defender-security / src / traits / webauthn.php

webauthn.php in Defender Security – Malware Scanner, Login Security & Firewall 5.3.1, at src/traits/webauthn.php

217 lines 5.5 KB

Raw Download Zip

1	<?php
2	/**
3	* Helper functions for webauthn related tasks.
4	*
5	* @package WP_Defender\Traits
6	*/
7
8	namespace WP_Defender\Traits;
9
10	use Throwable;
11
12	trait Webauthn {
13
14	/**
15	* Prefix used for option.
16	*
17	* @var string
18	*/
19	public $option_prefix = 'wpdef_webauthn_';
20
21	/**
22	* Check if SSL is used.
23	*
24	* @return bool
25	*/
26	public function is_ssl(): bool {
27	$server_data = defender_get_data_from_request( null, 's' );
28	if (
29	( ! empty( $server_data['HTTPS'] ) && ( 'on' === strtolower( $server_data['HTTPS'] ) \|\| '1' === $server_data['HTTPS'] ) ) \|\|
30	( ! empty( $server_data['REQUEST_SCHEME'] ) && 'https' === $server_data['REQUEST_SCHEME'] ) \|\|
31	( ! empty( $server_data['HTTP_X_FORWARDED_PROTO'] ) && 'https' === $server_data['HTTP_X_FORWARDED_PROTO'] ) \|\|
32	( ! empty( $server_data['HTTP_X_FORWARDED_SSL'] ) && 'on' === $server_data['HTTP_X_FORWARDED_SSL'] )
33	) {
34	return true;
35	}
36
37	return false;
38	}
39
40	/**
41	* Check if 'gmp' extension is enabled.
42	*
43	* @return bool
44	*/
45	public function is_enabled_gmp(): bool {
46	return extension_loaded( 'gmp' );
47	}
48
49	/**
50	* Check if 'mbstring' extension is enabled.
51	*
52	* @return bool
53	*/
54	public function is_enabled_mbstring(): bool {
55	return extension_loaded( 'mbstring' );
56	}
57
58	/**
59	* Check if 'sodium' extension is enabled.
60	*
61	* @return bool
62	*/
63	public function is_enabled_sodium(): bool {
64	return extension_loaded( 'sodium' );
65	}
66
67	/**
68	* Check if server requirements are met.
69	*
70	* @return bool
71	*/
72	public function check_webauthn_requirements(): bool {
73	return $this->is_ssl() &&
74	$this->is_enabled_gmp() &&
75	$this->is_enabled_mbstring() &&
76	$this->is_enabled_sodium();
77	}
78
79	/**
80	* Sets the value of a transient with a specific name, client ID, and expiration time.
81	*
82	* @param string $name The name of the transient.
83	* @param mixed $value The value to be serialized and stored in the transient.
84	* @param string $client_id The client ID associated with the transient.
85	* @param int $exp The expiration time in seconds. Default is 90.
86	*
87	* @return bool Returns true if the transient was successfully set, false otherwise.
88	*/
89	public function set_trans_val( string $name, $value, string $client_id, int $exp = 90 ): bool {
90	$trans_name = $this->option_prefix . $name . '_' . $client_id;
91	$trans_val = wp_json_encode( $value );
92
93	return set_transient( $trans_name, $trans_val, $exp );
94	}
95
96	/**
97	* Retrieves the value of a transient with the specified name and client ID.
98	*
99	* @param string $name The name of the transient.
100	* @param string $client_id The client ID associated with the transient.
101	*
102	* @return mixed\|false The deserialized value of the transient, or false if the transient does not exist.
103	*/
104	public function get_trans_val( string $name, string $client_id ) {
105	$trans_name = $this->option_prefix . $name . '_' . $client_id;
106	$trans_val = get_transient( $trans_name );
107
108	return false !== $trans_val ? json_decode( $trans_val ) : false;
109	}
110
111	/**
112	* Delete transient.
113	*
114	* @param string $name The name of the transient.
115	* @param string $client_id The client ID associated with the transient.
116	*
117	* @return bool
118	*/
119	public function delete_trans( string $name, string $client_id ): bool {
120	$trans_name = $this->option_prefix . $name . '_' . $client_id;
121
122	return delete_transient( $trans_name );
123	}
124
125	/**
126	* Update user meta.
127	*
128	* @param int $user_id User ID.
129	* @param string $name Metadata key.
130	* @param mixed $value Metadata value. Must be serializable if non-scalar.
131	*
132	* @return int\|bool
133	*/
134	public function update_user_meta( int $user_id, string $name, $value ) {
135	return update_user_meta( $user_id, $this->option_prefix . $name, addslashes( wp_json_encode( $value ) ) );
136	}
137
138	/**
139	* Get user meta.
140	*
141	* @param int $user_id User ID.
142	* @param string $name Metadata key.
143	*
144	* @return mixed
145	*/
146	public function get_user_meta( int $user_id, string $name ) {
147	$value = get_user_meta( $user_id, $this->option_prefix . $name, true );
148
149	if ( null !== $value ) {
150	try {
151	return json_decode( $value, true );
152	} catch ( Throwable $exception ) {
153	return array();
154	}
155	}
156
157	return array();
158	}
159
160	/**
161	* Get website name.
162	*
163	* @return string
164	*/
165	public function get_site_name(): string {
166	return get_bloginfo( 'name' );
167	}
168
169	/**
170	* Get website domain.
171	*
172	* @return string
173	*/
174	public function get_site_domain(): string {
175	$site_url = get_bloginfo( 'url' );
176	$site_domain = preg_replace( '#^http(s)?:\/\/#', '', $site_url );
177	$site_domain = preg_replace( '#^www\.#', '', $site_domain );
178	$site_domain = explode( '/', $site_domain );
179
180	return $site_domain[0] ?? $site_domain;
181	}
182
183	/**
184	* Get the hash of a user's username using SHA-256 algorithm.
185	*
186	* @param string $username The username of the user.
187	*
188	* @return string The hashed username.
189	*/
190	public function get_user_hash( string $username ): string {
191	return hash( 'sha256', $username );
192	}
193
194	/**
195	* URL safe base64 encoding.
196	*
197	* @param string $data The data to encode.
198	*
199	* @return string
200	*/
201	public function base64url_encode( string $data ): string {
202	return rtrim( strtr( base64_encode( $data ), '+/', '-_' ), '=' ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode
203	}
204
205	/**
206	* Base64 decoding from URL safe base64 encoding.
207	*
208	* @param string $data The data to decode.
209	*
210	* @return string\|bool
211	*/
212	public function base64url_decode( string $data ) {
213	// No need to add '=' at the end.
214	return base64_decode( strtr( $data, '-_', '+/' ) ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
215	}
216	}
217