fluentform / app / Helpers / Protector.php

Protector.php in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 6.2.7, at app/Helpers/Protector.php

97 lines 2.4 KB

Raw Download Zip

1	<?php
2
3	namespace FluentForm\App\Helpers;
4
5	class Protector
6	{
7	/**
8	* Get the salt for the encryption and decryption.
9	*/
10	public static function getSalt()
11	{
12	$salt = get_option('_fluentform_security_salt');
13
14	if (!$salt) {
15	$salt = wp_generate_password();
16
17	update_option('_fluentform_security_salt', $salt, 'no');
18	}
19
20	return $salt;
21	}
22
23	/**
24	* Encryp a text using a predefined salt.
25	*
26	* @param string $text
27	*
28	* @return string $text
29	*/
30	public static function encrypt($text)
31	{
32	$key = static::getSalt();
33
34	$cipher = 'AES-128-CBC';
35
36	$ivlen = openssl_cipher_iv_length($cipher);
37
38	$iv = openssl_random_pseudo_bytes($ivlen);
39
40	$ciphertext_raw = openssl_encrypt($text, $cipher, $key, $options = OPENSSL_RAW_DATA, $iv);
41
42	$hmac = hash_hmac('sha256', $iv . $ciphertext_raw, $key, $as_binary = true);
43
44	return base64_encode($iv . $hmac . $ciphertext_raw);
45	}
46
47	/**
48	* Decrypt a text using a predefined salt.
49	*
50	* @param string $text
51	*
52	* @return string $text
53	*/
54	public static function decrypt($text)
55	{
56	$key = static::getSalt();
57
58	$c = base64_decode($text, true);
59
60	$cipher = 'AES-128-CBC';
61
62	$ivlen = openssl_cipher_iv_length($cipher);
63
64	$sha2len = 32;
65
66	if ($c === false \|\| strlen($c) < $ivlen + $sha2len) {
67	return null;
68	}
69
70	$iv = substr($c, 0, $ivlen);
71
72	$hmac = substr($c, $ivlen, $sha2len);
73
74	$ciphertext_raw = substr($c, $ivlen + $sha2len);
75
76	// Verify with current HMAC (IV + ciphertext)
77	$calcmac = hash_hmac('sha256', $iv . $ciphertext_raw, $key, $as_binary = true);
78
79	if (!hash_equals($hmac, $calcmac)) {
80	// Fallback: verify with legacy HMAC (ciphertext only) for tokens generated before v6.2.0 IV authentication fix.
81	if (!apply_filters('fluentform/allow_legacy_token_decrypt', false)) {
82	return null;
83	}
84
85	$legacymac = hash_hmac('sha256', $ciphertext_raw, $key, $as_binary = true);
86
87	if (!hash_equals($hmac, $legacymac)) {
88	return null;
89	}
90	}
91
92	$original_plaintext = openssl_decrypt($ciphertext_raw, $cipher, $key, $options = OPENSSL_RAW_DATA, $iv);
93
94	return $original_plaintext !== false ? $original_plaintext : null;
95	}
96	}
97