Merge pull request #2683 from wallabag/credentials-in-db

Store credentials in DB

.gitignore

@@ -56,3 +56,4 @@ app/Resources/build/
 # Test-generated files
 admin-export.json
 specialexport.json
+/data/site-credentials-secret-key.txt

app/DoctrineMigrations/Version20170501115751.php

@@ -0,0 +1,61 @@
+<?php
+
+namespace Application\Migrations;
+
+use Doctrine\DBAL\Migrations\AbstractMigration;
+use Doctrine\DBAL\Schema\Schema;
+use Symfony\Component\DependencyInjection\ContainerAwareInterface;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+
+/**
+ * Add site credential table to store username & password for some website (behind authentication or paywall)
+ */
+class Version20170501115751 extends AbstractMigration implements ContainerAwareInterface
+{
+    /**
+     * @var ContainerInterface
+     */
+    private $container;
+
+    public function setContainer(ContainerInterface $container = null)
+    {
+        $this->container = $container;
+    }
+
+    private function getTable($tableName)
+    {
+        return $this->container->getParameter('database_table_prefix').$tableName;
+    }
+
+    /**
+     * @param Schema $schema
+     */
+    public function up(Schema $schema)
+    {
+        $this->skipIf($schema->hasTable($this->getTable('site_credential')), 'It seems that you already played this migration.');
+
+        $table = $schema->createTable($this->getTable('site_credential'));
+        $table->addColumn('id', 'integer', ['autoincrement' => true]);
+        $table->addColumn('user_id', 'integer');
+        $table->addColumn('host', 'string', ['length' => 255]);
+        $table->addColumn('username', 'text');
+        $table->addColumn('password', 'text');
+        $table->addColumn('createdAt', 'datetime');
+        $table->addIndex(['user_id'], 'idx_user');
+        $table->setPrimaryKey(['id']);
+        $table->addForeignKeyConstraint($this->getTable('user'), ['user_id'], ['id'], [], 'fk_user');
+
+        if ('postgresql' === $this->connection->getDatabasePlatform()->getName()) {
+            $schema->dropSequence('site_credential_id_seq');
+            $schema->createSequence('site_credential_id_seq');
+        }
+    }
+
+    /**
+     * @param Schema $schema
+     */
+    public function down(Schema $schema)
+    {
+        $schema->dropTable($this->getTable('site_credential'));
+    }
+}

app/config/parameters.yml.dist

@@ -60,6 +60,3 @@ parameters:
     redis_port: 6379
     redis_path: null
     redis_password: null
-
-    # sites credentials
-    sites_credentials: {}

app/config/wallabag.yml

@@ -26,6 +26,7 @@ wallabag_core:
     fetching_error_message: |
         wallabag can't retrieve contents for this article. Please <a href="http://doc.wallabag.org/en/user/errors_during_fetching.html#how-can-i-help-to-fix-that">troubleshoot this issue</a>.
     api_limit_mass_actions: 10
+    encryption_key_path: "%kernel.root_dir%/../data/site-credentials-secret-key.txt"
     default_internal_settings:
         -
             name: share_public

composer.json

@@ -73,7 +73,7 @@
         "kphoen/rulerz-bundle": "~0.13",
         "guzzlehttp/guzzle": "^5.3.1",
         "doctrine/doctrine-migrations-bundle": "^1.0",
-        "paragonie/random_compat": "~1.0",
+        "paragonie/random_compat": "~2.0",
         "craue/config-bundle": "~2.0",
         "mnapoli/piwik-twig-extension": "^1.0",
         "ocramius/proxy-manager": "1.*",
@@ -83,7 +83,8 @@
         "javibravo/simpleue": "^1.0",
         "symfony/dom-crawler": "^3.1",
         "friendsofsymfony/jsrouting-bundle": "^1.6",
-        "bdunogier/guzzle-site-authenticator": "^1.0.0@dev"
+        "bdunogier/guzzle-site-authenticator": "^1.0.0@dev",
+        "defuse/php-encryption": "^2.1"
     },
     "require-dev": {
         "doctrine/doctrine-fixtures-bundle": "~2.2",

src/Wallabag/CoreBundle/Command/InstallCommand.php

@@ -313,6 +313,8 @@ class InstallCommand extends ContainerAwareCommand
 
         $this
             ->runCommand('doctrine:migrations:migrate', ['--no-interaction' => true]);
+
+        return $this;
     }
 
     /**

src/Wallabag/CoreBundle/Controller/SiteCredentialController.php

@@ -0,0 +1,174 @@
+<?php
+
+namespace Wallabag\CoreBundle\Controller;
+
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Bundle\FrameworkBundle\Controller\Controller;
+use Sensio\Bundle\FrameworkExtraBundle\Configuration\Method;
+use Sensio\Bundle\FrameworkExtraBundle\Configuration\Route;
+use Wallabag\UserBundle\Entity\User;
+use Wallabag\CoreBundle\Entity\SiteCredential;
+
+/**
+ * SiteCredential controller.
+ *
+ * @Route("/site-credentials")
+ */
+class SiteCredentialController extends Controller
+{
+    /**
+     * Lists all User entities.
+     *
+     * @Route("/", name="site_credentials_index")
+     * @Method("GET")
+     */
+    public function indexAction()
+    {
+        $credentials = $this->get('wallabag_core.site_credential_repository')->findByUser($this->getUser());
+
+        return $this->render('WallabagCoreBundle:SiteCredential:index.html.twig', [
+            'credentials' => $credentials,
+        ]);
+    }
+
+    /**
+     * Creates a new site credential entity.
+     *
+     * @Route("/new", name="site_credentials_new")
+     * @Method({"GET", "POST"})
+     *
+     * @param Request $request
+     *
+     * @return \Symfony\Component\HttpFoundation\Response
+     */
+    public function newAction(Request $request)
+    {
+        $credential = new SiteCredential($this->getUser());
+
+        $form = $this->createForm('Wallabag\CoreBundle\Form\Type\SiteCredentialType', $credential);
+        $form->handleRequest($request);
+
+        if ($form->isSubmitted() && $form->isValid()) {
+            $credential->setUsername($this->get('wallabag_core.helper.crypto_proxy')->crypt($credential->getUsername()));
+            $credential->setPassword($this->get('wallabag_core.helper.crypto_proxy')->crypt($credential->getPassword()));
+
+            $em = $this->getDoctrine()->getManager();
+            $em->persist($credential);
+            $em->flush();
+
+            $this->get('session')->getFlashBag()->add(
+                'notice',
+                $this->get('translator')->trans('flashes.site_credential.notice.added', ['%host%' => $credential->getHost()])
+            );
+
+            return $this->redirectToRoute('site_credentials_index');
+        }
+
+        return $this->render('WallabagCoreBundle:SiteCredential:new.html.twig', [
+            'credential' => $credential,
+            'form' => $form->createView(),
+        ]);
+    }
+
+    /**
+     * Displays a form to edit an existing site credential entity.
+     *
+     * @Route("/{id}/edit", name="site_credentials_edit")
+     * @Method({"GET", "POST"})
+     *
+     * @param Request        $request
+     * @param SiteCredential $siteCredential
+     *
+     * @return \Symfony\Component\HttpFoundation\Response
+     */
+    public function editAction(Request $request, SiteCredential $siteCredential)
+    {
+        $this->checkUserAction($siteCredential);
+
+        $deleteForm = $this->createDeleteForm($siteCredential);
+        $editForm = $this->createForm('Wallabag\CoreBundle\Form\Type\SiteCredentialType', $siteCredential);
+        $editForm->handleRequest($request);
+
+        if ($editForm->isSubmitted() && $editForm->isValid()) {
+            $siteCredential->setUsername($this->get('wallabag_core.helper.crypto_proxy')->crypt($siteCredential->getUsername()));
+            $siteCredential->setPassword($this->get('wallabag_core.helper.crypto_proxy')->crypt($siteCredential->getPassword()));
+
+            $em = $this->getDoctrine()->getManager();
+            $em->persist($siteCredential);
+            $em->flush();
+
+            $this->get('session')->getFlashBag()->add(
+                'notice',
+                $this->get('translator')->trans('flashes.site_credential.notice.updated', ['%host%' => $siteCredential->getHost()])
+            );
+
+            return $this->redirectToRoute('site_credentials_index');
+        }
+
+        return $this->render('WallabagCoreBundle:SiteCredential:edit.html.twig', [
+            'credential' => $siteCredential,
+            'edit_form' => $editForm->createView(),
+            'delete_form' => $deleteForm->createView(),
+        ]);
+    }
+
+    /**
+     * Deletes a site credential entity.
+     *
+     * @Route("/{id}", name="site_credentials_delete")
+     * @Method("DELETE")
+     *
+     * @param Request        $request
+     * @param SiteCredential $siteCredential
+     *
+     * @return \Symfony\Component\HttpFoundation\RedirectResponse
+     */
+    public function deleteAction(Request $request, SiteCredential $siteCredential)
+    {
+        $this->checkUserAction($siteCredential);
+
+        $form = $this->createDeleteForm($siteCredential);
+        $form->handleRequest($request);
+
+        if ($form->isSubmitted() && $form->isValid()) {
+            $this->get('session')->getFlashBag()->add(
+                'notice',
+                $this->get('translator')->trans('flashes.site_credential.notice.deleted', ['%host%' => $siteCredential->getHost()])
+            );
+
+            $em = $this->getDoctrine()->getManager();
+            $em->remove($siteCredential);
+            $em->flush();
+        }
+
+        return $this->redirectToRoute('site_credentials_index');
+    }
+
+    /**
+     * Creates a form to delete a site credential entity.
+     *
+     * @param SiteCredential $siteCredential The site credential entity
+     *
+     * @return \Symfony\Component\Form\Form The form
+     */
+    private function createDeleteForm(SiteCredential $siteCredential)
+    {
+        return $this->createFormBuilder()
+            ->setAction($this->generateUrl('site_credentials_delete', ['id' => $siteCredential->getId()]))
+            ->setMethod('DELETE')
+            ->getForm()
+        ;
+    }
+
+    /**
+     * Check if the logged user can manage the given site credential.
+     *
+     * @param SiteCredential $siteCredential The site credential entity
+     */
+    private function checkUserAction(SiteCredential $siteCredential)
+    {
+        if (null === $this->getUser() || $this->getUser()->getId() != $siteCredential->getUser()->getId()) {
+            throw $this->createAccessDeniedException('You can not access this site credential.');
+        }
+    }
+}

