Edit File by line

<?php

[0] Fix | Delete

[1] Fix | Delete

if (!defined('ABSPATH')) exit;

[2] Fix | Delete

if (!class_exists('BVCallbackRequest')) :

[3] Fix | Delete

class BVCallbackRequest {

[4] Fix | Delete

public $params;

[5] Fix | Delete

public $method;

[6] Fix | Delete

public $wing;

[7] Fix | Delete

public $is_afterload;

[8] Fix | Delete

public $is_admin_ajax;

[9] Fix | Delete

public $is_debug;

[10] Fix | Delete

public $account;

[11] Fix | Delete

public $settings;

[12] Fix | Delete

public $sig;

[13] Fix | Delete

public $sighshalgo;

[14] Fix | Delete

public $time;

[15] Fix | Delete

public $version;

[16] Fix | Delete

public $is_sha1;

[17] Fix | Delete

public $bvb64stream;

[18] Fix | Delete

public $bvb64cksize;

[19] Fix | Delete

public $checksum;

[20] Fix | Delete

public $error = array();

[21] Fix | Delete

public $pubkey_name;

[22] Fix | Delete

public $bvprmsmac;

[23] Fix | Delete

public $bvboundry;

[24] Fix | Delete

[25] Fix | Delete

public function __construct($account, $in_params, $settings) {

[26] Fix | Delete

$this->params = array();

[27] Fix | Delete

$this->account = $account;

[28] Fix | Delete

$this->settings = $settings;

[29] Fix | Delete

$this->wing = $in_params['wing'];

[30] Fix | Delete

$this->method = $in_params['bvMethod'];

[31] Fix | Delete

$this->is_afterload = array_key_exists('afterload', $in_params);

[32] Fix | Delete

$this->is_admin_ajax = array_key_exists('adajx', $in_params);

[33] Fix | Delete

$this->is_debug = array_key_exists('bvdbg', $in_params);

[34] Fix | Delete

$this->sig = $in_params['sig'];

[35] Fix | Delete

$this->sighshalgo = !empty($in_params['sighshalgo']) ? $in_params['sighshalgo'] : null;

[36] Fix | Delete

$this->time = intval($in_params['bvTime']);

[37] Fix | Delete

$this->version = $in_params['bvVersion'];

[38] Fix | Delete

$this->is_sha1 = array_key_exists('sha1', $in_params);

[39] Fix | Delete

$this->bvb64stream = isset($in_params['bvb64stream']);

[40] Fix | Delete

$this->bvb64cksize = array_key_exists('bvb64cksize', $in_params) ? intval($in_params['bvb64cksize']) : false;

[41] Fix | Delete

$this->checksum = array_key_exists('checksum', $in_params) ? $in_params['checksum'] : false;

[42] Fix | Delete

$this->pubkey_name = !empty($in_params['pubkeyname']) ?

[43] Fix | Delete

BVAccount::sanitizeKey($in_params['pubkeyname']) : 'm_public';

[44] Fix | Delete

$this->bvprmsmac = !empty($in_params['bvprmsmac']) ? BVAccount::sanitizeKey($in_params['bvprmsmac']) : "";

[45] Fix | Delete

$this->bvboundry = !empty($in_params['bvboundry']) ? $in_params['bvboundry'] : "";

[46] Fix | Delete

}

[47] Fix | Delete

[48] Fix | Delete

public function isAPICall() {

[49] Fix | Delete

return array_key_exists('apicall', $this->params);

[50] Fix | Delete

}

[51] Fix | Delete

[52] Fix | Delete

public function curlRequest($url, $body) {

[53] Fix | Delete

$ch = curl_init($url);

[54] Fix | Delete

curl_setopt($ch, CURLOPT_POST, 1);

[55] Fix | Delete

curl_setopt($ch, CURLOPT_TIMEOUT, 15);

[56] Fix | Delete

curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($body));

[57] Fix | Delete

curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

[58] Fix | Delete

return curl_exec($ch);

[59] Fix | Delete

}

[60] Fix | Delete

[61] Fix | Delete

public function fileGetContentRequest($url, $body) {

[62] Fix | Delete

$options = array(

[63] Fix | Delete

'http' => array(

[64] Fix | Delete

'header' => "Content-type: application/x-www-form-urlencoded\r\n",

[65] Fix | Delete

'method' => 'POST',

[66] Fix | Delete

'content' => http_build_query($body)

[67] Fix | Delete

)

[68] Fix | Delete

);

[69] Fix | Delete

[70] Fix | Delete

$context = stream_context_create($options);

[71] Fix | Delete

return file_get_contents($url, false, $context);

