Skip to content

Commit 0c18a62

Browse files
committed
minor #7934 Use OpenSSL instead of Mcrypt in the examples (javiereguiluz)
This PR was squashed before being merged into the 2.7 branch (closes #7934). Discussion ---------- Use OpenSSL instead of Mcrypt in the examples This fixes #7925. Some comments: * openssl_*() functions are not documented on php.net (see http://php.net/manual/en/function.openssl-decrypt.php) so I used this article as a reference: http://thefsb.tumblr.com/post/110749271235/using-opensslendecrypt-in-php-instead-of * I think we don't need to use the `OPENSSL_RAW_DATA` or `OPENSSL_ZERO_PADDING` options ... but I'd like someone to verify this. * I can't find an equivalent of `\MCRYPT_3DES` so I used `\OPENSSL_ALGO_SHA1`. I'm not sure if that's correct. Commits ------- d6260a1 Use OpenSSL instead of Mcrypt in the examples
2 parents 8095cc2 + d6260a1 commit 0c18a62

File tree

1 file changed

+10
-5
lines changed

1 file changed

+10
-5
lines changed

session/proxy_examples.rst

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -88,19 +88,22 @@ guest sessions.
8888
Encryption of Session Data
8989
--------------------------
9090

91-
If you wanted to encrypt the session data, you could use the proxy to encrypt
92-
and decrypt the session as required::
91+
If you want to encrypt the session data, you can use the proxy to encrypt and
92+
decrypt the session as required. The following example uses the `php-encryption`_
93+
library, but you can adapt it to any other library that you may be using::
9394

9495
// src/AppBundle/Session/EncryptedSessionProxy.php
9596
namespace AppBundle\Session;
9697

98+
use Defuse\Crypto\Crypto;
99+
use Defuse\Crypto\Key;
97100
use Symfony\Component\HttpFoundation\Session\Storage\Proxy\SessionHandlerProxy;
98101

99102
class EncryptedSessionProxy extends SessionHandlerProxy
100103
{
101104
private $key;
102105

103-
public function __construct(\SessionHandlerInterface $handler, $key)
106+
public function __construct(\SessionHandlerInterface $handler, Key $key)
104107
{
105108
$this->key = $key;
106109

@@ -111,12 +114,12 @@ and decrypt the session as required::
111114
{
112115
$data = parent::read($id);
113116

114-
return mcrypt_decrypt(\MCRYPT_3DES, $this->key, $data);
117+
return Crypto::decrypt($data, $this->key);
115118
}
116119

117120
public function write($id, $data)
118121
{
119-
$data = mcrypt_encrypt(\MCRYPT_3DES, $this->key, $data);
122+
$data = Crypto::encrypt($data, $this->key);
120123

121124
return parent::write($id, $data);
122125
}
@@ -155,3 +158,5 @@ can intercept the session before it is written::
155158
return parent::write($id, $data);
156159
}
157160
}
161+
162+
.. _`php-encryption`: https://github.com/defuse/php-encryption

0 commit comments

Comments
 (0)