mailchimp / includes / class-mailchimp-data-encryption.php

class-mailchimp-data-encryption.php in Mailchimp List Subscribe Form 2.0.1, at includes/class-mailchimp-data-encryption.php

148 lines 3.4 KB

Raw Download Zip

1	<?php
2	/**
3	* Class responsible for encrypting and decrypting data.
4	*
5	* @package Mailchimp
6	*/
7
8	// Exit if accessed directly.
9	if ( ! defined( 'ABSPATH' ) ) {
10	exit;
11	}
12
13	/**
14	* Class Mailchimp_Data_Encryption
15	*
16	* @since 1.6.0
17	*/
18	class Mailchimp_Data_Encryption {
19
20	/**
21	* Key to use for encryption.
22	*
23	* @since 1.6.0
24	* @var string
25	*/
26	private $key;
27
28	/**
29	* Salt to use for encryption.
30	*
31	* @since 1.6.0
32	* @var string
33	*/
34	private $salt;
35
36	/**
37	* Constructor.
38	*
39	* @since 1.6.0
40	*/
41	public function __construct() {
42	$this->key = $this->get_default_key();
43	$this->salt = $this->get_default_salt();
44	}
45
46	/**
47	* Encrypts a value.
48	*
49	* If a user-based key is set, that is used. Otherwise the default key is used.
50	*
51	* @since 1.6.0
52	*
53	* @param string $value Value to encrypt.
54	* @return string\|bool Encrypted value, or false on failure.
55	*/
56	public function encrypt( $value ) {
57	if ( ! extension_loaded( 'openssl' ) ) {
58	return $value;
59	}
60
61	$method = 'aes-256-ctr';
62	$ivlen = openssl_cipher_iv_length( $method );
63	$iv = openssl_random_pseudo_bytes( $ivlen );
64
65	$raw_value = openssl_encrypt( $value . $this->salt, $method, $this->key, 0, $iv );
66	if ( ! $raw_value ) {
67	return false;
68	}
69
70	return base64_encode( $iv . $raw_value ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode
71	}
72
73	/**
74	* Decrypts a value.
75	*
76	* If a user-based key is set, that is used. Otherwise the default key is used.
77	*
78	* @since 1.6.0
79	*
80	* @param string $raw_value Value to decrypt.
81	* @return string\|bool Decrypted value, or false on failure.
82	*/
83	public function decrypt( $raw_value ) {
84	if ( ! extension_loaded( 'openssl' ) \|\| ! is_string( $raw_value ) ) {
85	return $raw_value;
86	}
87
88	$decoded_value = base64_decode( $raw_value, true ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
89
90	if ( false === $decoded_value ) {
91	return $raw_value;
92	}
93
94	$method = 'aes-256-ctr';
95	$ivlen = openssl_cipher_iv_length( $method );
96	$iv = substr( $decoded_value, 0, $ivlen );
97
98	$decoded_value = substr( $decoded_value, $ivlen );
99
100	$value = openssl_decrypt( $decoded_value, $method, $this->key, 0, $iv );
101	if ( ! $value \|\| substr( $value, - strlen( $this->salt ) ) !== $this->salt ) {
102	return false;
103	}
104
105	return substr( $value, 0, - strlen( $this->salt ) );
106	}
107
108	/**
109	* Gets the default encryption key to use.
110	*
111	* @since 1.6.0
112	*
113	* @return string Default (not user-based) encryption key.
114	*/
115	private function get_default_key() {
116	if ( defined( 'MAILCHIMP_SF_ENCRYPTION_KEY' ) && '' !== MAILCHIMP_SF_ENCRYPTION_KEY ) {
117	return MAILCHIMP_SF_ENCRYPTION_KEY;
118	}
119
120	if ( defined( 'LOGGED_IN_KEY' ) && '' !== LOGGED_IN_KEY ) {
121	return LOGGED_IN_KEY;
122	}
123
124	// Ideally this default is never used but we have it just in case.
125	return 'vJgwa_qf0u(k!uir[rB);g;DciNAKuX;+q&`A+z&m6kX3Y\|$q.U3:Q>!$)6CA+=O';
126	}
127
128	/**
129	* Gets the default encryption salt to use.
130	*
131	* @since 1.6.0
132	*
133	* @return string Encryption salt.
134	*/
135	private function get_default_salt() {
136	if ( defined( 'MAILCHIMP_SF_ENCRYPTION_SALT' ) && '' !== MAILCHIMP_SF_ENCRYPTION_SALT ) {
137	return MAILCHIMP_SF_ENCRYPTION_SALT;
138	}
139
140	if ( defined( 'LOGGED_IN_SALT' ) && '' !== LOGGED_IN_SALT ) {
141	return LOGGED_IN_SALT;
142	}
143
144	// Ideally this default is never used but we have it just in case.
145	return '\|qhC}/w6q+$V`H>wM:AtNpg/{s)g<k{F:WMcvJJD[K6c_Kb1OEy^Yx7f\|$Ovm+X\|';
146	}
147	}
148