← All changes | callback/request.php +18 -32 6.65 → 5.88 View file →

		@@ -1,15 +1,13 @@
1	1	<?php
2	2
3	3	if (!defined('ABSPATH')) exit;
4		-if (!class_exists('WPRCallbackRequest')) :
5		- class WPRCallbackRequest {
	4	+if (!class_exists('BVCallbackRequest')) :
	5	+ class BVCallbackRequest {
6	6	public $params;
7	7	public $method;
8	8	public $wing;
9	9	public $is_afterload;
10		- public $is_aftershutdown;
11		- public $keep_page_output;
12	10	public $is_admin_ajax;
13	11	public $is_debug;
14	12	public $account;
15	13	public $settings;
		@@ -25,13 +23,8 @@
25	23	public $pubkey_name;
26	24	public $bvprmsmac;
27	25	public $bvboundry;
28	26
29		- private static $SIG_HASH_ALGO_MAP = array(
30		- '1' => OPENSSL_ALGO_SHA1,
31		- '7' => OPENSSL_ALGO_SHA256
32		- );
33		-
34	27	public function __construct($account, $in_params, $settings) {
35	28	$this->params = array();
36	29	$this->account = $account;
37	30	$this->settings = $settings;
		@@ -37,15 +30,12 @@
37	30	$this->settings = $settings;
38	31	$this->wing = $in_params['wing'];
39	32	$this->method = $in_params['bvMethod'];
40	33	$this->is_afterload = array_key_exists('afterload', $in_params);
41		- $this->is_aftershutdown = array_key_exists('aftershutdown', $in_params);
42		- $this->keep_page_output = $this->is_aftershutdown &&
43		- array_key_exists('keeppageoutput', $in_params);
44	34	$this->is_admin_ajax = array_key_exists('adajx', $in_params);
45	35	$this->is_debug = array_key_exists('bvdbg', $in_params);
46	36	$this->sig = $in_params['sig'];
47		- $this->sighshalgo = !empty($in_params['sighshalgo']) ? $in_params['sighshalgo'] : '1';
	37	+ $this->sighshalgo = !empty($in_params['sighshalgo']) ? $in_params['sighshalgo'] : null;
48	38	$this->time = intval($in_params['bvTime']);
49	39	$this->version = $in_params['bvVersion'];
50	40	$this->is_sha1 = array_key_exists('sha1', $in_params);
51	41	$this->bvb64stream = isset($in_params['bvb64stream']);
		@@ -103,14 +93,8 @@
103	93	}
104	94	if ($this->is_afterload) {
105	95	$info["afterload"] = true;
106	96	}
107		- if ($this->is_aftershutdown) {
108		- $info["aftershutdown"] = true;
109		- }
110		- if ($this->keep_page_output) {
111		- $info["keeppageoutput"] = true;
112		- }
113	97	return $info;
114	98	}
115	99
116	100	public function processParams($in_params) {
		@@ -166,9 +150,9 @@
166	150	}
167	151
168	152	if (array_key_exists('sersafe', $in_params)) {
169	153	$key = $in_params['sersafe'];
170		- $in_params[$key] = WPRCallbackRequest::serialization_safe_decode($in_params[$key]);
	154	+ $in_params[$key] = BVCallbackRequest::serialization_safe_decode($in_params[$key]);
171	155	}
172	156
173	157	if (array_key_exists('bvprms', $in_params) && isset($in_params['bvprms'])) {
174	158	$params = $in_params['bvprms'];
		@@ -188,9 +172,8 @@
188	172	}
189	173
190	174	if (array_key_exists('memset', $in_params)) {
191	175	$val = intval($in_params['memset']);
192		- // phpcs:ignore Squiz.PHP.DiscouragedFunctions.Discouraged -- Required for memory limit adjustment
193	176	@ini_set('memory_limit', $val.'M');
194	177	}
195	178
196	179	return $params;
		@@ -216,9 +199,9 @@
216	199	}
217	200
218	201	public static function serialization_safe_decode($data) {
219	202	if (is_array($data)) {
220		- $data = array_map(array('WPRCallbackRequest', 'serialization_safe_decode'), $data);
