leadin / public / auth / class-oauthcrypto.php

class-oauthcrypto.php in HubSpot All-In-One Marketing – Forms, Popups, Live Chat 11.1.13, at public/auth/class-oauthcrypto.php

123 lines 3.3 KB

Raw Download Zip

1	<?php
2
3	namespace Leadin\auth;
4
5	use Leadin\data\Portal_Options;
6
7	/**
8	* Encrypting/decrypting OAuth credentials
9	* Adapted from https://felix-arntz.me/blog/storing-confidential-data-in-wordpress/
10	*/
11	class OAuthCrypto {
12
13	/**
14	* Return the key to use in encrypting/decrypting OAuth credentials
15	*/
16	private static function get_key() {
17	if ( defined( 'LOGGED_IN_KEY' ) ) {
18	return LOGGED_IN_KEY;
19	}
20
21	return '';
22	}
23
24	/**
25	* Return the salt to use in encrypting/decrypting OAuth credentials
26	*/
27	private static function get_salt() {
28	if ( defined( 'LOGGED_IN_SALT' ) ) {
29	return LOGGED_IN_SALT;
30	}
31
32	return '';
33	}
34
35	/**
36	* Given a value, encrypt it if the openssl extension is loaded and we have a valid key/salt
37	*
38	* @param string $value Value to encrypt.
39	*
40	* @return string Encrypted value
41	*/
42	public static function encrypt( $value ) {
43	if ( ! extension_loaded( 'openssl' ) ) {
44	Portal_Options::set_encryption_error( 'Error: OpenSSL extension not loaded' );
45	return $value;
46	}
47
48	if ( empty( self::get_key() ) ) {
49	Portal_Options::set_encryption_error( 'Error: Encryption key is missing' );
50	return $value;
51	}
52
53	if ( empty( self::get_salt() ) ) {
54	Portal_Options::set_encryption_error( 'Error: Encryption salt is missing' );
55	return $value;
56	}
57
58	$method = 'aes-256-ctr';
59	$init_vector_length = openssl_cipher_iv_length( $method );
60	$init_vector = openssl_random_pseudo_bytes( $init_vector_length );
61
62	if ( false === $init_vector ) {
63	return 'Error: Failed to generate initialization vector';
64	}
65
66	$raw_value = openssl_encrypt( $value . self::get_salt(), $method, self::get_key(), 0, $init_vector );
67	if ( ! $raw_value ) {
68	Portal_Options::set_encryption_error( 'Error: Encryption failed' );
69	return false;
70	}
71
72	// phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode
73	return base64_encode( $init_vector . $raw_value );
74	}
75
76	/**
77	* Decrpyt a given value
78	*
79	* @param string $value the encrypted value to decrypt.
80	*
81	* @return string The decrypted value
82	*/
83	public static function decrypt( $value ) {
84	if ( ! extension_loaded( 'openssl' ) ) {
85	return 'Error: OpenSSL extension not loaded';
86	}
87
88	if ( empty( self::get_key() ) ) {
89	return 'Error: Encryption key is missing';
90	}
91
92	if ( empty( self::get_salt() ) ) {
93	return 'Error: Encryption salt is missing';
94	}
95
96	// phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
97	$raw_value = base64_decode( $value, true );
98	if ( false === $raw_value ) {
99	return 'Error: Base64 decoding failed';
100	}
101
102	$method = 'aes-256-ctr';
103	$init_vector_length = openssl_cipher_iv_length( $method );
104	$init_vector = substr( $raw_value, 0, $init_vector_length );
105	$encrypted_data = substr( $raw_value, $init_vector_length );
106
107	if ( false === $init_vector \|\| false === $encrypted_data ) {
108	return 'Error: Failed to extract IV or encrypted data';
109	}
110
111	$decrypted_value = openssl_decrypt( $encrypted_data, $method, self::get_key(), 0, $init_vector );
112	if ( false === $decrypted_value ) {
113	return 'Error: Decryption failed';
114	}
115
116	if ( self::get_salt() !== substr( $decrypted_value, -strlen( self::get_salt() ) ) ) {
117	return 'Error: Salt verification failed';
118	}
119
120	return substr( $decrypted_value, 0, -strlen( self::get_salt() ) );
121	}
122	}
123