← All changes | callback/request.php +49 -45 5.72 → trunk View file →

		@@ -1,13 +1,15 @@
1	1	<?php
2	2
3	3	if (!defined('ABSPATH')) exit;
4		-if (!class_exists('BVCallbackRequest')) :
5		- class BVCallbackRequest {
	4	+if (!class_exists('WPRCallbackRequest')) :
	5	+ class WPRCallbackRequest {
6	6	public $params;
7	7	public $method;
8	8	public $wing;
9	9	public $is_afterload;
	10	+ public $is_aftershutdown;
	11	+ public $keep_page_output;
10	12	public $is_admin_ajax;
11	13	public $is_debug;
12	14	public $account;
13	15	public $settings;
		@@ -23,8 +25,13 @@
23	25	public $pubkey_name;
24	26	public $bvprmsmac;
25	27	public $bvboundry;
26	28
	29	+ private static $SIG_HASH_ALGO_MAP = array(
	30	+ '1' => OPENSSL_ALGO_SHA1,
	31	+ '7' => OPENSSL_ALGO_SHA256
	32	+ );
	33	+
27	34	public function __construct($account, $in_params, $settings) {
28	35	$this->params = array();
29	36	$this->account = $account;
30	37	$this->settings = $settings;
		@@ -30,17 +37,20 @@
30	37	$this->settings = $settings;
31	38	$this->wing = $in_params['wing'];
32	39	$this->method = $in_params['bvMethod'];
33	40	$this->is_afterload = array_key_exists('afterload', $in_params);
	41	+ $this->is_aftershutdown = array_key_exists('aftershutdown', $in_params);
	42	+ $this->keep_page_output = $this->is_aftershutdown &&
	43	+ array_key_exists('keeppageoutput', $in_params);
34	44	$this->is_admin_ajax = array_key_exists('adajx', $in_params);
35	45	$this->is_debug = array_key_exists('bvdbg', $in_params);
36	46	$this->sig = $in_params['sig'];
37		- $this->sighshalgo = !empty($in_params['sighshalgo']) ? $in_params['sighshalgo'] : null;
	47	+ $this->sighshalgo = !empty($in_params['sighshalgo']) ? $in_params['sighshalgo'] : '1';
38	48	$this->time = intval($in_params['bvTime']);
39	49	$this->version = $in_params['bvVersion'];
40	50	$this->is_sha1 = array_key_exists('sha1', $in_params);
41	51	$this->bvb64stream = isset($in_params['bvb64stream']);
42		- $this->bvb64cksize = array_key_exists('bvb64cksize', $in_params) ? intval($in_params['bvb64cksize']) : false;
	52	+ $this->bvb64cksize = array_key_exists('bvb64cksize', $in_params) ? intval($in_params['bvb64cksize']) : 0;
43	53	$this->checksum = array_key_exists('checksum', $in_params) ? $in_params['checksum'] : false;
44	54	$this->pubkey_name = !empty($in_params['pubkeyname']) ?
45	55	WPRAccount::sanitizeKey($in_params['pubkeyname']) : 'm_public';
46	56	$this->bvprmsmac = !empty($in_params['bvprmsmac']) ? WPRAccount::sanitizeKey($in_params['bvprmsmac']) : "";
		@@ -50,38 +60,25 @@
50	60	public function isAPICall() {
51	61	return array_key_exists('apicall', $this->params);
52	62	}
53	63
54		- public function curlRequest($url, $body) {
55		- $ch = curl_init($url);
56		- curl_setopt($ch, CURLOPT_POST, 1);
57		- curl_setopt($ch, CURLOPT_TIMEOUT, 15);
58		- curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($body));
59		- curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
60		- return curl_exec($ch);
61		- }
	64	+ public function http_request($url, $body) {
	65	+ $body = http_build_query($body);
	66	+ $response = wp_remote_post($url, array(
	67	+ 'body' => $body,
	68	+ 'timeout' => 15,
	69	+ 'headers' => array(
	70	+ 'Content-Type' => 'application/x-www-form-urlencoded',
	71	+ ),
	72	+ ));
62	73
63		- public function fileGetContentRequest($url, $body) {
64		- $options = array(
65		- 'http' => array(
66		- 'header' => "Content-type: application/x-www-form-urlencoded\r\n",
67		- 'method' => 'POST',
68		- 'content' => http_build_query($body)
69		- )
70		- );
	74	+ if (is_wp_error($response)) {
	75	+ return false;
	76	+ }
71	77
72		- $context = stream_context_create($options);
73		- return file_get_contents($url, false, $context);
	78	+ return wp_remote_retrieve_body($response);
74	79	}
75	80
76		- public function http_request($url, $body) {
77		- if (in_array('curl', get_loaded_extensions())) {
78		- return $this->curlRequest($url, $body);
79		- } else {
80		- return $this->fileGetContentRequest($url, $body);
81		- }
82		- }
83		-
84	81	public function get_params_via_api($params_key, $apiurl) {
85	82	$res = $this->http_request($apiurl, array('bvkey' => $params_key));
86	83
87	84	if ($res === FALSE) {
		@@ -106,8 +103,14 @@
106	103	}
107	104	if ($this->is_afterload) {
108	105	$info["afterload"] = true;
109	106	}
	107	+ if ($this->is_aftershutdown) {
	108	+ $info["aftershutdown"] = true;
	109	+ }
	110	+ if ($this->keep_page_output) {
