JezK
Edit File: Authentication.php
<?php defined('AUTOUPDATER_LIB') or die; class AutoUpdater_Authentication { protected static $instance = null; /** * @return static */ public static function getInstance() { if (!is_null(static::$instance)) { return static::$instance; } $class_name = AutoUpdater_Loader::loadClass('Authentication'); static::$instance = new $class_name(); return static::$instance; } /** * @param array $payload * @param string $method * * @return bool * * @throws Exception */ public function validate($payload, $method) { $timestamp = time(); $lifetime = 90; $received_timestamp = array_key_exists('wpe_timestamp', $payload) ? $payload['wpe_timestamp'] : ''; if (!$received_timestamp || $received_timestamp < $timestamp - $lifetime) { AutoUpdater_Log::error(sprintf('Invalid timestamp, actual %d, and expected not older than %ds but received "%s". Received %s request to %s', $timestamp, $lifetime, $received_timestamp, strtoupper($method), AutoUpdater_Request::getCurrentUrl())); throw new Exception('Invalid timestamp', 403); } $signature = $this->getSignature($payload); $received_signature = AutoUpdater_Request::getQueryVar('wpe_signature'); if ( !$signature || empty($received_signature) || !hash_equals($received_signature, $signature) ) { AutoUpdater_Log::error(sprintf('Invalid signature, expected signature mismatch. Received %s request to %s', strtoupper($method), AutoUpdater_Request::getCurrentUrl())); throw new Exception('Invalid signature', 403); } return true; } /** * @param array $payload * * @return false|string */ public function getSignature($payload = array()) { $token = AutoUpdater_Config::get('worker_token'); $message = ''; foreach ($payload as $key => $value) { $message .= $key . $value; } AutoUpdater_Log::debug(sprintf('Generated message to sign, length: %d', strlen($message))); return hash_hmac('sha256', $message, $token); } /** * @return bool */ public function logInAsAdmin() { require_once ABSPATH . 'wp-includes/pluggable.php'; $users = get_users(array('role' => 'administrator', 'number' => 1)); if (!empty($users[0]->ID)) { wp_set_current_user($users[0]->ID); } return is_user_logged_in(); } }