Add file name obfuscation

Author: unverbuggt

README.md

@@ -28,11 +28,11 @@ The content is encrypted with AES-256 in Python using PyCryptodome, and decrypte
 
 * ~~Sanitize code. F.ex. self.config variables should not be overwritten on other places than on_config.~~
 * ~~Rework search_index handling to be more bulletproof.~~
-* Add optional obfuscation of filenames. F.ex. to make it impossible to guess image names.
+* ~~Add optional obfuscation of file names. F.ex. to make it impossible to guess image names.~~
 * Rework password handling or inventory of some sort
 * ~~As we are vulnerable to brute force: Review strenght of used passwords.~~
 * download self-hosted cryptojs just once (check hash of js files)
-* ~~Add button press to decrypt without password (just to hide content from search engines)
+* ~~Add button press to decrypt without password (just to hide content from search engines)~~
 * ...to be defined
 
 # Table of Contents
@@ -43,7 +43,7 @@ The content is encrypted with AES-256 in Python using PyCryptodome, and decrypte
     * [Secret from environment](#secret-from-environment)
     * [Customization](#default-vars-customization)
     * [Translations](#translations)
-    * [Obfuscate pages](#obfuscate-pages)
+    * [Obfuscate pages](#obfuscate-pages) **NEW**
   * [Features](#features)
     * [HighlightJS support](#highlightjs-support) *(default)*
     * [Arithmatex support](#arithmatex-support) *(default)*
@@ -58,6 +58,7 @@ The content is encrypted with AES-256 in Python using PyCryptodome, and decrypte
     * [Add button](#add-button)
     * [Reload scripts](#reload-scripts)
     * [Self-host crypto-js](#self-host-crypto-js)
+    * [File name obfuscation](#filename-obfuscation)
   * [Contributing](#contributing)
 
 
@@ -595,6 +596,51 @@ plugins:
         selfhost_download: false
 ```
 
+### File name obfuscation
+
+Imagine your pages contain many images and you labeled them "1.jpg", "2.jpg" and so on for some reason.
+If you'd like to encrypt one of these pages, an attacker could try guessing the image file names
+and would be able to download them despite not having the password to the page.
+
+This feature should make it impossible or at least way harder for an external attacker to guess the file names.
+Please also check and disable directory listing for that matter.
+Keep in mind that you hosting provider is still able to see all your images and files.
+
+To counter file name guessing you could active the feature like this:
+
+```yaml
+plugins:
+    - encryptcontent:
+        selfhost: true
+        selfhost_download: false
+        hash_filenames:
+          extensions:
+            - 'png'
+            - 'jpg'
+            - 'jpeg'
+            - 'svg'
+          except:
+            - 'lilien.svg'
+```
+
+At `extensions` we define which file name extensions to obfuscate
+(extension is taken from the part after the last ".",
+so the extension of "image.jpg" is "jpg" and of "archive.tar.gz" is "gz").
+
+You can define multiple exceptions at the `except` list.
+The file names that end with these strings will be skipped.
+You should use this if some images are used by themes or other plugins.
+Otherwise, you'd need to change these file names to the obfuscated ones.
+
+The file names are obfuscated in a way that the corresponding file is hashed with MD5
+and the hash is added to the file name
+(If the file content is not changed the file name also not changes), like this:
+
+some_image_1_bb80db433751833b8f8b4ad23767c0fc.jpg
+("bb80db433751833b8f8b4ad23767c0fc" being the MD5 hash of said image.)
+
+> The file name obfuscation is currently applied to the whole site - not just the encrypted pages...
+
 # Contributing
 
 From reporting a bug to submitting a pull request: every contribution is appreciated and welcome.

encryptcontent/plugin.py

@@ -84,6 +84,7 @@ class encryptContentPlugin(BasePlugin):
         ('selfhost', config_options.Type(bool, default=False)),
         ('selfhost_download', config_options.Type(bool, default=True)),
         ('translations', config_options.Type(dict, default={}, required=False)),
+        ('hash_filenames', config_options.Type(dict, default={}, required=False)),
         # legacy features, doesn't exist anymore
     )
 
@@ -95,6 +96,13 @@ def __hash_md5__(self, text):
         key.update(text.encode('utf-8'))
         return key.digest()
 
+    def __hash_md5_file__(self, fname):
+        hash_md5 = hashlib.md5()
+        with open(fname, "rb") as f:
+            for chunk in iter(lambda: f.read(4096), b""):
+                hash_md5.update(chunk)
+        return hash_md5.hexdigest()
+
     def __encrypt_text_aes__(self, text, password):
         """ Encrypts text with AES-256. """
         BLOCK_SIZE = 32
@@ -328,6 +336,34 @@ def on_pre_build(self, config, **kwargs):
         except Exception as exp:
             logger.exception(exp)
 
+    def on_files(self, files, config, **kwargs):
+        """
+        The files event is called after the files collection is populated from the docs_dir.
+        Use this event to add, remove, or alter files in the collection.
+        Note that Page objects have not yet been associated with the file objects in the collection.
+        Use Page Events to manipulate page specific data.
+        """
+        if 'extensions' in self.config['hash_filenames']:
+            for file in files:
+
+                if 'except' in self.config['hash_filenames']:
+                    skip = False
+                    for check in self.config['hash_filenames']['except']:
+                        if file.src_path.endswith(check):
+                            skip = True
+                    if skip:
+                        continue
+
+                ext = file.src_path.rsplit('.',1)[1].lower()
+                if ext in self.config['hash_filenames']['extensions']:
+                    hash = self.__hash_md5_file__(file.abs_src_path)
+                    filename, ext =  file.abs_dest_path.rsplit('.',1)
+                    filename = filename + "_" + hash
+                    file.abs_dest_path = filename + "." + ext
+                    filename, ext =  file.url.rsplit('.',1)
+                    filename = filename + "_" + hash
+                    file.url = filename + "." + ext
+
     def on_page_markdown(self, markdown, page, config, **kwargs):
         """
         The page_markdown event is called after the page's markdown is loaded from file and
@@ -543,8 +579,6 @@ def on_post_page(self, output_content, page, config, **kwargs):
             if self.setup['search_plugin_found']:
                 location = page.url.lstrip('/')
                 self.setup['locations'][location] = page.encryptcontent['password']
-            print(page.title)
-            print(page.encryptcontent)
             delattr(page, 'encryptcontent')
 
         return output_content