Encrypted fields cannot be searched in the admin

[dustinlacewell]

Opening this pre-emptively. I'm not sure why but my immediate assumption is because it uses an SQL query to do the search which compares a plaintext vs an encrypted value. Not sure how one would get around this...

[svetlyak40wt]

You are right. It is impossible to search over encrypted values. And there is no workaround.

Probably, the only way is to use some 3d party solution, like haystack, to add a search index, using unencrypted data, but this approach could lead for security issues.

[getnoel]

Hi,

I think this is related to the object manager. When I tried MyModel.objects.get(email=user_email) it always says "matching query does not exist"

I tried adding method "get_prep_lookup" on BaseEncryptedField like this:

def get_prep_lookup(self, lookup_type, value):
value = self.get_db_prep_value(value)
return super(BaseEncryptedField, self).get_prep_lookup(lookup_type, value)

This isn't working because the method "get_db_prep_value" is appending random value from string.printable which isn't reversible. I changed this line into something reversible and everything worked as expected.

Hope this will be fixed.

Thanks

[svetlyak40wt]

What did you use to replace random value?

[getnoel]

I changed "random.choice(string.printable)" into "string.printable[index:index + 1] or 0". This way the get_prep_lookup will be able to recreate the encrypted value. I don't know if this would weaken the security.

I'm sorry, I think this didn't solve the admin search, but it did solve the "get" method of the object manager. I don't know why the search was working and now its not.

[getnoel]

Aha, I was searching using exact match. So if I search using a part or phrase it cant find any match.

[svetlyak40wt]

That is make sense, because part of the phrase can't be same as the whole phrase, after encoding.

[svetlyak40wt]

Probably, the best to close this issue, if there is now complete solution.

[getnoel]

Yeah, this doesn't solve the MyModel.objects.filter method too :(