← All changes | callback/request.php +44 -48 6.65 → 5.68 View file →

		@@ -1,15 +1,13 @@
1	1	<?php
2	2
3	3	if (!defined('ABSPATH')) exit;
4		-if (!class_exists('WPRCallbackRequest')) :
5		- class WPRCallbackRequest {
	4	+if (!class_exists('BVCallbackRequest')) :
	5	+ class BVCallbackRequest {
6	6	public $params;
7	7	public $method;
8	8	public $wing;
9	9	public $is_afterload;
10		- public $is_aftershutdown;
11		- public $keep_page_output;
12	10	public $is_admin_ajax;
13	11	public $is_debug;
14	12	public $account;
15	13	public $settings;
		@@ -25,13 +23,8 @@
25	23	public $pubkey_name;
26	24	public $bvprmsmac;
27	25	public $bvboundry;
28	26
29		- private static $SIG_HASH_ALGO_MAP = array(
30		- '1' => OPENSSL_ALGO_SHA1,
31		- '7' => OPENSSL_ALGO_SHA256
32		- );
33		-
34	27	public function __construct($account, $in_params, $settings) {
35	28	$this->params = array();
36	29	$this->account = $account;
37	30	$this->settings = $settings;
		@@ -37,15 +30,12 @@
37	30	$this->settings = $settings;
38	31	$this->wing = $in_params['wing'];
39	32	$this->method = $in_params['bvMethod'];
40	33	$this->is_afterload = array_key_exists('afterload', $in_params);
41		- $this->is_aftershutdown = array_key_exists('aftershutdown', $in_params);
42		- $this->keep_page_output = $this->is_aftershutdown &&
43		- array_key_exists('keeppageoutput', $in_params);
44	34	$this->is_admin_ajax = array_key_exists('adajx', $in_params);
45	35	$this->is_debug = array_key_exists('bvdbg', $in_params);
46	36	$this->sig = $in_params['sig'];
47		- $this->sighshalgo = !empty($in_params['sighshalgo']) ? $in_params['sighshalgo'] : '1';
	37	+ $this->sighshalgo = !empty($in_params['sighshalgo']) ? $in_params['sighshalgo'] : null;
48	38	$this->time = intval($in_params['bvTime']);
49	39	$this->version = $in_params['bvVersion'];
50	40	$this->is_sha1 = array_key_exists('sha1', $in_params);
51	41	$this->bvb64stream = isset($in_params['bvb64stream']);
		@@ -60,25 +50,38 @@
60	50	public function isAPICall() {
61	51	return array_key_exists('apicall', $this->params);
62	52	}
63	53
64		- public function http_request($url, $body) {
65		- $body = http_build_query($body);
66		- $response = wp_remote_post($url, array(
67		- 'body' => $body,
68		- 'timeout' => 15,
69		- 'headers' => array(
70		- 'Content-Type' => 'application/x-www-form-urlencoded',
71		- ),
72		- ));
	54	+ public function curlRequest($url, $body) {
	55	+ $ch = curl_init($url);
	56	+ curl_setopt($ch, CURLOPT_POST, 1);
	57	+ curl_setopt($ch, CURLOPT_TIMEOUT, 15);
	58	+ curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($body));
	59	+ curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
	60	+ return curl_exec($ch);
	61	+ }
73	62
74		- if (is_wp_error($response)) {
75		- return false;
76		- }
	63	+ public function fileGetContentRequest($url, $body) {
	64	+ $options = array(
	65	+ 'http' => array(
	66	+ 'header' => "Content-type: application/x-www-form-urlencoded\r\n",
	67	+ 'method' => 'POST',
	68	+ 'content' => http_build_query($body)
	69	+ )
	70	+ );
77	71
78		- return wp_remote_retrieve_body($response);
	72	+ $context = stream_context_create($options);
	73	+ return file_get_contents($url, false, $context);
79	74	}
80	75
	76	+ public function http_request($url, $body) {
	77	+ if (in_array('curl', get_loaded_extensions())) {
	78	+ return $this->curlRequest($url, $body);
	79	+ } else {
	80	+ return $this->fileGetContentRequest($url, $body);
	81	+ }
	82	+ }
	83	+
81	84	public function get_params_via_api($params_key, $apiurl) {
82	85	$res = $this->http_request($apiurl, array('bvkey' => $params_key));
83	86
84	87	if ($res === FALSE) {
		@@ -103,14 +106,8 @@
103	106	}
104	107	if ($this->is_afterload) {
105	108	$info["afterload"] = true;
106	109	}
107		- if ($this->is_aftershutdown) {
108		- $info["aftershutdown"] = true;
109		- }
110		- if ($this->keep_page_output) {
111		- $info["keeppageoutput"] = true;
112		- }
113	110	return $info;
114	111	}
115	112
116	113	public function processParams($in_params) {
		@@ -166,9 +163,9 @@
166	163	}
167	164
168	165	if (array_key_exists('sersafe', $in_params)) {
169	166	$key = $in_params['sersafe'];
