[4.0] [New feature] Add tls transfer encryption for database connections

administrator/components/com_admin/Model/SysinfoModel.php

@@ -308,16 +308,18 @@ public function &getInfo()
 		$db = $this->getDbo();
 
 		$this->info = array(
-			'php'                   => php_uname(),
-			'dbserver'              => $db->getServerType(),
-			'dbversion'             => $db->getVersion(),
-			'dbcollation'           => $db->getCollation(),
-			'dbconnectioncollation' => $db->getConnectionCollation(),
-			'phpversion'            => PHP_VERSION,
-			'server'                => $_SERVER['SERVER_SOFTWARE'] ?? getenv('SERVER_SOFTWARE'),
-			'sapi_name'             => PHP_SAPI,
-			'version'               => (new Version)->getLongVersion(),
-			'useragent'             => $_SERVER['HTTP_USER_AGENT'] ?? '',
+			'php'                    => php_uname(),
+			'dbserver'               => $db->getServerType(),
+			'dbversion'              => $db->getVersion(),
+			'dbcollation'            => $db->getCollation(),
+			'dbconnectioncollation'  => $db->getConnectionCollation(),
+			'dbconnectionencryption' => $db->getConnectionEncryption(),
+			'dbconnencryptsupported' => $db->isConnectionEncryptionSupported(),
+			'phpversion'             => PHP_VERSION,
+			'server'                 => $_SERVER['SERVER_SOFTWARE'] ?? getenv('SERVER_SOFTWARE'),
+			'sapi_name'              => PHP_SAPI,
+			'version'                => (new Version)->getLongVersion(),
+			'useragent'              => $_SERVER['HTTP_USER_AGENT'] ?? '',
 		);
 
 		return $this->info;

administrator/components/com_admin/tmpl/sysinfo/default_system.php

@@ -71,6 +71,22 @@
 					<?php echo $this->info['dbconnectioncollation']; ?>
 				</td>
 			</tr>
+			<tr>
+				<th scope="row">
+					<?php echo Text::_('COM_ADMIN_DATABASE_CONNECTION_ENCRYPTION'); ?>
+				</th>
+				<td>
+					<?php echo $this->info['dbconnectionencryption'] ?: Text::_('JNONE'); ?>
+				</td>
+			</tr>
+			<tr>
+				<th scope="row">
+					<?php echo Text::_('COM_ADMIN_DATABASE_CONNECTION_ENCRYPTION_SUPPORTED'); ?>
+				</th>
+				<td>
+					<?php echo $this->info['dbconnencryptsupported'] ? Text::_('JYES') : Text::_('JNO'); ?>
+				</td>
+			</tr>
 			<tr>
 				<th scope="row">
 					<?php echo Text::_('COM_ADMIN_PHP_VERSION'); ?>

administrator/components/com_config/Model/ApplicationModel.php

@@ -131,17 +131,35 @@ public function save($data)
 			'user'     => $data['user'],
 			'password' => $app->get('password'),
 			'database' => $data['db'],
-			'prefix'   => $data['dbprefix']
+			'prefix'   => $data['dbprefix'],
 		);
 
+		if ((int) $data['dbencryption'] !== 0)
+		{
+			$options['ssl'] = [
+				'enable'             => true,
+				'verify_server_cert' => (bool) $data['dbsslverifyservercert'],
+			];
+
+			foreach (['cipher', 'ca', 'capath', 'key', 'cert'] as $value)
+			{
+				$confVal = trim($data['dbssl' . $value]);
+
+				if ($confVal !== '')
+				{
+					$options['ssl'][$value] = $confVal;
+				}
+			}
+		}
+
 		try
 		{
 			$revisedDbo = DatabaseDriver::getInstance($options);
 			$revisedDbo->getVersion();
 		}
 		catch (\Exception $e)
 		{
-			$app->enqueueMessage(Text::_('JLIB_DATABASE_ERROR_DATABASE_CONNECT'), 'error');
+			$app->enqueueMessage(Text::sprintf('COM_CONFIG_ERROR_DATABASE_NOT_AVAILABLE', $e->getCode(), $e->getMessage()), 'error');
 
