← All changes | callback/request.php +18 -114 5.72 → 4.97 View file →

		@@ -9,11 +9,10 @@
9	9	public $is_afterload;
10	10	public $is_admin_ajax;
11	11	public $is_debug;
12	12	public $account;
13		- public $settings;
	13	+ public $calculated_mac;
14	14	public $sig;
15		- public $sighshalgo;
16	15	public $time;
17	16	public $version;
18	17	public $is_sha1;
19	18	public $bvb64stream;
		@@ -18,17 +17,12 @@
18	17	public $is_sha1;
19	18	public $bvb64stream;
20	19	public $bvb64cksize;
21	20	public $checksum;
22		- public $error = array();
23		- public $pubkey_name;
24		- public $bvprmsmac;
25		- public $bvboundry;
26	21
27		- public function __construct($account, $in_params, $settings) {
	22	+ public function __construct($account, $in_params) {
28	23	$this->params = array();
29	24	$this->account = $account;
30		- $this->settings = $settings;
31	25	$this->wing = $in_params['wing'];
32	26	$this->method = $in_params['bvMethod'];
33	27	$this->is_afterload = array_key_exists('afterload', $in_params);
34	28	$this->is_admin_ajax = array_key_exists('adajx', $in_params);
		@@ -33,9 +27,8 @@
33	27	$this->is_afterload = array_key_exists('afterload', $in_params);
34	28	$this->is_admin_ajax = array_key_exists('adajx', $in_params);
35	29	$this->is_debug = array_key_exists('bvdbg', $in_params);
36	30	$this->sig = $in_params['sig'];
37		- $this->sighshalgo = !empty($in_params['sighshalgo']) ? $in_params['sighshalgo'] : null;
38	31	$this->time = intval($in_params['bvTime']);
39	32	$this->version = $in_params['bvVersion'];
40	33	$this->is_sha1 = array_key_exists('sha1', $in_params);
41	34	$this->bvb64stream = isset($in_params['bvb64stream']);
		@@ -40,12 +33,8 @@
40	33	$this->is_sha1 = array_key_exists('sha1', $in_params);
41	34	$this->bvb64stream = isset($in_params['bvb64stream']);
42	35	$this->bvb64cksize = array_key_exists('bvb64cksize', $in_params) ? intval($in_params['bvb64cksize']) : false;
43	36	$this->checksum = array_key_exists('checksum', $in_params) ? $in_params['checksum'] : false;
44		- $this->pubkey_name = !empty($in_params['pubkeyname']) ?
45		- WPRAccount::sanitizeKey($in_params['pubkeyname']) : 'm_public';
46		- $this->bvprmsmac = !empty($in_params['bvprmsmac']) ? WPRAccount::sanitizeKey($in_params['bvprmsmac']) : "";
47		- $this->bvboundry = !empty($in_params['bvboundry']) ? $in_params['bvboundry'] : "";
48	37	}
49	38
50	39	public function isAPICall() {
51	40	return array_key_exists('apicall', $this->params);
		@@ -94,10 +83,9 @@
94	83	public function info() {
95	84	$info = array(
96	85	"requestedsig" => $this->sig,
97	86	"requestedtime" => $this->time,
98		- "requestedversion" => $this->version,
99		- "error" => $this->error
	87	+ "requestedversion" => $this->version
100	88	);
101	89	if ($this->is_debug) {
102	90	$info["inreq"] = $this->params;
103	91	}
		@@ -106,8 +94,11 @@
106	94	}
107	95	if ($this->is_afterload) {
108	96	$info["afterload"] = true;
109	97	}
	98	+ if ($this->calculated_mac) {
	99	+ $info["calculated_mac"] = $this->calculated_mac;
	100	+ }
110	101	return $info;
111	102	}
112	103
113	104	public function processParams($in_params) {
		@@ -136,17 +127,22 @@
136	127	$in_params["bvprms"] = $pdata;
137	128	}
138	129	}
139	130
140		- if (array_key_exists('bvprms', $in_params) && isset($in_params['bvprms'])) {
141		- if (!empty($in_params['bvprmshshalgo']) && $in_params['bvprmshshalgo'] === 'sha256') {
142		- $calculated_mac = hash_hmac('SHA256', $in_params['bvprms'], $this->account->secret);
143		- } else {
144		- $calculated_mac = hash_hmac('SHA1', $in_params['bvprms'], $this->account->secret);
	131	+ if (array_key_exists('bvprms', $in_params) && isset($in_params['bvprms']) &&
	132	+ array_key_exists('bvprmsmac', $in_params) && isset($in_params['bvprmsmac'])) {
	133	+ $digest_algo = 'SHA1';
	134	+ $sent_mac = WPRAccount::sanitizeKey($in_params['bvprmsmac']);
	135	+
	136	+ if (array_key_exists('bvprmshshalgo', $in_params) && isset($in_params['bvprmshshalgo'])) {
	137	+ $digest_algo = $in_params['bvprmshshalgo'];
145	138	}
146	139
147		- if ($this->compare_mac($this->bvprmsmac, $calculated_mac) === true) {
	140	+ $calculated_mac = hash_hmac($digest_algo, $in_params['bvprms'], $this->account->secret);
