[4.0] TLS encryption for database connections: Corrections and enhancements

administrator/components/com_config/Controller/ApplicationController.php

@@ -145,6 +145,29 @@ public function save()
 			return false;
 		}
 
+		// Validate database connection data.
+		$data   = $return;
+		$return = $model->validateDbConnection($data);
+
+		// Check for validation errors.
+		if ($return === false)
+		{
+			/*
+			 * The validateDbConnection method enqueued all messages for us.
+			 */
+
+			// Save the posted data in the session.
+			$this->app->setUserState('com_config.config.global.data', $data);
+
+			// Redirect back to the edit screen.
+			$this->setRedirect(Route::_('index.php?option=com_config', false));
+
+			return false;
+		}
+
+		// Save the validated data in the session.
+		$this->app->setUserState('com_config.config.global.data', $return);
+
 		// Attempt to save the configuration.
 		$data   = $return;
 		$return = $model->save($data);

administrator/components/com_config/Model/ApplicationModel.php

@@ -111,6 +111,167 @@ public function getData()
 		return $data;
 	}
 
+	/**
+	 * Method to validate the db connection properties.
+	 *
+	 * @param   array  $data  An array containing all global config data.
+	 *
+	 * @return  array|boolean  Array with the validated global config data or boolean false on a validation failure.
+	 *
+	 * @since	4.0.0
+	 */
+	public function validateDbConnection($data)
+	{
+		// Validate database connection encryption options
+		if ((int) $data['dbencryption'] === 0)
+		{
+			// Reset unused options
+			if (!empty($data['dbsslkey']))
+			{
+				$data['dbsslkey'] = '';
+			}
+
+			if (!empty($data['dbsslcert']))
+			{
+				$data['dbsslcert'] = '';
+			}
+
+			if ((bool) $data['dbsslverifyservercert'] === true)
+			{
+				$data['dbsslverifyservercert'] = false;
+			}
+
+			if (!empty($data['dbsslca']))
+			{
+				$data['dbsslca'] = '';
+			}
+
+			if (!empty($data['dbsslcipher']))
+			{
+				$data['dbsslcipher'] = '';
+			}
+		}
+		else
+		{
+			// Check localhost
+			if (strtolower($data['host']) === 'localhost')
+			{
+				Factory::getApplication()->enqueueMessage(Text::_('COM_CONFIG_ERROR_DATABASE_ENCRYPTION_LOCALHOST'), 'error');
+
+				return false;
+			}
+
+			// Check CA file and folder depending on database type if server certificate verification
+			if ((bool) $data['dbsslverifyservercert'] === true)
+			{
+				if (empty($data['dbsslca']))
+				{
+					Factory::getApplication()->enqueueMessage(
+						Text::sprintf(
+							'COM_CONFIG_ERROR_DATABASE_ENCRYPTION_FILE_FIELD_EMPTY',
+							Text::_('COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CA_LABEL')
+						),
+						'error'
+					);
+
+					return false;
+				}
+
+				if (!File::exists(Path::clean($data['dbsslca'])))
+				{
+					Factory::getApplication()->enqueueMessage(
+						Text::sprintf(
+							'COM_CONFIG_ERROR_DATABASE_ENCRYPTION_FILE_FIELD_BAD',
+							Text::_('COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CA_LABEL')
+						),
+						'error'
+					);
+
+					return false;
+				}
+			}
+			else
+			{
+				// Reset unused option
+				if (!empty($data['dbsslca']))
+				{
+					$data['dbsslca'] = '';
+				}
+			}
+
+			// Check key and certificate if two-way encryption
+			if ((int) $data['dbencryption'] === 2)
+			{
+				if (empty($data['dbsslkey']))
+				{
+					Factory::getApplication()->enqueueMessage(
+						Text::sprintf(
+							'COM_CONFIG_ERROR_DATABASE_ENCRYPTION_FILE_FIELD_EMPTY',
+							Text::_('COM_CONFIG_FIELD_DATABASE_ENCRYPTION_KEY_LABEL')
+						),
+						'error'
+					);
+
+					return false;
+				}
+
+				if (!File::exists(Path::clean($data['dbsslkey'])))
+				{
+					Factory::getApplication()->enqueueMessage(
+						Text::sprintf(
+							'COM_CONFIG_ERROR_DATABASE_ENCRYPTION_FILE_FIELD_BAD',
+							Text::_('COM_CONFIG_FIELD_DATABASE_ENCRYPTION_KEY_LABEL')
+						),
+						'error'
+					);
+
+					return false;
+				}
+
+				if (empty($data['dbsslcert']))
+				{
+					Factory::getApplication()->enqueueMessage(
+						Text::sprintf(
+							'COM_CONFIG_ERROR_DATABASE_ENCRYPTION_FILE_FIELD_EMPTY',
+							Text::_('COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CERT_LABEL')
+						),
+						'error'
+					);
+
+					return false;
+				}
+
+				if (!File::exists(Path::clean($data['dbsslcert'])))
+				{
+					Factory::getApplication()->enqueueMessage(
+						Text::sprintf(
+							'COM_CONFIG_ERROR_DATABASE_ENCRYPTION_FILE_FIELD_BAD',
+							Text::_('COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CERT_LABEL')
+						),
+						'error'
+					);
+
+					return false;
+				}
+			}
+			else
+			{
+				// Reset unused options
+				if (!empty($data['dbsslkey']))
+				{
+					$data['dbsslkey'] = '';
+				}
+
+				if (!empty($data['dbsslcert']))
+				{
+					$data['dbsslcert'] = '';
+				}
+			}
+		}
+
+		return $data;
+	}
+
 	/**
 	 * Method to save the configuration data.
 	 *
@@ -141,7 +302,7 @@ public function save($data)
 				'verify_server_cert' => (bool) $data['dbsslverifyservercert'],
 			];
 