 			return false;
 		}

administrator/components/com_config/forms/application.xml

@@ -231,6 +231,83 @@
 			size="10"
 		/>
 
+		<field
+			name="dbencryption"
+			type="list"
+			label="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_ENABLE_LABEL"
+			desc="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_ENABLE_DESC"
+			default="0"
+			filter="integer"
+			>
+			<option value="0">COM_CONFIG_FIELD_DATABASE_ENCRYPTION_ENABLE_VALUE_NONE</option>
+			<option value="1">COM_CONFIG_FIELD_DATABASE_ENCRYPTION_ENABLE_VALUE_ONE_WAY</option>
+			<option value="2">COM_CONFIG_FIELD_DATABASE_ENCRYPTION_ENABLE_VALUE_TWO_WAY</option>
+		</field>
+
+		<field
+			name="dbsslverifyservercert"
+			type="radio"
+			label="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_VERIFY_SERVER_CERT_LABEL"
+			desc="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_VERIFY_SERVER_CERT_DESC"
+			class="switcher"
+			default="0"
+			filter="boolean"
+			showon="dbencryption:1,2"
+			>
+			<option value="0">JNO</option>
+			<option value="1">JYES</option>
+		</field>
+
+		<field
+			name="dbsslkey"
+			type="text"
+			label="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_KEY_LABEL"
+			desc="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_KEY_DESC"
+			filter="string"
+			size="250"
+			showon="dbencryption:2"
+		/>
+
+		<field
+			name="dbsslcert"
+			type="text"
+			label="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CERT_LABEL"
+			desc="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CERT_DESC"
+			filter="string"
+			size="250"
+			showon="dbencryption:2"
+		/>
+
+		<field
+			name="dbsslca"
+			type="text"
+			label="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CA_LABEL"
+			desc="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CA_DESC"
+			filter="string"
+			size="250"
+			showon="dbencryption:2"
+		/>
+
+		<field
+			name="dbsslcapath"
+			type="text"
+			label="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CAPATH_LABEL"
+			desc="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CAPATH_DESC"
+			filter="string"
+			size="250"
+			showon="dbencryption:2"
+		/>
+
+		<field
+			name="dbsslcipher"
+			type="text"
+			label="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CIPHER_LABEL"
+			desc="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CIPHER_DESC"
+			filter="string"
+			size="300"
+			showon="dbencryption:2"
+		/>
+
 	</fieldset>
 
 	<fieldset

administrator/language/en-GB/en-GB.com_admin.ini

@@ -9,6 +9,8 @@ COM_ADMIN_CACHE_DIRECTORY="(Cache folder)"
 COM_ADMIN_CONFIGURATION_FILE="Configuration File"
 COM_ADMIN_DATABASE_COLLATION="Database Collation"
 COM_ADMIN_DATABASE_CONNECTION_COLLATION="Database Connection Collation"
+COM_ADMIN_DATABASE_CONNECTION_ENCRYPTION="Database Connection Encryption"
+COM_ADMIN_DATABASE_CONNECTION_ENCRYPTION_SUPPORTED="Database Server Supports Connection Encryption"
 COM_ADMIN_DATABASE_TYPE="Database Type"
 COM_ADMIN_DATABASE_VERSION="Database Version"
 COM_ADMIN_DIRECTORY="Folder"

