← All changes | src/component/class-crypt.php +3 -3 5.6.0 → 6.3.0 View file →

		@@ -129,9 +129,9 @@
129	129	* @throws SodiumException Throws an exception if encryption fails.
130	130	*/
131	131	private static function encrypt( $value, $key ) {
132	132	// This is not obfuscation. Just decode a base64-encoded string.
133		- $key = base64_decode( $key ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
	133	+ $key = base64_decode( $key, true ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
134	134	if ( SODIUM_CRYPTO_SECRETBOX_KEYBYTES !== mb_strlen( $key, '8bit' ) ) {
135	135	return new WP_Error(
136	136	Error_Code::ENCRYPT_ERROR,
137	137	esc_html__( 'The issue with Sodium library.', 'defender-security' )
		@@ -159,10 +159,10 @@
159	159	esc_html__( 'Please re-setup 2FA TOTP method again.', 'defender-security' )
160	160	);
161	161	}
162	162	// No obfuscation. Just decode base64-encoded $key and $encoded_value strings.
163		- $key = base64_decode( $key ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
164		- $decoded = base64_decode( $encoded_value ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
	163	+ $key = base64_decode( $key, true ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
	164	+ $decoded = base64_decode( $encoded_value, true ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
165	165	$nonce = mb_substr( $decoded, 0, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES, '8bit' );
166	166	$ciphertext = mb_substr( $decoded, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES, null, '8bit' );
167	167
168	168	$decrypted = sodium_crypto_secretbox_open( $ciphertext, $nonce, $key );