-			foreach (['cipher', 'ca', 'capath', 'key', 'cert'] as $value)
+			foreach (['cipher', 'ca', 'key', 'cert'] as $value)
 			{
 				$confVal = trim($data['dbssl' . $value]);
 
@@ -164,6 +325,20 @@ public function save($data)
 			return false;
 		}
 
+		if ((int) $data['dbencryption'] !== 0 && empty($revisedDbo->getConnectionEncryption()))
+		{
+			if ($revisedDbo->isConnectionEncryptionSupported())
+			{
+				Factory::getApplication()->enqueueMessage(Text::_('COM_CONFIG_ERROR_DATABASE_ENCRYPTION_CONN_NOT_ENCRYPT'), 'error');
+			}
+			else
+			{
+				Factory::getApplication()->enqueueMessage(Text::_('COM_CONFIG_ERROR_DATABASE_ENCRYPTION_SRV_NOT_SUPPORTS'), 'error');
+			}
+
+			return false;
+		}
+
 		// Check if we can set the Force SSL option
 		if ((int) $data['force_ssl'] !== 0 && (int) $data['force_ssl'] !== (int) $app->get('force_ssl', '0'))
 		{

administrator/components/com_config/forms/application.xml

@@ -201,7 +201,6 @@
 			label="COM_CONFIG_FIELD_DATABASE_HOST_LABEL"
 			required="true"
 			filter="string"
-			onchange="Joomla.resetDbEncryptionFields(this)"
 			size="30"
 		/>
 
