| 1 |
<?php |
| 2 |
|
| 3 |
namespace Leadin\auth; |
| 4 |
|
| 5 |
/** |
| 6 |
* Encrypting/decrypting OAuth credentials |
| 7 |
* Adapted from https://felix-arntz.me/blog/storing-confidential-data-in-wordpress/ |
| 8 |
*/ |
| 9 |
class OAuthCrypto { |
| 10 |
|
| 11 |
/** |
| 12 |
* Return the key to use in encrypting/decrypting OAuth credentials |
| 13 |
*/ |
| 14 |
private static function get_key() { |
| 15 |
if ( defined( 'LEADIN_KEY' ) ) { |
| 16 |
return LEADIN_KEY; |
| 17 |
} |
| 18 |
|
| 19 |
return ''; |
| 20 |
} |
| 21 |
|
| 22 |
/** |
| 23 |
* Return the salt to use in encrypting/decrypting OAuth credentials |
| 24 |
*/ |
| 25 |
private static function get_salt() { |
| 26 |
if ( defined( 'LEADIN_SALT' ) ) { |
| 27 |
return LEADIN_SALT; |
| 28 |
} |
| 29 |
|
| 30 |
return ''; |
| 31 |
} |
| 32 |
|
| 33 |
/** |
| 34 |
* Given a value, encrypt it if the openssl extension is loaded and we have a valid key/salt |
| 35 |
* |
| 36 |
* @param string $value Value to encrypt. |
| 37 |
* |
| 38 |
* @return string Encrypted value |
| 39 |
*/ |
| 40 |
public static function encrypt( $value ) { |
| 41 |
if ( ! extension_loaded( 'openssl' ) || |
| 42 |
empty( self::get_key() ) || |
| 43 |
empty( self::get_salt() ) ) { |
| 44 |
return $value; |
| 45 |
} |
| 46 |
|
| 47 |
$method = 'aes-256-ctr'; |
| 48 |
$init_vector_length = openssl_cipher_iv_length( $method ); |
| 49 |
$init_vector = openssl_random_pseudo_bytes( $init_vector_length ); |
| 50 |
|
| 51 |
$raw_value = openssl_encrypt( $value . self::get_salt(), $method, self::get_key(), 0, $init_vector ); |
| 52 |
if ( ! $raw_value ) { |
| 53 |
return false; |
| 54 |
} |
| 55 |
|
| 56 |
// phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode |
| 57 |
return base64_encode( $init_vector . $raw_value ); |
| 58 |
} |
| 59 |
|
| 60 |
/** |
| 61 |
* Decrpyt a given value |
| 62 |
* |
| 63 |
* @param string $value the encrypted value to decrypt. |
| 64 |
* |
| 65 |
* @return string The decrypted value |
| 66 |
*/ |
| 67 |
public static function decrypt( $value ) { |
| 68 |
if ( ! extension_loaded( 'openssl' ) || |
| 69 |
empty( self::get_key() ) || |
| 70 |
empty( self::get_salt() ) ) { |
| 71 |
return $value; |
| 72 |
} |
| 73 |
|
| 74 |
// phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode |
| 75 |
$raw_value = base64_decode( $value, true ); |
| 76 |
|
| 77 |
$method = 'aes-256-ctr'; |
| 78 |
$init_vector_length = openssl_cipher_iv_length( $method ); |
| 79 |
$init_vector = substr( $raw_value, 0, $init_vector_length ); |
| 80 |
|
| 81 |
$raw_value = substr( $raw_value, $init_vector_length ); |
| 82 |
|
| 83 |
$value = openssl_decrypt( $raw_value, $method, self::get_key(), 0, $init_vector ); |
| 84 |
if ( ! $value || substr( $value, - strlen( self::get_salt() ) ) !== self::get_salt() ) { |
| 85 |
return false; |
| 86 |
} |
| 87 |
|
| 88 |
return substr( $value, 0, - strlen( self::get_salt() ) ); |
| 89 |
} |
| 90 |
} |
| 91 |
|
