← All changes | src/traits/webauthn.php +60 -52 3.1.0 → 6.3.0 View file →

		@@ -1,5 +1,10 @@
1	1	<?php
	2	+/**
	3	+ * Helper functions for webauthn related tasks.
	4	+ *
	5	+ * @package WP_Defender\Traits
	6	+ */
2	7
3	8	namespace WP_Defender\Traits;
4	9
5	10	use Throwable;
		@@ -4,8 +9,9 @@
4	9
5	10	use Throwable;
6	11
7	12	trait Webauthn {
	13	+
8	14	/**
9	15	* Prefix used for option.
10	16	*
11	17	* @var string
		@@ -17,13 +23,14 @@
17	23	*
18	24	* @return bool
19	25	*/
20	26	public function is_ssl(): bool {
	27	+ $server_data = defender_get_data_from_request( null, 's' );
21	28	if (
22		- ( ! empty( $_SERVER['HTTPS'] ) && ( 'on' === strtolower( $_SERVER['HTTPS'] ) || '1' === $_SERVER['HTTPS'] ) ) ||
23		- ( ! empty( $_SERVER['REQUEST_SCHEME'] ) && 'https' === $_SERVER['REQUEST_SCHEME'] ) ||
24		- ( ! empty( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && 'https' === $_SERVER['HTTP_X_FORWARDED_PROTO'] ) ||
25		- ( ! empty( $_SERVER['HTTP_X_FORWARDED_SSL'] ) && 'on' === $_SERVER['HTTP_X_FORWARDED_SSL'] )
	29	+ ( isset( $server_data['HTTPS'] ) && ( 'on' === strtolower( $server_data['HTTPS'] ) || '1' === $server_data['HTTPS'] ) ) ||
	30	+ ( isset( $server_data['REQUEST_SCHEME'] ) && 'https' === $server_data['REQUEST_SCHEME'] ) ||
	31	+ ( isset( $server_data['HTTP_X_FORWARDED_PROTO'] ) && 'https' === $server_data['HTTP_X_FORWARDED_PROTO'] ) ||
	32	+ ( isset( $server_data['HTTP_X_FORWARDED_SSL'] ) && 'on' === $server_data['HTTP_X_FORWARDED_SSL'] )
26	33	) {
27	34	return true;
28	35	}
29	36
		@@ -63,50 +70,50 @@
63	70	* @return bool
64	71	*/
65	72	public function check_webauthn_requirements(): bool {
66	73	return $this->is_ssl() &&
67		- $this->is_enabled_gmp() &&
68		- $this->is_enabled_mbstring() &&
69		- $this->is_enabled_sodium();
	74	+ $this->is_enabled_gmp() &&
	75	+ $this->is_enabled_mbstring() &&
	76	+ $this->is_enabled_sodium();
70	77	}
71	78
72	79	/**
73		- * Set transient.
	80	+ * Sets the value of a transient with a specific name, client ID, and expiration time.
74	81	*
75		- * @param string $name
76		- * @param mixed $value
77		- * @param string $client_id
78		- * @param int $exp
	82	+ * @param string $name The name of the transient.
	83	+ * @param mixed $value The value to be serialized and stored in the transient.
	84	+ * @param string $client_id The client ID associated with the transient.
	85	+ * @param int $exp The expiration time in seconds. Default is 90.
79	86	*
80		- * @return bool
	87	+ * @return bool Returns true if the transient was successfully set, false otherwise.
81	88	*/
82	89	public function set_trans_val( string $name, $value, string $client_id, int $exp = 90 ): bool {
83	90	$trans_name = $this->option_prefix . $name . '_' . $client_id;
84		- $trans_val = serialize( $value );
	91	+ $trans_val = wp_json_encode( $value );
85	92
86	93	return set_transient( $trans_name, $trans_val, $exp );
87	94	}
88	95
89	96	/**
90		- * Get transient.
	97	+ * Retrieves the value of a transient with the specified name and client ID.
91	98	*
92		- * @param string $name
93		- * @param string $client_id
	99	+ * @param string $name The name of the transient.
	100	+ * @param string $client_id The client ID associated with the transient.
94	101	*
95		- * @return mixed
	102	+ * @return mixed|false The deserialized value of the transient, or false if the transient does not exist.
96	103	*/
97	104	public function get_trans_val( string $name, string $client_id ) {
98	105	$trans_name = $this->option_prefix . $name . '_' . $client_id;
99		- $trans_val = get_transient( $trans_name );
	106	+ $trans_val = get_transient( $trans_name );
100	107
101		- return false !== $trans_val ? unserialize( $trans_val ) : false;
	108	+ return false !== $trans_val ? json_decode( $trans_val ) : false;
102	109	}
103	110
104	111	/**
105	112	* Delete transient.