src/Wallabag/CoreBundle/DataFixtures/ORM/LoadSiteCredentialData.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace Wallabag\CoreBundle\DataFixtures\ORM;
+
+use Doctrine\Common\DataFixtures\AbstractFixture;
+use Doctrine\Common\DataFixtures\OrderedFixtureInterface;
+use Doctrine\Common\Persistence\ObjectManager;
+use Wallabag\CoreBundle\Entity\SiteCredential;
+
+class LoadSiteCredentialData extends AbstractFixture implements OrderedFixtureInterface
+{
+    /**
+     * {@inheritdoc}
+     */
+    public function load(ObjectManager $manager)
+    {
+        $credential = new SiteCredential($this->getReference('admin-user'));
+        $credential->setHost('example.com');
+        $credential->setUsername('foo');
+        $credential->setPassword('bar');
+
+        $manager->persist($credential);
+
+        $manager->flush();
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function getOrder()
+    {
+        return 50;
+    }
+}

src/Wallabag/CoreBundle/DependencyInjection/Configuration.php

@@ -63,6 +63,8 @@ class Configuration implements ConfigurationInterface
                         ->end()
                     ->end()
                 ->end()
+                ->scalarNode('encryption_key_path')
+                ->end()
             ->end()
         ;
 

src/Wallabag/CoreBundle/DependencyInjection/WallabagCoreExtension.php

@@ -29,6 +29,7 @@ class WallabagCoreExtension extends Extension
         $container->setParameter('wallabag_core.fetching_error_message_title', $config['fetching_error_message_title']);
         $container->setParameter('wallabag_core.api_limit_mass_actions', $config['api_limit_mass_actions']);
         $container->setParameter('wallabag_core.default_internal_settings', $config['default_internal_settings']);
+        $container->setParameter('wallabag_core.site_credentials.encryption_key_path', $config['encryption_key_path']);
 
         $loader = new Loader\YamlFileLoader($container, new FileLocator(__DIR__.'/../Resources/config'));
         $loader->load('services.yml');

src/Wallabag/CoreBundle/Entity/SiteCredential.php

@@ -0,0 +1,195 @@
+<?php
+
+namespace Wallabag\CoreBundle\Entity;
+
+use Doctrine\ORM\Mapping as ORM;
+use Symfony\Component\Validator\Constraints as Assert;
+use Wallabag\UserBundle\Entity\User;
+
+/**
+ * SiteCredential.
+ *
+ * @ORM\Entity(repositoryClass="Wallabag\CoreBundle\Repository\SiteCredentialRepository")
+ * @ORM\Table(name="`site_credential`")
+ * @ORM\HasLifecycleCallbacks()
+ */
+class SiteCredential
+{
+    /**
+     * @var int
+     *
+     * @ORM\Column(name="id", type="integer")
+     * @ORM\Id
+     * @ORM\GeneratedValue(strategy="AUTO")
+     */
+    private $id;
+
+    /**
+     * @var string
+     *
+     * @Assert\NotBlank()
+     * @Assert\Length(max=255)
+     * @ORM\Column(name="host", type="string", length=255)
+     */
+    private $host;
+
+    /**
+     * @var string
+     *
+     * @Assert\NotBlank()
+     * @ORM\Column(name="username", type="text")
+     */
+    private $username;
+
+    /**
+     * @var string
+     *
+     * @Assert\NotBlank()
+     * @ORM\Column(name="password", type="text")
+     */
+    private $password;
+
+    /**
+     * @var \DateTime
+     *
+     * @ORM\Column(name="createdAt", type="datetime")
+     */
+    private $createdAt;
+
+    /**
+     * @ORM\ManyToOne(targetEntity="Wallabag\UserBundle\Entity\User", inversedBy="site_credentials")
+     */
+    private $user;
+
+    /*
+     * @param User     $user
+     */
+    public function __construct(User $user)
+    {
+        $this->user = $user;
+    }
+
+    /**
+     * Get id.
+     *
+     * @return int
+     */
+    public function getId()
+    {
+        return $this->id;
+    }
+
+    /**
+     * Set host.
+     *
+     * @param string $host
+     *
+     * @return SiteCredential
+     */
+    public function setHost($host)
+    {
+        $this->host = $host;
+
+        return $this;
+    }
+
+    /**
+     * Get host.
+     *
+     * @return string
+     */
+    public function getHost()
+    {
+        return $this->host;
+    }
+
+    /**
+     * Set username.
+     *
+     * @param string $username
+     *
+     * @return SiteCredential
+     */
+    public function setUsername($username)
+    {
+        $this->username = $username;
+
+        return $this;
+    }
+
+    /**
+     * Get username.
+     *
+     * @return string
+     */
+    public function getUsername()
+    {
+        return $this->username;
+    }
+
+    /**
+     * Set password.
+     *
+     * @param string $password
+     *
+     * @return SiteCredential
+     */
+    public function setPassword($password)
+    {
+        $this->password = $password;
+
+        return $this;
+    }
+
+    /**
+     * Get password.
+     *
+     * @return string
+     */
+    public function getPassword()
+    {
+        return $this->password;
+    }
+
+    /**
+     * Set createdAt.
+     *
+     * @param \DateTime $createdAt
+     *
+     * @return SiteCredential
+     */
+    public function setCreatedAt($createdAt)
+    {
+        $this->createdAt = $createdAt;
+
+        return $this;
+    }
+
+    /**
+     * Get createdAt.
+     *
+     * @return \DateTime
+     */
+    public function getCreatedAt()
+    {
+        return $this->createdAt;
+    }
+
+    /**
+     * @return User
+     */
+    public function getUser()
+    {
+        return $this->user;
+    }
+
+    /**
+     * @ORM\PrePersist
+     */
+    public function timestamps()
+    {
+        if (is_null($this->createdAt)) {
+            $this->createdAt = new \DateTime();
+        }
+    }
+}

src/Wallabag/CoreBundle/Form/Type/SiteCredentialType.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace Wallabag\CoreBundle\Form\Type;
+
+use Symfony\Component\Form\AbstractType;
+use Symfony\Component\Form\Extension\Core\Type\PasswordType;
+use Symfony\Component\Form\Extension\Core\Type\SubmitType;
+use Symfony\Component\Form\Extension\Core\Type\TextType;
+use Symfony\Component\Form\FormBuilderInterface;
+use Symfony\Component\OptionsResolver\OptionsResolver;
+
+class SiteCredentialType extends AbstractType
+{
+    public function buildForm(FormBuilderInterface $builder, array $options)
+    {
+        $builder
+            ->add('host', TextType::class, [
+                'label' => 'site_credential.form.host_label',
+            ])
+            ->add('username', TextType::class, [
+                'label' => 'site_credential.form.username_label',
+                'data' => '',
+            ])
+            ->add('password', PasswordType::class, [
+                'label' => 'site_credential.form.password_label',
+            ])
+            ->add('save', SubmitType::class, [
+                'label' => 'config.form.save',
+            ])
+        ;
+    }
+
+    public function configureOptions(OptionsResolver $resolver)
+    {
+        $resolver->setDefaults([
+            'data_class' => 'Wallabag\CoreBundle\Entity\SiteCredential',
+        ]);
+    }
+
+    public function getBlockPrefix()
+    {
+        return 'site_credential';
+    }
+}

src/Wallabag/CoreBundle/GuzzleSiteAuthenticator/GrabySiteConfigBuilder.php

@@ -6,6 +6,8 @@ use BD\GuzzleSiteAuthenticator\SiteConfig\SiteConfig;
 use BD\GuzzleSiteAuthenticator\SiteConfig\SiteConfigBuilder;
 use Graby\SiteConfig\ConfigBuilder;
 use Psr\Log\LoggerInterface;
+use Wallabag\CoreBundle\Repository\SiteCredentialRepository;
+use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorage;
 
 class GrabySiteConfigBuilder implements SiteConfigBuilder
 {
@@ -13,27 +15,39 @@ class GrabySiteConfigBuilder implements SiteConfigBuilder
      * @var ConfigBuilder
      */
     private $grabyConfigBuilder;
+
     /**
-     * @var array
+     * @var SiteCredentialRepository
      */
-    private $credentials;
+    private $credentialRepository;
+
     /**
      * @var LoggerInterface
      */
     private $logger;
 