[72] Fix | Delete

}

[73] Fix | Delete

[74] Fix | Delete

public function http_request($url, $body) {

[75] Fix | Delete

if (in_array('curl', get_loaded_extensions())) {

[76] Fix | Delete

return $this->curlRequest($url, $body);

[77] Fix | Delete

} else {

[78] Fix | Delete

return $this->fileGetContentRequest($url, $body);

[79] Fix | Delete

}

[80] Fix | Delete

}

[81] Fix | Delete

[82] Fix | Delete

public function get_params_via_api($params_key, $apiurl) {

[83] Fix | Delete

$res = $this->http_request($apiurl, array('bvkey' => $params_key));

[84] Fix | Delete

[85] Fix | Delete

if ($res === FALSE) {

[86] Fix | Delete

return false;

[87] Fix | Delete

}

[88] Fix | Delete

[89] Fix | Delete

return $res;

[90] Fix | Delete

}

[91] Fix | Delete

[92] Fix | Delete

public function info() {

[93] Fix | Delete

$info = array(

[94] Fix | Delete

"requestedsig" => $this->sig,

[95] Fix | Delete

"requestedtime" => $this->time,

[96] Fix | Delete

"requestedversion" => $this->version,

[97] Fix | Delete

"error" => $this->error

[98] Fix | Delete

);

[99] Fix | Delete

if ($this->is_debug) {

[100] Fix | Delete

$info["inreq"] = $this->params;

[101] Fix | Delete

}

[102] Fix | Delete

if ($this->is_admin_ajax) {

[103] Fix | Delete

$info["adajx"] = true;

[104] Fix | Delete

}

[105] Fix | Delete

if ($this->is_afterload) {

[106] Fix | Delete

$info["afterload"] = true;

[107] Fix | Delete

}

[108] Fix | Delete

return $info;

[109] Fix | Delete

}

[110] Fix | Delete

[111] Fix | Delete

public function processParams($in_params) {

[112] Fix | Delete

$params = array();

[113] Fix | Delete

[114] Fix | Delete

if (array_key_exists('obend', $in_params) && function_exists('ob_end_clean'))

[115] Fix | Delete

@ob_end_clean();

[116] Fix | Delete

[117] Fix | Delete

if (array_key_exists('op_reset', $in_params) && function_exists('output_reset_rewrite_vars'))

[118] Fix | Delete

@output_reset_rewrite_vars();

[119] Fix | Delete

[120] Fix | Delete

if (array_key_exists('concat', $in_params)) {

[121] Fix | Delete

foreach ($in_params['concat'] as $key) {

[122] Fix | Delete

$concated = '';

[123] Fix | Delete

$count = intval($in_params[$key]);

[124] Fix | Delete

for ($i = 1; $i <= $count; $i++) {

[125] Fix | Delete

$concated .= $in_params[$key."_bv_".$i];

[126] Fix | Delete

}

[127] Fix | Delete

$in_params[$key] = $concated;

[128] Fix | Delete

}

[129] Fix | Delete

}

[130] Fix | Delete

[131] Fix | Delete

if (isset($in_params['bvpdataviaapi']) && isset($in_params['bvapiurl'])) {

[132] Fix | Delete

$pdata = $this->get_params_via_api($in_params['bvpdataviaapi'], $in_params['bvapiurl']);

[133] Fix | Delete

if ($pdata !== false) {

[134] Fix | Delete

$in_params["bvprms"] = $pdata;

[135] Fix | Delete

}

[136] Fix | Delete

}

[137] Fix | Delete

[138] Fix | Delete

if (array_key_exists('bvprms', $in_params) && isset($in_params['bvprms'])) {

[139] Fix | Delete

if (!empty($in_params['bvprmshshalgo']) && $in_params['bvprmshshalgo'] === 'sha256') {

[140] Fix | Delete

$calculated_mac = hash_hmac('SHA256', $in_params['bvprms'], $this->account->secret);

[141] Fix | Delete

} else {

[142] Fix | Delete

$calculated_mac = hash_hmac('SHA1', $in_params['bvprms'], $this->account->secret);

[143] Fix | Delete

}

[144] Fix | Delete

[145] Fix | Delete

if ($this->compare_mac($this->bvprmsmac, $calculated_mac) === true) {

[146] Fix | Delete

[147] Fix | Delete

if (array_key_exists('b64', $in_params)) {

[148] Fix | Delete

foreach ($in_params['b64'] as $key) {

[149] Fix | Delete

if (is_array($in_params[$key])) {

[150] Fix | Delete

$in_params[$key] = array_map('base64_decode', $in_params[$key]);

[151] Fix | Delete

} else {

[152] Fix | Delete

$in_params[$key] = base64_decode($in_params[$key]);

