From 37d69d6ab566255986c39d851a397dc35c586585 Mon Sep 17 00:00:00 2001
From: Ahmad Afandi <ahmad.afandi85@gmail.com>
Date: Mon, 31 Aug 2026 13:22:33 +0700
Subject: [PATCH] perbaikan ecryptString

---
 app/Http/Controllers/LogViewerController.php  |  8 +-
 .../vendor/laravel-log-viewer/log.blade.php   | 10 +--
 tests/Feature/LogViewerControllerTest.php     | 74 +++++++++++++++++++
 3 files changed, 83 insertions(+), 9 deletions(-)
 create mode 100644 tests/Feature/LogViewerControllerTest.php

diff --git a/app/Http/Controllers/LogViewerController.php b/app/Http/Controllers/LogViewerController.php
index 0f5e780804..b8ee2ffe90 100644
--- a/app/Http/Controllers/LogViewerController.php
+++ b/app/Http/Controllers/LogViewerController.php
@@ -81,11 +81,11 @@ public function index()
     {
         $folderFiles = [];
         if ($this->request->input('f')) {
-            $this->log_viewer->setFolder(Crypt::decrypt($this->request->input('f')));
+            $this->log_viewer->setFolder(Crypt::decryptString($this->request->input('f')));
             $folderFiles = $this->log_viewer->getFolderFiles(true);
         }
         if ($this->request->input('l')) {
-            $this->log_viewer->setFile(Crypt::decrypt($this->request->input('l')));
+            $this->log_viewer->setFile(Crypt::decryptString($this->request->input('l')));
         }
 
         if ($early_return = $this->earlyReturn()) {
@@ -143,7 +143,7 @@ public function index()
     private function earlyReturn()
     {
         if ($this->request->input('f')) {
-            $this->log_viewer->setFolder(Crypt::decrypt($this->request->input('f')));
+            $this->log_viewer->setFolder(Crypt::decryptString($this->request->input('f')));
         }
 
         if ($this->request->input('dl')) {
@@ -178,7 +178,7 @@ private function earlyReturn()
      */
     private function pathFromInput($input_string)
     {
-        return $this->log_viewer->pathToLogFile(Crypt::decrypt($this->request->input($input_string)));
+        return $this->log_viewer->pathToLogFile(Crypt::decryptString($this->request->input($input_string)));
     }
 