+    /**
+     * @var Wallabag\UserBundle\Entity\User|null
+     */
+    private $currentUser;
+
     /**
      * GrabySiteConfigBuilder constructor.
      *
-     * @param ConfigBuilder   $grabyConfigBuilder
-     * @param array           $credentials
-     * @param LoggerInterface $logger
+     * @param ConfigBuilder            $grabyConfigBuilder
+     * @param TokenStorage             $token
+     * @param SiteCredentialRepository $credentialRepository
+     * @param LoggerInterface          $logger
      */
-    public function __construct(ConfigBuilder $grabyConfigBuilder, array $credentials, LoggerInterface $logger)
+    public function __construct(ConfigBuilder $grabyConfigBuilder, TokenStorage $token, SiteCredentialRepository $credentialRepository, LoggerInterface $logger)
     {
         $this->grabyConfigBuilder = $grabyConfigBuilder;
-        $this->credentials = $credentials;
+        $this->credentialRepository = $credentialRepository;
         $this->logger = $logger;
+
+        if ($token->getToken()) {
+            $this->currentUser = $token->getToken()->getUser();
+        }
     }
 
     /**
@@ -47,7 +61,12 @@ class GrabySiteConfigBuilder implements SiteConfigBuilder
             $host = substr($host, 4);
         }
 
-        if (empty($this->credentials[$host])) {
+        $credentials = null;
+        if ($this->currentUser) {
+            $credentials = $this->credentialRepository->findOneByHostAndUser($host, $this->currentUser->getId());
+        }
+
+        if (null === $credentials) {
             $this->logger->debug('Auth: no credentials available for host.', ['host' => $host]);
 
             return false;
@@ -62,13 +81,14 @@ class GrabySiteConfigBuilder implements SiteConfigBuilder
             'passwordField' => $config->login_password_field ?: null,
             'extraFields' => $this->processExtraFields($config->login_extra_fields),
             'notLoggedInXpath' => $config->not_logged_in_xpath ?: null,
-            'username' => $this->credentials[$host]['username'],
-            'password' => $this->credentials[$host]['password'],
+            'username' => $credentials['username'],
+            'password' => $credentials['password'],
         ];
 
         $config = new SiteConfig($parameters);
 
-        // do not leak password in log
+        // do not leak usernames and passwords in log
+        $parameters['username'] = '**masked**';
         $parameters['password'] = '**masked**';
 
         $this->logger->debug('Auth: add parameters.', ['host' => $host, 'parameters' => $parameters]);

src/Wallabag/CoreBundle/Helper/CryptoProxy.php

@@ -0,0 +1,86 @@
+<?php
+
+namespace Wallabag\CoreBundle\Helper;
+
+use Psr\Log\LoggerInterface;
+use Defuse\Crypto\Key;
+use Defuse\Crypto\Crypto;
+use Defuse\Crypto\Exception\WrongKeyOrModifiedCiphertextException;
+
+/**
+ * This is a proxy to crypt and decrypt password used by SiteCredential entity.
+ * BTW, It might be re-use for sth else.
+ */
+class CryptoProxy
+{
+    private $logger;
+    private $encryptionKey;
+
+    public function __construct($encryptionKeyPath, LoggerInterface $logger)
+    {
+        $this->logger = $logger;
+
+        if (!file_exists($encryptionKeyPath)) {
+            $key = Key::createNewRandomKey();
+
+            file_put_contents($encryptionKeyPath, $key->saveToAsciiSafeString());
+            chmod($encryptionKeyPath, 0600);
+        }
+
+        $this->encryptionKey = file_get_contents($encryptionKeyPath);
+    }
+
+    /**
+     * Ensure the given value will be crypted.
+     *
+     * @param string $secretValue Secret valye to crypt
+     *
+     * @return string
+     */
+    public function crypt($secretValue)
+    {
+        $this->logger->debug('Crypto: crypting value: '.$this->mask($secretValue));
+
+        return Crypto::encrypt($secretValue, $this->loadKey());
+    }
+
+    /**
+     * Ensure the given crypted value will be decrypted.
+     *
+     * @param string $cryptedValue The value to be decrypted
+     *
+     * @return string
+     */
+    public function decrypt($cryptedValue)
+    {
+        $this->logger->debug('Crypto: decrypting value: '.$this->mask($cryptedValue));
+
+        try {
+            return Crypto::decrypt($cryptedValue, $this->loadKey());
+        } catch (WrongKeyOrModifiedCiphertextException $e) {
+            throw new \RuntimeException('Decrypt fail: '.$e->getMessage());
+        }
+    }
+
+    /**
+     * Load the private key.
+     *
+     * @return Key
+     */
+    private function loadKey()
+    {
+        return Key::loadFromAsciiSafeString($this->encryptionKey);
+    }
+
+    /**
+     * Keep first and last character and put some stars in between.
+     *
+     * @param string $value Value to mask
+     *
+     * @return string
+     */
+    private function mask($value)
+    {
+        return strlen($value) > 0 ? $value[0].'*****'.$value[strlen($value) - 1] : 'Empty value';
+    }
+}

src/Wallabag/CoreBundle/Repository/SiteCredentialRepository.php

@@ -0,0 +1,47 @@
+<?php
+
+namespace Wallabag\CoreBundle\Repository;
+
+use Wallabag\CoreBundle\Helper\CryptoProxy;
+
+/**
+ * SiteCredentialRepository.
+ */
+class SiteCredentialRepository extends \Doctrine\ORM\EntityRepository
+{
+    private $cryptoProxy;
+
+    public function setCrypto(CryptoProxy $cryptoProxy)
+    {
+        $this->cryptoProxy = $cryptoProxy;
+    }
+
+    /**
+     * Retrieve one username/password for the given host and userId.
+     *
+     * @param string $host
+     * @param int    $userId
+     *
+     * @return null|array
+     */
+    public function findOneByHostAndUser($host, $userId)
+    {
+        $res = $this->createQueryBuilder('s')
+            ->select('s.username', 's.password')
+            ->where('s.host = :hostname')->setParameter('hostname', $host)
+            ->andWhere('s.user = :userId')->setParameter('userId', $userId)
+            ->setMaxResults(1)
+            ->getQuery()
+            ->getOneOrNullResult();
+
+        if (null === $res) {
+            return;
+        }
+
+        // decrypt user & password before returning them
+        $res['username'] = $this->cryptoProxy->decrypt($res['username']);
+        $res['password'] = $this->cryptoProxy->decrypt($res['password']);
+
+        return $res;
+    }
+}

src/Wallabag/CoreBundle/Resources/config/services.yml

@@ -63,7 +63,8 @@ services:
         class: Wallabag\CoreBundle\GuzzleSiteAuthenticator\GrabySiteConfigBuilder
         arguments:
             - "@wallabag_core.graby.config_builder"
-            - "%sites_credentials%"
+            - "@security.token_storage"
+            - "@wallabag_core.site_credential_repository"
             - '@logger'
         tags:
             - { name: monolog.logger, channel: graby }
@@ -120,6 +121,14 @@ services:
         arguments:
             - WallabagCoreBundle:Tag
 
+    wallabag_core.site_credential_repository:
+        class: Wallabag\CoreBundle\Repository\SiteCredentialRepository
+        factory: [ "@doctrine.orm.default_entity_manager", getRepository ]
+        arguments:
+            - WallabagCoreBundle:SiteCredential
+        calls:
+            - [ setCrypto, [ "@wallabag_core.helper.crypto_proxy" ] ]
+
     wallabag_core.helper.entries_export:
         class: Wallabag\CoreBundle\Helper\EntriesExport
         arguments:
@@ -201,3 +210,9 @@ services:
 
     wallabag_core.entry.download_images.client:
         class: GuzzleHttp\Client
+
+    wallabag_core.helper.crypto_proxy:
+        class: Wallabag\CoreBundle\Helper\CryptoProxy
+        arguments:
+            - "%wallabag_core.site_credentials.encryption_key_path%"
+            - "@logger"

src/Wallabag/CoreBundle/Resources/translations/messages.da.yml

@@ -32,6 +32,7 @@ menu:
         # save_link: 'Save a link'
         back_to_unread: 'Tilbage til de ulæste artikler'
         # users_management: 'Users management'
+        # site_credentials: 'Site credentials'
     top:
         add_new_entry: 'Tilføj ny artikel'
         search: 'Søg'
@@ -520,6 +521,26 @@ user:
     search:
         # placeholder: Filter by username or email
 
+site_credential:
+    # page_title: Site credentials management
+    # new_site_credential: Create a credential
+    # edit_site_credential: Edit an existing credential
+    # description: "Here you can manage all credentials for sites which required them (create, edit and delete), like a paywall, an authentication, etc."
+    # list:
+    #     actions: Actions
+    #     edit_action: Edit
+    #     yes: Yes
+    #     no: No
+    #     create_new_one: Create a new credential
+    # form:
+    #     username_label: 'Username'
+    #     host_label: 'Host'
+    #     password_label: 'Password'
+    #     save: Save
+    #     delete: Delete
+    #     delete_confirm: Are you sure?
+    #     back_to_list: Back to list
+
 error:
     # page_title: An error occurred
 
