From d17131d29742f9167084ccbd268848404db33269 Mon Sep 17 00:00:00 2001
From: Christian Hohnstaedt <christian@hohnstaedt.de>
Date: Thu, 8 Feb 2024 18:15:15 +0100
Subject: [PATCH] Warn in case of weak PFX algorithm configured

---
 test/main.cpp          |  5 ++++-
 widgets/MainWindow.cpp | 22 +++++++++++++++++++++-
 2 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/test/main.cpp b/test/main.cpp
index 4b2bec1d..2d9a074a 100644
--- a/test/main.cpp
+++ b/test/main.cpp
@@ -67,7 +67,10 @@ void test_main::openDB()
 	pwdialog->setExpectations(QList<pw_expect*>{
 		new pw_expect("testdbpass", pw_ok),
 	});
-	mainwin->init_database("testdb.xdb");
+	mainwin->close_database();
+	Database.open("testdb.xdb");
+	Settings["pkcs12_keep_legacy"] = true;
+	mainwin->setup_open_database();
 	dbstatus();
 }
 
diff --git a/widgets/MainWindow.cpp b/widgets/MainWindow.cpp
index 54193cb4..16d61732 100644
--- a/widgets/MainWindow.cpp
+++ b/widgets/MainWindow.cpp
@@ -35,6 +35,7 @@
 #include "lib/pki_scard.h"
 #include "lib/dhgen.h"
 #include "lib/load_obj.h"
+#include "lib/pki_pkcs12.h"
 
 #include "XcaDialog.h"
 #include "XcaWarning.h"
@@ -600,7 +601,26 @@ enum open_result MainWindow::setup_open_database()
 		XCA_WARN(tr("The currently used default hash '%1' is insecure. Please select at least 'SHA 224' for security reasons.").arg(defdig.name()));
 		setOptions();
 	}
-
+	encAlgo encalg = encAlgo::getDefault();
+	if (encalg.legacy() && !Settings["pkcs12_keep_legacy"]) {
+		QString text(tr("The currently used PFX / PKCS#12 algorithm '%1' is insecure.")
+				.arg(encalg.name()));
+		xcaWarningBox msg(this, text);
+		msg.addButton(QMessageBox::Ok);
+        msg.addButton(QMessageBox::Ignore);
+        msg.addButton(QMessageBox::Apply, tr("Change"));
+		switch (msg.exec())
+		{
+			case QMessageBox::Ok:
+				break;
+			case QMessageBox::Ignore:
+				Settings["pkcs12_keep_legacy"] = true;
+				break;
+			case QMessageBox::Apply:
+				setOptions();
+				break;
+		}
+	}
 	keyView->setModel(Database.model<db_key>());
 	reqView->setModel(Database.model<db_x509req>());
 	certView->setModel(Database.model<db_x509>());