Cakephp 2.x Security::cipher not providing results across two apps - php

Question

I have 2 apps communicating with each other. The 1st app is the one who do the transactions and the other app is a settings app to control the 1st app's system settings.
Upon on reaching the login page of the first app, I'm calling a WebService through curl inside the config.php and it will communicate to the 2nd app and it will return corresponding values. Now, my problem is, the value was encrypted using the Security::cipher() function and it was encrypted using a module inside of the settings app. When I try to decrypt it, there is no error prompted and even no error is logged in the error logs file. I suspect that when I decrypt from WebServicesController it doesn't read the Security component. I tried to put App::uses('Security','Utility') on the top of the codes. Here's how I code it:
1st app
curl_setopt($ch, CURLOPT_URL, Configure::read('TMSWebServices.Url').'getSystemSetting.json');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($data));
$result_json = curl_exec($ch);
curl_close($ch);
$result = json_decode($result_json, true);
debug($result); exit;
2nd app
App::uses('AuthComponent', 'Controller/Component');
App::uses('UsersController', 'Controller');
App::uses('Security','Utility');
class WebServicesController extends AppController {
public $name = 'WebServices';
public $uses = array('Tenant', 'TbNextId', 'ReportMaster' );
public $components = array('RequestHandler');
public function getSystemSetting(){
$this->loadModel('SystemSetting');
$results = $this->SystemSetting->find($type, $params);
$return_value = array();
$return_value = $results['SystemSetting'];
foreach($return_value['Config'] as $key=>$value){
if ($value['ENCRYPT_IND'] == 'Y'){
$encryptedValue = $return_value['Config'][$key]['SYSTEM_SETTING_VALUE'];
//decrypt the value
$decryptedValue = Security::cipher($encryptedValue,
Configure::read('Security.salt')); // the problem starts here
$return_value['Config'][$key]['SYSTEM_SETTING_VALUE'] = $decryptedValue;
}
}
}
}
$this->set(array(
'return_value' => $return_value,
'_serialize' => array('return_value')
));
When I try to just put simple value on the $return_value, the communication works. But if I use the Security::cipher to decrypt, it doesn't work and give me a null value.

Answer 1

I would look at two problems:
The Security.salt value is usually not the same across two CakePHP apps. From your error message I think that it's either empty or not set (i.e. null). Unless you set Security.salt to the same value in both apps, cipher will not work giving you either null or some incorrect value.
As #ndm mentioned in the comment, you are creating a flat array (not an associative array) so I wonder how it is that your code even enters the foreach loop.
Look at the following code and my comments:
// ...
$return_value = array(); // we have ourselves an empty array
$return_value[] = $results['SystemSetting']; // we assign a value to $return_value[0]
foreach($return_value['Config'] as $key=>$value){ // no such key 'Config' in the array
// loop code follows, but execution flow shouldn't enter here...
While we are at it, I strongly encourage you to not use Security.salt because it is just a weak XOR cipher, try to use Security.encrypt() and Security.decrypt()