@@ -235,72 +234,58 @@
 		<field
 			name="dbencryption"
 			type="list"
-			label="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_ENABLE_LABEL"
+			label="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_MODE_LABEL"
 			default="0"
 			filter="integer"
-			showon="host!:localhost"
 			>
-			<option value="0">COM_CONFIG_FIELD_DATABASE_ENCRYPTION_ENABLE_VALUE_NONE</option>
-			<option value="1">COM_CONFIG_FIELD_DATABASE_ENCRYPTION_ENABLE_VALUE_ONE_WAY</option>
-			<option value="2">COM_CONFIG_FIELD_DATABASE_ENCRYPTION_ENABLE_VALUE_TWO_WAY</option>
-		</field>
-
-		<field
-			name="dbsslverifyservercert"
-			type="radio"
-			label="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_VERIFY_SERVER_CERT_LABEL"
-			class="switcher"
-			default="0"
-			filter="boolean"
-			showon="host!:localhost[AND]dbencryption:1,2"
-			>
-			<option value="0">JNO</option>
-			<option value="1">JYES</option>
+			<option value="0">COM_CONFIG_FIELD_DATABASE_ENCRYPTION_MODE_VALUE_NONE</option>
+			<option value="1">COM_CONFIG_FIELD_DATABASE_ENCRYPTION_MODE_VALUE_ONE_WAY</option>
+			<option value="2">COM_CONFIG_FIELD_DATABASE_ENCRYPTION_MODE_VALUE_TWO_WAY</option>
 		</field>
 
 		<field
 			name="dbsslkey"
 			type="text"
 			label="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_KEY_LABEL"
-			filter="string"
-			size="250"
-			showon="host!:localhost[AND]dbencryption:2"
+			filter="path"
+			showon="dbencryption:2"
 		/>
 
 		<field
 			name="dbsslcert"
 			type="text"
 			label="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CERT_LABEL"
-			filter="string"
-			size="250"
-			showon="host!:localhost[AND]dbencryption:2"
+			filter="path"
+			showon="dbencryption:2"
 		/>
 
 		<field
-			name="dbsslca"
-			type="text"
-			label="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CA_LABEL"
-			filter="string"
-			size="250"
-			showon="host!:localhost[AND]dbencryption:2"
-		/>
+			name="dbsslverifyservercert"
+			type="radio"
+			label="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_VERIFY_SERVER_CERT_LABEL"
+			class="switcher"
+			default="0"
+			filter="boolean"
+			showon="dbencryption:1,2"
+			>
+			<option value="0">JNO</option>
+			<option value="1">JYES</option>
+		</field>
 
 		<field
-			name="dbsslcapath"
+			name="dbsslca"
 			type="text"
-			label="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CAPATH_LABEL"
-			filter="string"
-			size="250"
-			showon="host!:localhost[AND]dbtype:mysql,mysqli[AND]dbencryption:2"
+			label="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CA_LABEL"
+			filter="path"
+			showon="dbencryption:1,2[AND]dbsslverifyservercert:1"
 		/>
 
 		<field
 			name="dbsslcipher"
 			type="text"
 			label="COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CIPHER_LABEL"
 			filter="string"
-			size="300"
-			showon="host!:localhost[AND]dbtype:mysql,mysqli[AND]dbencryption:2"
+			showon="dbtype:mysql,mysqli[AND]dbencryption:2"
 		/>
 
 	</fieldset>

administrator/components/com_config/tmpl/application/default.php

@@ -19,9 +19,6 @@
 HTMLHelper::_('behavior.formvalidator');
 HTMLHelper::_('behavior.keepalive');
 
-// Load config JS
-HTMLHelper::_('script', 'com_config/admin-config-default.js', ['version' => 'auto', 'relative' => true]);
-
 // Load JS message titles
 Text::script('ERROR');
 Text::script('WARNING');