     /**
diff --git a/resources/views/vendor/laravel-log-viewer/log.blade.php b/resources/views/vendor/laravel-log-viewer/log.blade.php
index 22a1b5801f..f53e807aa5 100644
--- a/resources/views/vendor/laravel-log-viewer/log.blade.php
+++ b/resources/views/vendor/laravel-log-viewer/log.blade.php
@@ -30,7 +30,7 @@
             <div class="box-body no-padding">
                 <ul class="nav nav-pills nav-stacked">
                     @foreach ($files as $file)
-                        <li @if ($current_file == $file) class="active" @endif><a href="?l={{ \Illuminate\Support\Facades\Crypt::encrypt($file) }}"> {{ $file }}
+                        <li @if ($current_file == $file) class="active" @endif><a href="?l={{ \Illuminate\Support\Facades\Crypt::encryptString($file) }}"> {{ $file }}
                             </a></li>
                     @endforeach
                 </ul>
@@ -43,22 +43,22 @@
                 <div class="p-3">
                     @if ($current_file)
                         <a class="btn btn-social btn-sm btn-success visible-xs-block visible-sm-inline-block visible-md-inline-block visible-lg-inline-block"
-                            href="?dl={{ \Illuminate\Support\Facades\Crypt::encrypt($current_file) }}{{ $current_folder ? '&f=' . \Illuminate\Support\Facades\Crypt::encrypt($current_folder) : '' }}"
+                            href="?dl={{ \Illuminate\Support\Facades\Crypt::encryptString($current_file) }}{{ $current_folder ? '&f=' . \Illuminate\Support\Facades\Crypt::encryptString($current_folder) : '' }}"
                         >
                             <span class="fa fa-download"></span> Unduh
                         </a>
                         <a class="btn btn-social btn-sm btn-info visible-xs-block visible-sm-inline-block visible-md-inline-block visible-lg-inline-block" id="clean-log"
-                            href="?clean={{ \Illuminate\Support\Facades\Crypt::encrypt($current_file) }}{{ $current_folder ? '&f=' . \Illuminate\Support\Facades\Crypt::encrypt($current_folder) : '' }}"
+                            href="?clean={{ \Illuminate\Support\Facades\Crypt::encryptString($current_file) }}{{ $current_folder ? '&f=' . \Illuminate\Support\Facades\Crypt::encryptString($current_folder) : '' }}"
                         >
                             <span class="fa fa-times-circle"></span> Bersihkan File
                         </a>
                         <a class="btn btn-social btn-sm btn-danger visible-xs-block visible-sm-inline-block visible-md-inline-block visible-lg-inline-block" id="delete-log"
-                            href="?del={{ \Illuminate\Support\Facades\Crypt::encrypt($current_file) }}{{ $current_folder ? '&f=' . \Illuminate\Support\Facades\Crypt::encrypt($current_folder) : '' }}"
+                            href="?del={{ \Illuminate\Support\Facades\Crypt::encryptString($current_file) }}{{ $current_folder ? '&f=' . \Illuminate\Support\Facades\Crypt::encryptString($current_folder) : '' }}"
                         >
                             <span class="fa fa-trash"></span> Hapus File
                         </a>
                         @if (count($files) > 1)
-                            <a id="delete-all-log" class="btn btn-social btn-sm btn-danger visible-sm-inline-block visible-md-inline-block visible-lg-inline-block" href="?delall=true{{ $current_folder ? '&f=' . \Illuminate\Support\Facades\Crypt::encrypt($current_folder) : '' }}">
+                            <a id="delete-all-log" class="btn btn-social btn-sm btn-danger visible-sm-inline-block visible-md-inline-block visible-lg-inline-block" href="?delall=true{{ $current_folder ? '&f=' . \Illuminate\Support\Facades\Crypt::encryptString($current_folder) : '' }}">
                                 <span class="fa fa-trash"></span> Hapus Semua file
                             </a>
                         @endif
diff --git a/tests/Feature/LogViewerControllerTest.php b/tests/Feature/LogViewerControllerTest.php
new file mode 100644
index 0000000000..542ab9c84a
--- /dev/null
+++ b/tests/Feature/LogViewerControllerTest.php
@@ -0,0 +1,74 @@
+<?php
+
+/*
+ * File ini bagian dari:
+ *
+ * OpenDK
+ *
+ * Aplikasi dan source code ini dirilis berdasarkan lisensi GPL V3
+ *
+ * Hak Cipta 2017 - 2025 Perkumpulan Desa Digital Terbuka (https://opendesa.id)
+ *
+ * Dengan ini diberikan izin, secara gratis, kepada siapa pun yang mendapatkan salinan
+ * dari perangkat lunak ini dan file dokumentasi terkait ("Aplikasi Ini"), untuk diperlakukan
+ * tanpa batasan, termasuk hak untuk menggunakan, menyalin, mengubah dan/atau mendistribusikan,
+ * asal tunduk pada syarat berikut:
+ *
+ * Pemberitahuan hak cipta di atas dan pemberitahuan izin ini harus disertakan dalam
+ * setiap salinan atau bagian penting Aplikasi Ini. Barang siapa yang menghapus atau menghilangkan
+ * pemberitahuan ini melanggar ketentuan lisensi Aplikasi Ini.
+ *
+ * PERANGKAT LUNAK INI DISEDIAKAN "SEBAGAIMANA ADANYA", TANPA JAMINAN APA PUN, BAIK TERSURAT MAUPUN
+ * TERSIRAT. PENULIS ATAU PEMEGANG HAK CIPTA SAMA SEKALI TIDAK BERTANGGUNG JAWAB ATAS KLAIM, KERUSAKAN ATAU
+ * KEWAJIBAN APAPUN ATAS PENGGUNAAN ATAU LAINNYA TERKAIT APLIKASI INI.
+ *
+ * @package    OpenDK
+ * @author     Tim Pengembang OpenDesa
+ * @copyright  Hak Cipta 2017 - 2025 Perkumpulan Desa Digital Terbuka (https://opendesa.id)
+ * @license    http://www.gnu.org/licenses/gpl.html    GPL V3
+ * @link       https://github.com/OpenSID/opendk
+ */
+
+use App\Http\Middleware\Authenticate;
+use App\Http\Middleware\CompleteProfile;
+use App\Http\Middleware\GlobalShareMiddleware;
+use Illuminate\Foundation\Testing\DatabaseTransactions;
+use Illuminate\Support\Facades\Crypt;
+use Spatie\Permission\Middleware\PermissionMiddleware;
+use Spatie\Permission\Middleware\RoleMiddleware;
+
+uses(DatabaseTransactions::class);
+
+class ObjectInjectionGadget
+{
+    public static $wokenUp = false;
+
+    public function __wakeup()
+    {
+        self::$wokenUp = true;
+    }
+}
+
+beforeEach(function () {
+    ObjectInjectionGadget::$wokenUp = false;
+
+    $this->withoutMiddleware([
+        Authenticate::class,
+        RoleMiddleware::class,
+        PermissionMiddleware::class,
+        CompleteProfile::class,
+        GlobalShareMiddleware::class,
+    ]);
+});
+
+test('user-supplied log params are decrypted without unserialization', function () {
+    // Payload dibuat seolah-olah oleh penyerang yang memiliki APP_KEY:
+    // menyerupai Crypt::decrypt() lama (unserialize=true) terhadap input user.
+    // decryptString() mengembalikan string mentah tanpa unserialize, sehingga
+    // object tidak pernah diinstansiasi (tidak ada side effect __wakeup()).
+    $malicious = Crypt::encryptString(serialize(new ObjectInjectionGadget));
+
+    $this->get(route('setting.info-sistem').'?f='.urlencode($malicious));
+
+    expect(ObjectInjectionGadget::$wokenUp)->toBeFalse();
+});