@@ -572,3 +593,8 @@ flashes:
             # added: 'User "%username%" added'
             # updated: 'User "%username%" updated'
             # deleted: 'User "%username%" deleted'
+    site_credential:
+        notice:
+            # added: 'Site credential for "%host%" added'
+            # updated: 'Site credential for "%host%" updated'
+            # deleted: 'Site credential for "%host%" deleted'

src/Wallabag/CoreBundle/Resources/translations/messages.de.yml

@@ -32,6 +32,7 @@ menu:
         save_link: 'Link speichern'
         back_to_unread: 'Zurück zu ungelesenen Artikeln'
         users_management: 'Benutzerverwaltung'
+        # site_credentials: 'Site credentials'
     top:
         add_new_entry: 'Neuen Artikel hinzufügen'
         search: 'Suche'
@@ -521,6 +522,26 @@ user:
     search:
         placeholder: Filtere nach Benutzer oder E-Mail-Adresse
 
+site_credential:
+    # page_title: Site credentials management
+    # new_site_credential: Create a credential
+    # edit_site_credential: Edit an existing credential
+    # description: "Here you can manage all credentials for sites which required them (create, edit and delete), like a paywall, an authentication, etc."
+    list:
+        actions: Aktionen
+        edit_action: Bearbeiten
+        yes: Ja
+        no: Nein
+        # create_new_one: Create a new credential
+    form:
+        # username_label: 'Username'
+        # host_label: 'Host'
+        # password_label: 'Password'
+        save: Speichern
+        delete: Löschen
+        delete_confirm: Bist du sicher?
+        back_to_list: Zurück zur Liste
+
 error:
     page_title: Ein Fehler ist aufgetreten
 
@@ -573,3 +594,8 @@ flashes:
             added: 'Benutzer "%username%" hinzugefügt'
             updated: 'Benutzer "%username%" aktualisiert'
             deleted: 'Benutzer "%username%" gelöscht'
+    site_credential:
+        notice:
+            # added: 'Site credential for "%host%" added'
+            # updated: 'Site credential for "%host%" updated'
+            # deleted: 'Site credential for "%host%" deleted'

src/Wallabag/CoreBundle/Resources/translations/messages.en.yml

@@ -32,6 +32,7 @@ menu:
         save_link: 'Save a link'
         back_to_unread: 'Back to unread articles'
         users_management: 'Users management'
+        site_credentials: 'Site credentials'
     top:
         add_new_entry: 'Add a new entry'
         search: 'Search'
@@ -521,6 +522,26 @@ user:
     search:
         placeholder: Filter by username or email
 
+site_credential:
+    page_title: Site credentials management
+    new_site_credential: Create a credential
+    edit_site_credential: Edit an existing credential
+    description: "Here you can manage all credentials for sites which required them (create, edit and delete), like a paywall, an authentication, etc."
+    list:
+        actions: Actions
+        edit_action: Edit
+        yes: Yes
+        no: No
+        create_new_one: Create a new credential
+    form:
+        username_label: 'Username'
+        host_label: 'Host'
+        password_label: 'Password'
+        save: Save
+        delete: Delete
+        delete_confirm: Are you sure?
+        back_to_list: Back to list
+
 error:
     page_title: An error occurred
 
@@ -573,3 +594,8 @@ flashes:
             added: 'User "%username%" added'
             updated: 'User "%username%" updated'
             deleted: 'User "%username%" deleted'
+    site_credential:
+        notice:
+            added: 'Site credential for "%host%" added'
+            updated: 'Site credential for "%host%" updated'
+            deleted: 'Site credential for "%host%" deleted'

src/Wallabag/CoreBundle/Resources/translations/messages.es.yml

@@ -32,6 +32,7 @@ menu:
         save_link: 'Guardar un enlace'
         back_to_unread: 'Volver a los artículos sin leer'
         users_management: 'Configuración de usuarios'
+        # site_credentials: 'Site credentials'
     top:
         add_new_entry: 'Añadir un nuevo artículo'
         search: 'Buscar'
@@ -521,6 +522,26 @@ user:
     search:
         # placeholder: Filter by username or email
 
+site_credential:
+    # page_title: Site credentials management
+    # new_site_credential: Create a credential
+    # edit_site_credential: Edit an existing credential
+    # description: "Here you can manage all credentials for sites which required them (create, edit and delete), like a paywall, an authentication, etc."
+    # list:
+    #     actions: Actions
+    #     edit_action: Edit
+    #     yes: Yes
+    #     no: No
+    #     create_new_one: Create a new credential
+    # form:
+    #     username_label: 'Username'
+    #     host_label: 'Host'
+    #     password_label: 'Password'
+    #     save: Save
+    #     delete: Delete
+    #     delete_confirm: Are you sure?
+    #     back_to_list: Back to list
+
 error:
     page_title: Ha ocurrido un error
 
@@ -573,3 +594,8 @@ flashes:
             added: 'Añadido el usuario "%username%"'
             updated: 'Actualizado el usuario "%username%"'
             deleted: 'Eliminado el usuario "%username%"'
+    site_credential:
+        notice:
+            # added: 'Site credential for "%host%" added'
+            # updated: 'Site credential for "%host%" updated'
+            # deleted: 'Site credential for "%host%" deleted'

src/Wallabag/CoreBundle/Resources/translations/messages.fa.yml

@@ -32,6 +32,7 @@ menu:
         save_link: 'ذخیرهٔ یک پیوند'
         back_to_unread: 'بازگشت به خوانده‌نشده‌ها'
         # users_management: 'Users management'
+        # site_credentials: 'Site credentials'
     top:
         add_new_entry: 'افزودن مقالهٔ تازه'
         search: 'جستجو'
@@ -521,6 +522,26 @@ user:
     search:
         # placeholder: Filter by username or email
 
+site_credential:
+    # page_title: Site credentials management
+    # new_site_credential: Create a credential
+    # edit_site_credential: Edit an existing credential
+    # description: "Here you can manage all credentials for sites which required them (create, edit and delete), like a paywall, an authentication, etc."
+    # list:
+    #     actions: Actions
+    #     edit_action: Edit
+    #     yes: Yes
+    #     no: No
+    #     create_new_one: Create a new credential
+    # form:
+    #     username_label: 'Username'
+    #     host_label: 'Host'
+    #     password_label: 'Password'
+    #     save: Save
+    #     delete: Delete
+    #     delete_confirm: Are you sure?
+    #     back_to_list: Back to list
+
 error:
     # page_title: An error occurred
 
@@ -573,3 +594,8 @@ flashes:
             # added: 'User "%username%" added'
             # updated: 'User "%username%" updated'
             # deleted: 'User "%username%" deleted'
+    site_credential:
+        notice:
+            # added: 'Site credential for "%host%" added'
+            # updated: 'Site credential for "%host%" updated'
+            # deleted: 'Site credential for "%host%" deleted'

src/Wallabag/CoreBundle/Resources/translations/messages.fr.yml

@@ -32,6 +32,7 @@ menu:
         save_link: "Sauvegarder un nouvel article"
         back_to_unread: "Retour aux articles non lus"
         users_management: "Gestion des utilisateurs"
+        site_credentials: 'Accès aux sites'
     top:
         add_new_entry: "Sauvegarder un nouvel article"
         search: "Rechercher"
@@ -516,11 +517,31 @@ user:
         twofactor_label: "Double authentification"
         save: "Sauvegarder"
         delete: "Supprimer"
-        delete_confirm: "Voulez-vous vraiment ?"
+        delete_confirm: "Êtes-vous sûr ?"
         back_to_list: "Revenir à la liste"
     search:
         placeholder: "Filtrer par nom d’utilisateur ou email"
 
+site_credential:
+    page_title: Gestion des accès aux sites
+    new_site_credential: Créer un accès à un site
+    edit_site_credential: Éditer l'accès d'un site
+    description: "Ici vous pouvez gérer les accès aux différents sites. Ces accès permettent de récupérer des contenus sur des sites qui requièrent une authentification ou un paywall"
+    list:
+        actions: Actions
+        edit_action: Éditer
+        yes: Oui
+        no: Non
+        create_new_one: Créer un nouvel accès à un site
+    form:
+        username_label: 'Identifiant'
+        host_label: 'Domaine'
+        password_label: 'Mot de passe'
+        save: "Sauvegarder"
+        delete: "Supprimer"
+        delete_confirm: "Êtes-vous sûr ?"
+        back_to_list: "Revenir à la liste"
+
 error:
     page_title: "Une erreur est survenue"
 
@@ -570,6 +591,11 @@ flashes:
             client_deleted: "Client %name% supprimé"
     user:
         notice:
-            added: "Utilisateur \"%username%\" ajouté"
-            updated: "Utilisateur \"%username%\" mis à jour"
-            deleted: "Utilisateur \"%username%\" supprimé"
+            added: 'Utilisateur "%username%" ajouté'
+            updated: 'Utilisateur "%username%" mis à jour'
+            deleted: 'Utilisateur "%username%" supprimé'
+    site_credential:
+        notice:
+            added: 'Accès au site "%host%" ajouté'
+            updated: 'Accès au site "%host%" mis à jour'
+            deleted: 'Accès au site "%host%" supprimé'

src/Wallabag/CoreBundle/Resources/translations/messages.it.yml

@@ -32,6 +32,7 @@ menu:
         save_link: 'Salva collegamento'
         back_to_unread: 'Torna ai contenuti non letti'
         # users_management: 'Users management'
+        # site_credentials: 'Site credentials'
     top:
         add_new_entry: 'Aggiungi un nuovo contenuto'
         search: 'Cerca'
@@ -521,6 +522,26 @@ user:
     search:
         # placeholder: Filter by username or email
 
