From 92ea0fc07175f52ed0da09517a589a7c1ec42aad Mon Sep 17 00:00:00 2001
From: ericshermancs <zensap92@gmail.com>
Date: Thu, 26 Dec 2019 00:21:25 -0500
Subject: [PATCH 1/2] modify htaccess so that it works i guess

---
 .htaccess                 | 5 +++--
 Depfiles/dependencies.pip | 1 +
 keys/.htaccess            | 3 ++-
 src/helper/security.py    | 8 +++-----
 4 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/.htaccess b/.htaccess
index 2b91858..eecf051 100644
--- a/.htaccess
+++ b/.htaccess
@@ -1,3 +1,4 @@
-<Files ".env">  
-  Require all denied
+<Files .env>
+    Order allow,deny
+    Deny from all
 </Files>
\ No newline at end of file
diff --git a/Depfiles/dependencies.pip b/Depfiles/dependencies.pip
index 62b8149..4dd3db1 100644
--- a/Depfiles/dependencies.pip
+++ b/Depfiles/dependencies.pip
@@ -8,3 +8,4 @@ colorconsole
 cunyfirstapi
 mysql
 mysql-connector
+pycryptodome
\ No newline at end of file
diff --git a/keys/.htaccess b/keys/.htaccess
index 8d2f256..4330c70 100644
--- a/keys/.htaccess
+++ b/keys/.htaccess
@@ -1 +1,2 @@
-deny from all
+Order Allow,Deny 
+Deny from all 
\ No newline at end of file
diff --git a/src/helper/security.py b/src/helper/security.py
index a2117a9..96d53df 100644
--- a/src/helper/security.py
+++ b/src/helper/security.py
@@ -1,20 +1,18 @@
 from Crypto.PublicKey import RSA
 from Crypto.Cipher import PKCS1_OAEP
 from Crypto.Signature import PKCS1_PSS
-from Crypto.Hash import SHA
-from Crypto import Random
 import Crypto
 import base64
 KEY_SIZE = 2048
 
 def gen_keys():
     key = RSA.generate(KEY_SIZE)
-    private_key = key.export_key()
+    private_key = key.export_key("PEM")
     file_out = open("keys/private.pem", "wb")
     file_out.write(private_key)
     file_out.close()
     
-    public_key = key.publickey().export_key()
+    public_key = key.publickey().export_key("PEM")
     file_out = open("keys/public.pem", "wb")
     file_out.write(public_key)
     file_out.close()
@@ -26,6 +24,7 @@ def encrypt(message, path='keys/public.pem'):
     ciphertext = cipher.encrypt(message)
     return ciphertext
 
+
 def decrypt(ciphertext_base64, path='keys/private.pem'):
     key = open(path).read()
     key = RSA.importKey(key)
@@ -34,6 +33,5 @@ def decrypt(ciphertext_base64, path='keys/private.pem'):
     message = cipher.decrypt(ciphertext)
     return message
 
-
 if __name__ == '__main__':
     gen_keys()
\ No newline at end of file

From f5072f1f9dbee661466fa8e5de49a21a030af3ad Mon Sep 17 00:00:00 2001
From: ericshermancs <zensap92@gmail.com>
Date: Thu, 26 Dec 2019 00:42:00 -0500
Subject: [PATCH 2/2] move sensitive stuff to ../../private

---
 index.php                  |  2 +-
 src/core/grade_notifier.py |  6 ++----
 src/core/initializegn.py   |  5 ++---
 src/helper/security.py     | 12 ++++++++----
 4 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/index.php b/index.php
index da7c11c..12d7b0f 100644
--- a/index.php
+++ b/index.php
@@ -119,7 +119,7 @@ function display()
                 <script type="text/javascript">
                     function encryptPassword() {
                         let rsa = forge.pki.rsa;
-                        let publicKeyEncoded = <?php echo '`'.file_get_contents("keys/public.pem").'`'?>;
+                        let publicKeyEncoded = <?php echo '`'.file_get_contents("../../private/keys/public.pem").'`'?>;
                         let publicKey = forge.pki.publicKeyFromPem(publicKeyEncoded);
                         let ciphertext = publicKey.encrypt(document.userform.password.value, 'RSA-OAEP', {
                             md: forge.md.sha256.create(),
diff --git a/src/core/grade_notifier.py b/src/core/grade_notifier.py
index 7dc02bf..5b5fe0d 100644
--- a/src/core/grade_notifier.py
+++ b/src/core/grade_notifier.py
@@ -49,11 +49,9 @@
 import mysql.connector
 ###********* GLOBALS *********###
 
-# Create .env file path.
-dotenv_path = join(constants.abs_repo_path(), '.env')
 
 # Load file from the path.
-load_dotenv()
+load_dotenv('../../private/.env')
 
 # Accessing variables.
 account_sid = os.getenv('TWILIO_SID')
@@ -250,7 +248,7 @@ def start_notifier():
 
             cursor.execute(f'UPDATE Users SET lastUpdated = NOW() WHERE id={__id};')
             
-            decrypted_password = decrypt(encrypted_password, 'keys/private.pem')
+            decrypted_password = decrypt(encrypted_password, '../../private/keys/private.pem')
             api = CUNYFirstAPI(username, decrypted_password, school.upper())
             api.login()
 
diff --git a/src/core/initializegn.py b/src/core/initializegn.py
index dade72d..846a68e 100644
--- a/src/core/initializegn.py
+++ b/src/core/initializegn.py
@@ -45,13 +45,12 @@
 __status__ = "Production"
 
 # Load file.
-load_dotenv()
+load_dotenv('../../private/.env')
 
 # Accessing variables.
 DB_USERNAME = os.getenv('DB_USERNAME')
 DB_PASSWORD = os.getenv('DB_PASSWORD')
 DB_HOST = os.getenv('DB_HOST')
-PRIVATE_RSA_KEY = os.getenv('PRIVATE_RSA_KEY').replace(r'\n', '\n')
 
 def add_to_db(username, encrypted_password, school, phone):
 
@@ -127,7 +126,7 @@ def main():
             )
             return
 
-        password = decrypt(encrypted_password, 'keys/private.pem')
+        password = decrypt(encrypted_password, '../../private/keys/private.pem')
         
         api = cunyfirstapi.CUNYFirstAPI(username, password)
         api.login()
diff --git a/src/helper/security.py b/src/helper/security.py
index 96d53df..166acab 100644
--- a/src/helper/security.py
+++ b/src/helper/security.py
@@ -1,3 +1,4 @@
+import os
 from Crypto.PublicKey import RSA
 from Crypto.Cipher import PKCS1_OAEP
 from Crypto.Signature import PKCS1_PSS
@@ -5,18 +6,21 @@
 import base64
 KEY_SIZE = 2048
 
-def gen_keys():
+def gen_keys(path='../../private/keys'):
+    if not os.path.isdir(path):
+        os.makedirs(path)
+
     key = RSA.generate(KEY_SIZE)
     private_key = key.export_key("PEM")
-    file_out = open("keys/private.pem", "wb")
+    file_out = open(f"{path}/private.pem", "wb")
     file_out.write(private_key)
     file_out.close()
     
     public_key = key.publickey().export_key("PEM")
-    file_out = open("keys/public.pem", "wb")
+    file_out = open(f"{path}/public.pem", "wb")
     file_out.write(public_key)
     file_out.close()
-    print("Keys have been written to keys/")
+    print(f"Keys have been written to {path}")
 
 def encrypt(message, path='keys/public.pem'):
     key = RSA.importKey(open(path).read())