| @@ -1,8 +1,8 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | /** |
| 3 | 3 | * @package FireBox |
| 4 | - * @version 3.1.10 | |
| 4 | + * @version 3.1.14 | |
| 5 | 5 | * |
| 6 | 6 | * @author FirePlugins <[email protected]> |
| 7 | 7 | * @link https://www.fireplugins.com |
| 8 | 8 | * @copyright Copyright © 2026 FirePlugins All Rights Reserved |
| @@ -48,8 +48,16 @@ | ||
| 48 | 48 | */ |
| 49 | 49 | const CIPHER = 'aes-256-cbc'; |
| 50 | 50 | |
| 51 | 51 | /** |
| 52 | + * Prefix of payloads that carry an HMAC. Older values have no prefix and are | |
| 53 | + * still accepted on read so existing credentials keep working. | |
| 54 | + * | |
| 55 | + * @var string | |
| 56 | + */ | |
| 57 | + const AUTHENTICATED_PREFIX = 'fbx2:'; | |
| 58 | + | |
| 59 | + /** | |
| 52 | 60 | * Encrypt value for storage. |
| 53 | 61 | * |
| 54 | 62 | * @param string $value |
| 55 | 63 | * |
| @@ -79,9 +87,12 @@ | ||
| 79 | 87 | */ |
| 80 | 88 | return false; |
| 81 | 89 | } |
| 82 | 90 | |
| 83 | - return base64_encode($encrypted_payload); | |
| 91 | + // Authenticate iv+ciphertext so a tampered value is rejected instead of decrypted to garbage. | |
| 92 | + $mac = hash_hmac('sha256', $encrypted_payload, $this->getMacKey($key), true); | |
| 93 | + | |
| 94 | + return self::AUTHENTICATED_PREFIX . base64_encode($encrypted_payload . $mac); | |
| 84 | 95 | } |
| 85 | 96 | |
| 86 | 97 | /** |
| 87 | 98 | * Decrypt value from storage. |
| @@ -97,9 +108,12 @@ | ||
| 97 | 108 | { |
| 98 | 109 | return ''; |
| 99 | 110 | } |
| 100 | 111 | |
| 101 | - $decoded = base64_decode($value, true); | |
| 112 | + $authenticated = strpos($value, self::AUTHENTICATED_PREFIX) === 0; | |
| 113 | + $encoded = $authenticated ? substr($value, strlen(self::AUTHENTICATED_PREFIX)) : $value; | |
| 114 | + | |
| 115 | + $decoded = base64_decode($encoded, true); | |
| 102 | 116 | if ($decoded === false || $decoded === '') |
| 103 | 117 | { |
| 104 | 118 | // Not a payload we produced; hand back the value as stored. |
| 105 | 119 | return $value; |
| @@ -110,8 +124,27 @@ | ||
| 110 | 124 | { |
| 111 | 125 | return $value; |
| 112 | 126 | } |
| 113 | 127 | |
| 128 | + if ($authenticated) | |
| 129 | + { | |
| 130 | + $mac_length = 32; | |
| 131 | + if (strlen($decoded) <= $mac_length) | |
| 132 | + { | |
| 133 | + return ''; | |
| 134 | + } | |
| 135 | + | |
| 136 | + $payload = substr($decoded, 0, -$mac_length); | |
| 137 | + $mac = substr($decoded, -$mac_length); | |
| 138 | + | |
| 139 | + if (!hash_equals(hash_hmac('sha256', $payload, $this->getMacKey($key), true), $mac)) | |
| 140 | + { | |
| 141 | + return ''; | |
| 142 | + } | |
| 143 | + | |
| 144 | + $decoded = $payload; | |
| 145 | + } | |
| 146 | + | |
| 114 | 147 | $decrypted = $this->decryptWithOpenSSL($decoded, $key); |
| 115 | 148 | if ($decrypted === '') |
| 116 | 149 | { |
| 117 | 150 | /** |
| @@ -157,8 +190,20 @@ | ||
| 157 | 190 | * @param string $key |
| 158 | 191 | * |
| 159 | 192 | * @return string|false |
| 160 | 193 | */ |
| 194 | + /** | |
| 195 | + * Separate key for the MAC, derived from the encryption key. | |
| 196 | + * | |
| 197 | + * @param string $key | |
| 198 | + * | |
| 199 | + * @return string | |
| 200 | + */ | |
| 201 | + private function getMacKey($key) | |
| 202 | + { | |
| 203 | + return hash('sha256', 'mac|' . $key, true); | |
| 204 | + } | |
| 205 | + | |
| 161 | 206 | private function encryptWithOpenSSL($value = '', $key = '') |
| 162 | 207 | { |
| 163 | 208 | if (!self::isAvailable()) |
| 164 | 209 | { |