+site_credential:
+    # page_title: Site credentials management
+    # new_site_credential: Create a credential
+    # edit_site_credential: Edit an existing credential
+    # description: "Here you can manage all credentials for sites which required them (create, edit and delete), like a paywall, an authentication, etc."
+    # list:
+    #     actions: Actions
+    #     edit_action: Edit
+    #     yes: Yes
+    #     no: No
+    #     create_new_one: Create a new credential
+    # form:
+    #     username_label: 'Username'
+    #     host_label: 'Host'
+    #     password_label: 'Password'
+    #     save: Save
+    #     delete: Delete
+    #     delete_confirm: Are you sure?
+    #     back_to_list: Back to list
+
 error:
     # page_title: An error occurred
 
@@ -573,3 +594,8 @@ flashes:
             # added: 'User "%username%" added'
             # updated: 'User "%username%" updated'
             # deleted: 'User "%username%" deleted'
+    site_credential:
+        notice:
+            # added: 'Site credential for "%host%" added'
+            # updated: 'Site credential for "%host%" updated'
+            # deleted: 'Site credential for "%host%" deleted'

src/Wallabag/CoreBundle/Resources/translations/messages.oc.yml

@@ -32,6 +32,7 @@ menu:
         save_link: 'Enregistrar un novèl article'
         back_to_unread: 'Tornar als articles pas legits'
         users_management: 'Gestion dels utilizaires'
+        # site_credentials: 'Site credentials'
     top:
         add_new_entry: 'Enregistrar un novèl article'
         search: 'Cercar'
@@ -521,6 +522,26 @@ user:
     search:
         placeholder: "Filtrar per nom d'utilizaire o corrièl"
 
+site_credential:
+    # page_title: Site credentials management
+    # new_site_credential: Create a credential
+    # edit_site_credential: Edit an existing credential
+    # description: "Here you can manage all credentials for sites which required them (create, edit and delete), like a paywall, an authentication, etc."
+    list:
+         actions: 'Accions'
+         edit_action: 'Modificar'
+         yes: 'Òc'
+         no: 'Non'
+        # create_new_one: Create a new credential
+    form:
+        # username_label: 'Username'
+        # host_label: 'Host'
+        # password_label: 'Password'
+        save: 'Enregistrar'
+        delete: 'Suprimir'
+        delete_confirm: 'Sètz segur ?'
+        back_to_list: 'Tornar a la lista'
+
 error:
     page_title: Una error s'es produsida
 
@@ -573,3 +594,8 @@ flashes:
             added: 'Utilizaire "%username%" ajustat'
             updated: 'Utilizaire "%username%" mes a jorn'
             deleted: 'Utilizaire "%username%" suprimit'
+    site_credential:
+        notice:
+            # added: 'Site credential for "%host%" added'
+            # updated: 'Site credential for "%host%" updated'
+            # deleted: 'Site credential for "%host%" deleted'

src/Wallabag/CoreBundle/Resources/translations/messages.pl.yml

@@ -32,6 +32,7 @@ menu:
         save_link: 'Zapisz link'
         back_to_unread: 'Powrót do nieprzeczytanych artykułów'
         users_management: 'Zarządzanie użytkownikami'
+        # site_credentials: 'Site credentials'
     top:
         add_new_entry: 'Dodaj nowy wpis'
         search: 'Szukaj'
@@ -521,6 +522,26 @@ user:
     search:
         placeholder: Filtruj po nazwie użytkownika lub adresie e-mail
 
+site_credential:
+    # page_title: Site credentials management
+    # new_site_credential: Create a credential
+    # edit_site_credential: Edit an existing credential
+    # description: "Here you can manage all credentials for sites which required them (create, edit and delete), like a paywall, an authentication, etc."
+    list:
+        actions: Akcje
+        edit_action: Edytuj
+        yes: Tak
+        no: Nie
+        # create_new_one: Create a new credential
+    form:
+        # username_label: 'Username'
+        # host_label: 'Host'
+        # password_label: 'Password'
+        save: Zapisz
+        delete: Usuń
+        delete_confirm: Jesteś pewien?
+        back_to_list: Powrót do listy
+
 error:
     page_title: Wystąpił błąd
 
@@ -573,3 +594,8 @@ flashes:
             added: 'Użytkownik "%username%" dodany'
             updated: 'Użytkownik "%username%" zaktualizowany'
             deleted: 'Użytkownik "%username%" usunięty'
+    site_credential:
+        notice:
+            # added: 'Site credential for "%host%" added'
+            # updated: 'Site credential for "%host%" updated'
+            # deleted: 'Site credential for "%host%" deleted'

src/Wallabag/CoreBundle/Resources/translations/messages.pt.yml

@@ -32,6 +32,7 @@ menu:
         save_link: 'Salvar um link'
         back_to_unread: 'Voltar para os artigos não lidos'
         users_management: 'Gestão de Usuários'
+        # site_credentials: 'Site credentials'
     top:
         add_new_entry: 'Adicionar uma nova entrada'
         search: 'Pesquisa'
@@ -521,6 +522,26 @@ user:
     search:
         # placeholder: Filter by username or email
 
+site_credential:
+    # page_title: Site credentials management
+    # new_site_credential: Create a credential
+    # edit_site_credential: Edit an existing credential
+    # description: "Here you can manage all credentials for sites which required them (create, edit and delete), like a paywall, an authentication, etc."
+    list:
+        actions: 'Ações'
+        edit_action: 'Editar'
+        yes: 'Sim'
+        no: 'Não'
+        # create_new_one: Create a new credential
+    form:
+        # username_label: 'Username'
+        # host_label: 'Host'
+        # password_label: 'Password'
+        save: 'Salvar'
+        delete: 'Apagar'
+        delete_confirm: 'Tem certeza?'
+        back_to_list: 'Voltar para a lista'
+
 error:
     # page_title: An error occurred
 
@@ -573,3 +594,8 @@ flashes:
             added: 'Usuário "%username%" adicionado'
             updated: 'Usuário "%username%" atualizado'
             deleted: 'Usuário "%username%" removido'
+    site_credential:
+        notice:
+            # added: 'Site credential for "%host%" added'
+            # updated: 'Site credential for "%host%" updated'
+            # deleted: 'Site credential for "%host%" deleted'

src/Wallabag/CoreBundle/Resources/translations/messages.ro.yml

@@ -32,6 +32,7 @@ menu:
         # save_link: 'Save a link'
         back_to_unread: 'Înapoi la articolele necitite'
         # users_management: 'Users management'
+        # site_credentials: 'Site credentials'
     top:
         add_new_entry: 'Introdu un nou articol'
         search: 'Căutare'
@@ -521,6 +522,26 @@ user:
     search:
         # placeholder: Filter by username or email
 
+site_credential:
+    # page_title: Site credentials management
+    # new_site_credential: Create a credential
+    # edit_site_credential: Edit an existing credential
+    # description: "Here you can manage all credentials for sites which required them (create, edit and delete), like a paywall, an authentication, etc."
+    # list:
+    #     actions: Actions
+    #     edit_action: Edit
+    #     yes: Yes
+    #     no: No
+    #     create_new_one: Create a new credential
+    # form:
+    #     username_label: 'Username'
+    #     host_label: 'Host'
+    #     password_label: 'Password'
+    #     save: Save
+    #     delete: Delete
+    #     delete_confirm: Are you sure?
+    #     back_to_list: Back to list
+
 error:
     # page_title: An error occurred
 
@@ -573,3 +594,8 @@ flashes:
             # added: 'User "%username%" added'
             # updated: 'User "%username%" updated'
             # deleted: 'User "%username%" deleted'
+    site_credential:
+        notice:
+            # added: 'Site credential for "%host%" added'
+            # updated: 'Site credential for "%host%" updated'
+            # deleted: 'Site credential for "%host%" deleted'

src/Wallabag/CoreBundle/Resources/translations/messages.tr.yml

@@ -32,6 +32,7 @@ menu:
         # save_link: 'Save a link'
         back_to_unread: 'Okunmayan makalelere geri dön'
         # users_management: 'Users management'
+        # site_credentials: 'Site credentials'
     top:
         add_new_entry: 'Yeni bir makale ekle'
         search: 'Ara'
@@ -571,3 +572,8 @@ flashes:
             # added: 'User "%username%" added'
             # updated: 'User "%username%" updated'
             # deleted: 'User "%username%" deleted'
+    site_credential:
+        notice:
+            # added: 'Site credential for "%host%" added'
+            # updated: 'Site credential for "%host%" updated'
+            # deleted: 'Site credential for "%host%" deleted'

src/Wallabag/CoreBundle/Resources/views/themes/baggy/SiteCredential/edit.html.twig