	203	+ $data = array_map(array('BVCallbackRequest', 'serialization_safe_decode'), $data);
221	204	} elseif (is_string($data)) {
222	205	$data = base64_decode($data);
223	206	}
224	207
		@@ -250,14 +233,8 @@
250	233	$this->error["message"] = "OPENSSL_FUNCS_NOT_FOUND";
251	234	return false;
252	235	}
253	236
254		- $openssl_algo = array_key_exists($sighshalgo, self::$SIG_HASH_ALGO_MAP) ? self::$SIG_HASH_ALGO_MAP[$sighshalgo] : null;
255		- if ($openssl_algo === null) {
256		- $this->error["message"] = "UNSUPPORTED_HASH_ALGORITHM: " . $sighshalgo;
257		- return false;
258		- }
259		-
260	237	$key_file = dirname( __DIR__ ) . '/public_keys/' . $this->pubkey_name . '.pub';
261	238	if (!file_exists($key_file)) {
262	239	$this->error["message"] = "PUBLIC_KEY_NOT_FOUND";
263	240	return false;
		@@ -262,9 +239,10 @@
262	239	$this->error["message"] = "PUBLIC_KEY_NOT_FOUND";
263	240	return false;
264	241	}
265	242
266		- $public_key_str = WPRWPFileSystem::getInstance()->getContents($key_file);
	243	+ $filesystem = WPRHelper::get_direct_filesystem();
	244	+ $public_key_str = $filesystem->get_contents($key_file);
267	245
268	246	$public_key = openssl_pkey_get_public($public_key_str);
269	247	if (!$public_key) {
270	248	$this->error["message"] = "UNABLE_TO_LOAD_PUBLIC_KEY";
		@@ -270,9 +248,13 @@
270	248	$this->error["message"] = "UNABLE_TO_LOAD_PUBLIC_KEY";
271	249	return false;
272	250	}
273	251
274		- $verify = openssl_verify($data, $sig, $public_key, $openssl_algo);
	252	+ if ($sighshalgo === 'sha256') {
	253	+ $verify = openssl_verify($data, $sig, $public_key, OPENSSL_ALGO_SHA256);
	254	+ } else {
	255	+ $verify = openssl_verify($data, $sig, $public_key);
	256	+ }
275	257	if ($verify === 1) {
276	258	return true;
277	259	} elseif ($verify === 0) {
278	260	$this->error["message"] = "INCORRECT_SIGNATURE";
		@@ -295,8 +277,9 @@
295	277	}
296	278
297	279	public function authFailedResp() {
298	280	$api_public_key = WPRAccount::getApiPublicKey($this->settings);
	281	+ $default_secret = WPRRecover::getDefaultSecret($this->settings);
299	282	$default_account_pubkey = WPRAccount::getDefaultPublicKey();
300	283	$bvinfo = new WPRInfo($this->settings);
301	284	$resp = array(
302	285	"request_info" => $this->info(),
		@@ -301,9 +284,11 @@
301	284	$resp = array(
302	285	"request_info" => $this->info(),
303	286	"bvinfo" => $bvinfo->info(),
304	287	"statusmsg" => "FAILED_AUTH",
305		- "api_pubkey" => substr($api_public_key, 0, 8)
	288	+ "api_pubkey" => substr($api_public_key, 0, 8),
	289	+ "def_key_status" => WPRRecover::getSecretStatus($this->settings),
	290	+ "def_sigmatch" => substr(hash('sha1', $this->method.$default_secret.$this->time.$this->version), 0, 8)
306	291	);
307	292
308	293	if (is_string($default_account_pubkey) && strlen($default_account_pubkey) >= 32) {
309	294	$resp["default_account_pubkey"] = substr($default_account_pubkey, 0, 8);
		@@ -310,8 +295,9 @@
310	295	}
311	296
312	297	if ($this->account) {
313	298	$resp["account_info"] = $this->account->info();
	299	+ $resp["sigmatch"] = substr(hash('sha1', $this->method.$this->account->secret.$this->time.$this->version), 0, 6);
314	300	} else {
315	301	$resp["account_info"] = array("error" => "ACCOUNT_NOT_FOUND");
316	302	}
317	303
		@@ -317,5 +303,5 @@
317	303
318	304	return $resp;
319	305	}
320	306	}
321		-endif;
	307	+endif;