class-email-sodium.php — NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall 4.8.8

ninjafirewall / lib / class-email-sodium.php

ninjafirewall / lib Last commit date

class-email-sodium.php

198 lines

1	<?php
2	/*
3	+=====================================================================+
4	\| _ _ _ _ _____ _ _ _ \|
5	\| \| \ \| (_)_ __ (_) __ _\| ___(_)_ __ _____ ____ _\| \| \| \|
6	\| \| \\| \| \| '_ \ \| \|/ _` \| \|_ \| \| '__/ _ \ \ /\ / / _` \| \| \| \|
7	\| \| \|\ \| \| \| \| \|\| \| (_\| \| _\| \| \| \| \| __/\ V V / (_\| \| \| \| \|
8	\| \|_\| \_\|_\|_\| \|_\|/ \|\__,_\|_\| \|_\|_\| \___\| \_/\_/ \__,_\|_\|_\| \|
9	\| \|__/ \|
10	\| (c) NinTechNet Limited ~ https://nintechnet.com/ \|
11	+=====================================================================+
12	*/
13
14	if ( class_exists('NinjaFirewall_emailsodium') ) {
15	return;
16	}
17
18	class NinjaFirewall_emailsodium {
19
20	/**
21	* Check whether Sodium is available (WordPress >=5.2 or PHP >= 7.2.0).
22	*/
23	public static function check_sodium() {
24
25	$sodium = 0;
26
27	if ( function_exists('sodium_crypto_generichash') ) {
28	$sodium = 'php';
29	} elseif ( file_exists( ABSPATH . WPINC . '/sodium_compat/autoload.php') ) {
30	$sodium = 'wordpress';
31	}
32	return $sodium;
33	}
34
35
36	/**
37	* Generate an encrypted link for notification emails.
38	*/
39	public static function sodium_encrypt( $email, $expire, $which_sodium ) {
40
41	$nonce = random_bytes( SODIUM_CRYPTO_SECRETBOX_NONCEBYTES );
42
43	if ( $which_sodium == 'php') {
44	// PHP native functions
45	$key = sodium_crypto_generichash( AUTH_KEY, '', SODIUM_CRYPTO_SECRETBOX_KEYBYTES );
46	$ciphertext = sodium_crypto_secretbox( "$email::$expire", $nonce, $key);
47	return sodium_bin2hex( $nonce . $ciphertext );
48
49	} else {
50	// WP sodium libraries
51	require ABSPATH . WPINC .'/sodium_compat/autoload.php';
52	$key = \Sodium\crypto_generichash( AUTH_KEY, '', SODIUM_CRYPTO_SECRETBOX_KEYBYTES );
53	$ciphertext = \Sodium\crypto_secretbox( "$email::$expire", $nonce, $key);
54	return \Sodium\bin2hex( $nonce . $ciphertext );
55	}
56	}
57
58
59	/**
60	* Verify encrypted signature.
61	*/
62	public static function sodium_decrypt( $hex ) {
63
64	// Make sure we have Sodium
65	$which_sodium = self::check_sodium();
66	if ( empty( $which_sodium ) ) {
67	return;
68	}
69	// Hexadecimal input only
70	if (! preg_match('/^(?:[0-9a-f]{2})+$/', $hex ) ) {
71	return;
72	}
73
74	$raw = hex2bin( $hex );
75	$nonce = substr( $raw, 0, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES );
76	$ciphertext = substr( $raw, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES );
77
78	if ( $which_sodium == 'php') {
79	// PHP native functions
80	$key = sodium_crypto_generichash( AUTH_KEY, '', SODIUM_CRYPTO_SECRETBOX_KEYBYTES );
81	$decrypted = sodium_crypto_secretbox_open( $ciphertext, $nonce, $key );
82
83	} else {
84	// WP sodium libraries
85	require ABSPATH . WPINC .'/sodium_compat/autoload.php';
86	$key = \Sodium\crypto_generichash( AUTH_KEY, '', SODIUM_CRYPTO_SECRETBOX_KEYBYTES );
87	$decrypted = \Sodium\crypto_secretbox_open( $ciphertext, $nonce, $key );
88	}
89
90	if ( $decrypted === false ) {
91	self::removal_error();
92	}
93
94	$data = explode('::', $decrypted );
95	if ( empty( $data[0] ) \|\| empty( $data[1] ) ) {
