powered-cache / includes / classes / Encryption.php

Encryption.php in Powered Cache – Caching and Optimization for WordPress – Easily Improve PageSpeed & Web Vitals Score 3.6.1, at includes/classes/Encryption.php

137 lines 3.2 KB

Raw Download Zip

1	<?php
2	/**
3	* Encryption class.
4	*
5	* @see https://felix-arntz.me/blog/storing-confidential-data-in-wordpress/
6	* @package PoweredCache
7	*/
8
9	namespace PoweredCache;
10
11	/**
12	* Class Encryption.
13	* Encrypting and decrypting data.
14	*/
15	final class Encryption {
16
17	/**
18	* Key to use for encryption.
19	*
20	* @since 3.4
21	* @var string
22	*/
23	private $key;
24
25	/**
26	* Salt to use for encryption.
27	*
28	* @since 3.4
29	* @var string
30	*/
31	private $salt;
32
33	/**
34	* Constructor.
35	*
36	* @since 3.4
37	*/
38	public function __construct() {
39	$this->key = $this->get_default_key();
40	$this->salt = $this->get_default_salt();
41	}
42
43	/**
44	* Encrypts a value.
45	* If a user-based key is set, that key is used. Otherwise the default key is used.
46	*
47	* @param string $value Value to encrypt.
48	*
49	* @return string\|bool Encrypted value, or false on failure.
50	* @since 3.4
51	*/
52	public function encrypt( $value ) {
53	if ( ! extension_loaded( 'openssl' ) ) {
54	return $value;
55	}
56
57	$method = 'aes-256-ctr';
58	$ivlen = openssl_cipher_iv_length( $method );
59	$iv = openssl_random_pseudo_bytes( $ivlen );
60
61	$raw_value = openssl_encrypt( $value . $this->salt, $method, $this->key, 0, $iv );
62	if ( ! $raw_value ) {
63	return false;
64	}
65
66	return base64_encode( $iv . $raw_value ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode
67	}
68
69	/**
70	* Decrypts a value.
71	* If a user-based key is set, that key is used. Otherwise the default key is used.
72	*
73	* @param string $raw_value Value to decrypt.
74	*
75	* @return string\|bool Decrypted value, or false on failure.
76	* @since 3.4
77	*/
78	public function decrypt( $raw_value ) {
79	if ( ! extension_loaded( 'openssl' ) ) {
80	return $raw_value;
81	}
82
83	$raw_value = base64_decode( $raw_value, true ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
84
85	$method = 'aes-256-ctr';
86	$ivlen = openssl_cipher_iv_length( $method );
87	$iv = substr( $raw_value, 0, $ivlen );
88
89	$raw_value = substr( $raw_value, $ivlen );
90
91	$value = openssl_decrypt( $raw_value, $method, $this->key, 0, $iv );
92	if ( ! $value \|\| substr( $value, - strlen( $this->salt ) ) !== $this->salt ) {
93	return false;
94	}
95
96	return substr( $value, 0, - strlen( $this->salt ) );
97	}
98
99	/**
100	* Gets the default encryption key
101	*
102	* @return string Default (not user-based) encryption key.
103	* @since 3.4
104	*/
105	private function get_default_key() {
106	if ( defined( 'POWERED_CACHE_ENCRYPTION_KEY' ) && '' !== POWERED_CACHE_ENCRYPTION_KEY ) {
107	return POWERED_CACHE_ENCRYPTION_KEY;
108	}
109
110	if ( defined( 'LOGGED_IN_KEY' ) && '' !== LOGGED_IN_KEY ) {
111	return LOGGED_IN_KEY;
112	}
113
114	// If this is reached, you're either not on a live site or have a serious security issue.
115	return 'this-is-not-a-secret-key';
116	}
117
118	/**
119	* Gets the encryption salt
120	*
121	* @return string Encryption salt.
122	* @since 3.4
123	*/
124	private function get_default_salt() {
125	if ( defined( 'POWERED_CACHE_ENCRYPTION_SALT' ) && '' !== POWERED_CACHE_ENCRYPTION_SALT ) {
126	return POWERED_CACHE_ENCRYPTION_SALT;
127	}
128
129	if ( defined( 'LOGGED_IN_SALT' ) && '' !== LOGGED_IN_SALT ) {
130	return LOGGED_IN_SALT;
131	}
132
133	// If this is reached, you're either not on a live site or have a serious security issue.
134	return 'this-is-not-a-secret-salt';
135	}
136	}
137