← All changes | callback/request.php +19 -97 5.22 → 4.97 View file →

		@@ -9,9 +9,9 @@
9	9	public $is_afterload;
10	10	public $is_admin_ajax;
11	11	public $is_debug;
12	12	public $account;
13		- public $settings;
	13	+ public $calculated_mac;
14	14	public $sig;
15	15	public $time;
16	16	public $version;
17	17	public $is_sha1;
		@@ -17,16 +17,12 @@
17	17	public $is_sha1;
18	18	public $bvb64stream;
19	19	public $bvb64cksize;
20	20	public $checksum;
21		- public $error = array();
22		- public $pubkey_name;
23		- public $bvprmsmac;
24	21
25		- public function __construct($account, $in_params, $settings) {
	22	+ public function __construct($account, $in_params) {
26	23	$this->params = array();
27	24	$this->account = $account;
28		- $this->settings = $settings;
29	25	$this->wing = $in_params['wing'];
30	26	$this->method = $in_params['bvMethod'];
31	27	$this->is_afterload = array_key_exists('afterload', $in_params);
32	28	$this->is_admin_ajax = array_key_exists('adajx', $in_params);
		@@ -37,11 +33,8 @@
37	33	$this->is_sha1 = array_key_exists('sha1', $in_params);
38	34	$this->bvb64stream = isset($in_params['bvb64stream']);
39	35	$this->bvb64cksize = array_key_exists('bvb64cksize', $in_params) ? intval($in_params['bvb64cksize']) : false;
40	36	$this->checksum = array_key_exists('checksum', $in_params) ? $in_params['checksum'] : false;
41		- $this->pubkey_name = !empty($in_params['pubkeyname']) ?
42		- WPRAccount::sanitizeKey($in_params['pubkeyname']) : 'm_public';
43		- $this->bvprmsmac = !empty($in_params['bvprmsmac']) ? WPRAccount::sanitizeKey($in_params['bvprmsmac']) : "";
44	37	}
45	38
46	39	public function isAPICall() {
47	40	return array_key_exists('apicall', $this->params);
		@@ -90,10 +83,9 @@
90	83	public function info() {
91	84	$info = array(
92	85	"requestedsig" => $this->sig,
93	86	"requestedtime" => $this->time,
94		- "requestedversion" => $this->version,
95		- "error" => $this->error
	87	+ "requestedversion" => $this->version
96	88	);
97	89	if ($this->is_debug) {
98	90	$info["inreq"] = $this->params;
99	91	}
		@@ -102,8 +94,11 @@
102	94	}
103	95	if ($this->is_afterload) {
104	96	$info["afterload"] = true;
105	97	}
	98	+ if ($this->calculated_mac) {
	99	+ $info["calculated_mac"] = $this->calculated_mac;
	100	+ }
106	101	return $info;
107	102	}
108	103
109	104	public function processParams($in_params) {
		@@ -132,13 +127,22 @@
132	127	$in_params["bvprms"] = $pdata;
133	128	}
134	129	}
135	130
136		- if (array_key_exists('bvprms', $in_params) && isset($in_params['bvprms'])) {
137		- $calculated_mac = hash_hmac('SHA1', $in_params['bvprms'], $this->account->secret);
	131	+ if (array_key_exists('bvprms', $in_params) && isset($in_params['bvprms']) &&
	132	+ array_key_exists('bvprmsmac', $in_params) && isset($in_params['bvprmsmac'])) {
	133	+ $digest_algo = 'SHA1';
	134	+ $sent_mac = WPRAccount::sanitizeKey($in_params['bvprmsmac']);
138	135
139		- if ($this->compare_mac($this->bvprmsmac, $calculated_mac) === true) {
	136	+ if (array_key_exists('bvprmshshalgo', $in_params) && isset($in_params['bvprmshshalgo'])) {
	137	+ $digest_algo = $in_params['bvprmshshalgo'];
	138	+ }
140	139
	140	+ $calculated_mac = hash_hmac($digest_algo, $in_params['bvprms'], $this->account->secret);
	141	+ $this->calculated_mac = substr($calculated_mac, 0, 6);
	142	+
	143	+ if ($this->compare_mac($sent_mac, $calculated_mac) === true) {
	144	+
141	145	if (array_key_exists('b64', $in_params)) {
