← All changes | src/traits/webauthn.php +61 -66 3.0.1 → 6.3.0 View file →

		@@ -1,5 +1,10 @@
1	1	<?php
	2	+/**
	3	+ * Helper functions for webauthn related tasks.
	4	+ *
	5	+ * @package WP_Defender\Traits
	6	+ */
2	7
3	8	namespace WP_Defender\Traits;
4	9
5	10	use Throwable;
		@@ -4,8 +9,9 @@
4	9
5	10	use Throwable;
6	11
7	12	trait Webauthn {
	13	+
8	14	/**
9	15	* Prefix used for option.
10	16	*
11	17	* @var string
		@@ -12,30 +18,19 @@
12	18	*/
13	19	public $option_prefix = 'wpdef_webauthn_';
14	20
15	21	/**
16		- * Check if required PHP is installed.
17		- *
18		- * @return bool
19		- */
20		- public function check_php_version(): bool {
21		- if ( version_compare( PHP_VERSION, '7.2.0', '>=' ) ) {
22		- return true;
23		- }
24		- return false;
25		- }
26		-
27		- /**
28	22	* Check if SSL is used.
29	23	*
30	24	* @return bool
31	25	*/
32	26	public function is_ssl(): bool {
	27	+ $server_data = defender_get_data_from_request( null, 's' );
33	28	if (
34		- ( ! empty( $_SERVER['HTTPS'] ) && ( 'on' === strtolower( $_SERVER['HTTPS'] ) || '1' === $_SERVER['HTTPS'] ) ) ||
35		- ( ! empty( $_SERVER['REQUEST_SCHEME'] ) && 'https' === $_SERVER['REQUEST_SCHEME'] ) ||
36		- ( ! empty( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && 'https' === $_SERVER['HTTP_X_FORWARDED_PROTO'] ) ||
37		- ( ! empty( $_SERVER['HTTP_X_FORWARDED_SSL'] ) && 'on' === $_SERVER['HTTP_X_FORWARDED_SSL'] )
	29	+ ( isset( $server_data['HTTPS'] ) && ( 'on' === strtolower( $server_data['HTTPS'] ) || '1' === $server_data['HTTPS'] ) ) ||
	30	+ ( isset( $server_data['REQUEST_SCHEME'] ) && 'https' === $server_data['REQUEST_SCHEME'] ) ||
	31	+ ( isset( $server_data['HTTP_X_FORWARDED_PROTO'] ) && 'https' === $server_data['HTTP_X_FORWARDED_PROTO'] ) ||
	32	+ ( isset( $server_data['HTTP_X_FORWARDED_SSL'] ) && 'on' === $server_data['HTTP_X_FORWARDED_SSL'] )
38	33	) {
39	34	return true;
40	35	}
41	36
		@@ -74,52 +69,51 @@
74	69	*
75	70	* @return bool
76	71	*/
77	72	public function check_webauthn_requirements(): bool {
78		- return $this->check_php_version() &&
79		- $this->is_ssl() &&
80		- $this->is_enabled_gmp() &&
81		- $this->is_enabled_mbstring() &&
82		- $this->is_enabled_sodium();
	73	+ return $this->is_ssl() &&
	74	+ $this->is_enabled_gmp() &&
	75	+ $this->is_enabled_mbstring() &&
	76	+ $this->is_enabled_sodium();
83	77	}
84	78
85	79	/**
86		- * Set transient.
	80	+ * Sets the value of a transient with a specific name, client ID, and expiration time.
87	81	*
88		- * @param string $name
89		- * @param mixed $value
90		- * @param string $client_id
91		- * @param int $exp
	82	+ * @param string $name The name of the transient.
	83	+ * @param mixed $value The value to be serialized and stored in the transient.
	84	+ * @param string $client_id The client ID associated with the transient.
	85	+ * @param int $exp The expiration time in seconds. Default is 90.
92	86	*
93		- * @return bool
	87	+ * @return bool Returns true if the transient was successfully set, false otherwise.
94	88	*/
95	89	public function set_trans_val( string $name, $value, string $client_id, int $exp = 90 ): bool {
96	90	$trans_name = $this->option_prefix . $name . '_' . $client_id;
97		- $trans_val = serialize( $value );
	91	+ $trans_val = wp_json_encode( $value );
98	92
99	93	return set_transient( $trans_name, $trans_val, $exp );
100	94	}
101	95
102	96	/**
103		- * Get transient.
	97	+ * Retrieves the value of a transient with the specified name and client ID.
104	98	*
105		- * @param string $name
106		- * @param string $client_id
	99	+ * @param string $name The name of the transient.
	100	+ * @param string $client_id The client ID associated with the transient.
107	101	*
108		- * @return mixed
	102	+ * @return mixed|false The deserialized value of the transient, or false if the transient does not exist.
