← All changes | callback/request.php +113 -18 4.97 → 5.53 View file →

		@@ -9,10 +9,11 @@
9	9	public $is_afterload;
10	10	public $is_admin_ajax;
11	11	public $is_debug;
12	12	public $account;
13		- public $calculated_mac;
	13	+ public $settings;
14	14	public $sig;
	15	+ public $sighshalgo;
15	16	public $time;
16	17	public $version;
17	18	public $is_sha1;
18	19	public $bvb64stream;
		@@ -17,12 +18,17 @@
17	18	public $is_sha1;
18	19	public $bvb64stream;
19	20	public $bvb64cksize;
20	21	public $checksum;
	22	+ public $error = array();
	23	+ public $pubkey_name;
	24	+ public $bvprmsmac;
	25	+ public $bvboundry;
21	26
22		- public function __construct($account, $in_params) {
	27	+ public function __construct($account, $in_params, $settings) {
23	28	$this->params = array();
24	29	$this->account = $account;
	30	+ $this->settings = $settings;
25	31	$this->wing = $in_params['wing'];
26	32	$this->method = $in_params['bvMethod'];
27	33	$this->is_afterload = array_key_exists('afterload', $in_params);
28	34	$this->is_admin_ajax = array_key_exists('adajx', $in_params);
		@@ -27,8 +33,9 @@
27	33	$this->is_afterload = array_key_exists('afterload', $in_params);
28	34	$this->is_admin_ajax = array_key_exists('adajx', $in_params);
29	35	$this->is_debug = array_key_exists('bvdbg', $in_params);
30	36	$this->sig = $in_params['sig'];
	37	+ $this->sighshalgo = !empty($in_params['sighshalgo']) ? $in_params['sighshalgo'] : null;
31	38	$this->time = intval($in_params['bvTime']);
32	39	$this->version = $in_params['bvVersion'];
33	40	$this->is_sha1 = array_key_exists('sha1', $in_params);
34	41	$this->bvb64stream = isset($in_params['bvb64stream']);
		@@ -33,8 +40,12 @@
33	40	$this->is_sha1 = array_key_exists('sha1', $in_params);
34	41	$this->bvb64stream = isset($in_params['bvb64stream']);
35	42	$this->bvb64cksize = array_key_exists('bvb64cksize', $in_params) ? intval($in_params['bvb64cksize']) : false;
36	43	$this->checksum = array_key_exists('checksum', $in_params) ? $in_params['checksum'] : false;
	44	+ $this->pubkey_name = !empty($in_params['pubkeyname']) ?
	45	+ WPRAccount::sanitizeKey($in_params['pubkeyname']) : 'm_public';
	46	+ $this->bvprmsmac = !empty($in_params['bvprmsmac']) ? WPRAccount::sanitizeKey($in_params['bvprmsmac']) : "";
	47	+ $this->bvboundry = !empty($in_params['bvboundry']) ? $in_params['bvboundry'] : "";
37	48	}
38	49
39	50	public function isAPICall() {
40	51	return array_key_exists('apicall', $this->params);
		@@ -83,9 +94,10 @@
83	94	public function info() {
84	95	$info = array(
85	96	"requestedsig" => $this->sig,
86	97	"requestedtime" => $this->time,
87		- "requestedversion" => $this->version
	98	+ "requestedversion" => $this->version,
	99	+ "error" => $this->error
88	100	);
89	101	if ($this->is_debug) {
90	102	$info["inreq"] = $this->params;
91	103	}
		@@ -94,11 +106,8 @@
94	106	}
95	107	if ($this->is_afterload) {
96	108	$info["afterload"] = true;
97	109	}
98		- if ($this->calculated_mac) {
99		- $info["calculated_mac"] = $this->calculated_mac;
100		- }
101	110	return $info;
102	111	}
103	112
104	113	public function processParams($in_params) {
		@@ -127,22 +136,17 @@
127	136	$in_params["bvprms"] = $pdata;
128	137	}
129	138	}
130	139
131		- if (array_key_exists('bvprms', $in_params) && isset($in_params['bvprms']) &&
132		- array_key_exists('bvprmsmac', $in_params) && isset($in_params['bvprmsmac'])) {
133		- $digest_algo = 'SHA1';
134		- $sent_mac = WPRAccount::sanitizeKey($in_params['bvprmsmac']);
135		-
136		- if (array_key_exists('bvprmshshalgo', $in_params) && isset($in_params['bvprmshshalgo'])) {
137		- $digest_algo = $in_params['bvprmshshalgo'];
	140	+ if (array_key_exists('bvprms', $in_params) && isset($in_params['bvprms'])) {
	141	+ if (!empty($in_params['bvprmshshalgo']) && $in_params['bvprmshshalgo'] === 'sha256') {
	142	+ $calculated_mac = hash_hmac('SHA256', $in_params['bvprms'], $this->account->secret);
	143	+ } else {
	144	+ $calculated_mac = hash_hmac('SHA1', $in_params['bvprms'], $this->account->secret);
138	145	}
139	146
140		- $calculated_mac = hash_hmac($digest_algo, $in_params['bvprms'], $this->account->secret);
