From 726634f68e464d6114eb7c455b013e266c0d26e5 Mon Sep 17 00:00:00 2001
From: Kevin Niehage
Date: Tue, 8 Nov 2016 10:08:24 +0100
Subject: [PATCH] interface improvements publication on github
---
CHANGELOG.md | 31 ++++++++++++++++++++++++++++++
README.md | 15 +++++++++++++--
actions/read.php | 6 +++---
index.php | 17 +++++++++++-----
libs/shared-secrets.def.php | 5 +++--
libs/shared-secrets.exec.php | 9 ++++++---
pages/how/get.php | 12 +++++++++++-
pages/read/get.php | 5 ++++-
pages/read/post.php | 31 +++++++++++++++++-------------
pages/share/get.php | 11 +++++++----
pages/share/post.php | 25 ++++++++++++++----------
resources/css/read.css | 9 +++++++--
resources/css/share.css | 17 ++++++++++------
resources/js/copy-to-clipboard.js | 14 --------------
template/footer.php | 7 +++++--
template/header.php | 9 ++++++---
vendors/buffer/index.js | 2 +-
vendors/clipboard/clipboard.min.js | 7 -------
vendors/jquery/jquery.min.js | 9 ++++-----
vendors/jquery/jquery.min.map | 1 +
vendors/respond/respond.min.js | 9 +++++----
21 files changed, 163 insertions(+), 88 deletions(-)
delete mode 100644 resources/js/copy-to-clipboard.js
delete mode 100644 vendors/clipboard/clipboard.min.js
create mode 100644 vendors/jquery/jquery.min.map
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a180e97..ebdc5cf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,34 @@
+# 0.9b0 (2016-11-08)
+
+* version bump for interface improvements publication on github
+
+# 0.8b5 (2016-10-21)
+
+* introduced dynamic indentation for shell command on how page
+* tested interface improvements within chroot environment
+
+# 0.8b4 (2016-10-20)
+
+* introduced dummy parameters to fix cached-subresource-checksum-mismatch problem when changing CSS/JS files
+
+# 0.8b3 (2016-10-20)
+
+* removed copy-to-clipboard functionality as it proves to be unreliable
+* improved style to simplify manual copying of generated shared secret link
+* updated readme accordingly
+
+# 0.8b2 (2016-10-19)
+
+* fixed secret-already-retrieved error message
+
+# 0.8b1 (2016-10-07)
+
+* introduced the parameter "plain" for the share action to just return the link without surrounding HTML
+* introduced the parameter "plain" for the read action to just return the secret without surrounding HTML
+* introduced some minor changes to make parameter constant naming more consistent
+* introduced .htaccess to simplify installation using Apache HTTPD
+* updated included libraries to newer releases
+
# 0.8b0 (2016-09-11)
* version bump for GnuPG PECL package support publication on github
diff --git a/README.md b/README.md
index d758337..a69a136 100644
--- a/README.md
+++ b/README.md
@@ -14,10 +14,21 @@ To protect your secret from getting known by the server or an attacker, you can
Simply enter your secret on the default page of the Shared-Secrets service. You can decide to password-protect the entered secret before sending it to the server by checking the "Password-protected:" box, entering your password and pressing the "Protect!" button. After that, press the "Share the Secret!" button. The secret will be GPG-encrypted and converted into a secret sharing link.
+Secret sharing links can also be created by using a simple POST request:
+```
+curl -X POST -d "secret=&plain" https://example.com/
+```
+
### Read a Secret
To retrieve the secret, simply open the secret sharing link and press the "Read the Secret!" button. Should your secret be password-protected, check the "Password-protected:" box, enter your password and read your actual secret by pressing the "Unprotect!" button.
+Secrets can also be retrieved using a simple POST request:
+
+```
+curl -X POST -d "plain"
+```
+
## Installation
### Requirements
@@ -109,7 +120,7 @@ sudo apt-get install libgpgme11-dev
# install the GnuPG PECL package
sudo pecl install gnupg
-# register tje GnuPG PECL package as an available module
+# register the GnuPG PECL package as an available module
sudo sh -c 'echo "extension=gnupg.so" > /etc/php/7.0/mods-available/gnupg.ini'
# activate the GnuPG PECL package in PHP CLI and PHP-FPM
@@ -135,7 +146,6 @@ It is strongly recommended to use TLS to protect the connection between the serv
* [asmCrypto](https://github.com/vibornoff/asmcrypto.js): for providing PBKDF2 and AES functions
* [Bootstrap](https://getbootstrap.com): for providing an easy-to-use framework to build nice-looking applications
* [buffer](https://github.com/feross/buffer): for providing Base64 encoding and array conversion functions
-* [clipboard.js](https://clipboardjs.com): for simplifying the copy-to-clipboard use-case a lot
* [GnuPG](https://www.gnupg.org): for providing a reliable tool for secure communication
* [GnuPG PECL package](https://pecl.php.net/package/gnupg): for providing a clean interface to GnuPG
* [html5shiv](https://github.com/aFarkas/html5shiv): for handling Internet Explorer compatibility stuff
@@ -147,6 +157,7 @@ It is strongly recommended to use TLS to protect the connection between the serv
* make PECL method work in a chroot environment to get rid of the direct call method
* switch to a more personalized design (current design is taken from [here](https://github.com/twbs/bootstrap/tree/master/docs/examples/starter-template))
+* implement an alternative encryption scheme based on AES instead of GPG (fewer dependencies)
* implement an expiry date functionality
## License
diff --git a/actions/read.php b/actions/read.php
index 82b7f61..21d782b 100644
--- a/actions/read.php
+++ b/actions/read.php
@@ -65,7 +65,7 @@ function read_secret($secret) {
$decrypted_secret = decrypt_pecl(base64_decode($secret), GPG_KEY_FINGERPRINT, GPG_HOME_DIR, GPG_PASSPHRASE_FILE);
} else {
$decrypted_secret = decrypt(base64_decode($secret), GPG_HOME_DIR, GPG_PASSPHRASE_FILE);
- }
+ }
}
if (null !== $decrypted_secret) {
@@ -95,9 +95,9 @@ function read_secret($secret) {
}
}
}
+ } else {
+ $result = "ERROR: SECRET HAS ALREADY BEEN RETRIEVED.";
}
- } else {
- $result = "ERROR: SECRET HAS ALREADY BEEN RETRIEVED.";
}
}
}
diff --git a/index.php b/index.php
index 83308ce..58850c8 100644
--- a/index.php
+++ b/index.php
@@ -1,6 +1,6 @@