| 1 |
<?php |
| 2 |
/* |
| 3 |
WP Simple Nonce 1.0 by Cal Evans |
| 4 |
https://github.com/wahabmirjan/wp-simple-nonce |
| 5 |
GNU General Public License v2.0 |
| 6 |
*/ |
| 7 |
|
| 8 |
if (!defined('ABSPATH')) exit; |
| 9 |
|
| 10 |
function banhammer_nonce_cleanup() { |
| 11 |
|
| 12 |
WPSimpleNonce::clearNonces(); |
| 13 |
|
| 14 |
} |
| 15 |
add_action('banhammer_nonce_cleanup', 'banhammer_nonce_cleanup'); |
| 16 |
|
| 17 |
function banhammer_nonce_garbage_collection() { |
| 18 |
|
| 19 |
if (!wp_next_scheduled('banhammer_nonce_cleanup')) { |
| 20 |
|
| 21 |
wp_schedule_event(time(), 'hourly', 'banhammer_nonce_cleanup'); |
| 22 |
|
| 23 |
} |
| 24 |
|
| 25 |
} |
| 26 |
add_action('wp', 'banhammer_nonce_garbage_collection'); |
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
if (!class_exists('WPSimpleNonce')) { |
| 31 |
|
| 32 |
class WPSimpleNonce { |
| 33 |
const option_root ='wp-snc'; |
| 34 |
public static function createNonce($name) |
| 35 |
{ |
| 36 |
if (is_array($name)) { |
| 37 |
if (isset($name['name'])) { |
| 38 |
$name = $name['name']; |
| 39 |
} else { |
| 40 |
$name = 'nonce'; |
| 41 |
} |
| 42 |
} |
| 43 |
$id = self::generate_id(); |
| 44 |
$name = substr($name, 0,17).'_'.$id; |
| 45 |
$nonce = md5( wp_salt('nonce') . $name . microtime(true)); |
| 46 |
self::storeNonce($nonce,$name); |
| 47 |
$array = array('name' => $name, 'value' => $nonce); |
| 48 |
return $array; |
| 49 |
} |
| 50 |
public static function createNonceField($name='nonce') |
| 51 |
{ |
| 52 |
if (is_array($name)) { |
| 53 |
if (isset($name['name'])) { |
| 54 |
$name = $name['name']; |
| 55 |
} else { |
| 56 |
$name = 'nonce'; |
| 57 |
} |
| 58 |
} |
| 59 |
$name = filter_var($name,FILTER_SANITIZE_STRING); |
| 60 |
$nonce = self::createNonce($name); |
| 61 |
$nonce['value'] = '<input type="hidden" name="' . $nonce['name'] . '" value="'.$nonce['value'].'" />'; |
| 62 |
return $nonce; |
| 63 |
} |
| 64 |
public static function checkNonce( $name, $value ) |
| 65 |
{ |
| 66 |
$name = filter_var($name,FILTER_SANITIZE_STRING); |
| 67 |
$nonce = self::fetchNonce($name); |
| 68 |
$returnValue = ($nonce===$value); |
| 69 |
return $returnValue; |
| 70 |
} |
| 71 |
public static function storeNonce($nonce, $name) |
| 72 |
{ |
| 73 |
if (empty($name)) { |
| 74 |
return false; |
| 75 |
} |
| 76 |
add_option(self::option_root.'_'.$name,$nonce); |
| 77 |
add_option(self::option_root.'_expires_'.$name,time()+86400); |
| 78 |
return true; |
| 79 |
} |
| 80 |
protected static function fetchNonce($name) |
| 81 |
{ |
| 82 |
$returnValue = get_option(self::option_root.'_'.$name); |
| 83 |
$nonceExpires = get_option(self::option_root.'_expires_'.$name); |
| 84 |
|
| 85 |
self::deleteNonce($name); |
| 86 |
|
| 87 |
if ($nonceExpires<time()) { |
| 88 |
$returnValue = null; |
| 89 |
} |
| 90 |
return $returnValue; |
| 91 |
} |
| 92 |
public static function deleteNonce($name) |
| 93 |
{ |
| 94 |
$optionDeleted = delete_option(self::option_root.'_'.$name); |
| 95 |
$optionDeleted = $optionDeleted && delete_option(self::option_root.'_expires_'.$name); |
| 96 |
return (bool)$optionDeleted; |
| 97 |
} |
| 98 |
public static function clearNonces($force=false) |
| 99 |
{ |
| 100 |
if ( defined('WP_SETUP_CONFIG') or defined('WP_INSTALLING') ) { |
| 101 |
return; |
| 102 |
} |
| 103 |
global $wpdb; |
| 104 |
$sql = 'SELECT option_id, |
| 105 |
option_name, |
| 106 |
option_value |
| 107 |
FROM ' . $wpdb->options . ' |
| 108 |
WHERE option_name like "'.self::option_root.'_expires_%"'; |
| 109 |
$rows = $wpdb->get_results($sql); |
| 110 |
$noncesDeleted = 0; |
| 111 |
foreach ( $rows as $singleNonce ) |
| 112 |
{ |
| 113 |
if ($force or ($singleNonce->option_value>time()+86400)) { |
| 114 |
$name = substr($singleNonce->option_name, strlen(self::option_root.'_expires_')); |
| 115 |
$noncesDeleted += (self::deleteNonce($name)?1:0); |
| 116 |
} |
| 117 |
} |
| 118 |
return (int)$noncesDeleted; |
| 119 |
} |
| 120 |
protected static function generate_id() { |
| 121 |
require_once( ABSPATH . 'wp-includes/class-phpass.php'); |
| 122 |
$hasher = new PasswordHash( 8, false ); |
| 123 |
return md5($hasher->get_random_bytes(100,false)); |
| 124 |
} |
| 125 |
} |
| 126 |
|
| 127 |
} |
| 128 |
|