141		- $this->calculated_mac = substr($calculated_mac, 0, 6);
	147	+ if ($this->compare_mac($this->bvprmsmac, $calculated_mac) === true) {
142	148
143		- if ($this->compare_mac($sent_mac, $calculated_mac) === true) {
144		-
145	149	if (array_key_exists('b64', $in_params)) {
146	150	foreach ($in_params['b64'] as $key) {
147	151	if (is_array($in_params[$key])) {
148	152	$in_params[$key] = array_map('base64_decode', $in_params[$key]);
		@@ -187,9 +191,8 @@
187	191
188	192	return $params;
189	193	}
190	194	}
191		-
192	195	return false;
193	196	}
194	197
195	198	private function compare_mac($l_hash, $r_hash) {
		@@ -215,7 +218,99 @@
215	218	$data = base64_decode($data);
216	219	}
217	220
218	221	return $data;
	222	+ }
	223	+
	224	+ public function authenticate() {
	225	+ if (!$this->account) {
	226	+ $this->error["message"] = "ACCOUNT_NOT_FOUND";
	227	+ return false;
	228	+ }
	229	+
	230	+ $bv_last_recv_time = $this->settings->getOption('bvLastRecvTime');
	231	+ if ($this->time < intval($bv_last_recv_time) - 300) {
	232	+ return false;
	233	+ }
	234	+
	235	+ $data = $this->method.$this->account->secret.$this->time.$this->version.$this->bvprmsmac;
	236	+ if (!$this->verify($data, base64_decode($this->sig), $this->sighshalgo)) {
	237	+ return false;
	238	+ }
	239	+ $this->settings->updateOption('bvLastRecvTime', $this->time);
	240	+
	241	+ return 1;
	242	+ }
	243	+
	244	+ public function verify($data, $sig, $sighshalgo) {
	245	+ if (!function_exists('openssl_verify') || !function_exists('openssl_pkey_get_public')) {
	246	+ $this->error["message"] = "OPENSSL_FUNCS_NOT_FOUND";
	247	+ return false;
	248	+ }
	249	+
	250	+ $key_file = dirname( __FILE__ ) . '/../public_keys/' . $this->pubkey_name . '.pub';
	251	+ if (!file_exists($key_file)) {
	252	+ $this->error["message"] = "PUBLIC_KEY_NOT_FOUND";
	253	+ return false;
	254	+ }
	255	+ $public_key_str = file_get_contents($key_file);
	256	+ $public_key = openssl_pkey_get_public($public_key_str);
	257	+ if (!$public_key) {
	258	+ $this->error["message"] = "UNABLE_TO_LOAD_PUBLIC_KEY";
	259	+ return false;
	260	+ }
	261	+
	262	+ if ($sighshalgo === 'sha256') {
	263	+ $verify = openssl_verify($data, $sig, $public_key, OPENSSL_ALGO_SHA256);
	264	+ } else {
	265	+ $verify = openssl_verify($data, $sig, $public_key);
	266	+ }
	267	+ if ($verify === 1) {
	268	+ return true;
	269	+ } elseif ($verify === 0) {
	270	+ $this->error["message"] = "INCORRECT_SIGNATURE";
	271	+ $this->error["pubkey_sig"] = substr(hash('md5', $public_key_str), 0, 8);
	272	+ } else {
	273	+ $this->error["message"] = "OPENSSL_VERIFY_FAILED";
	274	+ }
	275	+ return false;
	276	+ }
	277	+
	278	+ public function corruptedParamsResp() {
	279	+ $bvinfo = new WPRInfo($this->settings);
	280	+
	281	+ return array(
	282	+ "account_info" => $this->account->info(),
	283	+ "request_info" => $this->info(),
	284	+ "bvinfo" => $bvinfo->info(),
	285	+ "statusmsg" => "BVPRMS_CORRUPTED"
	286	+ );
	287	+ }
	288	+
	289	+ public function authFailedResp() {
	290	+ $api_public_key = WPRAccount::getApiPublicKey($this->settings);
	291	+ $default_secret = WPRRecover::getDefaultSecret($this->settings);
	292	+ $default_account_pubkey = WPRAccount::getDefaultPublicKey();
	293	+ $bvinfo = new WPRInfo($this->settings);
	294	+ $resp = array(
	295	+ "request_info" => $this->info(),
	296	+ "bvinfo" => $bvinfo->info(),
	297	+ "statusmsg" => "FAILED_AUTH",
	298	+ "api_pubkey" => substr($api_public_key, 0, 8),
	299	+ "def_sigmatch" => substr(hash('sha1', $this->method.$default_secret.$this->time.$this->version), 0, 8)
	300	+ );
	301	+
	302	+ if (is_string($default_account_pubkey) && strlen($default_account_pubkey) >= 32) {
	303	+ $resp["default_account_pubkey"] = substr($default_account_pubkey, 0, 8);
	304	+ }
	305	+
	306	+ if ($this->account) {
	307	+ $resp["account_info"] = $this->account->info();
	308	+ $resp["sigmatch"] = substr(hash('sha1', $this->method.$this->account->secret.$this->time.$this->version), 0, 6);
	309	+ } else {
	310	+ $resp["account_info"] = array("error" => "ACCOUNT_NOT_FOUND");
	311	+ }
	312	+
	313	+ return $resp;
219	314	}
220	315	}
221	316	endif;