DataInconsistency
2 weeks ago
License
2 months ago
Notices
2 months ago
pQuery
2 months ago
APIPermissionHelper.php
1 year ago
CdnAssetUrl.php
3 years ago
ConflictResolver.php
1 month ago
Cookies.php
2 months ago
DBCollationChecker.php
2 months ago
DOM.php
2 years ago
DateConverter.php
3 years ago
FreeDomains.php
3 years ago
Headers.php
1 year ago
Helpers.php
1 month ago
Installation.php
1 year ago
LegacyDatabase.php
1 year ago
Request.php
2 months ago
SecondLevelDomainNames.php
3 years ago
Security.php
2 months ago
ThirdPartyOutput.php
1 month ago
Url.php
2 months ago
index.php
3 years ago
Security.php
99 lines
| 1 | <?php // phpcs:ignore SlevomatCodingStandard.TypeHints.DeclareStrictTypes.DeclareStrictTypesMissing |
| 2 | |
| 3 | namespace MailPoet\Util; |
| 4 | |
| 5 | if (!defined('ABSPATH')) exit; |
| 6 | |
| 7 | |
| 8 | use Exception; |
| 9 | use MailPoet\Entities\NewsletterEntity; |
| 10 | use MailPoet\Entities\SubscriberEntity; |
| 11 | use MailPoet\Newsletter\NewslettersRepository; |
| 12 | use MailPoet\Subscribers\SubscribersRepository; |
| 13 | |
| 14 | class Security { |
| 15 | const HASH_LENGTH = 12; |
| 16 | const UNSUBSCRIBE_TOKEN_LENGTH = 15; |
| 17 | |
| 18 | /** @var NewslettersRepository */ |
| 19 | private $newslettersRepository; |
| 20 | |
| 21 | /** @var SubscribersRepository */ |
| 22 | private $subscribersRepository; |
| 23 | |
| 24 | public function __construct( |
| 25 | NewslettersRepository $newslettersRepository, |
| 26 | SubscribersRepository $subscribersRepository |
| 27 | ) { |
| 28 | $this->newslettersRepository = $newslettersRepository; |
| 29 | $this->subscribersRepository = $subscribersRepository; |
| 30 | } |
| 31 | |
| 32 | /** |
| 33 | * Generate random lowercase alphanumeric string. |
| 34 | * 1 lowercase alphanumeric character = 6 bits (because log2(36) = 5.17) |
| 35 | * So 3 bytes = 4 characters |
| 36 | * @param int $length Minimal lenght is 5 |
| 37 | * @return string |
| 38 | */ |
| 39 | public static function generateRandomString($length = 5): string { |
| 40 | $length = max(5, (int)$length); |
| 41 | $string = base_convert( |
| 42 | bin2hex( |
| 43 | random_bytes( // phpcs:ignore |
| 44 | max(1, (int)ceil(3 * $length / 4)) |
| 45 | ) |
| 46 | ), |
| 47 | 16, |
| 48 | 36 |
| 49 | ); |
| 50 | $result = substr($string, 0, $length); |
| 51 | if (strlen($result) === $length) return $result; |
| 52 | // in very rare occasions we generate a shorter string when random_bytes generates something starting with 0 let's try again |
| 53 | return self::generateRandomString($length); |
| 54 | } |
| 55 | |
| 56 | /** |
| 57 | * @param int $length Maximal length is 32 |
| 58 | * @return string |
| 59 | */ |
| 60 | public static function generateHash($length = null) { |
| 61 | $length = ($length) ? $length : self::HASH_LENGTH; |
| 62 | $authKey = self::generateRandomString(64); |
| 63 | if (defined('AUTH_KEY')) { |
| 64 | $authKey = AUTH_KEY; |
| 65 | } |
| 66 | $hash = substr( |
| 67 | hash_hmac('sha512', self::generateRandomString(64), (string)$authKey), |
| 68 | 0, |
| 69 | $length |
| 70 | ); |
| 71 | return is_string($hash) ? $hash : ''; |
| 72 | } |
| 73 | |
| 74 | static public function generateUnsubscribeToken($model) { |
| 75 | do { |
| 76 | $token = self::generateRandomString(self::UNSUBSCRIBE_TOKEN_LENGTH); |
| 77 | $found = $model::whereEqual('unsubscribe_token', $token)->count(); |
| 78 | } while ($found > 0); |
| 79 | return $token; |
| 80 | } |
| 81 | |
| 82 | public function generateUnsubscribeTokenByEntity($entity): string { |
| 83 | $repository = null; |
| 84 | if ($entity instanceof NewsletterEntity) { |
| 85 | $repository = $this->newslettersRepository; |
| 86 | } elseif ($entity instanceof SubscriberEntity) { |
| 87 | $repository = $this->subscribersRepository; |
| 88 | } else { |
| 89 | throw new Exception('Unsupported Entity type'); |
| 90 | } |
| 91 | |
| 92 | do { |
| 93 | $token = self::generateRandomString(self::UNSUBSCRIBE_TOKEN_LENGTH); |
| 94 | $found = count($repository->findBy(['unsubscribeToken' => $token])); |
| 95 | } while ($found > 0); |
| 96 | return $token; |
| 97 | } |
| 98 | } |
| 99 |