wpgetapi / includes / class-encryption.php

class-encryption.php in WPGet API – Connect to any external REST API 1.1.0, at includes/class-encryption.php

144 lines 3.2 KB

Raw Download Zip

1	<?php
2	/**
3	* Class Google\Site_Kit\Core\Storage\Data_Encryption
4	*
5	* @package Google\Site_Kit
6	* @copyright 2021 Google LLC
7	* @license https://www.apache.org/licenses/LICENSE-2.0 Apache License 2.0
8	* @link https://sitekit.withgoogle.com
9	*/
10
11	/**
12	* Class responsible for encrypting and decrypting data.
13	*
14	* @since 1.0.0
15	* @access private
16	* @ignore
17	*/
18	class WpGetApi_Encryption {
19
20	/**
21	* Key to use for encryption.
22	*
23	* @since 1.0.0
24	* @var string
25	*/
26	private $key;
27
28	/**
29	* Salt to use for encryption.
30	*
31	* @since 1.0.0
32	* @var string
33	*/
34	private $salt;
35
36	/**
37	* Constructor.
38	*
39	* @since 1.0.0
40	*/
41	public function __construct() {
42	$this->key = $this->get_default_key();
43	$this->salt = $this->get_default_salt();
44	}
45
46	/**
47	* Encrypts a value.
48	*
49	* If a user-based key is set, that key is used. Otherwise the default key is used.
50	*
51	* @since 1.0.0
52	*
53	* @param string $value Value to encrypt.
54	* @return string\|bool Encrypted value, or false on failure.
55	*/
56	public function encrypt( $value ) {
57	if ( ! extension_loaded( 'openssl' ) ) {
58	return $value;
59	}
60
61	$method = 'aes-256-ctr';
62	$ivlen = openssl_cipher_iv_length( $method );
63	$iv = openssl_random_pseudo_bytes( $ivlen );
64
65	$raw_value = openssl_encrypt( $value . $this->salt, $method, $this->key, 0, $iv );
66	if ( ! $raw_value ) {
67	return false;
68	}
69
70	return base64_encode( $iv . $raw_value );
71	}
72
73	/**
74	* Decrypts a value.
75	*
76	* If a user-based key is set, that key is used. Otherwise the default key is used.
77	*
78	* @since 1.0.0
79	*
80	* @param string $raw_value Value to decrypt.
81	* @return string\|bool Decrypted value, or false on failure.
82	*/
83	public function decrypt( $raw_value ) {
84	if ( ! extension_loaded( 'openssl' ) ) {
85	return $raw_value;
86	}
87
88	$raw_value = base64_decode( $raw_value, true );
89
90	$method = 'aes-256-ctr';
91	$ivlen = openssl_cipher_iv_length( $method );
92	$iv = substr( $raw_value, 0, $ivlen );
93
94	$raw_value = substr( $raw_value, $ivlen );
95
96	$value = openssl_decrypt( $raw_value, $method, $this->key, 0, $iv );
97	if ( ! $value \|\| substr( $value, - strlen( $this->salt ) ) !== $this->salt ) {
98	return false;
99	}
100
101	return substr( $value, 0, - strlen( $this->salt ) );
102	}
103
104	/**
105	* Gets the default encryption key to use.
106	*
107	* @since 1.0.0
108	*
109	* @return string Default (not user-based) encryption key.
110	*/
111	private function get_default_key() {
112	if ( defined( 'WPGETAPI_ENCRYPTION_KEY' ) && '' !== WPGETAPI_ENCRYPTION_KEY ) {
113	return WPGETAPI_ENCRYPTION_KEY;
114	}
115
116	if ( defined( 'LOGGED_IN_KEY' ) && '' !== LOGGED_IN_KEY ) {
117	return LOGGED_IN_KEY;
118	}
119
120	// If this is reached, you're either not on a live site or have a serious security issue.
121	return 'das-ist-kein-geheimer-schluessel';
122	}
123
124	/**
125	* Gets the default encryption salt to use.
126	*
127	* @since 1.0.0
128	*
129	* @return string Encryption salt.
130	*/
131	private function get_default_salt() {
132	if ( defined( 'WPGETAPI_ENCRYPTION_SALT' ) && '' !== WPGETAPI_ENCRYPTION_SALT ) {
133	return WPGETAPI_ENCRYPTION_SALT;
134	}
135
136	if ( defined( 'LOGGED_IN_SALT' ) && '' !== LOGGED_IN_SALT ) {
137	return LOGGED_IN_SALT;
138	}
139
140	// If this is reached, you're either not on a live site or have a serious security issue.
141	return 'das-ist-kein-geheimes-salz';
142	}
143	}
144