170		- $in_params[$key] = WPRCallbackRequest::serialization_safe_decode($in_params[$key]);
	167	+ $in_params[$key] = BVCallbackRequest::serialization_safe_decode($in_params[$key]);
171	168	}
172	169
173	170	if (array_key_exists('bvprms', $in_params) && isset($in_params['bvprms'])) {
174	171	$params = $in_params['bvprms'];
		@@ -188,9 +185,8 @@
188	185	}
189	186
190	187	if (array_key_exists('memset', $in_params)) {
191	188	$val = intval($in_params['memset']);
192		- // phpcs:ignore Squiz.PHP.DiscouragedFunctions.Discouraged -- Required for memory limit adjustment
193	189	@ini_set('memory_limit', $val.'M');
194	190	}
195	191
196	192	return $params;
		@@ -216,9 +212,9 @@
216	212	}
217	213
218	214	public static function serialization_safe_decode($data) {
219	215	if (is_array($data)) {
220		- $data = array_map(array('WPRCallbackRequest', 'serialization_safe_decode'), $data);
	216	+ $data = array_map(array('BVCallbackRequest', 'serialization_safe_decode'), $data);
221	217	} elseif (is_string($data)) {
222	218	$data = base64_decode($data);
223	219	}
224	220
		@@ -250,22 +246,14 @@
250	246	$this->error["message"] = "OPENSSL_FUNCS_NOT_FOUND";
251	247	return false;
252	248	}
253	249
254		- $openssl_algo = array_key_exists($sighshalgo, self::$SIG_HASH_ALGO_MAP) ? self::$SIG_HASH_ALGO_MAP[$sighshalgo] : null;
255		- if ($openssl_algo === null) {
256		- $this->error["message"] = "UNSUPPORTED_HASH_ALGORITHM: " . $sighshalgo;
257		- return false;
258		- }
259		-
260		- $key_file = dirname( __DIR__ ) . '/public_keys/' . $this->pubkey_name . '.pub';
	250	+ $key_file = dirname( __FILE__ ) . '/../public_keys/' . $this->pubkey_name . '.pub';
261	251	if (!file_exists($key_file)) {
262	252	$this->error["message"] = "PUBLIC_KEY_NOT_FOUND";
263	253	return false;
264	254	}
265		-
266		- $public_key_str = WPRWPFileSystem::getInstance()->getContents($key_file);
267		-
	255	+ $public_key_str = file_get_contents($key_file);
268	256	$public_key = openssl_pkey_get_public($public_key_str);
269	257	if (!$public_key) {
270	258	$this->error["message"] = "UNABLE_TO_LOAD_PUBLIC_KEY";
271	259	return false;
		@@ -270,9 +258,13 @@
270	258	$this->error["message"] = "UNABLE_TO_LOAD_PUBLIC_KEY";
271	259	return false;
272	260	}
273	261
274		- $verify = openssl_verify($data, $sig, $public_key, $openssl_algo);
	262	+ if ($sighshalgo === 'sha256') {
	263	+ $verify = openssl_verify($data, $sig, $public_key, OPENSSL_ALGO_SHA256);
	264	+ } else {
	265	+ $verify = openssl_verify($data, $sig, $public_key);
	266	+ }
275	267	if ($verify === 1) {
276	268	return true;
277	269	} elseif ($verify === 0) {
278	270	$this->error["message"] = "INCORRECT_SIGNATURE";
		@@ -295,8 +287,9 @@
295	287	}
296	288
297	289	public function authFailedResp() {
298	290	$api_public_key = WPRAccount::getApiPublicKey($this->settings);
	291	+ $default_secret = WPRRecover::getDefaultSecret($this->settings);
299	292	$default_account_pubkey = WPRAccount::getDefaultPublicKey();
300	293	$bvinfo = new WPRInfo($this->settings);
301	294	$resp = array(
302	295	"request_info" => $this->info(),
		@@ -301,9 +294,11 @@
301	294	$resp = array(
302	295	"request_info" => $this->info(),
303	296	"bvinfo" => $bvinfo->info(),
304	297	"statusmsg" => "FAILED_AUTH",
305		- "api_pubkey" => substr($api_public_key, 0, 8)
	298	+ "api_pubkey" => substr($api_public_key, 0, 8),
	299	+ "def_key_status" => WPRRecover::getSecretStatus($this->settings),
	300	+ "def_sigmatch" => substr(hash('sha1', $this->method.$default_secret.$this->time.$this->version), 0, 8)
306	301	);
307	302
308	303	if (is_string($default_account_pubkey) && strlen($default_account_pubkey) >= 32) {
309	304	$resp["default_account_pubkey"] = substr($default_account_pubkey, 0, 8);
		@@ -310,8 +305,9 @@
310	305	}
311	306
312	307	if ($this->account) {
313	308	$resp["account_info"] = $this->account->info();
	309	+ $resp["sigmatch"] = substr(hash('sha1', $this->method.$this->account->secret.$this->time.$this->version), 0, 6);
314	310	} else {
315	311	$resp["account_info"] = array("error" => "ACCOUNT_NOT_FOUND");
316	312	}
317	313
		@@ -317,5 +313,5 @@
317	313
318	314	return $resp;
319	315	}
320	316	}
321		-endif;
	317	+endif;