109	103	*/
110	104	public function get_trans_val( string $name, string $client_id ) {
111	105	$trans_name = $this->option_prefix . $name . '_' . $client_id;
112		- $trans_val = get_transient( $trans_name );
	106	+ $trans_val = get_transient( $trans_name );
113	107
114		- return false !== $trans_val ? unserialize( $trans_val ) : false;
	108	+ return false !== $trans_val ? json_decode( $trans_val ) : false;
115	109	}
116	110
117	111	/**
118	112	* Delete transient.
119	113	*
120		- * @param string $name
121		- * @param string $client_id
	114	+ * @param string $name The name of the transient.
	115	+ * @param string $client_id The client ID associated with the transient.
122	116	*
123	117	* @return bool
124	118	*/
125	119	public function delete_trans( string $name, string $client_id ): bool {
		@@ -128,36 +122,38 @@
128	122	return delete_transient( $trans_name );
129	123	}
130	124
131	125	/**
132		- * Update option.
	126	+ * Update user meta.
133	127	*
134		- * @param string $name
135		- * @param mixed $value
	128	+ * @param int $user_id User ID.
	129	+ * @param string $name Metadata key.
	130	+ * @param mixed $value Metadata value. Must be serializable if non-scalar.
136	131	*
137		- * @return bool
	132	+ * @return int|bool
138	133	*/
139		- public function update_option( string $name, $value ): bool {
140		- return update_option( $this->option_prefix . $name, json_encode( $value ) );
	134	+ public function update_user_meta( int $user_id, string $name, $value ) {
	135	+ return update_user_meta( $user_id, $this->option_prefix . $name, addslashes( wp_json_encode( $value ) ) );
141	136	}
142	137
143	138	/**
144		- * Get option.
	139	+ * Get user meta.
145	140	*
146		- * @param string $name
	141	+ * @param int $user_id User ID.
	142	+ * @param string $name Metadata key.
147	143	*
148		- * @return mixed
	144	+ * @return array
149	145	*/
150		- public function get_option( string $name ) {
151		- $value = get_option( $this->option_prefix . $name );
152		- if ( null !== $value ) {
153		- try {
154		- return json_decode( $value, true );
155		- } catch ( Throwable $exception ) {
156		- return [];
157		- }
	146	+ public function get_user_meta( int $user_id, string $name ): array {
	147	+ $value = get_user_meta( $user_id, $this->option_prefix . $name, true );
	148	+
	149	+ if ( null === $value ) {
	150	+ return array();
158	151	}
159		- return [];
	152	+
	153	+ $data = json_decode( $value, true );
	154	+
	155	+ return is_array( $data ) ? $data : array();
160	156	}
161	157
162	158	/**
163	159	* Get website name.
		@@ -173,47 +169,46 @@
173	169	*
174	170	* @return string
175	171	*/
176	172	public function get_site_domain(): string {
177		- $site_url = get_bloginfo( 'url' );
	173	+ $site_url = get_bloginfo( 'url' );
178	174	$site_domain = preg_replace( '#^http(s)?:\/\/#', '', $site_url );
179	175	$site_domain = preg_replace( '#^www\.#', '', $site_domain );
180	176	$site_domain = explode( '/', $site_domain );
181	177
182		- return $site_domain[0] ?? $site_domain;
	178	+ return $site_domain[0];
183	179	}
184	180
185	181	/**
186		- * Get user hash.
	182	+ * Get the hash of a user's username using SHA-256 algorithm.
187	183	*
188		- * @param string $username
189		- * @param string $display_name
	184	+ * @param string $username The username of the user.
190	185	*
191		- * @return string
	186	+ * @return string The hashed username.
192	187	*/
193		- public function get_user_hash( string $username, string $display_name ): string {
194		- return hash( 'sha256', $username . '-' . $display_name . '-' . AUTH_SALT );
	188	+ public function get_user_hash( string $username ): string {
	189	+ return hash( 'sha256', $username );
195	190	}
196	191
197	192	/**
198	193	* URL safe base64 encoding.
199	194	*
200		- * @param string $data
	195	+ * @param string $data The data to encode.
201	196	*
202	197	* @return string
203	198	*/
204	199	public function base64url_encode( string $data ): string {
205		- return rtrim( strtr( base64_encode( $data ), '+/', '-_' ), '=' );
	200	+ return rtrim( strtr( base64_encode( $data ), '+/', '-_' ), '=' ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode
206	201	}
207	202
208	203	/**
209	204	* Base64 decoding from URL safe base64 encoding.
210	205	*
211		- * @param string $data
	206	+ * @param string $data The data to decode.
212	207	*
213	208	* @return string|bool
214	209	*/
215	210	public function base64url_decode( string $data ) {
216	211	// No need to add '=' at the end.
217		- return base64_decode( strtr( $data, '-_', '+/' ) );
	212	+ return base64_decode( strtr( $data, '-_', '+/' ), true ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
218	213	}
219	214	}