← All changes | inc/class-ps-conditional.php +26 -23 4.0 → 4.3.16 View file →

		@@ -1,11 +1,10 @@
1	1	<?php
2	2
3	3	namespace passster;
4	4
5		-use Exception ;
6		-class PS_Conditional
7		-{
	5	+use Exception;
	6	+class PS_Conditional {
8	7	/**
9	8	* Check if valid authentication exists.
10	9	*
11	10	* @param array $atts array of attributes.
		@@ -12,29 +11,36 @@
12	11	*
13	12	* @return boolean
14	13	* @throws Exception
15	14	*/
16		- public static function is_valid( array $atts ) : bool
17		- {
18		- $input = '';
19		- // is Cookie set?
20		- if ( !empty($_COOKIE['passster']) ) {
21		- $input = $_COOKIE['passster'];
	15	+ public static function is_valid( array $atts ) : bool {
	16	+ $inputs = array();
	17	+ // is Cookie set? Support multiple hashes (pipe-separated).
	18	+ if ( !empty( $_COOKIE['passster'] ) ) {
	19	+ $cookie_value = esc_html( $_COOKIE['passster'] );
	20	+ // Split by pipe to support multiple password hashes
	21	+ $inputs = array_filter( explode( '|', $cookie_value ) );
22	22	}
23		- // Valid password.
24		- if ( self::is_valid_password( $input, $atts ) ) {
25		- return true;
	23	+ // For backwards compatibility, also check single input
	24	+ $input = ( !empty( $inputs ) ? $inputs[0] : '' );
	25	+ // Valid password - check all inputs from cookie (supports multiple unlocks).
	26	+ foreach ( $inputs as $input ) {
	27	+ if ( self::is_valid_password( $input, $atts ) ) {
	28	+ return true;
	29	+ }
26	30	}
27		- // captcha.
	31	+ // captcha - check all inputs.
28	32	if ( isset( $atts['captcha'] ) ) {
29		- if ( 'captcha' == $input ) {
30		- return true;
	33	+ foreach ( $inputs as $input ) {
	34	+ if ( 'captcha' === $input ) {
	35	+ return true;
	36	+ }
31	37	}
32	38	}
33	39	// if nothing was correct.
34	40	return false;
35	41	}
36		-
	42	+
37	43	/**
38	44	* Validate the password.
39	45	*
40	46	* @param string $input given password to validate.
		@@ -42,19 +48,16 @@
42	48	*
43	49	* @return bool
44	50	* @throws Exception
45	51	*/
46		- public static function is_valid_password( string $input, array $atts ) : bool
47		- {
	52	+ public static function is_valid_password( string $input, array $atts ) : bool {
48	53	// password.
49		-
50		- if ( !empty($atts['password']) ) {
51		- $hash = hash_hmac( 'sha256', $atts['password'], get_option( 'passster_secure_key' ) );
	54	+ if ( !empty( $atts['password'] ) ) {
	55	+ $hash = hash_hmac( 'sha256', wp_unslash( $atts['password'] ), get_option( 'passster_secure_key' ) );
52	56	if ( hash_equals( $hash, $input ) ) {
53	57	return true;
54	58	}
55	59	}
56		-
57	60	return false;
58	61	}
59	62
60		-}
	63	+}