administrator/language/en-GB/com_config.ini

@@ -20,6 +20,11 @@ COM_CONFIG_ERROR_CONFIGURATION_PHP_NOTUNWRITABLE="Could not make configuration.p
 COM_CONFIG_ERROR_CONFIGURATION_PHP_NOTWRITABLE="Could not make configuration.php writable."
 COM_CONFIG_ERROR_CUSTOM_CACHE_PATH_NOTWRITABLE_USING_DEFAULT="The folder at %1$s is not writable and cannot be used for the cache, using the default %2$s instead."
 COM_CONFIG_ERROR_CUSTOM_SESSION_FILESYSTEM_PATH_NOTWRITABLE_USING_DEFAULT="The folder at %s is not writable and cannot be used to store session data, the default PHP path will be used instead."
+COM_CONFIG_ERROR_DATABASE_ENCRYPTION_CONN_NOT_ENCRYPT="You have selected database connection enryption to be used, and a connection could be established, but it was not encrypted. The reason might be that the database server is configured to fall back to an unencrypted connection in case of bad encryption parameters. Either check and correct the database encryption parameters, or change field \"Connection Encryption\" back to \"Default (server controlled)\"."
+COM_CONFIG_ERROR_DATABASE_ENCRYPTION_FILE_FIELD_BAD="The file entered in field \"%s\" does not exist or is not accessible."
+COM_CONFIG_ERROR_DATABASE_ENCRYPTION_FILE_FIELD_EMPTY="Field \"%s\" is empty or doesn't contain a valid path."
+COM_CONFIG_ERROR_DATABASE_ENCRYPTION_LOCALHOST="You have entered \"localhost\" as host name. Connecting to the database with connection encryption might fail with this. Either change \"localhost\" to \"127.0.0.1\" or \"::1\" or a different host name, or change field \"Connection Encryption\" back to \"Default (server controlled)\"."
+COM_CONFIG_ERROR_DATABASE_ENCRYPTION_SRV_NOT_SUPPORTS="The database server doesn't support connection encryption. Either enable TLS (often called SSL in docs) support on your database server, or change field \"Connection Encryption\" back to \"Default (server controlled)\"."
 COM_CONFIG_ERROR_DATABASE_NOT_AVAILABLE="Database connection test failed with the following error: <em>%s: %s</em><br>Database connection settings changes were not saved."
 COM_CONFIG_ERROR_ROOT_ASSET_NOT_FOUND="The asset for global configuration could not be found. Permissions have not been saved."
 COM_CONFIG_ERROR_SSL_NOT_AVAILABLE="HTTPS has not been enabled as it is not available on this server. HTTPS connection test failed with the following error: <em>%s</em>"
@@ -37,14 +42,13 @@ COM_CONFIG_FIELD_COOKIE_DOMAIN_DESC="Precede domain with '.' if cookie should be
 COM_CONFIG_FIELD_COOKIE_DOMAIN_LABEL="Cookie Domain"
 COM_CONFIG_FIELD_COOKIE_PATH_LABEL="Cookie Path"
 COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CA_LABEL="Path to CA File"
-COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CAPATH_LABEL="Path to CA Folder"
 COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CERT_LABEL="Path to Certificate File"
-COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CIPHER_LABEL="Supported Cipher Suite"
-COM_CONFIG_FIELD_DATABASE_ENCRYPTION_ENABLE_LABEL="Connection Encryption"
-COM_CONFIG_FIELD_DATABASE_ENCRYPTION_ENABLE_VALUE_NONE="Default (server controlled)"
-COM_CONFIG_FIELD_DATABASE_ENCRYPTION_ENABLE_VALUE_ONE_WAY="One-way encryption"
-COM_CONFIG_FIELD_DATABASE_ENCRYPTION_ENABLE_VALUE_TWO_WAY="Two-way encryption"
+COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CIPHER_LABEL="Supported Cipher Suite (optional)"
 COM_CONFIG_FIELD_DATABASE_ENCRYPTION_KEY_LABEL="Path to Private Key File"
+COM_CONFIG_FIELD_DATABASE_ENCRYPTION_MODE_LABEL="Connection Encryption"
+COM_CONFIG_FIELD_DATABASE_ENCRYPTION_MODE_VALUE_NONE="Default (server controlled)"
+COM_CONFIG_FIELD_DATABASE_ENCRYPTION_MODE_VALUE_ONE_WAY="One-way authentication"
+COM_CONFIG_FIELD_DATABASE_ENCRYPTION_MODE_VALUE_TWO_WAY="Two-way authentication"
 COM_CONFIG_FIELD_DATABASE_ENCRYPTION_VERIFY_SERVER_CERT_LABEL="Verify Server Certificate"
 COM_CONFIG_FIELD_DATABASE_HOST_LABEL="Host"
 COM_CONFIG_FIELD_DATABASE_NAME_LABEL="Database Name"