File.ReadAllText(filePath)))
+ {
+ var settingsLine = string.Empty;
+ while ((settingsLine = reader.ReadLine()) != null)
+ {
+ var separatorIndex = settingsLine.IndexOf(':');
+ if (separatorIndex == -1)
+ continue;
+
+ var key = settingsLine.Substring(0, separatorIndex).Trim();
+ var value = settingsLine.Substring(separatorIndex + 1).Trim();
+
+ switch (key)
+ {
+ case "DataProvider":
+ dataSettings.DataProvider = value;
+ continue;
+ case "DataConnectionString":
+ dataSettings.DataConnectionString = value;
+ continue;
+ case "EncryptStringSettings":
+ dataSettings.EncryptStringSettings = Convert.ToBoolean(value);
+ continue;
+ default:
+ dataSettings.RawDataSettings.Add(key, value);
+ continue;
+ }
+ }
+ }
+ return dataSettings;
+ }
+
+ /// <summary>
+ /// Saves the value of the text param to the settings file.
+ /// </summary>
+ /// <param name="text">value of all text to be saved to the settings file.</param>
+ protected void SaveFile(string text)
+ {
  var filePath = CommonHelper.MapPath(DataSettingsFilePath);
 
  //create file if not exists
@@ -113,12 +148,23 @@ public virtual void SaveSettings(DataSettings settings)
  //we use 'using' to close the file after it's created
  using (File.Create(filePath)) { }
  }
-
- //save data settings to the file
- var text = JsonConvert.SerializeObject(Singleton<DataSettings>.Instance, Formatting.Indented);
  File.WriteAllText(filePath, text);
  }
 
- #endregion
+ /// <summary>
+ /// Will call SaveSettings() as needed when the EncryptStringSettings method does not match the state of the current datasettings object. Used when the user manually edits the value of EncryptStringSettings in the settings file.
+ /// </summary>
+ private void ResaveSettingsWhenEncryptionStateMismatch()
+ {
+ if (Singleton<DataSettings>.Instance.EncryptStringSettings && Singleton<DataSettings>.Instance.HasAnyDecryptedDataSettings()) //If it's not encrypted and should be, then encrypt it.
+ {
+ SaveSettings(Singleton<DataSettings>.Instance);
+ }
+ else if (!Singleton<DataSettings>.Instance.EncryptStringSettings && !Singleton<DataSettings>.Instance.HasAnyEncryptedDataSettings()) //If it's encrypted and it should not be, then decrypt it.
+ {
+ SaveSettings(Singleton<DataSettings>.Instance);
+ }
+ }
+ #endregion Methods
  }
-}
+}