← All changes | callback/request.php +32 -34 5.41 → 6.36 View file →

		@@ -23,8 +23,13 @@
23	23	public $pubkey_name;
24	24	public $bvprmsmac;
25	25	public $bvboundry;
26	26
	27	+ private static $SIG_HASH_ALGO_MAP = array(
	28	+ '1' => OPENSSL_ALGO_SHA1,
	29	+ '7' => OPENSSL_ALGO_SHA256
	30	+ );
	31	+
27	32	public function __construct($account, $in_params, $settings) {
28	33	$this->params = array();
29	34	$this->account = $account;
30	35	$this->settings = $settings;
		@@ -33,9 +38,9 @@
33	38	$this->is_afterload = array_key_exists('afterload', $in_params);
34	39	$this->is_admin_ajax = array_key_exists('adajx', $in_params);
35	40	$this->is_debug = array_key_exists('bvdbg', $in_params);
36	41	$this->sig = $in_params['sig'];
37		- $this->sighshalgo = !empty($in_params['sighshalgo']) ? $in_params['sighshalgo'] : null;
	42	+ $this->sighshalgo = !empty($in_params['sighshalgo']) ? $in_params['sighshalgo'] : '1';
38	43	$this->time = intval($in_params['bvTime']);
39	44	$this->version = $in_params['bvVersion'];
40	45	$this->is_sha1 = array_key_exists('sha1', $in_params);
41	46	$this->bvb64stream = isset($in_params['bvb64stream']);
		@@ -50,38 +55,25 @@
50	55	public function isAPICall() {
51	56	return array_key_exists('apicall', $this->params);
52	57	}
53	58
54		- public function curlRequest($url, $body) {
55		- $ch = curl_init($url);
56		- curl_setopt($ch, CURLOPT_POST, 1);
57		- curl_setopt($ch, CURLOPT_TIMEOUT, 15);
58		- curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($body));
59		- curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
60		- return curl_exec($ch);
61		- }
	59	+ public function http_request($url, $body) {
	60	+ $body = http_build_query($body);
	61	+ $response = wp_remote_post($url, array(
	62	+ 'body' => $body,
	63	+ 'timeout' => 15,
	64	+ 'headers' => array(
	65	+ 'Content-Type' => 'application/x-www-form-urlencoded',
	66	+ ),
	67	+ ));
62	68
63		- public function fileGetContentRequest($url, $body) {
64		- $options = array(
65		- 'http' => array(
66		- 'header' => "Content-type: application/x-www-form-urlencoded\r\n",
67		- 'method' => 'POST',
68		- 'content' => http_build_query($body)
69		- )
70		- );
	69	+ if (is_wp_error($response)) {
	70	+ return false;
	71	+ }
71	72
72		- $context = stream_context_create($options);
73		- return file_get_contents($url, false, $context);
	73	+ return wp_remote_retrieve_body($response);
74	74	}
75	75
76		- public function http_request($url, $body) {
77		- if (in_array('curl', get_loaded_extensions())) {
78		- return $this->curlRequest($url, $body);
79		- } else {
80		- return $this->fileGetContentRequest($url, $body);
81		- }
82		- }
83		-
84	76	public function get_params_via_api($params_key, $apiurl) {
85	77	$res = $this->http_request($apiurl, array('bvkey' => $params_key));
86	78
87	79	if ($res === FALSE) {
		@@ -185,8 +177,9 @@
185	177	}
186	178
187	179	if (array_key_exists('memset', $in_params)) {
188	180	$val = intval($in_params['memset']);
	181	+ // phpcs:ignore Squiz.PHP.DiscouragedFunctions.Discouraged -- Required for memory limit adjustment
189	182	@ini_set('memory_limit', $val.'M');
190	183	}
191	184
192	185	return $params;
		@@ -246,14 +239,22 @@
246	239	$this->error["message"] = "OPENSSL_FUNCS_NOT_FOUND";
247	240	return false;
248	241	}
249	242
250		- $key_file = dirname( __FILE__ ) . '/../public_keys/' . $this->pubkey_name . '.pub';
	243	+ $openssl_algo = array_key_exists($sighshalgo, self::$SIG_HASH_ALGO_MAP) ? self::$SIG_HASH_ALGO_MAP[$sighshalgo] : null;
	244	+ if ($openssl_algo === null) {
	245	+ $this->error["message"] = "UNSUPPORTED_HASH_ALGORITHM: " . $sighshalgo;
	246	+ return false;
	247	+ }
	248	+
	249	+ $key_file = dirname( __DIR__ ) . '/public_keys/' . $this->pubkey_name . '.pub';
251	250	if (!file_exists($key_file)) {
252	251	$this->error["message"] = "PUBLIC_KEY_NOT_FOUND";
253	252	return false;
254	253	}
255		- $public_key_str = file_get_contents($key_file);
	254	+
	255	+ $public_key_str = WPRWPFileSystem::getInstance()->getContents($key_file);
	256	+
256	257	$public_key = openssl_pkey_get_public($public_key_str);
257	258	if (!$public_key) {
258	259	$this->error["message"] = "UNABLE_TO_LOAD_PUBLIC_KEY";
259	260	return false;
		@@ -258,13 +259,9 @@
258	259	$this->error["message"] = "UNABLE_TO_LOAD_PUBLIC_KEY";
259	260	return false;
260	261	}
261	262
262		- if ($sighshalgo === 'sha256') {
263		- $verify = openssl_verify($data, $sig, $public_key, OPENSSL_ALGO_SHA256);
264		- } else {
265		- $verify = openssl_verify($data, $sig, $public_key);
266		- }
	263	+ $verify = openssl_verify($data, $sig, $public_key, $openssl_algo);
267	264	if ($verify === 1) {
268	265	return true;
269	266	} elseif ($verify === 0) {
270	267	$this->error["message"] = "INCORRECT_SIGNATURE";
		@@ -295,8 +292,9 @@
295	292	"request_info" => $this->info(),
296	293	"bvinfo" => $bvinfo->info(),
297	294	"statusmsg" => "FAILED_AUTH",
298	295	"api_pubkey" => substr($api_public_key, 0, 8),
	296	+ "def_key_status" => WPRRecover::getSecretStatus($this->settings),
299	297	"def_sigmatch" => substr(hash('sha1', $this->method.$default_secret.$this->time.$this->version), 0, 8)
300	298	);
301	299
302	300	if (is_string($default_account_pubkey) && strlen($default_account_pubkey) >= 32) {