← All changes | inc/encryption.php +138 -126 2.12.1 → 2.16.7 View file →

		@@ -1,126 +1,138 @@
1		-<?php
2		-
3		-// If this file is called directly, abort.
4		-if ( ! defined( 'WPINC' ) ) {
5		- die;
6		-}
7		-
8		-
9		-/**
10		- * Get the encryption key for AES-256-GCM.
11		- *
12		- * Retrieves the encryption key from the database. If it doesn't exist,
13		- * generates a new 256-bit random key and stores it.
14		- *
15		- * @return string The raw binary encryption key.
16		- */
17		-function wplng_encryption_get_key() {
18		-
19		- $option_name = 'wplng_encryption_key';
20		-
21		- // Try to retrieve the key from the database stored in an option
22		- $encryption_key = get_option( $option_name );
23		-
24		- // If the key doesn't exist, create one randomly and store it
25		- if ( empty( $encryption_key ) ) {
26		- $encryption_key = base64_encode( random_bytes( 32 ) ); // 256 bits
27		- update_option( $option_name, $encryption_key, false );
28		- }
29		-
30		- return base64_decode( $encryption_key );
31		-}
32		-
33		-
34		-/**
35		- * Encrypt a text using AES-256-GCM.
36		- *
37		- * Encrypts the given text using AES-256-GCM symmetric encryption.
38		- * The result includes the IV and authentication tag for decryption.
39		- *
40		- * @param string $text The plain text to encrypt.
41		- * @return string The encrypted text encoded in base64, or empty string on failure.
42		- */
43		-function wplng_encryption_encrypt( $text ) {
44		-
45		- if ( empty( $text ) ) {
46		- return '';
47		- }
48		-
49		- $method = 'aes-256-gcm';
50		- $key = wplng_encryption_get_key();
51		-
52		- // Generate a random IV (initialization vector)
53		- $iv_length = openssl_cipher_iv_length( $method );
54		- $iv = random_bytes( $iv_length );
55		-
56		- // Encrypt the text with AES-256-GCM
57		- $tag = '';
58		- $encrypted = openssl_encrypt(
59		- $text,
60		- $method,
61		- $key,
62		- OPENSSL_RAW_DATA,
63		- $iv,
64		- $tag,
65		- '',
66		- 16 // Authentication tag length
67		- );
68		-
69		- if ( $encrypted === false ) {
70		- return '';
71		- }
72		-
73		- // Combine IV + tag + encrypted text and encode in base64
74		- $encrypted_text = base64_encode( $iv . $tag . $encrypted );
75		-
76		- return $encrypted_text;
77		-}
78		-
79		-
80		-/**
81		- * Decrypt a text encrypted with AES-256-GCM.
82		- *
83		- * Decrypts the given base64-encoded text that was encrypted
84		- * using the wplng_encryption_encrypt function.
85		- *
86		- * @param string $text The encrypted text encoded in base64.
87		- * @return string The decrypted plain text, or empty string on failure.
88		- */
89		-function wplng_encryption_decrypt( $text ) {
90		-
91		- if ( empty( $text ) ) {
92		- return '';
93		- }
94		-
95		- $method = 'aes-256-gcm';
96		- $key = wplng_encryption_get_key();
97		-
98		- // Decode the text from base64
99		- $data = base64_decode( $text );
100		-
101		- if ( $data === false ) {
102		- return '';
103		- }
104		-
105		- // Extract the IV, tag and encrypted text
106		- $iv_length = openssl_cipher_iv_length( $method );
107		- $iv = substr( $data, 0, $iv_length );
108		- $tag = substr( $data, $iv_length, 16 );
109		- $encrypted = substr( $data, $iv_length + 16 );
110		-
111		- // Decrypt the text
112		- $decrypted_text = openssl_decrypt(
113		- $encrypted,
114		- $method,
115		- $key,
116		- OPENSSL_RAW_DATA,
117		- $iv,
118		- $tag
119		- );
120		-
121		- if ( $decrypted_text === false ) {
122		- return '';
123		- }
124		-
125		- return $decrypted_text;
126		-}
	1	+<?php
	2	+
	3	+// If this file is called directly, abort.
	4	+if ( ! defined( 'WPINC' ) ) {
	5	+ die;
	6	+}
	7	+
	8	+
	9	+/**
	10	+ * Get the encryption key for AES-256-GCM.
	11	+ *
	12	+ * Retrieves the encryption key from the database. If it doesn't exist,
	13	+ * generates a new 256-bit random key and stores it.