administrator/language/en-GB/en-GB.com_config.ini

@@ -20,6 +20,7 @@ COM_CONFIG_ERROR_CONFIGURATION_PHP_NOTUNWRITABLE="Could not make configuration.p
 COM_CONFIG_ERROR_CONFIGURATION_PHP_NOTWRITABLE="Could not make configuration.php writable."
 COM_CONFIG_ERROR_CUSTOM_CACHE_PATH_NOTWRITABLE_USING_DEFAULT="The folder at %1$s is not writable and cannot be used for the cache, using the default %2$s instead."
 COM_CONFIG_ERROR_CUSTOM_SESSION_FILESYSTEM_PATH_NOTWRITABLE_USING_DEFAULT="The folder at %s is not writable and cannot be used to store session data, the default PHP path will be used instead."
+COM_CONFIG_ERROR_DATABASE_NOT_AVAILABLE="Database connection test failed with the following error: <em>%s: %s</em><br/>Database connection settings changes were not saved."
 COM_CONFIG_ERROR_ROOT_ASSET_NOT_FOUND="The asset for global configuration could not be found. Permissions have not been saved."
 COM_CONFIG_ERROR_SSL_NOT_AVAILABLE="HTTPS has not been enabled as it is not available on this server. HTTPS connection test failed with the following error: <em>%s</em>"
 COM_CONFIG_ERROR_SSL_NOT_AVAILABLE_HTTP_CODE="HTTPS version of the site returned an invalid HTTP status code."
@@ -35,6 +36,23 @@ COM_CONFIG_FIELD_CACHE_TIME_LABEL="Cache Time (minutes)"
 COM_CONFIG_FIELD_COOKIE_DOMAIN_DESC="Precede domain with '.' if cookie should be valid for all subdomains."
 COM_CONFIG_FIELD_COOKIE_DOMAIN_LABEL="Cookie Domain"
 COM_CONFIG_FIELD_COOKIE_PATH_LABEL="Cookie Path"
+COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CA_DESC="The absolute file path to the Certificate Authority (CA) base64 encoded certificates file, eg 'ex: /path/to/joomla/site/administrator/tls/ca/my-client-certificate-ca.pem'."
+COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CA_LABEL="CA File"
+COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CAPATH_DESC="The full path to Certificate Authority (CA) base64 encoded certificate files (MySQL only), eg '/path/to/joomla/site/administrator/tls/ca/'. Leave it empty if \"CA File\" already have all the CA certificates needed to validate the chain of trust."
+COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CAPATH_LABEL="CA Path"
+COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CERT_DESC="The absolute file path to the database client's base64 encoded certificate file, eg '/path/to/joomla/site/administrator/tls/certs/my-client-certificate.pem', including any intermediate CA's certificates if used."
+COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CERT_LABEL="Certificate File"
+COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CIPHER_DESC="The list of ciphers the database client supports, eg 'EECDH+AESGCM:EDH+AESGCM:EECDH+AES:EDH+AES'."
+COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CIPHER_LABEL="Cipher Suite"
+COM_CONFIG_FIELD_DATABASE_ENCRYPTION_ENABLE_DESC="Data in transit encryption (with TLS for database connections)."
+COM_CONFIG_FIELD_DATABASE_ENCRYPTION_ENABLE_LABEL="Connection Encryption"
+COM_CONFIG_FIELD_DATABASE_ENCRYPTION_ENABLE_VALUE_NONE="Default (server controlled)"
+COM_CONFIG_FIELD_DATABASE_ENCRYPTION_ENABLE_VALUE_ONE_WAY="One-way encryption"
+COM_CONFIG_FIELD_DATABASE_ENCRYPTION_ENABLE_VALUE_TWO_WAY="Two-way encryption"
+COM_CONFIG_FIELD_DATABASE_ENCRYPTION_KEY_DESC="The absolute file path to the database client's. private key file, eg '/path/to/joomla/site/administrator/tls/private/my-client-private-key.pem'."
+COM_CONFIG_FIELD_DATABASE_ENCRYPTION_KEY_LABEL="Private Key File"
+COM_CONFIG_FIELD_DATABASE_ENCRYPTION_VERIFY_SERVER_CERT_DESC="Verify the server certificate on client side."
+COM_CONFIG_FIELD_DATABASE_ENCRYPTION_VERIFY_SERVER_CERT_LABEL="Verify Server Certificate"
 COM_CONFIG_FIELD_DATABASE_HOST_LABEL="Host"
 COM_CONFIG_FIELD_DATABASE_NAME_LABEL="Database Name"
 COM_CONFIG_FIELD_DATABASE_PREFIX_LABEL="Database Tables Prefix"

administrator/language/en-GB/en-GB.mod_privacy_status.ini

@@ -4,4 +4,6 @@
 ; Note : All ini files need to be saved as UTF-8
 
 MOD_PRIVACY_STATUS="Privacy Status Check"
+MOD_PRIVACY_STATUS_CHECK_DATABASE_CONNECTION_ENCRYPTION_DISABLED="Database connection encryption is not enabled."
+MOD_PRIVACY_STATUS_CHECK_DATABASE_CONNECTION_ENCRYPTION_ENABLED="Database connection encryption is enabled.<br><small>Encrypting all database connections with %s</small>"
 MOD_PRIVACY_STATUS_XML_DESCRIPTION="The Privacy Status Check Module shows information about your sites privacy status."