142	146	foreach ($in_params['b64'] as $key) {
143	147	if (is_array($in_params[$key])) {
144	148	$in_params[$key] = array_map('base64_decode', $in_params[$key]);
		@@ -183,8 +187,9 @@
183	187
184	188	return $params;
185	189	}
186	190	}
	191	+
187	192	return false;
188	193	}
189	194
190	195	private function compare_mac($l_hash, $r_hash) {
		@@ -210,90 +215,7 @@
210	215	$data = base64_decode($data);
211	216	}
212	217
213	218	return $data;
214		- }
215		-
216		- public function authenticate() {
217		- if (!$this->account) {
218		- $this->error["message"] = "ACCOUNT_NOT_FOUND";
219		- return false;
220		- }
221		-
222		- $bv_last_recv_time = $this->settings->getOption('bvLastRecvTime');
223		- if ($this->time < intval($bv_last_recv_time) - 300) {
224		- return false;
225		- }
226		-
227		- $data = $this->method.$this->account->secret.$this->time.$this->version.$this->bvprmsmac;
228		- if (!$this->verify($data, base64_decode($this->sig))) {
229		- return false;
230		- }
231		- $this->settings->updateOption('bvLastRecvTime', $this->time);
232		-
233		- return 1;
234		- }
235		-
236		- public function verify($data, $sig) {
237		- if (!function_exists('openssl_verify') || !function_exists('openssl_pkey_get_public')) {
238		- $this->error["message"] = "OPENSSL_FUNCS_NOT_FOUND";
239		- return false;
240		- }
241		-
242		- $key_file = dirname( __FILE__ ) . '/../public_keys/' . $this->pubkey_name . '.pub';
243		- if (!file_exists($key_file)) {
244		- $this->error["message"] = "PUBLIC_KEY_NOT_FOUND";
245		- return false;
246		- }
247		- $public_key_str = file_get_contents($key_file);
248		- $public_key = openssl_pkey_get_public($public_key_str);
249		- if (!$public_key) {
250		- $this->error["message"] = "UNABLE_TO_LOAD_PUBLIC_KEY";
251		- return false;
252		- }
253		-
254		- $verify = openssl_verify($data, $sig, $public_key);
255		- if ($verify === 1) {
256		- return true;
257		- } elseif ($verify === 0) {
258		- $this->error["message"] = "INCORRECT_SIGNATURE";
259		- $this->error["pubkey_sig"] = substr(hash('md5', $public_key_str), 0, 8);
260		- } else {
261		- $this->error["message"] = "OPENSSL_VERIFY_FAILED";
262		- }
263		- return false;
264		- }
265		-
266		- public function corruptedParamsResp() {
267		- $bvinfo = new WPRInfo($this->settings);
268		-
269		- return array(
270		- "account_info" => $this->account->info(),
271		- "request_info" => $this->info(),
272		- "bvinfo" => $bvinfo->info(),
273		- "statusmsg" => "BVPRMS_CORRUPTED"
274		- );
275		- }
276		-
277		- public function authFailedResp() {
278		- $api_public_key = WPRAccount::getApiPublicKey($this->settings);
279		- $default_secret = WPRRecover::getDefaultSecret($this->settings);
280		- $bvinfo = new WPRInfo($this->settings);
281		- $resp = array(
282		- "request_info" => $this->info(),
283		- "bvinfo" => $bvinfo->info(),
284		- "statusmsg" => "FAILED_AUTH",
285		- "api_pubkey" => substr($api_public_key, 0, 8),
286		- "def_sigmatch" => substr(hash('sha1', $this->method.$default_secret.$this->time.$this->version), 0, 8)
287		- );
288		-
289		- if ($this->account) {
290		- $resp["account_info"] = $this->account->info();
291		- $resp["sigmatch"] = substr(hash('sha1', $this->method.$this->account->secret.$this->time.$this->version), 0, 6);
292		- } else {
293		- $resp["account_info"] = array("error" => "ACCOUNT_NOT_FOUND");
294		- }
295		-
296		- return $resp;
297	219	}
298	220	}
299	221	endif;