← All changes | inc/class-ps-conditional.php +63 -55 4.2.14 → 4.3.16 View file →

		@@ -1,55 +1,63 @@
1		-<?php
2		-
3		-namespace passster;
4		-
5		-use Exception;
6		-class PS_Conditional {
7		- /**
8		- * Check if valid authentication exists.
9		- *
10		- * @param array $atts array of attributes.
11		- *
12		- * @return boolean
13		- * @throws Exception
14		- */
15		- public static function is_valid( array $atts ) : bool {
16		- $input = '';
17		- // is Cookie set?
18		- if ( !empty( $_COOKIE['passster'] ) ) {
19		- $input = esc_html( $_COOKIE['passster'] );
20		- }
21		- // Valid password.
22		- if ( self::is_valid_password( $input, $atts ) ) {
23		- return true;
24		- }
25		- // captcha.
26		- if ( isset( $atts['captcha'] ) ) {
27		- if ( 'captcha' == $input ) {
28		- return true;
29		- }
30		- }
31		- // if nothing was correct.
32		- return false;
33		- }
34		-
35		- /**
36		- * Validate the password.
37		- *
38		- * @param string $input given password to validate.
39		- * @param array $atts given arguments to check.
40		- *
41		- * @return bool
42		- * @throws Exception
43		- */
44		- public static function is_valid_password( string $input, array $atts ) : bool {
45		- // password.
46		- if ( !empty( $atts['password'] ) ) {
47		- $hash = hash_hmac( 'sha256', esc_html( $atts['password'] ), get_option( 'passster_secure_key' ) );
48		- if ( hash_equals( $hash, $input ) ) {
49		- return true;
50		- }
51		- }
52		- return false;
53		- }
54		-
55		-}
	1	+<?php
	2	+
	3	+namespace passster;
	4	+
	5	+use Exception;
	6	+class PS_Conditional {
	7	+ /**
	8	+ * Check if valid authentication exists.
	9	+ *
	10	+ * @param array $atts array of attributes.
	11	+ *
	12	+ * @return boolean
	13	+ * @throws Exception
	14	+ */
	15	+ public static function is_valid( array $atts ) : bool {
	16	+ $inputs = array();
	17	+ // is Cookie set? Support multiple hashes (pipe-separated).
	18	+ if ( !empty( $_COOKIE['passster'] ) ) {
	19	+ $cookie_value = esc_html( $_COOKIE['passster'] );
	20	+ // Split by pipe to support multiple password hashes
	21	+ $inputs = array_filter( explode( '|', $cookie_value ) );
	22	+ }
	23	+ // For backwards compatibility, also check single input
	24	+ $input = ( !empty( $inputs ) ? $inputs[0] : '' );
	25	+ // Valid password - check all inputs from cookie (supports multiple unlocks).
	26	+ foreach ( $inputs as $input ) {
	27	+ if ( self::is_valid_password( $input, $atts ) ) {
	28	+ return true;
	29	+ }
	30	+ }
	31	+ // captcha - check all inputs.
	32	+ if ( isset( $atts['captcha'] ) ) {
	33	+ foreach ( $inputs as $input ) {
	34	+ if ( 'captcha' === $input ) {
	35	+ return true;
	36	+ }
	37	+ }
	38	+ }
	39	+ // if nothing was correct.
	40	+ return false;
	41	+ }
	42	+
	43	+ /**
	44	+ * Validate the password.
	45	+ *
	46	+ * @param string $input given password to validate.
	47	+ * @param array $atts given arguments to check.
	48	+ *
	49	+ * @return bool
	50	+ * @throws Exception
	51	+ */
	52	+ public static function is_valid_password( string $input, array $atts ) : bool {
	53	+ // password.
	54	+ if ( !empty( $atts['password'] ) ) {
	55	+ $hash = hash_hmac( 'sha256', wp_unslash( $atts['password'] ), get_option( 'passster_secure_key' ) );
	56	+ if ( hash_equals( $hash, $input ) ) {
	57	+ return true;
	58	+ }
	59	+ }
	60	+ return false;
	61	+ }
	62	+
	63	+}