wpgetapi / includes / class-wpgetapi-encryption.php

class-wpgetapi-encryption.php in WPGet API – Connect to any external REST API 2.25.1, at includes/class-wpgetapi-encryption.php

145 lines 3.2 KB

Raw Download Zip

1	<?php
2	/**
3	* Class Google\Site_Kit\Core\Storage\Data_Encryption
4	*
5	* @package Google\Site_Kit
6	* @copyright 2021 Google LLC
7	* @license https://www.apache.org/licenses/LICENSE-2.0 Apache License 2.0
8	* @link https://sitekit.withgoogle.com
9	*/
10
11	/**
12	* Class responsible for encrypting and decrypting data.
13	*
14	* @since 1.0.0
15	* @access private
16	* @ignore
17	*/
18	class WpGetApi_Encryption {
19
20	/**
21	* Key to use for encryption.
22	*
23	* @since 1.0.0
24	* @var string
25	*/
26	private $key;
27
28	/**
29	* Salt to use for encryption.
30	*
31	* @since 1.0.0
32	* @var string
33	*/
34	private $salt;
35
36	/**
37	* Constructor.
38	*
39	* @since 1.0.0
40	*/
41	public function __construct() {
42	$this->key = $this->get_default_key();
43	$this->salt = $this->get_default_salt();
44	}
45
46	/**
47	* Encrypts a value.
48	*
49	* If a user-based key is set, that key is used. Otherwise the default key is used.
50	*
51	* @since 1.0.0
52	*
53	* @param string $value Value to encrypt.
54	* @return string\|bool Encrypted value, or false on failure.
55	*/
56	public function encrypt( $value ) {
57	if ( ! extension_loaded( 'openssl' ) ) {
58	return $value;
59	}
60
61	$method = 'aes-256-ctr';
62	$ivlen = openssl_cipher_iv_length( $method );
63	$iv = openssl_random_pseudo_bytes( $ivlen );
64
65	$raw_value = openssl_encrypt( $value . $this->salt, $method, $this->key, 0, $iv );
66	if ( ! $raw_value ) {
67	return false;
68	}
69
70	return base64_encode( $iv . $raw_value );
71	}
72
73	/**
74	* Decrypts a value.
75	*
76	* If a user-based key is set, that key is used. Otherwise the default key is used.
77	*
78	* @since 1.0.0
79	*
80	* @param string $raw_value Value to decrypt.
81	* @return string\|bool Decrypted value, or false on failure.
82	*/
83	public function decrypt( $raw_value ) {
84
85	if ( ! extension_loaded( 'openssl' ) ) {
86	return $raw_value;
87	}
88
89	$raw_value = base64_decode( $raw_value, true );
90
91	$method = 'aes-256-ctr';
92	$ivlen = openssl_cipher_iv_length( $method );
93	$iv = substr( $raw_value, 0, $ivlen );
94
95	$raw_value = substr( $raw_value, $ivlen );
96
97	$value = openssl_decrypt( $raw_value, $method, $this->key, 0, $iv );
98	if ( ! $value \|\| substr( $value, - strlen( $this->salt ) ) !== $this->salt ) {
99	return false;
100	}
101
102	return substr( $value, 0, - strlen( $this->salt ) );
103	}
104
105	/**
106	* Gets the default encryption key to use.
107	*
108	* @since 1.0.0
109	*
110	* @return string Default (not user-based) encryption key.
111	*/
112	private function get_default_key() {
113	if ( defined( 'WPGETAPI_ENCRYPTION_KEY' ) && '' !== WPGETAPI_ENCRYPTION_KEY ) {
114	return WPGETAPI_ENCRYPTION_KEY;
115	}
116
117	if ( defined( 'LOGGED_IN_KEY' ) && '' !== LOGGED_IN_KEY ) {
118	return LOGGED_IN_KEY;
119	}
120
121	// If this is reached, you're either not on a live site or have a serious security issue.
122	return 'das-ist-kein-geheimer-schluessel'; // spellchecker:ignore
123	}
124
125	/**
126	* Gets the default encryption salt to use.
127	*
128	* @since 1.0.0
129	*
130	* @return string Encryption salt.
131	*/
132	private function get_default_salt() {
133	if ( defined( 'WPGETAPI_ENCRYPTION_SALT' ) && '' !== WPGETAPI_ENCRYPTION_SALT ) {
134	return WPGETAPI_ENCRYPTION_SALT;
135	}
136
137	if ( defined( 'LOGGED_IN_SALT' ) && '' !== LOGGED_IN_SALT ) {
138	return LOGGED_IN_SALT;
139	}
140
141	// If this is reached, you're either not on a live site or have a serious security issue.
142	return 'das-ist-kein-geheimes-salz'; // spellchecker:ignore
143	}
144	}
145