← All changes | callback/request.php +40 -32 5.22 → 5.93 View file →

		@@ -11,8 +11,9 @@
11	11	public $is_debug;
12	12	public $account;
13	13	public $settings;
14	14	public $sig;
	15	+ public $sighshalgo;
15	16	public $time;
16	17	public $version;
17	18	public $is_sha1;
18	19	public $bvb64stream;
		@@ -20,8 +21,9 @@
20	21	public $checksum;
21	22	public $error = array();
22	23	public $pubkey_name;
23	24	public $bvprmsmac;
	25	+ public $bvboundry;
24	26
25	27	public function __construct($account, $in_params, $settings) {
26	28	$this->params = array();
27	29	$this->account = $account;
		@@ -31,8 +33,9 @@
31	33	$this->is_afterload = array_key_exists('afterload', $in_params);
32	34	$this->is_admin_ajax = array_key_exists('adajx', $in_params);
33	35	$this->is_debug = array_key_exists('bvdbg', $in_params);
34	36	$this->sig = $in_params['sig'];
	37	+ $this->sighshalgo = !empty($in_params['sighshalgo']) ? $in_params['sighshalgo'] : null;
35	38	$this->time = intval($in_params['bvTime']);
36	39	$this->version = $in_params['bvVersion'];
37	40	$this->is_sha1 = array_key_exists('sha1', $in_params);
38	41	$this->bvb64stream = isset($in_params['bvb64stream']);
		@@ -40,8 +43,9 @@
40	43	$this->checksum = array_key_exists('checksum', $in_params) ? $in_params['checksum'] : false;
41	44	$this->pubkey_name = !empty($in_params['pubkeyname']) ?
42	45	WPRAccount::sanitizeKey($in_params['pubkeyname']) : 'm_public';
43	46	$this->bvprmsmac = !empty($in_params['bvprmsmac']) ? WPRAccount::sanitizeKey($in_params['bvprmsmac']) : "";
	47	+ $this->bvboundry = !empty($in_params['bvboundry']) ? $in_params['bvboundry'] : "";
44	48	}
45	49
46	50	public function isAPICall() {
47	51	return array_key_exists('apicall', $this->params);
		@@ -46,38 +50,25 @@
46	50	public function isAPICall() {
47	51	return array_key_exists('apicall', $this->params);
48	52	}
49	53
50		- public function curlRequest($url, $body) {
51		- $ch = curl_init($url);
52		- curl_setopt($ch, CURLOPT_POST, 1);
53		- curl_setopt($ch, CURLOPT_TIMEOUT, 15);
54		- curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($body));
55		- curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
56		- return curl_exec($ch);
57		- }
	54	+ public function http_request($url, $body) {
	55	+ $body = http_build_query($body);
	56	+ $response = wp_remote_post($url, array(
	57	+ 'body' => $body,
	58	+ 'timeout' => 15,
	59	+ 'headers' => array(
	60	+ 'Content-Type' => 'application/x-www-form-urlencoded',
	61	+ ),
	62	+ ));
58	63
59		- public function fileGetContentRequest($url, $body) {
60		- $options = array(
61		- 'http' => array(
62		- 'header' => "Content-type: application/x-www-form-urlencoded\r\n",
63		- 'method' => 'POST',
64		- 'content' => http_build_query($body)
65		- )
66		- );
	64	+ if (is_wp_error($response)) {
	65	+ return false;
	66	+ }
67	67
68		- $context = stream_context_create($options);
69		- return file_get_contents($url, false, $context);
	68	+ return wp_remote_retrieve_body($response);
70	69	}
71	70
72		- public function http_request($url, $body) {
73		- if (in_array('curl', get_loaded_extensions())) {
74		- return $this->curlRequest($url, $body);
75		- } else {
76		- return $this->fileGetContentRequest($url, $body);
77		- }
78		- }
79		-
80	71	public function get_params_via_api($params_key, $apiurl) {
81	72	$res = $this->http_request($apiurl, array('bvkey' => $params_key));
82	73
83	74	if ($res === FALSE) {
		@@ -133,9 +124,13 @@
133	124	}
134	125	}
135	126
136	127	if (array_key_exists('bvprms', $in_params) && isset($in_params['bvprms'])) {
137		- $calculated_mac = hash_hmac('SHA1', $in_params['bvprms'], $this->account->secret);
	128	+ if (!empty($in_params['bvprmshshalgo']) && $in_params['bvprmshshalgo'] === 'sha256') {
	129	+ $calculated_mac = hash_hmac('SHA256', $in_params['bvprms'], $this->account->secret);
