GPG


#1

hey guys,

Heres the code I’ll explain the problem below

$gpg = '/usr/bin/gpg';                                             # path to gpg - yours may differ
  $recipient = 'orders@mysite.com';
  $order = ......;                                                   # make a composite of your order information
  $tmpfile = '/home/username/tmp/phpbasket_' . md5(uniqid(time()));  # temp file to encrypt to
  $cmd = "$gpg --homedir /home/username/.gnupg --no-default-keyring
        --always-trust --no-secmem-warning -e -a --batch -t -r $recipient -o $tmpfile";
  $fp = popen($cmd, 'w');                       # open a new process to gpg
  fwrite($fp, $nospaces);                       # write the command to encrypt our order to the gpg process
  pclose($fp);                                  # close it

  $fp = fopen($tmpfile, 'r');                   # open the temp file
  $enc_order = fread($fp, filesize($tmpfile));  # read the encrypted contents
  fclose($fp);                                  # close it

  unlink($tmpfile);                             # delete the temp file

  mail($recipient, 'New order!', $enc_order);   # mail it to your account

Okay, what I don’t understand is this: $tmpfile = ‘/home/username/tmp/phpbasket_’ . md5(uniqid(time())); # temp file to encrypt to

Explanation:

I’m trying to send encrypted emails that will eventually contain credit card numbers to a client. I found this script at http://www.tiraen.com/dave/php_gpg_howto.html and it says that by using GPG you can send encrypted emails to someone which can then be decrypted using a private key. Now, the script works great (meaning it executes and i get an email) but the email is blank when it should actually be a bunch of encrypted text. my theory is that it has something to do with that temp file. Maybe it’s just not being created. But when i look at the line i don’t understand what file is going to be encrypted exactly. Any ideas on how to get this thing up and running? thanx.


#2

never really used the GPG, however, I would get rid of the UNLINK command (or comment it) for the purposes of testing. Then run the script. Check to see the permissions of the file and what type. Is it binary or text.

If the file is there and accessible by the webserver, we can look further… if not… Well then there’s the problem…

Let us know.


#3

I dunno man. if i change the tmp file to a file that exists (like a txt file with a text phrase in it) it gets sent wtih the email but its unencrypted. it looks like gpg doesnt even get executed.


#4

but did you comment out the UNLINK command and see if the encrypted gpg file exists?

What about error reporting? Any errors? is the error reporting shut off? Is the GPG command even being executed successfully?

Don’t change the tmp file name… Comment the unlink command. Check that there, then let us know.


#5

Okay, sorry for all the confusion. Here’s the errors I’m getting:

[22-Jun-2004 22:37:07] PHP Warning: fopen(): Unable to access /home/artist36/tmp/phpbasket_23187dc9925ca028956b62f7db249a76 in /home/artist36/public_html/hackwild/encryption_test.php on line 12
[22-Jun-2004 22:37:07] PHP Warning: fopen(/home/artist36/tmp/phpbasket_23187dc9925ca028956b62f7db249a76): failed to open stream: Permission denied in /home/artist36/public_html/hackwild/encryption_test.php on line 12
[22-Jun-2004 22:37:07] PHP Warning: filesize(): Stat failed for /home/artist36/tmp/phpbasket_23187dc9925ca028956b62f7db249a76 (errno=13 - Permission denied) in /home/artist36/public_html/hackwild/encryption_test.php on line 13
[22-Jun-2004 22:37:07] PHP Warning: fread(): supplied argument is not a valid stream resource in /home/artist36/public_html/hackwild/encryption_test.php on line 13
[22-Jun-2004 22:37:07] PHP Warning: fclose(): supplied argument is not a valid stream resource in /home/artist36/public_html/hackwild/encryption_test.php on line 14

maybe this helps i did comment the unlink


#6

The error message says it all.

You are unable to access the file. A later message advises that permission is denied. Although you as a USER might have permission to access the file, you need to ensure that the Webserver has permission to do so. This can be done with the CHMOD command. Set it to 664 (Read/Write for USER and GROUP and READ for all others). Also ensure that the Webserver has READ permissions for the directory /home/artist36/tmp/

Also if you did you check to see if the file was actually created? What are the permissions on it?

I definitely believe it’s a permissions issue.

Good luck


#7

i tried the chmod(644) thing but i get the same errors. the problem is I don’t have direct access to the permissions and such because I don’t have direct access to the server I’m working on (I’m trying to build an ecommerce site and the server is on the east coast while im in the mid west). I can’t verify whether or not the tmp file is being made becuase i cannot access the tmp directory. Any ideas?