SiteSecret.php

Go to the documentation of this file.

<?php

namespace Elgg\Security;

use Elgg\Database\ConfigTable;
use Elgg\Exceptions\Configuration\InstallationException;
use Elgg\Exceptions\RuntimeException;

class SiteSecret {

    const CONFIG_KEY = '__site_secret__';

    protected string $key;

    public function __construct(protected Crypto $crypto, protected ConfigTable $table) {
        $key = $table->get(self::CONFIG_KEY);
        if (!$key) {
            throw new InstallationException('Site secret is not in the config table.');
        }
        
        $this->key = $key;
    }

    public function get($raw = false) {
        if (!$this->key) {
            throw new RuntimeException('Secret key is not set');
        }

        if (!$raw) {
            return $this->key;
        }

        // try to return binary key
        if ($this->key[0] === 'z') {
            // new keys are "z" + base64URL
            $base64 = strtr(substr($this->key, 1), '-_', '+/');
            $key = base64_decode($base64);
            if ($key !== false) {
                return $key;
            }

            // on failure, at least return string key :/
            return $this->key;
        }

        // old keys are hex
        return hex2bin($this->key);
    }

    public function getStrength() {
        $secret = $this->get();
        if ($secret[0] !== 'z') {
            $rand_max = getrandmax();
            if ($rand_max < pow(2, 16)) {
                return 'weak';
            }
            
            if ($rand_max < pow(2, 32)) {
                return 'moderate';
            }
        }
        
        return 'strong';
    }

    public function regenerate() {
        $key = 'z' . $this->crypto->getRandomString(31);

        $this->table->set(self::CONFIG_KEY, $key);
    }
}