CRL: decode stored crl data before display

[kulikov-a]

Hi!
ref. https://forum.opnsense.org/index.php?topic=29937.0
Turned out that administrator may accidentally break the imported CRL by clicking Save when viewing crl data: CRL data field shows encoded string.
Thanks!

[fichtner]

This is all a bit strange... if we save base64 encoded data and expect users to paste base64 encoded data (they certainly cannot paste binary data into a textarea very well) where is the need for any sort of decode/encode internally?

[kulikov-a]

@fichtner Hi! hm..if we encode user input for imorted/existing crl at

core/src/www/system_crlmanager.php

Lines 219 to 221 in f782ccb

	if (($pconfig['crlmethod'] == "existing") || ($act == "editimported")) {
	$crl['text'] = base64_encode($pconfig['crltext']);
	}

i think we need to decode it before display (or we will double encode it later on save? ;)

[swhite2]

This is all a bit strange... if we save base64 encoded data and expect users to paste base64 encoded data (they certainly cannot paste binary data into a textarea very well) where is the need for any sort of decode/encode internally?

Do we expect base64 encoded data though?

[kulikov-a]

since all other certs data is encoded in conf (keys, internal crl's etc) i found it quiet logical )

[fichtner]

I don't think we double-encode all PEM related input. It is what it is (and there could be more bugs).

[kulikov-a]

yep. and, for example, on the system_camanager.php CA edit page, config certificates are pre-decoded:

core/src/www/system_camanager.php

Lines 168 to 179 in 0592276

	if ($act == "edit") {
	if (!isset($id)) {
	header(url_safe('Location: /system_camanager.php'));
	exit;
	}
	$pconfig['descr'] = $a_ca[$id]['descr'];
	$pconfig['refid'] = $a_ca[$id]['refid'];
	$pconfig['cert'] = base64_decode($a_ca[$id]['crt']);
	$pconfig['serial'] = $a_ca[$id]['serial'] + 1;
	if (!empty($a_ca[$id]['prv'])) {
	$pconfig['key'] = base64_decode($a_ca[$id]['prv']);
	}

Or did I miss the thread somewhere?

[swhite2]

@kulikov-a Thanks!

[kulikov-a]

Thanks!)