[153] Fix | Delete

}

[154] Fix | Delete

}

[155] Fix | Delete

}

[156] Fix | Delete

[157] Fix | Delete

if (array_key_exists('unser', $in_params)) {

[158] Fix | Delete

foreach ($in_params['unser'] as $key) {

[159] Fix | Delete

$in_params[$key] = json_decode($in_params[$key], TRUE);

[160] Fix | Delete

}

[161] Fix | Delete

}

[162] Fix | Delete

[163] Fix | Delete

if (array_key_exists('sersafe', $in_params)) {

[164] Fix | Delete

$key = $in_params['sersafe'];

[165] Fix | Delete

$in_params[$key] = BVCallbackRequest::serialization_safe_decode($in_params[$key]);

[166] Fix | Delete

}

[167] Fix | Delete

[168] Fix | Delete

if (array_key_exists('bvprms', $in_params) && isset($in_params['bvprms'])) {

[169] Fix | Delete

$params = $in_params['bvprms'];

[170] Fix | Delete

}

[171] Fix | Delete

[172] Fix | Delete

if (array_key_exists('clacts', $in_params)) {

[173] Fix | Delete

foreach ($in_params['clacts'] as $action) {

[174] Fix | Delete

remove_all_actions($action);

[175] Fix | Delete

}

[176] Fix | Delete

}

[177] Fix | Delete

[178] Fix | Delete

if (array_key_exists('clallacts', $in_params)) {

[179] Fix | Delete

global $wp_filter;

[180] Fix | Delete

foreach ( $wp_filter as $filter => $val ){

[181] Fix | Delete

remove_all_actions($filter);

[182] Fix | Delete

}

[183] Fix | Delete

}

[184] Fix | Delete

[185] Fix | Delete

if (array_key_exists('memset', $in_params)) {

[186] Fix | Delete

$val = intval($in_params['memset']);

[187] Fix | Delete

@ini_set('memory_limit', $val.'M');

[188] Fix | Delete

}

[189] Fix | Delete

[190] Fix | Delete

return $params;

[191] Fix | Delete

}

[192] Fix | Delete

}

[193] Fix | Delete

return false;

[194] Fix | Delete

}

[195] Fix | Delete

[196] Fix | Delete

private function compare_mac($l_hash, $r_hash) {

[197] Fix | Delete

if (!is_string($l_hash) || !is_string($r_hash)) {

[198] Fix | Delete

return false;

[199] Fix | Delete

}

[200] Fix | Delete

[201] Fix | Delete

if (strlen($l_hash) !== strlen($r_hash)) {

[202] Fix | Delete

return false;

[203] Fix | Delete

}

[204] Fix | Delete

[205] Fix | Delete

if (function_exists('hash_equals')) {

[206] Fix | Delete

return hash_equals($l_hash, $r_hash);

[207] Fix | Delete

} else {

[208] Fix | Delete

return $l_hash === $r_hash;

[209] Fix | Delete

}

[210] Fix | Delete

}

[211] Fix | Delete

[212] Fix | Delete

public static function serialization_safe_decode($data) {

[213] Fix | Delete

if (is_array($data)) {

[214] Fix | Delete

$data = array_map(array('BVCallbackRequest', 'serialization_safe_decode'), $data);

[215] Fix | Delete

} elseif (is_string($data)) {

[216] Fix | Delete

$data = base64_decode($data);

[217] Fix | Delete

}

[218] Fix | Delete

[219] Fix | Delete

return $data;

[220] Fix | Delete

}

[221] Fix | Delete

[222] Fix | Delete

public function authenticate() {

[223] Fix | Delete

if (!$this->account) {

[224] Fix | Delete

$this->error["message"] = "ACCOUNT_NOT_FOUND";

[225] Fix | Delete

return false;

[226] Fix | Delete

}

[227] Fix | Delete

[228] Fix | Delete

$bv_last_recv_time = $this->settings->getOption('bvLastRecvTime');

[229] Fix | Delete

if ($this->time < intval($bv_last_recv_time) - 300) {

[230] Fix | Delete

return false;

[231] Fix | Delete

}

[232] Fix | Delete

[233] Fix | Delete

$data = $this->method.$this->account->secret.$this->time.$this->version.$this->bvprmsmac;

[234] Fix | Delete

if (!$this->verify($data, base64_decode($this->sig), $this->sighshalgo)) {

[235] Fix | Delete

return false;

[236] Fix | Delete

}

[237] Fix | Delete

$this->settings->updateOption('bvLastRecvTime', $this->time);

[238] Fix | Delete

[239] Fix | Delete

return 1;

[240] Fix | Delete

}

[241] Fix | Delete

[242] Fix | Delete

public function verify($data, $sig, $sighshalgo) {

[243] Fix | Delete

if (!function_exists('openssl_verify') || !function_exists('openssl_pkey_get_public')) {