administrator/modules/mod_privacy_status/mod_privacy_status.php

@@ -33,11 +33,12 @@
 
 JLoader::register('ModPrivacyStatusHelper', __DIR__ . '/helper.php');
 
-$privacyPolicyInfo      = ModPrivacyStatusHelper::getPrivacyPolicyInfo();
-$requestFormPublished   = ModPrivacyStatusHelper::getRequestFormPublished();
-$privacyConsentPluginId = PrivacyHelper::getPrivacyConsentPluginId();
-$sendMailEnabled        = (bool) Factory::getConfig()->get('mailonline', 1);
-$numberOfUrgentRequests = ModPrivacyStatusHelper::getNumberUrgentRequests();
-$urgentRequestDays      = (int) ComponentHelper::getParams('com_privacy')->get('notify', 14);
+$privacyPolicyInfo            = ModPrivacyStatusHelper::getPrivacyPolicyInfo();
+$requestFormPublished         = ModPrivacyStatusHelper::getRequestFormPublished();
+$privacyConsentPluginId       = PrivacyHelper::getPrivacyConsentPluginId();
+$sendMailEnabled              = (bool) Factory::getConfig()->get('mailonline', 1);
+$numberOfUrgentRequests       = ModPrivacyStatusHelper::getNumberUrgentRequests();
+$urgentRequestDays            = (int) ComponentHelper::getParams('com_privacy')->get('notify', 14);
+$databaseConnectionEncryption = Factory::getContainer()->get('DatabaseDriver')->getConnectionEncryption();
 
 require ModuleHelper::getLayoutPath('mod_privacy_status', $params->get('layout', 'default'));

