Hello all and happy new year !

I had troubles with the API system, particularly regarding the encryption system. It follows this previous locked discussion :  https://www.projeqtor.org/fr/forum-fr/5-ask-questions/10767-python-connection-to-api

I have the same problem as Xav38 : the API works perfectly if I bypass the decryption system in the "if" block line 269 of api/index.php, replacing the

$data=AesCtr::decrypt ...

with a dirty

$data=$dataEncoded ;

Just for information, here is the python script :

import pycurl

from io import BytesIO

import ast

from Crypto.Cipher

import AES

import binascii

from base64 import b64encode, b64decode

import json 

login="admin.api"

key="d87b5ca7c5fdf827aa35914e966bf768"  

##################### Reading test###################

buffer = BytesIO()

c_getProj = pycurl.Curl()

c_getProj.setopt(c_getProj.URL, 'http://localhost/projeqtor/api/Project/all')

c_getProj.setopt(c_getProj.HTTPAUTH , pycurl.HTTPAUTH_BASIC)

c_getProj.setopt(c_getProj.USERPWD , "%s:%s"%(login,key))

#c_getProj.setopt(c_getProj.SSL_VERIFYPEER, False)

c_getProj.setopt(pycurl.WRITEDATA, buffer) 

c_getProj.perform()

c_getProj.close() 

body = ast.literal_eval(buffer.getvalue().decode("UTF-8")) 

# Juste pour simuler une sélection

projetRetenu = [x for x in body["items"] if x["nameStatus"] == 'qualified'][0]

print (projetRetenu)

 

##################### Writing test###################

# Définition d’une activité à créer

activite = {"name" : "Activité de test","idActivityType" : "26","idProject" : projetRetenu["id"],"idStatus" : "1","idResource" : "3","creationDate" : "2020-12-24",'idActivityPlanningMode': '1'} 

c_setAct = pycurl.Curl()

c_setAct.setopt(c_setAct.URL, 'http://localhost/projeqtor/api/Activity')

c_setAct.setopt(c_setAct.HTTPAUTH , pycurl.HTTPAUTH_BASIC)

c_setAct.setopt(c_setAct.USERPWD , "%s:%s"%(login,key)) 

res = json.dumps(activite)

c_setAct.setopt(c_setAct.CUSTOMREQUEST, "POST")

c_setAct.setopt(c_setAct.POSTFIELDS, res)

c_setAct.perform()

c_setAct.close()

In that case, I can see the succesful result in the logs :

===== TRACE ===== {"apiResult":"OK", "apiResultMessage":"Activité #432 inséré", "id":"432", "reference":"-TAS-40", "name":"Activité de test", "idActivityType":"26", ...

Now, regarding the encryption, I use pycryptodome and I use it with several other encrypted APIs not written in python ... and it works, so I consider this library as reliable (at least in a first approach).
Here is the writing test part of the script to test encryption / decryption (replacing previous one) :

##################### Writing test###################

# Définition d’une activité à créer

activite = {"name" : "Activité de test","idActivityType" : "26","idProject" : projetRetenu["id"],"idStatus" : "1","idResource" : "3","creationDate" : "2020-12-24",'idActivityPlanningMode': '1'}  

c_setAct = pycurl.Curl()

c_setAct.setopt(c_setAct.URL, 'http://localhost/projeqtor/api/Activity')

c_setAct.setopt(c_setAct.HTTPAUTH , pycurl.HTTPAUTH_BASIC)

c_setAct.setopt(c_setAct.USERPWD , "%s:%s"%(login,key)) 

print("-----------------------------------")

res = json.dumps(activite)

print("Chaine json : " + res) 

key_b=binascii.a2b_hex(key)

cipher = AES.new(key_b, AES.MODE_CTR, nonce=binascii.a2b_hex("CAFEBEEFCAFEBEEF")) # Forced 8 bytes nonce as this is the expected size on server side

ct_bytes = cipher.encrypt(res.encode("utf-8"))

ciphertext = b64encode(cipher.nonce + ct_bytes)

print("Texte encrypté : " + str(ciphertext))

print("Texte b64decode :" + str(b64decode(ciphertext))) 

c_setAct.setopt(c_setAct.CUSTOMREQUEST, "POST")

c_setAct.setopt(c_setAct.POSTFIELDS, ciphertext)

c_setAct.perform()

c_setAct.close() 


# just to test local decryption

tmp = b64decode(ciphertext)

cipher_d = AES.new(key_b, AES.MODE_CTR, nonce=tmp[:8])

msg_d = cipher_d.decrypt(tmp[8:])

print("Texte décrypté : " + str(msg_d))

The output is (I added return lines) :

-----------------------------------
Chaine json : {"name": "Activitu00e9 de test", "idActivityType": "26", "idProject": "2", "idStatus": "1", "idResource": "3", "creationDate": "2020-12-24", "idActivityPlanningMode": "1"}


Texte encrypté : b'yv6+78r+vu/Z4Ln+J0/Ke0pUDZrbrQHKtql/wxi3ZESJGDQk/fm09NN270CSpUmIsQ/cwjUT1U+5FdwSBcCreT/uNyVS13N1WqmWMtg1UjNsfjrgiD7DF5A+K6iqv9CMUeHQOheczLbtz+XQjC/ZUXCc+uVOagwrX1R2WoPjrqd1yERIOEFr8v/omdf1LIeSVeocqPP2JexfSZ957uK9tCaECluEBekBizAGU4R80Q2evlG9'


Texte b64decode :b"xcaxfexbexefxcaxfexbexefxd9xe0xb9xfe'Oxca{JTrx9axdbxadx01xcaxb6xa9x7fxc3x18xb7dDx89x184$xfdxf9xb4xf4xd3vxef@x92xa5Ix88xb1x0fxdcxc25x13xd5Oxb9x15xdcx12x05xc0xaby?xee7%Rxd7suZxa9x962xd85R3l~:xe0x88>xc3x17x90>+xa8xaaxbfxd0x8cQxe1xd0:x17x9cxccxb6xedxcfxe5xd0x8c/xd9Qpx9cxfaxe5Njx0c+_TvZx83xe3xaexa7uxc8DH8Akxf2xffxe8x99xd7xf5,x87x92Uxeax1cxa8xf3xf6%xec_Ix9fyxeexe2xbdxb4&x84n[x84x05xe9x01x8b0x06Sx84|xd1rx9exbeQxbd"


Texte décrypté : b'{"name": "Activit\u00e9 de test", "idActivityType": "26", "idProject": "2", "idStatus": "1", "idResource": "3", "creationDate": "2020-12-24", "idActivityPlanningMode": "1"}'

On the server side, the b64 decoded string is exactly the same, the nonce is properly extracted ($ctrTxt) ... but the string is not properly decrypted 🙁

I had a look to external/phpAES/aesctr.class.php ... and several points let me think there might be some implementation issue : 

• The decryption process seems to be 32bits only (I am not sure of that, but regarding the magic numbers, I guess so).
• For production use, Chris Veness recommends  https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto ... but it is javascript 🙁

At the end, solving this problem seems quite time consumming and maybe a workaround could be acceptable : would it be possible to have a setting to activate / deactivate encryption for the API ?
By the way, why is the GET unencrypted ?

Any help is welcome ... :/