[244] Fix | Delete

$this->error["message"] = "OPENSSL_FUNCS_NOT_FOUND";

[245] Fix | Delete

return false;

[246] Fix | Delete

}

[247] Fix | Delete

[248] Fix | Delete

$key_file = dirname( __FILE__ ) . '/../public_keys/' . $this->pubkey_name . '.pub';

[249] Fix | Delete

if (!file_exists($key_file)) {

[250] Fix | Delete

$this->error["message"] = "PUBLIC_KEY_NOT_FOUND";

[251] Fix | Delete

return false;

[252] Fix | Delete

}

[253] Fix | Delete

$public_key_str = file_get_contents($key_file);

[254] Fix | Delete

$public_key = openssl_pkey_get_public($public_key_str);

[255] Fix | Delete

if (!$public_key) {

[256] Fix | Delete

$this->error["message"] = "UNABLE_TO_LOAD_PUBLIC_KEY";

[257] Fix | Delete

return false;

[258] Fix | Delete

}

[259] Fix | Delete

[260] Fix | Delete

if ($sighshalgo === 'sha256') {

[261] Fix | Delete

$verify = openssl_verify($data, $sig, $public_key, OPENSSL_ALGO_SHA256);

[262] Fix | Delete

} else {

[263] Fix | Delete

$verify = openssl_verify($data, $sig, $public_key);

[264] Fix | Delete

}

[265] Fix | Delete

if ($verify === 1) {

[266] Fix | Delete

return true;

[267] Fix | Delete

} elseif ($verify === 0) {

[268] Fix | Delete

$this->error["message"] = "INCORRECT_SIGNATURE";

[269] Fix | Delete

$this->error["pubkey_sig"] = substr(hash('md5', $public_key_str), 0, 8);

[270] Fix | Delete

} else {

[271] Fix | Delete

$this->error["message"] = "OPENSSL_VERIFY_FAILED";

[272] Fix | Delete

}

[273] Fix | Delete

return false;

[274] Fix | Delete

}

[275] Fix | Delete

[276] Fix | Delete

public function corruptedParamsResp() {

[277] Fix | Delete

$bvinfo = new BVInfo($this->settings);

[278] Fix | Delete

[279] Fix | Delete

return array(

[280] Fix | Delete

"account_info" => $this->account->info(),

[281] Fix | Delete

"request_info" => $this->info(),

[282] Fix | Delete

"bvinfo" => $bvinfo->info(),

[283] Fix | Delete

"statusmsg" => "BVPRMS_CORRUPTED"

[284] Fix | Delete

);

[285] Fix | Delete

}

[286] Fix | Delete

[287] Fix | Delete

public function authFailedResp() {

[288] Fix | Delete

$api_public_key = BVAccount::getApiPublicKey($this->settings);

[289] Fix | Delete

$default_secret = BVRecover::getDefaultSecret($this->settings);

[290] Fix | Delete

$default_account_pubkey = BVAccount::getDefaultPublicKey();

[291] Fix | Delete

$bvinfo = new BVInfo($this->settings);

[292] Fix | Delete

$resp = array(

[293] Fix | Delete

"request_info" => $this->info(),

[294] Fix | Delete

"bvinfo" => $bvinfo->info(),

[295] Fix | Delete

"statusmsg" => "FAILED_AUTH",

[296] Fix | Delete

"api_pubkey" => substr($api_public_key, 0, 8),

[297] Fix | Delete

"def_key_status" => BVRecover::getSecretStatus($this->settings),

[298] Fix | Delete

"def_sigmatch" => substr(hash('sha1', $this->method.$default_secret.$this->time.$this->version), 0, 8)

[299] Fix | Delete

);

[300] Fix | Delete

[301] Fix | Delete

if (is_string($default_account_pubkey) && strlen($default_account_pubkey) >= 32) {

[302] Fix | Delete

$resp["default_account_pubkey"] = substr($default_account_pubkey, 0, 8);

[303] Fix | Delete

}

[304] Fix | Delete

[305] Fix | Delete

if ($this->account) {

[306] Fix | Delete

$resp["account_info"] = $this->account->info();

[307] Fix | Delete

$resp["sigmatch"] = substr(hash('sha1', $this->method.$this->account->secret.$this->time.$this->version), 0, 6);

[308] Fix | Delete

} else {

[309] Fix | Delete

$resp["account_info"] = array("error" => "ACCOUNT_NOT_FOUND");

[310] Fix | Delete

}

[311] Fix | Delete

[312] Fix | Delete

return $resp;

[313] Fix | Delete

}

[314] Fix | Delete

}

[315] Fix | Delete

endif;

[316] Fix | Delete