138 lines
3.8 KiB
PHP
138 lines
3.8 KiB
PHP
<?php
|
|
|
|
function create_pppr_salt() {
|
|
// 1. Check permissions first (Optional but recommended)
|
|
if ( ! wp_is_writable( plugin_dir_path( __FILE__ ) ) ) {
|
|
// Log error or handle failure
|
|
return false;
|
|
}
|
|
|
|
// 2. Define path INSIDE the plugin folder
|
|
$file_path = plugin_dir_path( __FILE__ ) . 'wp-pppr-salt.php';
|
|
|
|
// 3. Get the salt
|
|
$current_salt = wp_salt( 'auth' );
|
|
|
|
if ( empty( $current_salt ) ) {
|
|
return false;
|
|
}
|
|
|
|
// 4. Prepare content
|
|
$file_content = "<?php\n";
|
|
$file_content .= "// Auto-generated salt constant\n";
|
|
$file_content .= "// Exported salt from " . date( 'Y-m-d H:i:s' ) . "\n";
|
|
$file_content .= "define( 'WP_PPPR_SALT', '{$current_salt}' );\n";
|
|
|
|
// 5. Write the file
|
|
$bytes_written = file_put_contents( $file_path, $file_content, LOCK_EX );
|
|
|
|
// 6. Verify success
|
|
if ( $bytes_written === false ) {
|
|
// Handle error (e.g., log it)
|
|
return false;
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
function set_pppr_cookie($is_local, $street_name, $house_number, $postcode, $city) {
|
|
$data_string = (int)$is_local . "|" . $street_name . "|" . $house_number . "|" . $postcode . "|" . $city;
|
|
$signature = hash_hmac('sha256', $data_string, WP_PPPR_SALT);
|
|
$cookie_value = $data_string . "|" . $signature;
|
|
|
|
setcookie("PPPR", $cookie_value, [
|
|
'expires' => time() + 7200,
|
|
'path' => '/',
|
|
'domain' => $_SERVER['SERVER_NAME'],
|
|
'secure' => true, // Only send over HTTPS
|
|
'httponly' => true, // Prevent JavaScript access
|
|
'samesite' => 'Lax' // Protect against CSRF
|
|
]);
|
|
}
|
|
|
|
function unset_pppr_cookie( $path = '/') {
|
|
unset($_COOKIE["PPPR"]);
|
|
|
|
if (empty($domain)) {
|
|
setcookie("PPPR", '', time() - 3600, '/');
|
|
} else {
|
|
setcookie("PPPR", '', time() - 3600, '/' , $_SERVER['SERVER_NAME']);
|
|
}
|
|
}
|
|
|
|
function verify_pppr_cookie_string() {
|
|
if (!isset($_COOKIE['PPPR'])) {
|
|
return false;
|
|
}
|
|
|
|
$cookie_value = $_COOKIE['PPPR'];
|
|
|
|
$last_delimiter = strrpos($cookie_value, '|');
|
|
if ($last_delimiter === false) {
|
|
return false;
|
|
}
|
|
|
|
$data_part = substr($cookie_value, 0, $last_delimiter);
|
|
$hash_part = substr($cookie_value, $last_delimiter + 1);
|
|
|
|
// Check if salt is defined
|
|
if (!defined('WP_PPPR_SALT')) {
|
|
return false;
|
|
}
|
|
|
|
$expected_hash = hash_hmac('sha256', $data_part, WP_PPPR_SALT);
|
|
|
|
return hash_equals($expected_hash, $hash_part);
|
|
}
|
|
|
|
function get_PPPR_data() {
|
|
// 1. Check if cookie exists
|
|
if (!isset($_COOKIE['PPPR'])) {
|
|
return false;
|
|
}
|
|
|
|
$cookie_value = $_COOKIE['PPPR'];
|
|
|
|
// 2. Split safely using the LAST delimiter (handles pipes in street names)
|
|
$last_delimiter = strrpos($cookie_value, '|');
|
|
if ($last_delimiter === false) {
|
|
return false; // Malformed cookie
|
|
}
|
|
|
|
$data_part = substr($cookie_value, 0, $last_delimiter);
|
|
$provided_hash = substr($cookie_value, $last_delimiter + 1);
|
|
|
|
// 3. CRITICAL: Verify the signature before trusting ANY data
|
|
// Ensure WP_PPPR_SALT is defined and matches the setter exactly
|
|
if (!defined('WP_PPPR_SALT')) {
|
|
return false;
|
|
}
|
|
|
|
$expected_hash = hash_hmac('sha256', $data_part, WP_PPPR_SALT);
|
|
|
|
if (!hash_equals($expected_hash, $provided_hash)) {
|
|
return false; // Tampered or invalid cookie
|
|
}
|
|
|
|
// 4. Only now is it safe to explode the verified data
|
|
$fields = explode('|', $data_part);
|
|
|
|
// Ensure we have enough fields
|
|
if (count($fields) < 5) {
|
|
return false;
|
|
}
|
|
|
|
return [
|
|
'is_local' => (bool)$fields[0],
|
|
'street' => $fields[1],
|
|
'house_number' => $fields[2],
|
|
'postcode' => $fields[3],
|
|
'city' => $fields[4],
|
|
];
|
|
}
|
|
|
|
function pppr_is_local() {
|
|
$first_char = $_COOKIE['PPPR'][0];
|
|
return $first_char === '1';
|
|
}
|