updraftplus / includes / Dropbox2 / OAuth / Storage / Encrypter.php

Encrypter.php in UpdraftPlus: WP Backup & Migration Plugin 1.16.5, at includes/Dropbox2/OAuth/Storage/Encrypter.php

117 lines 4.3 KB

Raw Download Zip

1	<?php
2
3	/**
4	* This class provides the functionality to encrypt
5	* and decrypt access tokens stored by the application
6	* @author Ben Tadiar <ben@handcraftedbyben.co.uk>
7	* @link https://github.com/benthedesigner/dropbox
8	* @package Dropbox\Oauth
9	* @subpackage Storage
10	*/
11
12	/* UpdraftPlus notes
13	Using this was fairly pointless (it encrypts storage credentials at rest). But, it's implemented now, so needs supporting.
14	Investigation shows that mcrypt and phpseclib native encryption using different padding schemes.
15	As a result, that which is encrypted by phpseclib native can be decrypted by mcrypt, but not vice-versa. Each can (as you'd expect) decrypt the results of their own encryption.
16	As a consequence, it makes sense to always encrypt with phpseclib native, and prefer decrypting with with mcrypt if it is available and otherwise fall back to phpseclib.
17	We could deliberately re-encrypt all loaded information with phpseclib native, but there seems little need for that yet. There can only be a problem if mcrypt is disabled - which pre-July-2015 meant that Dropbox wouldn't work at all. Now, it will force a re-authorisation.
18	*/
19
20	class Dropbox_Encrypter
21	{
22	// Encryption settings - default settings yield encryption to AES (256-bit) standard
23	// @todo Provide PHPDOC for each class constant
24	const KEY_SIZE = 32;
25	const IV_SIZE = 16;
26
27	/**
28	* Encryption key
29	* @var null\|string
30	*/
31	private $key = null;
32
33	/**
34	* Check Mcrypt is loaded and set the encryption key
35	* @param string $key
36	* @return void
37	*/
38	public function __construct($key)
39	{
40	if (preg_match('/^[A-Za-z0-9]+$/', $key) && $length = strlen($key) === self::KEY_SIZE) {
41	# Short-cut so that the mbstring extension is not required
42	$this->key = $key;
43	} elseif (($length = mb_strlen($key, '8bit')) !== self::KEY_SIZE) {
44	throw new Dropbox_Exception('Expecting a ' . self::KEY_SIZE . ' byte key, got ' . $length);
45	} else {
46	// Set the encryption key
47	$this->key = $key;
48	}
49	}
50
51	/**
52	* Encrypt the OAuth token
53	* @param \stdClass $token Serialized token object
54	* @return string
55	*/
56	public function encrypt($token)
57	{
58
59	// Encryption: we always use phpseclib for this
60	global $updraftplus;
61	$ensure_phpseclib = $updraftplus->ensure_phpseclib('Crypt_AES', 'Crypt/AES');
62
63	if (is_wp_error($ensure_phpseclib)) {
64	$updraftplus->log("Failed to load phpseclib classes (".$ensure_phpseclib->get_error_code()."): ".$ensure_phpseclib->get_error_message());
65	$updraftplus->log("Failed to load phpseclib classes (".$ensure_phpseclib->get_error_code()."): ".$ensure_phpseclib->get_error_message(), 'error');
66	return false;
67	}
68
69	$updraftplus->ensure_phpseclib('Crypt_Rijndael', 'Crypt/Rijndael');
70
71	if (!function_exists('crypt_random_string')) require_once(UPDRAFTPLUS_DIR.'/vendor/phpseclib/phpseclib/phpseclib/Crypt/Random.php');
72
73	$iv = crypt_random_string(self::IV_SIZE);
74
75	// Defaults to CBC mode
76	$rijndael = new Crypt_Rijndael();
77
78	$rijndael->setKey($this->key);
79
80	$rijndael->setIV($iv);
81
82	$cipherText = $rijndael->encrypt($token);
83
84	return base64_encode($iv . $cipherText);
85	}
86
87	/**
88	* Decrypt the ciphertext
89	* @param string $cipherText
90	* @return object \stdClass Unserialized token
91	*/
92	public function decrypt($cipherText)
93	{
94
95	// Decryption: prefer mcrypt, if available (since it can decrypt data encrypted by either mcrypt or phpseclib)
96
97	$cipherText = base64_decode($cipherText);
98	$iv = substr($cipherText, 0, self::IV_SIZE);
99	$cipherText = substr($cipherText, self::IV_SIZE);
100
101	if (function_exists('mcrypt_decrypt')) {
102	// @codingStandardsIgnoreLine
103	$token = @mcrypt_decrypt(MCRYPT_RIJNDAEL_128, $this->key, $cipherText, MCRYPT_MODE_CBC, $iv);
104	} else {
105	global $updraftplus;
106	$updraftplus->ensure_phpseclib('Crypt_Rijndael', 'Crypt/Rijndael');
107
108	$rijndael = new Crypt_Rijndael();
109	$rijndael->setKey($this->key);
110	$rijndael->setIV($iv);
111	$token = $rijndael->decrypt($cipherText);
112	}
113
114	return $token;
115	}
116	}
117