@@ -0,0 +1,60 @@
+{% extends "WallabagCoreBundle::layout.html.twig" %}
+
+{% block title %}{{ 'site_credential.page_title'|trans }}{% endblock %}
+
+{% block content %}
+
+    <div class="row">
+        <div class="col s12">
+            <div class="card-panel">
+                <div class="row">
+                    <div class="input-field col s12">
+                        <h4>{{ 'site_credential.edit_site_credential'|trans }}</h4>
+
+                        <div id="set6" class="col s12">
+                            {{ form_start(edit_form) }}
+                                {{ form_errors(edit_form) }}
+
+                                <div class="row">
+                                    <div class="input-field col s12">
+                                        {{ form_label(edit_form.host) }}
+                                        {{ form_errors(edit_form.host) }}
+                                        {{ form_widget(edit_form.host) }}
+                                    </div>
+                                </div>
+
+                                <div class="row">
+                                    <div class="input-field col s12">
+                                        {{ form_label(edit_form.username) }}
+                                        {{ form_errors(edit_form.username) }}
+                                        {{ form_widget(edit_form.username) }}
+                                    </div>
+                                </div>
+
+                                <div class="row">
+                                    <div class="input-field col s12">
+                                        {{ form_label(edit_form.password) }}
+                                        {{ form_errors(edit_form.password) }}
+                                        {{ form_widget(edit_form.password) }}
+                                    </div>
+                                </div>
+
+                                <br/>
+
+                                {{ form_widget(edit_form.save, {'attr': {'class': 'btn waves-effect waves-light'}}) }}
+                                {{ form_widget(edit_form._token) }}
+                            </form>
+                            <p>
+                                {{ form_start(delete_form) }}
+                                    <button onclick="return confirm('{{ 'site_credential.form.delete_confirm'|trans|escape('js') }}')" type="submit" class="btn waves-effect waves-light red">{{ 'site_credential.form.delete'|trans }}</button>
+                                {{ form_end(delete_form) }}
+                            </p>
+                            <p><a class="waves-effect waves-light btn blue-grey" href="{{ path('site_credentials_index') }}">{{ 'site_credential.form.back_to_list'|trans }}</a></p>
+                        </div>
+                    </div>
+                </div>
+            </div>
+        </div>
+    </div>
+
+{% endblock %}

src/Wallabag/CoreBundle/Resources/views/themes/baggy/SiteCredential/index.html.twig

@@ -0,0 +1,42 @@
+{% extends "WallabagCoreBundle::layout.html.twig" %}
+
+{% block title %}{{ 'site_credential.page_title'|trans }}{% endblock %}
+
+{% block content %}
+
+    <div class="row">
+        <div class="col s12">
+            <div class="card-panel">
+                <div class="row">
+                    <div class="input-field col s12">
+                        <p class="help">{{ 'site_credential.description'|trans|raw }}</p>
+
+                        <table class="bordered">
+                            <thead>
+                                <tr>
+                                    <th>{{ 'site_credential.form.host_label'|trans }}</th>
+                                    <th>{{ 'site_credential.list.actions'|trans }}</th>
+                                </tr>
+                            </thead>
+                            <tbody>
+                            {% for credential in credentials %}
+                                <tr>
+                                    <td>{{ credential.host }}</td>
+                                    <td>
+                                        <a href="{{ path('site_credentials_edit', { 'id': credential.id }) }}">{{ 'site_credential.list.edit_action'|trans }}</a>
+                                    </td>
+                                </tr>
+                            {% endfor %}
+                            </tbody>
+                        </table>
+                        <br />
+                        <p>
+                            <a href="{{ path('site_credentials_new') }}" class="waves-effect waves-light btn">{{ 'site_credential.list.create_new_one'|trans }}</a>
+                        </p>
+                    </div>
+                </div>
+            </div>
+        </div>
+    </div>
+
+{% endblock %}

src/Wallabag/CoreBundle/Resources/views/themes/baggy/SiteCredential/new.html.twig

@@ -0,0 +1,53 @@
+{% extends "WallabagCoreBundle::layout.html.twig" %}
+
+{% block title %}{{ 'site_credential.page_title'|trans }}{% endblock %}
+
+{% block content %}
+
+    <div class="row">
+        <div class="col s12">
+            <div class="card-panel">
+                <div class="row">
+                    <div class="input-field col s12">
+                        <h4>{{ 'site_credential.new_site_credential'|trans }}</h4>
+
+                        <div id="set6" class="col s12">
+                            {{ form_start(form) }}
+                                {{ form_errors(form) }}
+
+                                <div class="row">
+                                    <div class="input-field col s12">
+                                        {{ form_label(form.host) }}
+                                        {{ form_errors(form.host) }}
+                                        {{ form_widget(form.host) }}
+                                    </div>
+                                </div>
+
+                                <div class="row">
+                                    <div class="input-field col s12">
+                                        {{ form_label(form.username) }}
+                                        {{ form_errors(form.username) }}
+                                        {{ form_widget(form.username) }}
+                                    </div>
+                                </div>
+
+                                <div class="row">
+                                    <div class="input-field col s12">
+                                        {{ form_label(form.password) }}
+                                        {{ form_errors(form.password) }}
+                                        {{ form_widget(form.password) }}
+                                    </div>
+                                </div>
+
+                                {{ form_widget(form.save, {'attr': {'class': 'btn waves-effect waves-light'}}) }}
+                                {{ form_rest(form) }}
+                            </form>
+                            <p><a class="waves-effect waves-light btn blue-grey" href="{{ path('site_credentials_index') }}">{{ 'site_credential.form.back_to_list'|trans }}</a></p>
+                        </div>
+                    </div>
+                </div>
+            </div>
+        </div>
+    </div>
+
+{% endblock %}

src/Wallabag/CoreBundle/Resources/views/themes/baggy/layout.html.twig

@@ -38,6 +38,9 @@
                 {{ render(controller("WallabagCoreBundle:Entry:searchForm", {'currentRoute': app.request.attributes.get('_route')})) }}
             </div>
         </li>
+        {% if craue_setting('restricted_access') %}
+        <li class="menu site_credentials"><a href="{{ path('site_credentials_index') }}">{{ 'menu.left.site_credentials'|trans }}</a></li>
+        {% endif %}
         <li class="menu config"><a href="{{ path('config') }}">{{ 'menu.left.config'|trans }}</a></li>
         {% if is_granted('ROLE_SUPER_ADMIN') %}
             <li class="menu users"><a href="{{ path('user_index') }}">{{ 'menu.left.users_management'|trans }}</a></li>

src/Wallabag/CoreBundle/Resources/views/themes/material/Config/index.html.twig

@@ -66,13 +66,13 @@
                                 </div>
                             </div>
 
-                        <div class="row">
-                            <div class="input-field col s12">
-                                {{ form_errors(form.config.action_mark_as_read) }}
-                                {{ form_widget(form.config.action_mark_as_read) }}
-                                {{ form_label(form.config.action_mark_as_read) }}
+                            <div class="row">
+                                <div class="input-field col s12">
+                                    {{ form_label(form.config.action_mark_as_read) }}
+                                    {{ form_errors(form.config.action_mark_as_read) }}
+                                    {{ form_widget(form.config.action_mark_as_read) }}
+                                </div>
                             </div>
-                        </div>
 
                             <div class="row">
                                 <div class="input-field col s11">
@@ -254,11 +254,11 @@
                         {{ form_start(form.pwd) }}
                             {{ form_errors(form.pwd) }}
 
-                        <div class="row">
-                            <div class="input-field col s12">
-                                {{ 'config.form_password.description'|trans }}
+                            <div class="row">
+                                <div class="input-field col s12">
+                                    {{ 'config.form_password.description'|trans }}
+                                </div>
                             </div>
-                        </div>
 
                             <div class="row">
                                 <div class="input-field col s12">

src/Wallabag/CoreBundle/Resources/views/themes/material/SiteCredential/edit.html.twig

@@ -0,0 +1,60 @@
+{% extends "WallabagCoreBundle::layout.html.twig" %}
+
+{% block title %}{{ 'site_credential.page_title'|trans }}{% endblock %}
+
+{% block content %}
+
+    <div class="row">
+        <div class="col s12">
+            <div class="card-panel">
+                <div class="row">
+                    <div class="input-field col s12">
+                        <h4>{{ 'site_credential.edit_site_credential'|trans }}</h4>
+
+                        <div id="set6" class="col s12">
+                            {{ form_start(edit_form) }}
+                                {{ form_errors(edit_form) }}
+
+                                <div class="row">
+                                    <div class="input-field col s12">
+                                        {{ form_label(edit_form.host) }}
+                                        {{ form_errors(edit_form.host) }}
+                                        {{ form_widget(edit_form.host) }}
+                                    </div>
+                                </div>
+
+                                <div class="row">
+                                    <div class="input-field col s12">
+                                        {{ form_label(edit_form.username) }}
+                                        {{ form_errors(edit_form.username) }}
+                                        {{ form_widget(edit_form.username) }}
+                                    </div>
+                                </div>
+
+                                <div class="row">
+                                    <div class="input-field col s12">
+                                        {{ form_label(edit_form.password) }}
+                                        {{ form_errors(edit_form.password) }}
+                                        {{ form_widget(edit_form.password) }}
+                                    </div>
+                                </div>
+
+                                <br/>
+
+                                {{ form_widget(edit_form.save, {'attr': {'class': 'btn waves-effect waves-light'}}) }}
+                                {{ form_widget(edit_form._token) }}
+                            </form>
+                            <p>
+                                {{ form_start(delete_form) }}
+                                    <button onclick="return confirm('{{ 'site_credential.form.delete_confirm'|trans|escape('js') }}')" type="submit" class="btn waves-effect waves-light red">{{ 'site_credential.form.delete'|trans }}</button>
+                                {{ form_end(delete_form) }}
+                            </p>
+                            <p><a class="waves-effect waves-light btn blue-grey" href="{{ path('site_credentials_index') }}">{{ 'site_credential.form.back_to_list'|trans }}</a></p>
+                        </div>
+                    </div>
+                </div>
+            </div>
+        </div>
+    </div>
+
+{% endblock %}

src/Wallabag/CoreBundle/Resources/views/themes/material/SiteCredential/index.html.twig

