| 1 |
<?php |
| 2 |
|
| 3 |
namespace AATXT\App\Utilities; |
| 4 |
|
| 5 |
use RuntimeException; |
| 6 |
|
| 7 |
final class Encryption |
| 8 |
{ |
| 9 |
private string $key; |
| 10 |
private string $salt; |
| 11 |
|
| 12 |
public function __construct() |
| 13 |
{ |
| 14 |
$this->key = $this->getKey(); |
| 15 |
$this->salt = $this->getSalt(); |
| 16 |
} |
| 17 |
|
| 18 |
/** |
| 19 |
* @return Encryption |
| 20 |
*/ |
| 21 |
public static function make(): Encryption |
| 22 |
{ |
| 23 |
return new self(); |
| 24 |
} |
| 25 |
|
| 26 |
/** |
| 27 |
* @param string $value |
| 28 |
* @return string|bool |
| 29 |
*/ |
| 30 |
public function encrypt(string $value): string |
| 31 |
{ |
| 32 |
if (empty($value)) { |
| 33 |
return ''; |
| 34 |
} |
| 35 |
|
| 36 |
if (!extension_loaded('openssl')) { |
| 37 |
return $value; |
| 38 |
} |
| 39 |
|
| 40 |
$method = 'aes-256-ctr'; |
| 41 |
$ivLength = openssl_cipher_iv_length($method); |
| 42 |
$iv = openssl_random_pseudo_bytes($ivLength); |
| 43 |
$raw_value = openssl_encrypt($value . $this->salt, $method, $this->key, 0, $iv); |
| 44 |
if (!$raw_value) { |
| 45 |
throw new RuntimeException('Encryption failed.'); |
| 46 |
} |
| 47 |
|
| 48 |
return base64_encode($iv . $raw_value); |
| 49 |
} |
| 50 |
|
| 51 |
/** |
| 52 |
* @param string $rawValue |
| 53 |
* @return string|bool |
| 54 |
*/ |
| 55 |
public function decrypt(string $rawValue): string |
| 56 |
{ |
| 57 |
if (empty($rawValue) || ! extension_loaded('openssl')) { |
| 58 |
return ''; |
| 59 |
} |
| 60 |
|
| 61 |
try { |
| 62 |
$decoded = base64_decode($rawValue, true); |
| 63 |
$method = 'aes-256-ctr'; |
| 64 |
$ivLength = openssl_cipher_iv_length($method); |
| 65 |
$iv = substr($decoded, 0, $ivLength); |
| 66 |
$cipherText = substr($decoded, $ivLength); |
| 67 |
$decrypted = openssl_decrypt($cipherText, $method, $this->key, 0, $iv); |
| 68 |
|
| 69 |
// If decryption fails or the salt is not present, return an empty string |
| 70 |
if ( ! $decrypted || substr($decrypted, -strlen($this->salt)) !== $this->salt) { |
| 71 |
return ''; |
| 72 |
} |
| 73 |
|
| 74 |
return substr($decrypted, 0, -strlen($this->salt)); |
| 75 |
} catch (\Throwable $e) { |
| 76 |
throw new RuntimeException('Decryption failed.'); |
| 77 |
} |
| 78 |
} |
| 79 |
|
| 80 |
|
| 81 |
/** |
| 82 |
* Get key from WordPress Authentication Unique Keys and Salts |
| 83 |
*/ |
| 84 |
private function getKey(): string |
| 85 |
{ |
| 86 |
if (defined('LOGGED_IN_KEY') && '' !== LOGGED_IN_KEY) { |
| 87 |
return LOGGED_IN_KEY; |
| 88 |
} |
| 89 |
|
| 90 |
// If this is reached, you're either not on a live site or have a serious security issue. |
| 91 |
return 'warning-not-logged-in-key-constant-defined'; |
| 92 |
} |
| 93 |
|
| 94 |
/** |
| 95 |
* Get salt from WordPress Authentication Unique Keys and Salts |
| 96 |
*/ |
| 97 |
public function getSalt(): string |
| 98 |
{ |
| 99 |
if (defined('LOGGED_IN_SALT') && '' !== LOGGED_IN_SALT) { |
| 100 |
return LOGGED_IN_SALT; |
| 101 |
} |
| 102 |
|
| 103 |
// If this is reached, you're either not on a live site or have a serious security issue. |
| 104 |
return 'warning-not-logged-in-salt-constant-defined'; |
| 105 |
} |
| 106 |
} |
| 107 |
|