96	self::removal_error();
97	}
98
99	// Verify expiry date
100	$now = time();
101	if ( $data[1] < $now ) {
102	// Link has expired
103	wp_die(
104	esc_html__('The link you followed has expired.', 'ninjafirewall'),
105	esc_html__('Error', 'ninjafirewall'),
106	200
107	);
108	}
109
110	// Confirm deletion
111	if ( empty( $_REQUEST['nfw_confirm'] ) ) {
112	self::removal_confimation( $_GET['nfw_stop_notification'] );
113	exit;
114	}
115
116	$new_list = '';
117	$found = 0;
118	$nfw_options = nfw_get_option('nfw_options');
119	$recipients = explode(',', $nfw_options['alert_email'] );
120	foreach( $recipients as $recipient ) {
121	$recipient = trim( $recipient );
122	if ( $recipient == $data[0] ) {
123	// Remove that email from the list
124	$found = 1;
125	continue;
126	}
127	$new_list .= "$recipient, ";
128	}
129
130	if ( $found ) {
131	// Update options
132	$nfw_options['alert_email'] = trim( $new_list, ', ');
133	if ( empty( $nfw_options['alert_email'] ) ) {
134	$nfw_options['alert_email'] = get_option('admin_email');
135	}
136	nfw_update_option('nfw_options', $nfw_options );
137
138	$subject = __('Email removal confirmation', 'ninjafirewall');
139	NinjaFirewall_log::write(
140	"WordPress: $subject",
141	"User: {$data[0]}",
142	NFWLOG_INFO, 0, $nfw_options, NFW_LOG_DIR .'/nfwlog'
143	);
144	$subject = "[NinjaFirewall] $subject";
145	$message = __('Your email address was removed from the "Event Notifications" option.', 'ninjafirewall') . "\n\n";
146	$message.= __('Blog:', 'ninjafirewall') .' '. home_url('/') . "\n";
147	$message.= __('Email address:', 'ninjafirewall') .' '. "{$data[0]}\n";
148	$message.= __('User IP:', 'ninjafirewall') .' '. NFW_REMOTE_ADDR . "\n";
149	$message.= __('Date:', 'ninjafirewall') .' '. date_i18n('F j, Y @ H:i:s T') . "\n\n";
150	/**
151	* We don't use NinjaFirewall_mail::send() because the email
152	* must be sent to the corresponding user, not the admin.
153	*/
154	wp_mail( $data[0], $subject, $message );
155	}
156	}
157
158
159	/**
160	* Fatal error.
161	*/
162	private static function removal_error() {
163
164	wp_die(
165	esc_html__('Error, your resquest cannot be processed.', 'ninjafirewall'),
166	esc_html__('Error', 'ninjafirewall'),
167	200
168	);
169	}
170
171
172	/**
173	* Email removal confirmation.
174	*/
175	private static function removal_confimation( $hex ) {
176
177	$home_url = esc_url( home_url('/') );
178	$removal_url = esc_url( home_url("/?nfw_stop_notification=$hex&nfw_confirm=1") );
179	wp_die(
180	esc_html__('If you want to remove your email address from the Event Notifications option, click '.
181	'the button below. If the operation is successful, a confirmation email will be sent to you.',
182	'ninjafirewall'
183	). '<p>
184	<button class="button button-large button-active" style="min-width:100px;" onclick=\'location.'.
185	'href="'. $removal_url .'"\'>'. esc_html__('Yes', 'ninjafirewall' ) .'</button>
186
187	<button class="button button-large button-active" style="min-width:100px;" onclick=\'location.'.
188	'href="'. $home_url .'"\'>'. esc_html__('No', 'ninjafirewall' ) .'</button>
189	</p>',
190	esc_html__('Email removal confirmation', 'ninjafirewall'),
191	200
192	);
193	}
194
195	}
196	// =====================================================================
197	// EOL
198