administrator/modules/mod_privacy_status/tmpl/default.php

@@ -24,19 +24,19 @@
 			<td>
 				<?php if ($privacyPolicyInfo['published'] && $privacyPolicyInfo['articlePublished']) : ?>
 					<span class="badge badge-success">
-					<span class="icon-checkbox" aria-hidden="true"></span>
-					<?php echo Text::_('JPUBLISHED'); ?>
-				</span>
+						<span class="icon-checkbox" aria-hidden="true"></span>
+						<?php echo Text::_('JPUBLISHED'); ?>
+					</span>
 				<?php elseif ($privacyPolicyInfo['published'] && !$privacyPolicyInfo['articlePublished']) : ?>
 					<span class="badge badge-warning">
-					<span class="icon-warning" aria-hidden="true"></span>
-					<?php echo Text::_('JUNPUBLISHED'); ?>
-				</span>
+						<span class="icon-warning" aria-hidden="true"></span>
+						<?php echo Text::_('JUNPUBLISHED'); ?>
+					</span>
 				<?php else : ?>
 					<span class="badge badge-warning">
-					<span class="icon-warning" aria-hidden="true"></span>
-					<?php echo Text::_('COM_PRIVACY_STATUS_CHECK_NOT_AVAILABLE'); ?>
-				</span>
+						<span class="icon-warning" aria-hidden="true"></span>
+						<?php echo Text::_('COM_PRIVACY_STATUS_CHECK_NOT_AVAILABLE'); ?>
+					</span>
 				<?php endif; ?>
 			</td>
 			<td>
@@ -53,19 +53,19 @@
 			<td>
 				<?php if ($requestFormPublished['published'] && $requestFormPublished['exists']) : ?>
 					<span class="badge badge-success">
-					<span class="icon-checkbox" aria-hidden="true"></span>
-					<?php echo Text::_('JPUBLISHED'); ?>
-				</span>
+						<span class="icon-checkbox" aria-hidden="true"></span>
+						<?php echo Text::_('JPUBLISHED'); ?>
+					</span>
 				<?php elseif (!$requestFormPublished['published'] && $requestFormPublished['exists']) : ?>
 					<span class="badge badge-warning">
-					<span class="icon-warning" aria-hidden="true"></span>
-					<?php echo Text::_('JUNPUBLISHED'); ?>
-				</span>
+						<span class="icon-warning" aria-hidden="true"></span>
+						<?php echo Text::_('JUNPUBLISHED'); ?>
+					</span>
 				<?php else : ?>
 					<span class="badge badge-warning">
-					<span class="icon-warning" aria-hidden="true"></span>
-					<?php echo Text::_('COM_PRIVACY_STATUS_CHECK_NOT_AVAILABLE'); ?>
-				</span>
+						<span class="icon-warning" aria-hidden="true"></span>
+						<?php echo Text::_('COM_PRIVACY_STATUS_CHECK_NOT_AVAILABLE'); ?>
+					</span>
 				<?php endif; ?>
 			</td>
 			<td>
@@ -105,7 +105,7 @@
 						<?php echo Text::_('JENABLED'); ?>
 					</span>
 				<?php else : ?>
-				<span class="badge badge-danger">
+					<span class="badge badge-danger">
 						<span class="icon-warning" aria-hidden="true"></span>
 						<?php echo Text::_('JDISABLED'); ?>
 					</span>
@@ -120,5 +120,27 @@
 				<?php endif; ?>
 			</td>
 		</tr>
+		<tr>
+			<td>
+				<?php if ($databaseConnectionEncryption !== '') : ?>
+					<span class="badge badge-success">
+						<span class="icon-checkbox" aria-hidden="true"></span>
+						<?php echo Text::_('JENABLED'); ?>
+					</span>
+				<?php else : ?>
+					<span class="badge badge-warning">
+						<span class="icon-warning" aria-hidden="true"></span>
+						<?php echo Text::_('COM_PRIVACY_STATUS_CHECK_NOT_AVAILABLE'); ?>
+					</span>
+				<?php endif; ?>
+			</td>
+			<td>
+				<?php if ($databaseConnectionEncryption === '') : ?>
+					<?php echo Text::_('MOD_PRIVACY_STATUS_CHECK_DATABASE_CONNECTION_ENCRYPTION_DISABLED'); ?>
+				<?php else : ?>
+					<?php echo Text::sprintf('MOD_PRIVACY_STATUS_CHECK_DATABASE_CONNECTION_ENCRYPTION_ENABLED', $databaseConnectionEncryption); ?>
+				<?php endif; ?>
+			</td>
+		</tr>
 	</tbody>
 </table>

installation/configuration.php-dist

@@ -44,6 +44,13 @@ class JConfig
 	public $password = '';                   // DB password
 	public $db = '';                         // DB database name
 	public $dbprefix = 'jos_';               // Do not change unless you need to!
+	public $dbencryption = 0;
+	public $dbsslverifyservercert = false;
+	public $dbsslkey = '';
+	public $dbsslcert = '';
+	public $dbsslca = '';
+	public $dbsslcapath = '';
+	public $dbsslcipher = '';
 
 	/* Server Settings */
 	public $secret = 'FBVtggIk5lAzEU9H';     // Change this to something more secure

installation/src/Model/ConfigurationModel.php

@@ -133,6 +133,13 @@ public function createConfiguration($options)
 		$registry->set('password', $options->db_pass_plain);
 		$registry->set('db', $options->db_name);
 		$registry->set('dbprefix', $options->db_prefix);
+		$registry->set('dbencryption', 0);
+		$registry->set('dbsslverifyservercert', false);
+		$registry->set('dbsslkey', '');
+		$registry->set('dbsslcert', '');
+		$registry->set('dbsslca', '');
+		$registry->set('dbsslcapath', '');
+		$registry->set('dbsslcipher', '');
 
 		// Server settings.
 		$registry->set('live_site', '');