fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-01-07 18:51:41 +09:00
Code Issues Projects Releases Packages Wiki Activity

Add currentSessionOnly option to Crypto class

Browse source
This commit is contained in:
Kijin Sung 2015-07-17 11:37:19 +09:00
parent 7526e76eb5
commit 402276f4ff
1 changed files with 39 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

43
classes/security/Crypto.class.php
View file

@ -47,6 +47,11 @@ class Crypto
*/
protected static $_extension = null;
/**
* @brief If this is true, encryption and signature are only valid in current session
*/
protected $_current_session_only = false;
/**
* @brief Constructor
*/
@ -75,6 +80,15 @@ class Crypto
return (function_exists('openssl_encrypt') || function_exists('mcrypt_encrypt'));
}
/**
* @brief Make encryption and signature only valid in current session
* @return void
*/
public function currentSessionOnly()
{
$this->_current_session_only = true;
}
/**
* @brief Encrypt a string
* @param string $plaintext The string to encrypt
@ -85,7 +99,7 @@ class Crypto
{
if($key === null || $key === '')
{
$key = self::_getDefaultKey();
$key = $this->_getSessionKey();
}
// Generate subkey for encryption
@ -125,7 +139,7 @@ class Crypto
{
if($key === null || $key === '')
{
$key = self::_getDefaultKey();
$key = $this->_getSessionKey();
}
// Base64 decode the ciphertext and check the length
@ -187,7 +201,7 @@ class Crypto
{
if($key === null || $key === '')
{
$key = self::_getDefaultKey();
$key = $this->_getSessionKey();
}
// Generate a signature using HMAC
@ -205,7 +219,7 @@ class Crypto
{
if($key === null || $key === '')
{
$key = self::_getDefaultKey();
$key = $this->_getSessionKey();
}
// Verify the signature using HMAC
@ -214,6 +228,27 @@ class Crypto
return $oPassword->strcmpConstantTime($signature, $compare);
}
/**
* @brief Get the default key applicable to this instance
* @return string
*/
protected function _getSessionKey()
{
if($this->_current_session_only)
{
if(!isset($_SESSION['XE_CRYPTO_SESSKEY']))
{
$_SESSION['XE_CRYPTO_SESSKEY'] = self::_createSecureKey();
}
$session_key = base64_decode($_SESSION['XE_CRYPTO_SESSKEY']);
return strval(self::_getDefaultKey()) ^ strval($session_key);
}
else
{
return strval(self::_getDefaultKey());
}
}
/**
* @brief Get the default key
* @return string