ZipArchive password protection doesn't work if entryname is used in addFile()

[zoltan-sule]

Description

The following code:

<?php
$zip = new ZipArchive();

if ($zip->open('/tmp/test1.zip', ZipArchive::CREATE) === TRUE) {
    $zip->setPassword('secret_');
    $zip->addFile('/tmp/test.txt', 'test.txt');
    $zip->setEncryptionName('/tmp/test.txt', ZipArchive::EM_AES_256);
    $zip->close();
}

Resulted in this output:
I am able to extract the content without the password.

But I expected this output instead:
that I need to use the password during the extraction.

Working but not optimal
If I leave entryname empty in addFile() method then I need to type the password before I want to extract the content but then the tmp appears inside the zip file as a directory structure.

<?php
$zip = new ZipArchive();

if ($zip->open('/tmp/test2.zip', ZipArchive::CREATE) === TRUE) {
    $zip->setPassword('secret_');
    $zip->addFile('/tmp/test.txt');
    $zip->setEncryptionName('/tmp/test.txt', ZipArchive::EM_AES_256);
    $zip->close();
}

PHP Version

PHP 8.1.8

Operating System

Ubuntu 20.04.4 LTS

[zoltan-sule]

my bad!
If is set the entry name of the file I added I have to use the same entry name for the setEncryptionName. Maybe clarifying it in the description would make it clean.

<?php
$zip = new ZipArchive();

if ($zip->open('/tmp/test2.zip', ZipArchive::CREATE) === TRUE) {
    $zip->setPassword('secret_');
    $zip->addFile('/tmp/test.txt', 'test.txt');
    $zip->setEncryptionName('test.txt', ZipArchive::EM_AES_256);
    $zip->close();
}

[cAstraea]

Have more info ? I want to create a password zip , tried like this
$zipArchive->setEncryptionName(basename($pdfFile), ZipArchive::EM_TRAD_PKWARE, 'password');
but the resulting archive can still be opened without a password

[zoltan-sule]

Have more info ? I want to create a password zip , tried like this $zipArchive->setEncryptionName(basename($pdfFile), ZipArchive::EM_TRAD_PKWARE, 'password'); but the resulting archive can still be opened without a password

You need to use it like this then it will work (if $pdfFile contains the absolute path to your file):

$zip->setPassword('secret_');
$zip->addFile($pdfFile, basename($pdfFile));
$zip->setEncryptionName(basename($pdfFile), ZipArchive::EM_TRAD_PKWARE);

The point is: the 2nd parameter of addFile method has to be the same like the 1st parameter of setEncryptionName method.

[mw108]

The same works with $zip->addFromString, except that you have to pass the absolute path and filename to setEncryptionName in the archive:

$zip->setPassword( 'secret_' );
$zip->addFromString( 'path/to/file/name.txt', 'Hello World!' );
$zip->setEncryptionName( 'path/to/file/name.txt', ZipArchive::EM_AES_256 );