forked from eventum/eventum
-
Notifications
You must be signed in to change notification settings - Fork 0
/
CryptoManager.php
129 lines (112 loc) · 3.41 KB
/
CryptoManager.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
<?php
/*
* This file is part of the Eventum (Issue Tracking System) package.
*
* @copyright (c) Eventum Team
* @license GNU General Public License, version 2 or later (GPL-2+)
*
* For the full copyright and license information,
* please see the COPYING and AUTHORS files
* that were distributed with this source code.
*/
namespace Eventum\Crypto;
use Defuse\Crypto\Crypto;
use Defuse\Crypto\Key;
use Defuse\Crypto\RuntimeTests;
use Setup;
/**
* Class Crypto Manager.
*
* Provides methods to encrypt/decrypt a text using own private key.
* The encrypted value is base64 encoded so it's safe to store to database.
*/
final class CryptoManager
{
/**
* @return bool return true if Encryption is enabled
*/
public static function encryptionEnabled()
{
return Setup::get()->encryption === 'enabled';
}
/**
* Checks if system can perform encryption:
* - has openssl extension
* - some other tests performed by Crypto library
*
* Checks for extensions presence because defuse/php-encryption is very cryptic about it errors.
*
* @throws CryptoException if it can't be enabled
* @return bool
*/
public static function canEncrypt()
{
if (!function_exists('openssl_encrypt')) {
throw new CryptoException('openssl extension not enabled');
}
try {
RuntimeTests::runtimeTest();
} catch (CryptoException $e) {
throw new CryptoException($e->getMessage(), $e->getCode(), $e);
}
return true;
}
/**
* Encrypts a message.
* $plaintext is the message to encrypt.
* $key is the encryption key, a value generated by CreateNewRandomKey().
*
* @param string $plaintext
* @param string $key optional key to encrypt
* @throws CryptoException
* @return string
*/
public static function encrypt($plaintext, $key = null)
{
if ($plaintext === null || $plaintext === false) {
throw new CryptoException('Refusing to encrypt empty value');
}
if (!self::encryptionEnabled()) {
return $plaintext;
}
try {
$ciphertext = Crypto::encrypt($plaintext, $key ?: self::getKey(), true);
} catch (CryptoException $e) {
throw new CryptoException('Cannot perform operation: ' . $e->getMessage());
}
return rtrim(base64_encode($ciphertext), '=');
}
/**
* Decrypts a ciphertext.
* $ciphertext is the ciphertext to decrypt.
*
* @param string $ciphertext
* @throws CryptoException
* @return string
*/
public static function decrypt($ciphertext)
{
if (!self::encryptionEnabled()) {
return $ciphertext;
}
$ciphertext = base64_decode($ciphertext);
if (!$ciphertext) {
throw new CryptoException('Unable to decode ciphertext');
}
try {
$key = self::getKey();
if ($key instanceof Key) {
return Crypto::decrypt($ciphertext, $key, true);
}
// support legacy decrypt
return Crypto::legacyDecrypt($ciphertext, $key);
} catch (CryptoException $e) {
throw new CryptoException('Cannot perform operation: ' . $e->getMessage());
}
}
private static function getKey()
{
$km = new CryptoKeyManager();
return $km->getKey();
}
}