wp-postcode-plugin/pppr_cookie.php

<?php

function create_pppr_salt() {
   // 1. Check permissions first (Optional but recommended)
    if ( ! wp_is_writable( plugin_dir_path( __FILE__ ) ) ) {
        // Log error or handle failure
        return false;
    }

    // 2. Define path INSIDE the plugin folder
    $file_path = plugin_dir_path( __FILE__ ) . 'wp-pppr-salt.php';
    
    // 3. Get the salt
    $current_salt = wp_salt( 'auth' );

    if ( empty( $current_salt ) ) {
        return false;
    }

    // 4. Prepare content
    $file_content = "<?php\n";
    $file_content .= "// Auto-generated salt constant\n";
    $file_content .= "// Exported salt from " . date( 'Y-m-d H:i:s' ) . "\n";
    $file_content .= "define( 'WP_PPPR_SALT', '{$current_salt}' );\n";

    // 5. Write the file
    $bytes_written = file_put_contents( $file_path, $file_content, LOCK_EX );

    // 6. Verify success
    if ( $bytes_written === false ) {
        // Handle error (e.g., log it)
        return false;
    }
    
    return true;
}

function set_pppr_cookie($is_local, $street_name, $house_number, $postcode, $city) {
    $data_string = (int)$is_local . "|" . $street_name . "|" . $house_number . "|" . $postcode . "|" . $city;
    $signature = hash_hmac('sha256', $data_string, WP_PPPR_SALT);
    $cookie_value = $data_string . "|" . $signature;

    $cookie_domain = $_SERVER['SERVER_NAME'];
    $is_secure = is_ssl(); 

    setcookie("PPPR", $cookie_value, [
        'expires' => time() + 7200,
        'path' => '/',
        'domain' => $cookie_domain,
        'secure' => $is_secure, 
        'httponly' => true, // Prevent JavaScript access
        'samesite' => 'Lax' // Protect against CSRF
    ]);
}   

function unset_pppr_cookie( $path = '/') {
    unset($_COOKIE["PPPR"]);

    $domain = $_SERVER['SERVER_NAME'];
    $is_secure = is_ssl();

    // 3. Send the delete command with ALL matching parameters
    setcookie(
        "PPPR", 
        '', 
        time() - 3600, 
        '/', 
        $domain, 
        $is_secure, // Critical: Must match the 'secure' flag used when setting
        true        
    );
}

function update_expire_pppr_cookie() {
    if (!isset($_COOKIE['PPPR'])) {
        return false;
    }
 
    $cookie_value = $_COOKIE['PPPR'];
    $cookie_domain = $_SERVER['SERVER_NAME'];
    $is_secure = is_ssl(); 

    setcookie("PPPR", $cookie_value, [
        'expires' => time() + 7200,
        'path' => '/',
        'domain' => $cookie_domain,
        'secure' => $is_secure,
        'httponly' => true, // Prevent JavaScript access
        'samesite' => 'Lax' // Protect against CSRF
    ]);
}

function verify_pppr_cookie_string() {
    if (!isset($_COOKIE['PPPR'])) {
        return false;
    }

    $cookie_value = $_COOKIE['PPPR'];

    $last_delimiter = strrpos($cookie_value, '|');
    if ($last_delimiter === false) {
        return false;
    }

    $data_part = substr($cookie_value, 0, $last_delimiter);
    $hash_part = substr($cookie_value, $last_delimiter + 1);

    // Check if salt is defined
    if (!defined('WP_PPPR_SALT')) {
        return false;
    }

    $expected_hash = hash_hmac('sha256', $data_part, WP_PPPR_SALT);

    return hash_equals($expected_hash, $hash_part);
}   

function get_PPPR_data() {
    // 1. Check if cookie exists
    if (!isset($_COOKIE['PPPR'])) {
        return false;
    }

    $cookie_value = $_COOKIE['PPPR'];

    // 2. Split safely using the LAST delimiter (handles pipes in street names)
    $last_delimiter = strrpos($cookie_value, '|');
    if ($last_delimiter === false) {
        return false; // Malformed cookie
    }

    $data_part = substr($cookie_value, 0, $last_delimiter);
    $provided_hash = substr($cookie_value, $last_delimiter + 1);

    // 3. CRITICAL: Verify the signature before trusting ANY data
    // Ensure WP_PPPR_SALT is defined and matches the setter exactly
    if (!defined('WP_PPPR_SALT')) {
        return false; 
    }

    $expected_hash = hash_hmac('sha256', $data_part, WP_PPPR_SALT);

    if (!hash_equals($expected_hash, $provided_hash)) {
        return false; // Tampered or invalid cookie
    }

    // 4. Only now is it safe to explode the verified data
    $fields = explode('|', $data_part);
    
    // Ensure we have enough fields
    if (count($fields) < 5) {
        return false;
    }

    return [
        'is_local'     => (bool)$fields[0],
        'street'       => $fields[1],
        'house_number' => $fields[2],
        'postcode'     => $fields[3],
        'city'         => $fields[4],
    ];
}

function pppr_is_local() {
    $first_char =  $_COOKIE['PPPR'][0];
    return $first_char === '1';
}