	141	+ $this->calculated_mac = substr($calculated_mac, 0, 6);
148	142
	143	+ if ($this->compare_mac($sent_mac, $calculated_mac) === true) {
	144	+
149	145	if (array_key_exists('b64', $in_params)) {
150	146	foreach ($in_params['b64'] as $key) {
151	147	if (is_array($in_params[$key])) {
152	148	$in_params[$key] = array_map('base64_decode', $in_params[$key]);
		@@ -191,8 +187,9 @@
191	187
192	188	return $params;
193	189	}
194	190	}
	191	+
195	192	return false;
196	193	}
197	194
198	195	private function compare_mac($l_hash, $r_hash) {
		@@ -218,100 +215,7 @@
218	215	$data = base64_decode($data);
219	216	}
220	217
221	218	return $data;
222		- }
223		-
224		- public function authenticate() {
225		- if (!$this->account) {
226		- $this->error["message"] = "ACCOUNT_NOT_FOUND";
227		- return false;
228		- }
229		-
230		- $bv_last_recv_time = $this->settings->getOption('bvLastRecvTime');
231		- if ($this->time < intval($bv_last_recv_time) - 300) {
232		- return false;
233		- }
234		-
235		- $data = $this->method.$this->account->secret.$this->time.$this->version.$this->bvprmsmac;
236		- if (!$this->verify($data, base64_decode($this->sig), $this->sighshalgo)) {
237		- return false;
238		- }
239		- $this->settings->updateOption('bvLastRecvTime', $this->time);
240		-
241		- return 1;
242		- }
243		-
244		- public function verify($data, $sig, $sighshalgo) {
245		- if (!function_exists('openssl_verify') || !function_exists('openssl_pkey_get_public')) {
246		- $this->error["message"] = "OPENSSL_FUNCS_NOT_FOUND";
247		- return false;
248		- }
249		-
250		- $key_file = dirname( __FILE__ ) . '/../public_keys/' . $this->pubkey_name . '.pub';
251		- if (!file_exists($key_file)) {
252		- $this->error["message"] = "PUBLIC_KEY_NOT_FOUND";
253		- return false;
254		- }
255		- $public_key_str = file_get_contents($key_file);
256		- $public_key = openssl_pkey_get_public($public_key_str);
257		- if (!$public_key) {
258		- $this->error["message"] = "UNABLE_TO_LOAD_PUBLIC_KEY";
259		- return false;
260		- }
261		-
262		- if ($sighshalgo === 'sha256') {
263		- $verify = openssl_verify($data, $sig, $public_key, OPENSSL_ALGO_SHA256);
264		- } else {
265		- $verify = openssl_verify($data, $sig, $public_key);
266		- }
267		- if ($verify === 1) {
268		- return true;
269		- } elseif ($verify === 0) {
270		- $this->error["message"] = "INCORRECT_SIGNATURE";
271		- $this->error["pubkey_sig"] = substr(hash('md5', $public_key_str), 0, 8);
272		- } else {
273		- $this->error["message"] = "OPENSSL_VERIFY_FAILED";
274		- }
275		- return false;
276		- }
277		-
278		- public function corruptedParamsResp() {
279		- $bvinfo = new WPRInfo($this->settings);
280		-
281		- return array(
282		- "account_info" => $this->account->info(),
283		- "request_info" => $this->info(),
284		- "bvinfo" => $bvinfo->info(),
285		- "statusmsg" => "BVPRMS_CORRUPTED"
286		- );
287		- }
288		-
289		- public function authFailedResp() {
290		- $api_public_key = WPRAccount::getApiPublicKey($this->settings);
291		- $default_secret = WPRRecover::getDefaultSecret($this->settings);
292		- $default_account_pubkey = WPRAccount::getDefaultPublicKey();
293		- $bvinfo = new WPRInfo($this->settings);
294		- $resp = array(
295		- "request_info" => $this->info(),
296		- "bvinfo" => $bvinfo->info(),
297		- "statusmsg" => "FAILED_AUTH",
298		- "api_pubkey" => substr($api_public_key, 0, 8),
299		- "def_key_status" => WPRRecover::getSecretStatus($this->settings),
300		- "def_sigmatch" => substr(hash('sha1', $this->method.$default_secret.$this->time.$this->version), 0, 8)
301		- );
302		-
303		- if (is_string($default_account_pubkey) && strlen($default_account_pubkey) >= 32) {
304		- $resp["default_account_pubkey"] = substr($default_account_pubkey, 0, 8);
305		- }
306		-
307		- if ($this->account) {
308		- $resp["account_info"] = $this->account->info();
309		- $resp["sigmatch"] = substr(hash('sha1', $this->method.$this->account->secret.$this->time.$this->version), 0, 6);
310		- } else {
311		- $resp["account_info"] = array("error" => "ACCOUNT_NOT_FOUND");
312		- }
313		-
314		- return $resp;
315	219	}
316	220	}
317	221	endif;