	14	+ *
	15	+ * @return string The raw binary encryption key.
	16	+ */
	17	+function wplng_encryption_get_key() {
	18	+
	19	+ $option_name = 'wplng_encryption_key';
	20	+
	21	+ // Try to retrieve the key from the database stored in an option
	22	+ $encryption_key = get_option( $option_name );
	23	+
	24	+ // If the key doesn't exist, create one randomly and store it
	25	+ if ( empty( $encryption_key ) ) {
	26	+ $encryption_key = base64_encode( random_bytes( 32 ) ); // 256 bits
	27	+ update_option( $option_name, $encryption_key, false );
	28	+ }
	29	+
	30	+ return base64_decode( $encryption_key );
	31	+}
	32	+
	33	+
	34	+/**
	35	+ * Encrypt a text using AES-256-GCM.
	36	+ *
	37	+ * Encrypts the given text using AES-256-GCM symmetric encryption.
	38	+ * The result includes the IV and authentication tag for decryption.
	39	+ *
	40	+ * @param string $text The plain text to encrypt.
	41	+ * @return string The encrypted text encoded in base64, or empty string on failure.
	42	+ */
	43	+function wplng_encryption_encrypt( $text ) {
	44	+
	45	+ if ( empty( $text ) ) {
	46	+ return '';
	47	+ }
	48	+
	49	+ $method = 'aes-256-gcm';
	50	+ $key = wplng_encryption_get_key();
	51	+
	52	+ // Generate a random IV (initialization vector)
	53	+ $iv_length = openssl_cipher_iv_length( $method );
	54	+
	55	+ if ( false === $iv_length ) {
	56	+ return '';
	57	+ }
	58	+
	59	+ $iv = random_bytes( $iv_length );
	60	+
	61	+ // Encrypt the text with AES-256-GCM
	62	+ $tag = '';
	63	+ $encrypted = openssl_encrypt(
	64	+ $text,
	65	+ $method,
	66	+ $key,
	67	+ OPENSSL_RAW_DATA,
	68	+ $iv,
	69	+ $tag,
	70	+ '',
	71	+ 16 // Authentication tag length
	72	+ );
	73	+
	74	+ if ( $encrypted === false ) {
	75	+ return '';
	76	+ }
	77	+
	78	+ // Combine IV + tag + encrypted text and encode in base64
	79	+ $encrypted_text = base64_encode( $iv . $tag . $encrypted );
	80	+
	81	+ return $encrypted_text;
	82	+}
	83	+
	84	+
	85	+/**
	86	+ * Decrypt a text encrypted with AES-256-GCM.
	87	+ *
	88	+ * Decrypts the given base64-encoded text that was encrypted
	89	+ * using the wplng_encryption_encrypt function.
	90	+ *
	91	+ * @param string $text The encrypted text encoded in base64.
	92	+ * @return string The decrypted plain text, or empty string on failure.
	93	+ */
	94	+function wplng_encryption_decrypt( $text ) {
	95	+
	96	+ if ( empty( $text ) ) {
	97	+ return '';
	98	+ }
	99	+
	100	+ $method = 'aes-256-gcm';
	101	+ $key = wplng_encryption_get_key();
	102	+
	103	+ // Decode the text from base64
	104	+ $data = base64_decode( $text );
	105	+
	106	+ if ( $data === false ) {
	107	+ return '';
	108	+ }
	109	+
	110	+ // Extract the IV, tag and encrypted text
	111	+ $iv_length = openssl_cipher_iv_length( $method );
	112	+
	113	+ if ( false === $iv_length
	114	+ || strlen( $data ) < $iv_length + 16 + 1
	115	+ ) {
	116	+ return '';
	117	+ }
	118	+
	119	+ $iv = substr( $data, 0, $iv_length );
	120	+ $tag = substr( $data, $iv_length, 16 );
	121	+ $encrypted = substr( $data, $iv_length + 16 );
	122	+
	123	+ // Decrypt the text
	124	+ $decrypted_text = openssl_decrypt(
	125	+ $encrypted,
	126	+ $method,
	127	+ $key,
	128	+ OPENSSL_RAW_DATA,
	129	+ $iv,
	130	+ $tag
	131	+ );
	132	+
	133	+ if ( $decrypted_text === false ) {
	134	+ return '';
	135	+ }
	136	+
	137	+ return $decrypted_text;
	138	+}