	130	+ } else {
	131	+ $calculated_mac = hash_hmac('SHA1', $in_params['bvprms'], $this->account->secret);
	132	+ }
138	133
139	134	if ($this->compare_mac($this->bvprmsmac, $calculated_mac) === true) {
140	135
141	136	if (array_key_exists('b64', $in_params)) {
		@@ -177,8 +172,9 @@
177	172	}
178	173
179	174	if (array_key_exists('memset', $in_params)) {
180	175	$val = intval($in_params['memset']);
	176	+ // phpcs:ignore Squiz.PHP.DiscouragedFunctions.Discouraged -- Required for memory limit adjustment
181	177	@ini_set('memory_limit', $val.'M');
182	178	}
183	179
184	180	return $params;
		@@ -224,9 +220,9 @@
224	220	return false;
225	221	}
226	222
227	223	$data = $this->method.$this->account->secret.$this->time.$this->version.$this->bvprmsmac;
228		- if (!$this->verify($data, base64_decode($this->sig))) {
	224	+ if (!$this->verify($data, base64_decode($this->sig), $this->sighshalgo)) {
229	225	return false;
230	226	}
231	227	$this->settings->updateOption('bvLastRecvTime', $this->time);
232	228
		@@ -232,20 +228,22 @@
232	228
233	229	return 1;
234	230	}
235	231
236		- public function verify($data, $sig) {
	232	+ public function verify($data, $sig, $sighshalgo) {
237	233	if (!function_exists('openssl_verify') || !function_exists('openssl_pkey_get_public')) {
238	234	$this->error["message"] = "OPENSSL_FUNCS_NOT_FOUND";
239	235	return false;
240	236	}
241	237
242		- $key_file = dirname( __FILE__ ) . '/../public_keys/' . $this->pubkey_name . '.pub';
	238	+ $key_file = dirname( __DIR__ ) . '/public_keys/' . $this->pubkey_name . '.pub';
243	239	if (!file_exists($key_file)) {
244	240	$this->error["message"] = "PUBLIC_KEY_NOT_FOUND";
245	241	return false;
246	242	}
247		- $public_key_str = file_get_contents($key_file);
	243	+
	244	+ $public_key_str = WPRWPFileSystem::getInstance()->getContents($key_file);
	245	+
248	246	$public_key = openssl_pkey_get_public($public_key_str);
249	247	if (!$public_key) {
250	248	$this->error["message"] = "UNABLE_TO_LOAD_PUBLIC_KEY";
251	249	return false;
		@@ -250,9 +248,13 @@
250	248	$this->error["message"] = "UNABLE_TO_LOAD_PUBLIC_KEY";
251	249	return false;
252	250	}
253	251
254		- $verify = openssl_verify($data, $sig, $public_key);
	252	+ if ($sighshalgo === 'sha256') {
	253	+ $verify = openssl_verify($data, $sig, $public_key, OPENSSL_ALGO_SHA256);
	254	+ } else {
	255	+ $verify = openssl_verify($data, $sig, $public_key);
	256	+ }
255	257	if ($verify === 1) {
256	258	return true;
257	259	} elseif ($verify === 0) {
258	260	$this->error["message"] = "INCORRECT_SIGNATURE";
		@@ -276,8 +278,9 @@
276	278
277	279	public function authFailedResp() {
278	280	$api_public_key = WPRAccount::getApiPublicKey($this->settings);
279	281	$default_secret = WPRRecover::getDefaultSecret($this->settings);
	282	+ $default_account_pubkey = WPRAccount::getDefaultPublicKey();
280	283	$bvinfo = new WPRInfo($this->settings);
281	284	$resp = array(
282	285	"request_info" => $this->info(),
283	286	"bvinfo" => $bvinfo->info(),
		@@ -282,10 +285,15 @@
282	285	"request_info" => $this->info(),
283	286	"bvinfo" => $bvinfo->info(),
284	287	"statusmsg" => "FAILED_AUTH",
285	288	"api_pubkey" => substr($api_public_key, 0, 8),
	289	+ "def_key_status" => WPRRecover::getSecretStatus($this->settings),
286	290	"def_sigmatch" => substr(hash('sha1', $this->method.$default_secret.$this->time.$this->version), 0, 8)
287	291	);
	292	+
	293	+ if (is_string($default_account_pubkey) && strlen($default_account_pubkey) >= 32) {
	294	+ $resp["default_account_pubkey"] = substr($default_account_pubkey, 0, 8);
	295	+ }
288	296
289	297	if ($this->account) {
290	298	$resp["account_info"] = $this->account->info();
291	299	$resp["sigmatch"] = substr(hash('sha1', $this->method.$this->account->secret.$this->time.$this->version), 0, 6);