@@ -0,0 +1,42 @@
+{% extends "WallabagCoreBundle::layout.html.twig" %}
+
+{% block title %}{{ 'site_credential.page_title'|trans }}{% endblock %}
+
+{% block content %}
+
+    <div class="row">
+        <div class="col s12">
+            <div class="card-panel">
+                <div class="row">
+                    <div class="input-field col s12">
+                        <p class="help">{{ 'site_credential.description'|trans|raw }}</p>
+
+                        <table class="bordered">
+                            <thead>
+                                <tr>
+                                    <th>{{ 'site_credential.form.host_label'|trans }}</th>
+                                    <th>{{ 'site_credential.list.actions'|trans }}</th>
+                                </tr>
+                            </thead>
+                            <tbody>
+                            {% for credential in credentials %}
+                                <tr>
+                                    <td>{{ credential.host }}</td>
+                                    <td>
+                                        <a href="{{ path('site_credentials_edit', { 'id': credential.id }) }}">{{ 'site_credential.list.edit_action'|trans }}</a>
+                                    </td>
+                                </tr>
+                            {% endfor %}
+                            </tbody>
+                        </table>
+                        <br />
+                        <p>
+                            <a href="{{ path('site_credentials_new') }}" class="waves-effect waves-light btn">{{ 'site_credential.list.create_new_one'|trans }}</a>
+                        </p>
+                    </div>
+                </div>
+            </div>
+        </div>
+    </div>
+
+{% endblock %}

src/Wallabag/CoreBundle/Resources/views/themes/material/SiteCredential/new.html.twig

@@ -0,0 +1,53 @@
+{% extends "WallabagCoreBundle::layout.html.twig" %}
+
+{% block title %}{{ 'site_credential.page_title'|trans }}{% endblock %}
+
+{% block content %}
+
+    <div class="row">
+        <div class="col s12">
+            <div class="card-panel">
+                <div class="row">
+                    <div class="input-field col s12">
+                        <h4>{{ 'site_credential.new_site_credential'|trans }}</h4>
+
+                        <div id="set6" class="col s12">
+                            {{ form_start(form) }}
+                                {{ form_errors(form) }}
+
+                                <div class="row">
+                                    <div class="input-field col s12">
+                                        {{ form_label(form.host) }}
+                                        {{ form_errors(form.host) }}
+                                        {{ form_widget(form.host) }}
+                                    </div>
+                                </div>
+
+                                <div class="row">
+                                    <div class="input-field col s12">
+                                        {{ form_label(form.username) }}
+                                        {{ form_errors(form.username) }}
+                                        {{ form_widget(form.username) }}
+                                    </div>
+                                </div>
+
+                                <div class="row">
+                                    <div class="input-field col s12">
+                                        {{ form_label(form.password) }}
+                                        {{ form_errors(form.password) }}
+                                        {{ form_widget(form.password) }}
+                                    </div>
+                                </div>
+
+                                {{ form_widget(form.save, {'attr': {'class': 'btn waves-effect waves-light'}}) }}
+                                {{ form_rest(form) }}
+                            </form>
+                            <p><a class="waves-effect waves-light btn blue-grey" href="{{ path('site_credentials_index') }}">{{ 'site_credential.form.back_to_list'|trans }}</a></p>
+                        </div>
+                    </div>
+                </div>
+            </div>
+        </div>
+    </div>
+
+{% endblock %}

src/Wallabag/CoreBundle/Resources/views/themes/material/layout.html.twig

@@ -66,6 +66,11 @@
             <li class="bold {% if currentRoute == 'config' %}active{% endif %}">
                 <a class="waves-effect" href="{{ path('config') }}">{{ 'menu.left.config'|trans }}</a>
             </li>
+            {% if craue_setting('restricted_access') %}
+            <li class="bold {% if currentRoute starts with 'site_credentials_' %}active{% endif %}">
+                <a class="waves-effect" href="{{ path('site_credentials_index') }}">{{ 'menu.left.site_credentials'|trans }}</a>
+            </li>
+            {% endif %}
             {% if is_granted('ROLE_SUPER_ADMIN') %}
                 <li class="bold {% if currentRoute starts with 'user_' %}active{% endif %}">
                     <a class="waves-effect" href="{{ path('user_index') }}">{{ 'menu.left.users_management'|trans }}</a>

tests/Wallabag/CoreBundle/Controller/EntryControllerTest.php

@@ -5,6 +5,7 @@ namespace Tests\Wallabag\CoreBundle\Controller;
 use Tests\Wallabag\CoreBundle\WallabagCoreTestCase;
 use Wallabag\CoreBundle\Entity\Config;
 use Wallabag\CoreBundle\Entity\Entry;
+use Wallabag\CoreBundle\Entity\SiteCredential;
 
 class EntryControllerTest extends WallabagCoreTestCase
 {
@@ -1335,4 +1336,56 @@ class EntryControllerTest extends WallabagCoreTestCase
         $this->assertEquals($url, $content->getUrl());
         $this->assertEquals($expectedLanguage, $content->getLanguage());
     }
+
+    /**
+     * This test will require an internet connection.
+     */
+    public function testRestrictedArticle()
+    {
+        $url = 'http://www.monde-diplomatique.fr/2017/05/BONNET/57475';
+        $this->logInAs('admin');
+        $client = $this->getClient();
+        $em = $client->getContainer()->get('doctrine.orm.entity_manager');
+
+        // enable restricted access
+        $client->getContainer()->get('craue_config')->set('restricted_access', 1);
+
+        // create a new site_credential
+        $user = $client->getContainer()->get('security.token_storage')->getToken()->getUser();
+        $credential = new SiteCredential($user);
+        $credential->setHost('monde-diplomatique.fr');
+        $credential->setUsername($client->getContainer()->get('wallabag_core.helper.crypto_proxy')->crypt('foo'));
+        $credential->setPassword($client->getContainer()->get('wallabag_core.helper.crypto_proxy')->crypt('bar'));
+
+        $em->persist($credential);
+        $em->flush();
+
+        $crawler = $client->request('GET', '/new');
+
+        $this->assertEquals(200, $client->getResponse()->getStatusCode());
+
+        $form = $crawler->filter('form[name=entry]')->form();
+
+        $data = [
+            'entry[url]' => $url,
+        ];
+
+        $client->submit($form, $data);
+
+        $this->assertEquals(302, $client->getResponse()->getStatusCode());
+
+        $crawler = $client->followRedirect();
+
+        $this->assertEquals(200, $client->getResponse()->getStatusCode());
+        $this->assertContains('flashes.entry.notice.entry_saved', $crawler->filter('body')->extract(['_text'])[0]);
+
+        $content = $em
+            ->getRepository('WallabagCoreBundle:Entry')
+            ->findByUrlAndUserId($url, $this->getLoggedInUserId());
+
+        $this->assertInstanceOf('Wallabag\CoreBundle\Entity\Entry', $content);
+        $this->assertSame('Crimes et réformes aux Philippines', $content->getTitle());
+
+        $client->getContainer()->get('craue_config')->set('restricted_access', 0);
+    }
 }

