| @@ -13,8 +13,9 @@ | ||
| 13 | 13 | use SodiumException; |
| 14 | 14 | use RuntimeException; |
| 15 | 15 | use WP_Defender\Traits\IO; |
| 16 | 16 | use Calotes\Base\Component; |
| 17 | +use WP_Filesystem_Base; | |
| 17 | 18 | |
| 18 | 19 | /** |
| 19 | 20 | * Methods for generating cryptographically secure pseudo-random bytes and integers, comparing strings securely, |
| 20 | 21 | * and encrypting/decrypting data. |
| @@ -128,9 +129,9 @@ | ||
| 128 | 129 | * @throws SodiumException Throws an exception if encryption fails. |
| 129 | 130 | */ |
| 130 | 131 | private static function encrypt( $value, $key ) { |
| 131 | 132 | // This is not obfuscation. Just decode a base64-encoded string. |
| 132 | - $key = base64_decode( $key ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode | |
| 133 | + $key = base64_decode( $key, true ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode | |
| 133 | 134 | if ( SODIUM_CRYPTO_SECRETBOX_KEYBYTES !== mb_strlen( $key, '8bit' ) ) { |
| 134 | 135 | return new WP_Error( |
| 135 | 136 | Error_Code::ENCRYPT_ERROR, |
| 136 | 137 | esc_html__( 'The issue with Sodium library.', 'defender-security' ) |
| @@ -158,10 +159,10 @@ | ||
| 158 | 159 | esc_html__( 'Please re-setup 2FA TOTP method again.', 'defender-security' ) |
| 159 | 160 | ); |
| 160 | 161 | } |
| 161 | 162 | // No obfuscation. Just decode base64-encoded $key and $encoded_value strings. |
| 162 | - $key = base64_decode( $key ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode | |
| 163 | - $decoded = base64_decode( $encoded_value ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode | |
| 163 | + $key = base64_decode( $key, true ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode | |
| 164 | + $decoded = base64_decode( $encoded_value, true ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode | |
| 164 | 165 | $nonce = mb_substr( $decoded, 0, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES, '8bit' ); |
| 165 | 166 | $ciphertext = mb_substr( $decoded, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES, null, '8bit' ); |
| 166 | 167 | |
| 167 | 168 | $decrypted = sodium_crypto_secretbox_open( $ciphertext, $nonce, $key ); |
| @@ -266,9 +267,9 @@ | ||
| 266 | 267 | */ |
| 267 | 268 | public function create_key_file(): bool { |
| 268 | 269 | global $wp_filesystem; |
| 269 | 270 | // Initialize the WP filesystem, no more using 'file-put-contents' function. |
| 270 | - if ( empty( $wp_filesystem ) ) { | |
| 271 | + if ( ! $wp_filesystem instanceof WP_Filesystem_Base ) { | |
| 271 | 272 | require_once ABSPATH . '/wp-admin/includes/file.php'; |
| 272 | 273 | WP_Filesystem(); |
| 273 | 274 | } |
| 274 | 275 | $to = self::get_path_to_key_file(); |
