| @@ -117,12 +117,13 @@ | ||
| 117 | 117 | /** |
| 118 | 118 | * Decrypt w/ best possible technique. |
| 119 | 119 | * |
| 120 | 120 | * @since 3.5 Nearly the first release. |
| 121 | + * @since 260810 Allows Defuse decryption on PHP 5.6+. | |
| 121 | 122 | * |
| 122 | 123 | * @param string $base64 String to decrypt (base64). |
| 123 | 124 | * @param string $key Optional custom decryption key. |
| 124 | - * @param bool|null $allow_defuse Allow Defuse encryption as a better alternative? | |
| 125 | + * @param bool|null $allow_defuse Allow Defuse decryption as a better alternative? | |
| 125 | 126 | * |
| 126 | 127 | * @return string Decrypted string, else empty string. |
| 127 | 128 | */ |
| 128 | 129 | public static function decrypt($base64 = '', $key = '', $allow_defuse = null) |
| @@ -133,12 +134,13 @@ | ||
| 133 | 134 | |
| 134 | 135 | $allow_defuse = isset($allow_defuse) ? $allow_defuse |
| 135 | 136 | : apply_filters('c_ws_plugin__s2member_allow_defuse', true); |
| 136 | 137 | |
| 137 | - if ($allow_defuse && version_compare(PHP_VERSION, '7.0.4', '>=') | |
| 138 | - && ($_d = c_ws_plugin__s2member_utils_defuse::decrypt($base64, $key))) { | |
| 138 | + //260810 Allow PHP 5.6 to read Defuse ciphertext created on newer PHP versions; decryption was previously gated to PHP 7.0.4+. | |
| 139 | + // Defuse encryption remains gated separately so PHP 5.6 does not generate new Defuse ciphertext yet. | |
| 140 | + if ($allow_defuse && ($_d = c_ws_plugin__s2member_utils_defuse::decrypt($base64, $key))) { | |
| 139 | 141 | return $string = $_d; // Defuse success. |
| 140 | - } // This is a new/improved way of handling decryption. | |
| 142 | + } | |
| 141 | 143 | |
| 142 | 144 | if (function_exists('mcrypt_decrypt') |
| 143 | 145 | && in_array('rijndael-256', @mcrypt_list_algorithms()) |
| 144 | 146 | && in_array('cbc', @mcrypt_list_modes())) { |
| @@ -182,9 +184,10 @@ | ||
| 182 | 184 | |
| 183 | 185 | for ($i = 1, $e = ''; $i <= strlen($string); ++$i) { |
| 184 | 186 | $char = substr($string, $i - 1, 1); |
| 185 | 187 | $keychar = substr($key, ($i % strlen($key)) - 1, 1); |
| 186 | - $e .= chr(ord($char) + ord($keychar)); | |
| 188 | + //260830.2134 PHP 8.5 deprecates chr() values outside 0..255; mask explicitly to preserve chr()'s historical byte-wrap behavior. | |
| 189 | + $e .= chr((ord($char) + ord($keychar)) & 0xFF); | |
| 187 | 190 | } |
| 188 | 191 | $e = isset($e[0]) ? '~xe'.($w_md5_cs ? ':'.md5($e) : '').'|'.$e : ''; |
| 189 | 192 | return $base64 = isset($e[0]) ? ($base64 = c_ws_plugin__s2member_utils_strings::base64_url_safe_encode($e)) : ''; |
| 190 | 193 | } |
| @@ -213,9 +216,10 @@ | ||
| 213 | 216 | if (isset($md5_e[2][0]) && (empty($md5_e[1]) || $md5_e[1] === md5($md5_e[2]))) { |
| 214 | 217 | for ($i = 1, $d = ''; $i <= strlen($md5_e[2]); ++$i) { |
| 215 | 218 | $char = substr($md5_e[2], $i - 1, 1); |
| 216 | 219 | $keychar = substr($key, ($i % strlen($key)) - 1, 1); |
| 217 | - $d .= chr(ord($char) - ord($keychar)); | |
| 220 | + //260830.2134 PHP 8.5 deprecates chr() values outside 0..255; mask explicitly to preserve chr()'s historical byte-wrap behavior. | |
| 221 | + $d .= chr((ord($char) - ord($keychar)) & 0xFF); | |
| 218 | 222 | } // Reverse XOR encryption. |
| 219 | 223 | } // Else the checksum was not a match. |
| 220 | 224 | |
| 221 | 225 | if (!isset($d)) { // Failed above? |
