Security note from AdminTools PHP File Scanner - outdated crypto in Google Drive

Hello,

I'm just a regular EDocman user (not a PHP or security expert), and recently I ran the AdminTools PHP File Scanner on my site.

It flagged the phpseclib library inside the Google Drive v3 plugin (plugins/edocman/googledrivev3/GoogleV3/packages/phpseclib/phpseclib/Crypt/RSA.php) as potentially outdated / using legacy code.

Out of curiosity, I asked an AI tool (Grok) to take a look at that part of the code. The AI explained to me that:

- The code is using phpseclib 1.x (a very old version from many years ago)
- It implements the old PKCS#1 v1.5 signature method (EMSA-PKCS1-v1_5)
- According to current security recommendations, this method is now considered legacy and is no longer recommended for new or long-term use
- Modern best practice is to use RSA-PSS instead, and newer versions of phpseclib (3.x) already do this by default

The AI also mentioned that while it doesn't mean the site is immediately hacked, it would be safer to update this part in the future — especially because Google might one day stop accepting the old signature format, or because newer phpseclib versions have many security improvements and fixes.

I completely understand that updating such things takes time and must keep backward compatibility in mind.  
I'm not asking for an immediate fix or starting any technical discussion — I just wanted to kindly pass on what I learned from the scanner + AI analysis, in case it is helpful for future planning.

Thank you very much for creating and maintaining EDocman — it's a really useful extension for our site.

Thanks

Hi,
Thank you very much for your helpful feedback regarding the security of the Google Drive v3 plugin.
I have researched and made improvements to enhance the security of Google Drive Version 3.
To help you check the new changes, please submit a support ticket in the "Edocman" category and provide your site information.
I will upload the updated version to your site so you can test if it works as expected.
Thank you again for your valuable input.
Dam

Hi Dam,

This topic was posted to provide feedback in order to contribute to the future security of EDocman. I discovered this issue while working on a client’s website, not my own site, so unfortunately I do not have permission to disclose that site’s details and cannot provide any site information. If this is implemented in a future version of EDocman, I believe I will be able to provide feedback on whether or not it is detected by the AdminTools PHP File Scanner.

Thanks

Hi,
The next version of Edocman, which will be released soon, will include improved security for the Edocman Google Drive plugin.
You will be able to test these enhancements once the new version is available.
Thanks
Dam