	111	+ $info["keeppageoutput"] = true;
	112	+ }
110	113	return $info;
111	114	}
112	115
113	116	public function processParams($in_params) {
		@@ -163,9 +166,9 @@
163	166	}
164	167
165	168	if (array_key_exists('sersafe', $in_params)) {
166	169	$key = $in_params['sersafe'];
167		- $in_params[$key] = BVCallbackRequest::serialization_safe_decode($in_params[$key]);
	170	+ $in_params[$key] = WPRCallbackRequest::serialization_safe_decode($in_params[$key]);
168	171	}
169	172
170	173	if (array_key_exists('bvprms', $in_params) && isset($in_params['bvprms'])) {
171	174	$params = $in_params['bvprms'];
		@@ -185,8 +188,9 @@
185	188	}
186	189
187	190	if (array_key_exists('memset', $in_params)) {
188	191	$val = intval($in_params['memset']);
	192	+ // phpcs:ignore Squiz.PHP.DiscouragedFunctions.Discouraged -- Required for memory limit adjustment
189	193	@ini_set('memory_limit', $val.'M');
190	194	}
191	195
192	196	return $params;
		@@ -212,9 +216,9 @@
212	216	}
213	217
214	218	public static function serialization_safe_decode($data) {
215	219	if (is_array($data)) {
216		- $data = array_map(array('BVCallbackRequest', 'serialization_safe_decode'), $data);
	220	+ $data = array_map(array('WPRCallbackRequest', 'serialization_safe_decode'), $data);
217	221	} elseif (is_string($data)) {
218	222	$data = base64_decode($data);
219	223	}
220	224
		@@ -246,14 +250,22 @@
246	250	$this->error["message"] = "OPENSSL_FUNCS_NOT_FOUND";
247	251	return false;
248	252	}
249	253
250		- $key_file = dirname( __FILE__ ) . '/../public_keys/' . $this->pubkey_name . '.pub';
	254	+ $openssl_algo = array_key_exists($sighshalgo, self::$SIG_HASH_ALGO_MAP) ? self::$SIG_HASH_ALGO_MAP[$sighshalgo] : null;
	255	+ if ($openssl_algo === null) {
	256	+ $this->error["message"] = "UNSUPPORTED_HASH_ALGORITHM: " . $sighshalgo;
	257	+ return false;
	258	+ }
	259	+
	260	+ $key_file = dirname( __DIR__ ) . '/public_keys/' . $this->pubkey_name . '.pub';
251	261	if (!file_exists($key_file)) {
252	262	$this->error["message"] = "PUBLIC_KEY_NOT_FOUND";
253	263	return false;
254	264	}
255		- $public_key_str = file_get_contents($key_file);
	265	+
	266	+ $public_key_str = WPRWPFileSystem::getInstance()->getContents($key_file);
	267	+
256	268	$public_key = openssl_pkey_get_public($public_key_str);
257	269	if (!$public_key) {
258	270	$this->error["message"] = "UNABLE_TO_LOAD_PUBLIC_KEY";
259	271	return false;
		@@ -258,13 +270,9 @@
258	270	$this->error["message"] = "UNABLE_TO_LOAD_PUBLIC_KEY";
259	271	return false;
260	272	}
261	273
262		- if ($sighshalgo === 'sha256') {
263		- $verify = openssl_verify($data, $sig, $public_key, OPENSSL_ALGO_SHA256);
264		- } else {
265		- $verify = openssl_verify($data, $sig, $public_key);
266		- }
	274	+ $verify = openssl_verify($data, $sig, $public_key, $openssl_algo);
267	275	if ($verify === 1) {
268	276	return true;
269	277	} elseif ($verify === 0) {
270	278	$this->error["message"] = "INCORRECT_SIGNATURE";
		@@ -287,9 +295,8 @@
287	295	}
288	296
289	297	public function authFailedResp() {
290	298	$api_public_key = WPRAccount::getApiPublicKey($this->settings);
291		- $default_secret = WPRRecover::getDefaultSecret($this->settings);
292	299	$default_account_pubkey = WPRAccount::getDefaultPublicKey();
293	300	$bvinfo = new WPRInfo($this->settings);
294	301	$resp = array(
295	302	"request_info" => $this->info(),
		@@ -294,11 +301,9 @@
294	301	$resp = array(
295	302	"request_info" => $this->info(),
296	303	"bvinfo" => $bvinfo->info(),
297	304	"statusmsg" => "FAILED_AUTH",
298		- "api_pubkey" => substr($api_public_key, 0, 8),
299		- "def_key_status" => WPRRecover::getSecretStatus($this->settings),
300		- "def_sigmatch" => substr(hash('sha1', $this->method.$default_secret.$this->time.$this->version), 0, 8)
	305	+ "api_pubkey" => substr($api_public_key, 0, 8)
301	306	);
302	307
303	308	if (is_string($default_account_pubkey) && strlen($default_account_pubkey) >= 32) {
304	309	$resp["default_account_pubkey"] = substr($default_account_pubkey, 0, 8);
		@@ -305,9 +310,8 @@
305	310	}
306	311
307	312	if ($this->account) {
308	313	$resp["account_info"] = $this->account->info();
309		- $resp["sigmatch"] = substr(hash('sha1', $this->method.$this->account->secret.$this->time.$this->version), 0, 6);
310	314	} else {
311	315	$resp["account_info"] = array("error" => "ACCOUNT_NOT_FOUND");
312	316	}
313	317
		@@ -313,5 +317,5 @@
313	317
314	318	return $resp;
315	319	}
316	320	}
317		-endif;
	321	+endif;