SiteSecret.php

Go to the documentation of this file.

<?php

namespace Elgg\Database;

use Elgg\Config as ElggConfig;
use Elgg\Database;
use ElggCrypto;

class SiteSecret {

    const CONFIG_KEY = '__site_secret__';

    public function __construct($key) {
        $this->key = $key;
    }

    private $key;

    public function get($raw = false) {
        if (!$this->key) {
            throw new \RuntimeException('Secret key is not set');
        }

        if (!$raw) {
            return $this->key;
        }

        // try to return binary key
        if ($this->key[0] === 'z') {
            // new keys are "z" + base64URL
            $base64 = strtr(substr($this->key, 1), '-_', '+/');
            $key = base64_decode($base64);
            if ($key !== false) {
                return $key;
            }

            // on failure, at least return string key :/
            return $this->key;
        }

        // old keys are hex
        return hex2bin($this->key);
    }

    public function getStrength() {
        $secret = $this->get();
        if ($secret[0] !== 'z') {
            $rand_max = getrandmax();
            if ($rand_max < pow(2, 16)) {
                return 'weak';
            }
            if ($rand_max < pow(2, 32)) {
                return 'moderate';
            }
        }
        return 'strong';
    }

    public static function regenerate(ElggCrypto $crypto, ConfigTable $table) {
        $key = 'z' . $crypto->getRandomString(31);

        $table->set(self::CONFIG_KEY, $key);

        return new self($key);
    }

    public static function fromDatabase(ConfigTable $table) {
        $key = $table->get(self::CONFIG_KEY);
        if (!$key) {
            throw new \InstallationException('Site secret is not in the config table.');
        }

        return new self($key);
    }

    public static function fromConfig(ElggConfig $config) {
        $key = $config->{self::CONFIG_KEY};
        if (!$key) {
            return false;
        }

        // Don't leave this sitting around in config, in case it gets dumped
        unset($config->{self::CONFIG_KEY});

        return new self($key);
    }
}