← All changes | includes/_booking_hash/booking_hash.php +25 -9 11.3 → 11.8.4 View file →

		@@ -1,4 +1,4 @@
1	1	<?php /**
2	2	* @version 1.0
3	3	* @description Booking Hash Functions
4	4	* @category Booking Hash
		@@ -11,9 +11,25 @@
11	11	*/
12	12
13	13	if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
14	14
15		-// H A S H // FixIn: 9.2.3.3.
	15	+// H A S H // FixIn: 9.2.3.3.
	16	+
	17	+/**
	18	+ * Generate an opaque booking hash without relying on database hashing functions.
	19	+ *
	20	+ * Booking hashes are used in customer-facing edit, cancellation, and payment
	21	+ * links. Keep the historical 32-character hexadecimal shape so existing
	22	+ * consumers continue to work, while deriving new values from WordPress random
	23	+ * data and a PHP hashing algorithm supported by the plugin's PHP requirement.
	24	+ *
	25	+ * @return string A 32-character lowercase hexadecimal booking hash.
	26	+ */
	27	+function wpbc_hash__generate_booking_hash() {
	28	+ $random_source = wp_generate_password( 64, true, true ) . '|' . microtime( true ) . '|' . wp_rand();
	29	+
	30	+ return substr( hash( 'sha256', $random_source ), 0, 32 );
	31	+}
16	32
17	33	/**
18	34	* Get booking ID and resource ID by booking HASH
19	35	*
		@@ -98,16 +114,16 @@
98	114	* @param $resource_id
99	115	*
100	116	* @return void
101	117	*/
102		-function wpbc_hash__update_booking_hash( $booking_id, $resource_id = '1' ) {
103		- global $wpdb;
104		- // FixIn: 10.12.1.5.
105		- $update_sql = $wpdb->prepare(
106		- "UPDATE {$wpdb->prefix}booking SET hash = MD5(%s) WHERE booking_id = %d"
107		- , time() . '_' . wp_rand( 1000, 1000000 )
108		- , $booking_id
109		- );
	118	+function wpbc_hash__update_booking_hash( $booking_id, $resource_id = '1' ) {
	119	+ global $wpdb;
	120	+ // FixIn: 10.12.1.5.
	121	+ $update_sql = $wpdb->prepare(
	122	+ "UPDATE {$wpdb->prefix}booking SET hash = %s WHERE booking_id = %d"
	123	+ , wpbc_hash__generate_booking_hash()
	124	+ , $booking_id
	125	+ );
110	126	// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter
111	127	if ( false === $wpdb->query( $update_sql ) ) {
112	128	?>
113	129	<script type="text/javascript"> document.getElementById('submiting<?php echo esc_attr( $resource_id ); ?>').innerHTML = '<div style=&quot;height:20px;width:100%;text-align:center;margin:15px auto;&quot;><?php debuge_error( 'Error during updating hash in BD', __FILE__, __LINE__ ); ?></div>'; </script> <?php