← All changes | Inc/Core/Helpers/Encryption.php +48 -3 3.1.12 → 3.1.14 View file →

		@@ -1,8 +1,8 @@
1	1	<?php
2	2	/**
3	3	* @package FireBox
4		- * @version 3.1.12
	4	+ * @version 3.1.14
5	5	*
6	6	* @author FirePlugins <[email protected]>
7	7	* @link https://www.fireplugins.com
8	8	* @copyright Copyright © 2026 FirePlugins All Rights Reserved
		@@ -48,8 +48,16 @@
48	48	*/
49	49	const CIPHER = 'aes-256-cbc';
50	50
51	51	/**
	52	+ * Prefix of payloads that carry an HMAC. Older values have no prefix and are
	53	+ * still accepted on read so existing credentials keep working.
	54	+ *
	55	+ * @var string
	56	+ */
	57	+ const AUTHENTICATED_PREFIX = 'fbx2:';
	58	+
	59	+ /**
52	60	* Encrypt value for storage.
53	61	*
54	62	* @param string $value
55	63	*
		@@ -79,9 +87,12 @@
79	87	*/
80	88	return false;
81	89	}
82	90
83		- return base64_encode($encrypted_payload);
	91	+ // Authenticate iv+ciphertext so a tampered value is rejected instead of decrypted to garbage.
	92	+ $mac = hash_hmac('sha256', $encrypted_payload, $this->getMacKey($key), true);
	93	+
	94	+ return self::AUTHENTICATED_PREFIX . base64_encode($encrypted_payload . $mac);
84	95	}
85	96
86	97	/**
87	98	* Decrypt value from storage.
		@@ -97,9 +108,12 @@
97	108	{
98	109	return '';
99	110	}
100	111
101		- $decoded = base64_decode($value, true);
	112	+ $authenticated = strpos($value, self::AUTHENTICATED_PREFIX) === 0;
	113	+ $encoded = $authenticated ? substr($value, strlen(self::AUTHENTICATED_PREFIX)) : $value;
	114	+
	115	+ $decoded = base64_decode($encoded, true);
102	116	if ($decoded === false || $decoded === '')
103	117	{
104	118	// Not a payload we produced; hand back the value as stored.
105	119	return $value;
		@@ -110,8 +124,27 @@
110	124	{
111	125	return $value;
112	126	}
113	127
	128	+ if ($authenticated)
	129	+ {
	130	+ $mac_length = 32;
	131	+ if (strlen($decoded) <= $mac_length)
	132	+ {
	133	+ return '';
	134	+ }
	135	+
	136	+ $payload = substr($decoded, 0, -$mac_length);
	137	+ $mac = substr($decoded, -$mac_length);
	138	+
	139	+ if (!hash_equals(hash_hmac('sha256', $payload, $this->getMacKey($key), true), $mac))
	140	+ {
	141	+ return '';
	142	+ }
	143	+
	144	+ $decoded = $payload;
	145	+ }
	146	+
114	147	$decrypted = $this->decryptWithOpenSSL($decoded, $key);
115	148	if ($decrypted === '')
116	149	{
117	150	/**
		@@ -157,8 +190,20 @@
157	190	* @param string $key
158	191	*
159	192	* @return string|false
160	193	*/
	194	+ /**
	195	+ * Separate key for the MAC, derived from the encryption key.
	196	+ *
	197	+ * @param string $key
	198	+ *
	199	+ * @return string
	200	+ */
	201	+ private function getMacKey($key)
	202	+ {
	203	+ return hash('sha256', 'mac|' . $key, true);
	204	+ }
	205	+
161	206	private function encryptWithOpenSSL($value = '', $key = '')
162	207	{
163	208	if (!self::isAvailable())
164	209	{