tests/Wallabag/CoreBundle/Controller/SiteCredentialControllerTest.php

@@ -0,0 +1,139 @@
+<?php
+
+namespace Tests\Wallabag\CoreBundle\Controller;
+
+use Symfony\Bundle\FrameworkBundle\Client;
+use Tests\Wallabag\CoreBundle\WallabagCoreTestCase;
+use Wallabag\CoreBundle\Entity\SiteCredential;
+
+class SiteCredentialControllerTest extends WallabagCoreTestCase
+{
+    public function testListSiteCredential()
+    {
+        $this->logInAs('admin');
+        $client = $this->getClient();
+
+        $crawler = $client->request('GET', '/site-credentials/');
+
+        $this->assertEquals(200, $client->getResponse()->getStatusCode());
+
+        $body = $crawler->filter('body')->extract(['_text'])[0];
+
+        $this->assertContains('site_credential.description', $body);
+        $this->assertContains('site_credential.list.create_new_one', $body);
+    }
+
+    public function testNewSiteCredential()
+    {
+        $this->logInAs('admin');
+        $client = $this->getClient();
+
+        $crawler = $client->request('GET', '/site-credentials/new');
+
+        $this->assertEquals(200, $client->getResponse()->getStatusCode());
+
+        $body = $crawler->filter('body')->extract(['_text'])[0];
+
+        $this->assertContains('site_credential.new_site_credential', $body);
+        $this->assertContains('site_credential.form.back_to_list', $body);
+
+        $form = $crawler->filter('button[id=site_credential_save]')->form();
+
+        $data = [
+            'site_credential[host]' => 'google.io',
+            'site_credential[username]' => 'sergei',
+            'site_credential[password]' => 'microsoft',
+        ];
+
+        $client->submit($form, $data);
+
+        $this->assertEquals(302, $client->getResponse()->getStatusCode());
+
+        $crawler = $client->followRedirect();
+
+        $this->assertContains('flashes.site_credential.notice.added', $crawler->filter('body')->extract(['_text'])[0]);
+    }
+
+    public function testEditSiteCredential()
+    {
+        $this->logInAs('admin');
+        $client = $this->getClient();
+
+        $credential = $this->createSiteCredential($client);
+
+        $crawler = $client->request('GET', '/site-credentials/'.$credential->getId().'/edit');
+
+        $this->assertEquals(200, $client->getResponse()->getStatusCode());
+
+        $body = $crawler->filter('body')->extract(['_text'])[0];
+
+        $this->assertContains('site_credential.edit_site_credential', $body);
+        $this->assertContains('site_credential.form.back_to_list', $body);
+
+        $form = $crawler->filter('button[id=site_credential_save]')->form();
+
+        $data = [
+            'site_credential[host]' => 'google.io',
+            'site_credential[username]' => 'larry',
+            'site_credential[password]' => 'microsoft',
+        ];
+
+        $client->submit($form, $data);
+
+        $this->assertEquals(302, $client->getResponse()->getStatusCode());
+
+        $crawler = $client->followRedirect();
+
+        $this->assertContains('flashes.site_credential.notice.updated', $crawler->filter('body')->extract(['_text'])[0]);
+    }
+
+    public function testEditFromADifferentUserSiteCredential()
+    {
+        $this->logInAs('admin');
+        $client = $this->getClient();
+
+        $credential = $this->createSiteCredential($client);
+
+        $this->logInAs('bob');
+
+        $client->request('GET', '/site-credentials/'.$credential->getId().'/edit');
+
+        $this->assertEquals(403, $client->getResponse()->getStatusCode());
+    }
+
+    public function testDeleteSiteCredential()
+    {
+        $this->logInAs('admin');
+        $client = $this->getClient();
+
+        $credential = $this->createSiteCredential($client);
+
+        $crawler = $client->request('GET', '/site-credentials/'.$credential->getId().'/edit');
+
+        $this->assertEquals(200, $client->getResponse()->getStatusCode());
+
+        $deleteForm = $crawler->filter('body')->selectButton('site_credential.form.delete')->form();
+
+        $client->submit($deleteForm, []);
+
+        $this->assertEquals(302, $client->getResponse()->getStatusCode());
+
+        $crawler = $client->followRedirect();
+
+        $this->assertContains('flashes.site_credential.notice.deleted', $crawler->filter('body')->extract(['_text'])[0]);
+    }
+
+    private function createSiteCredential(Client $client)
+    {
+        $credential = new SiteCredential($this->getLoggedInUser());
+        $credential->setHost('google.io');
+        $credential->setUsername('sergei');
+        $credential->setPassword('microsoft');
+
+        $em = $client->getContainer()->get('doctrine.orm.entity_manager');
+        $em->persist($credential);
+        $em->flush();
+
+        return $credential;
+    }
+}

tests/Wallabag/CoreBundle/GuzzleSiteAuthenticator/GrabySiteConfigBuilderTest.php

@@ -6,10 +6,11 @@ use Monolog\Handler\TestHandler;
 use Monolog\Logger;
 use BD\GuzzleSiteAuthenticator\SiteConfig\SiteConfig;
 use Graby\SiteConfig\SiteConfig as GrabySiteConfig;
-use PHPUnit_Framework_TestCase;
 use Wallabag\CoreBundle\GuzzleSiteAuthenticator\GrabySiteConfigBuilder;
+use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken;
+use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorage;
 
-class GrabySiteConfigBuilderTest extends PHPUnit_Framework_TestCase
+class GrabySiteConfigBuilderTest extends \PHPUnit_Framework_TestCase
 {
     /** @var \Wallabag\CoreBundle\GuzzleSiteAuthenticator\GrabySiteConfigBuilder */
     protected $builder;
@@ -17,13 +18,13 @@ class GrabySiteConfigBuilderTest extends PHPUnit_Framework_TestCase
     public function testBuildConfigExists()
     {
         /* @var \Graby\SiteConfig\ConfigBuilder|\PHPUnit_Framework_MockObject_MockObject */
-        $grabyConfigBuilderMock = $this->getMockBuilder('\Graby\SiteConfig\ConfigBuilder')
+        $grabyConfigBuilderMock = $this->getMockBuilder('Graby\SiteConfig\ConfigBuilder')
             ->disableOriginalConstructor()
             ->getMock();
 
         $grabySiteConfig = new GrabySiteConfig();
         $grabySiteConfig->requires_login = true;
-        $grabySiteConfig->login_uri = 'http://example.com/login';
+        $grabySiteConfig->login_uri = 'http://www.example.com/login';
         $grabySiteConfig->login_username_field = 'login';
         $grabySiteConfig->login_password_field = 'password';
         $grabySiteConfig->login_extra_fields = ['field=value'];
@@ -38,19 +39,40 @@ class GrabySiteConfigBuilderTest extends PHPUnit_Framework_TestCase
         $handler = new TestHandler();
         $logger->pushHandler($handler);
 
+        $siteCrentialRepo = $this->getMockBuilder('Wallabag\CoreBundle\Repository\SiteCredentialRepository')
+            ->disableOriginalConstructor()
+            ->getMock();
+        $siteCrentialRepo->expects($this->once())
+            ->method('findOneByHostAndUser')
+            ->with('example.com', 1)
+            ->willReturn(['username' => 'foo', 'password' => 'bar']);
+
+        $user = $this->getMockBuilder('Wallabag\UserBundle\Entity\User')
+            ->disableOriginalConstructor()
+            ->getMock();
+        $user->expects($this->once())
+            ->method('getId')
+            ->willReturn(1);
+
+        $token = new UsernamePasswordToken($user, 'pass', 'provider');
+
+        $tokenStorage = new TokenStorage();
+        $tokenStorage->setToken($token);
+
         $this->builder = new GrabySiteConfigBuilder(
             $grabyConfigBuilderMock,
-            ['example.com' => ['username' => 'foo', 'password' => 'bar']],
+            $tokenStorage,
+            $siteCrentialRepo,
             $logger
         );
 
-        $config = $this->builder->buildForHost('example.com');
+        $config = $this->builder->buildForHost('www.example.com');
 
         $this->assertEquals(
             new SiteConfig([
                 'host' => 'example.com',
                 'requiresLogin' => true,
-                'loginUri' => 'http://example.com/login',
+                'loginUri' => 'http://www.example.com/login',
                 'usernameField' => 'login',
                 'passwordField' => 'password',
                 'extraFields' => ['field' => 'value'],
@@ -82,9 +104,30 @@ class GrabySiteConfigBuilderTest extends PHPUnit_Framework_TestCase
         $handler = new TestHandler();
         $logger->pushHandler($handler);
 
+        $siteCrentialRepo = $this->getMockBuilder('Wallabag\CoreBundle\Repository\SiteCredentialRepository')
+            ->disableOriginalConstructor()
+            ->getMock();
+        $siteCrentialRepo->expects($this->once())
+            ->method('findOneByHostAndUser')
+            ->with('unknown.com', 1)
+            ->willReturn(null);
+
+        $user = $this->getMockBuilder('Wallabag\UserBundle\Entity\User')
+            ->disableOriginalConstructor()
+            ->getMock();
+        $user->expects($this->once())
+            ->method('getId')
+            ->willReturn(1);
+
+        $token = new UsernamePasswordToken($user, 'pass', 'provider');
+
+        $tokenStorage = new TokenStorage();
+        $tokenStorage->setToken($token);
+
         $this->builder = new GrabySiteConfigBuilder(
             $grabyConfigBuilderMock,
-            [],
+            $tokenStorage,
+            $siteCrentialRepo,
             $logger
         );
 

tests/Wallabag/CoreBundle/Helper/CryptoProxyTest.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace Tests\Wallabag\CoreBundle\Helper;
+
+use Psr\Log\NullLogger;
+use Monolog\Logger;
+use Monolog\Handler\TestHandler;
+use Wallabag\CoreBundle\Helper\CryptoProxy;
+
+class CryptoProxyTest extends \PHPUnit_Framework_TestCase
+{
+    public function testCrypto()
+    {
+        $logHandler = new TestHandler();
+        $logger = new Logger('test', [$logHandler]);
+
+        $crypto = new CryptoProxy(sys_get_temp_dir().'/'.uniqid('', true).'.txt', $logger);
+        $crypted = $crypto->crypt('test');
+        $decrypted = $crypto->decrypt($crypted);
+
+        $this->assertSame('test', $decrypted);
+
+        $records = $logHandler->getRecords();
+        $this->assertCount(2, $records);
+        $this->assertContains('Crypto: crypting value', $records[0]['message']);
+        $this->assertContains('Crypto: decrypting value', $records[1]['message']);
+    }
+
+    /**
+     * @expectedException RuntimeException
+     * @expectedExceptionMessage Decrypt fail
+     *
+     * @return [type] [description]
+     */
+    public function testDecryptBadValue()
+    {
+        $crypto = new CryptoProxy(sys_get_temp_dir().'/'.uniqid('', true).'.txt', new NullLogger());
+        $crypto->decrypt('badvalue');
+    }
+}