106	113	*
107		- * @param string $name
108		- * @param string $client_id
	114	+ * @param string $name The name of the transient.
	115	+ * @param string $client_id The client ID associated with the transient.
109	116	*
110	117	* @return bool
111	118	*/
112	119	public function delete_trans( string $name, string $client_id ): bool {
		@@ -115,36 +122,38 @@
115	122	return delete_transient( $trans_name );
116	123	}
117	124
118	125	/**
119		- * Update option.
	126	+ * Update user meta.
120	127	*
121		- * @param string $name
122		- * @param mixed $value
	128	+ * @param int $user_id User ID.
	129	+ * @param string $name Metadata key.
	130	+ * @param mixed $value Metadata value. Must be serializable if non-scalar.
123	131	*
124		- * @return bool
	132	+ * @return int|bool
125	133	*/
126		- public function update_option( string $name, $value ): bool {
127		- return update_option( $this->option_prefix . $name, json_encode( $value ) );
	134	+ public function update_user_meta( int $user_id, string $name, $value ) {
	135	+ return update_user_meta( $user_id, $this->option_prefix . $name, addslashes( wp_json_encode( $value ) ) );
128	136	}
129	137
130	138	/**
131		- * Get option.
	139	+ * Get user meta.
132	140	*
133		- * @param string $name
	141	+ * @param int $user_id User ID.
	142	+ * @param string $name Metadata key.
134	143	*
135		- * @return mixed
	144	+ * @return array
136	145	*/
137		- public function get_option( string $name ) {
138		- $value = get_option( $this->option_prefix . $name );
139		- if ( null !== $value ) {
140		- try {
141		- return json_decode( $value, true );
142		- } catch ( Throwable $exception ) {
143		- return [];
144		- }
	146	+ public function get_user_meta( int $user_id, string $name ): array {
	147	+ $value = get_user_meta( $user_id, $this->option_prefix . $name, true );
	148	+
	149	+ if ( null === $value ) {
	150	+ return array();
145	151	}
146		- return [];
	152	+
	153	+ $data = json_decode( $value, true );
	154	+
	155	+ return is_array( $data ) ? $data : array();
147	156	}
148	157
149	158	/**
150	159	* Get website name.
		@@ -160,47 +169,46 @@
160	169	*
161	170	* @return string
162	171	*/
163	172	public function get_site_domain(): string {
164		- $site_url = get_bloginfo( 'url' );
	173	+ $site_url = get_bloginfo( 'url' );
165	174	$site_domain = preg_replace( '#^http(s)?:\/\/#', '', $site_url );
166	175	$site_domain = preg_replace( '#^www\.#', '', $site_domain );
167	176	$site_domain = explode( '/', $site_domain );
168	177
169		- return $site_domain[0] ?? $site_domain;
	178	+ return $site_domain[0];
170	179	}
171	180
172	181	/**
173		- * Get user hash.
	182	+ * Get the hash of a user's username using SHA-256 algorithm.
174	183	*
175		- * @param string $username
176		- * @param string $display_name
	184	+ * @param string $username The username of the user.
177	185	*
178		- * @return string
	186	+ * @return string The hashed username.
179	187	*/
180		- public function get_user_hash( string $username, string $display_name ): string {
181		- return hash( 'sha256', $username . '-' . $display_name . '-' . AUTH_SALT );
	188	+ public function get_user_hash( string $username ): string {
	189	+ return hash( 'sha256', $username );
182	190	}
183	191
184	192	/**
185	193	* URL safe base64 encoding.
186	194	*
187		- * @param string $data
	195	+ * @param string $data The data to encode.
188	196	*
189	197	* @return string
190	198	*/
191	199	public function base64url_encode( string $data ): string {
192		- return rtrim( strtr( base64_encode( $data ), '+/', '-_' ), '=' );
	200	+ return rtrim( strtr( base64_encode( $data ), '+/', '-_' ), '=' ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode
193	201	}
194	202
195	203	/**
196	204	* Base64 decoding from URL safe base64 encoding.
197	205	*
198		- * @param string $data
	206	+ * @param string $data The data to decode.
199	207	*
200	208	* @return string|bool
201	209	*/
202	210	public function base64url_decode( string $data ) {
203	211	// No need to add '=' at the end.
204		- return base64_decode( strtr( $data, '-_', '+/' ) );
	212	+ return base64_decode( strtr( $data, '-_', '+/' ), true ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
205	213	}
206	214	}