1: <?php
  2: /**
  3:  * Core Security
  4:  *
  5:  * PHP 5
  6:  *
  7:  * CakePHP(tm) : Rapid Development Framework (http://cakephp.org)
  8:  * Copyright 2005-2011, Cake Software Foundation, Inc. (http://cakefoundation.org)
  9:  *
 10:  * Licensed under The MIT License
 11:  * Redistributions of files must retain the above copyright notice.
 12:  *
 13:  * @copyright     Copyright 2005-2011, Cake Software Foundation, Inc. (http://cakefoundation.org)
 14:  * @link          http://cakephp.org CakePHP(tm) Project
 15:  * @package       Cake.Utility
 16:  * @since         CakePHP(tm) v .0.10.0.1233
 17:  * @license       MIT License (http://www.opensource.org/licenses/mit-license.php)
 18:  */
 19: 
 20: App::uses('String', 'Utility');
 21: 
 22: /**
 23:  * Security Library contains utility methods related to security
 24:  *
 25:  * @package       Cake.Utility
 26:  */
 27: class Security {
 28: 
 29: /**
 30:  * Default hash method
 31:  *
 32:  * @var string
 33:  */
 34:     public static $hashType = null;
 35: 
 36: /**
 37:  * Get allowed minutes of inactivity based on security level.
 38:  *
 39:  * @return integer Allowed inactivity in minutes
 40:  */
 41:     public static function inactiveMins() {
 42:         switch (Configure::read('Security.level')) {
 43:             case 'high':
 44:                 return 10;
 45:             break;
 46:             case 'medium':
 47:                 return 100;
 48:             break;
 49:             case 'low':
 50:             default:
 51:                 return 300;
 52:                 break;
 53:         }
 54:     }
 55: 
 56: /**
 57:  * Generate authorization hash.
 58:  *
 59:  * @return string Hash
 60:  */
 61:     public static function generateAuthKey() {
 62:         return Security::hash(String::uuid());
 63:     }
 64: 
 65: /**
 66:  * Validate authorization hash.
 67:  *
 68:  * @param string $authKey Authorization hash
 69:  * @return boolean Success
 70:  * @todo Complete implementation
 71:  */
 72:     public static function validateAuthKey($authKey) {
 73:         return true;
 74:     }
 75: 
 76: /**
 77:  * Create a hash from string using given method.
 78:  * Fallback on next available method.
 79:  *
 80:  * @param string $string String to hash
 81:  * @param string $type Method to use (sha1/sha256/md5)
 82:  * @param boolean $salt If true, automatically appends the application's salt
 83:  *     value to $string (Security.salt)
 84:  * @return string Hash
 85:  */
 86:     public static function hash($string, $type = null, $salt = false) {
 87:         if ($salt) {
 88:             if (is_string($salt)) {
 89:                 $string = $salt . $string;
 90:             } else {
 91:                 $string = Configure::read('Security.salt') . $string;
 92:             }
 93:         }
 94: 
 95:         if (empty($type)) {
 96:             $type = self::$hashType;
 97:         }
 98:         $type = strtolower($type);
 99: 
100:         if ($type == 'sha1' || $type == null) {
101:             if (function_exists('sha1')) {
102:                 $return = sha1($string);
103:                 return $return;
104:             }
105:             $type = 'sha256';
106:         }
107: 
108:         if ($type == 'sha256' && function_exists('mhash')) {
109:             return bin2hex(mhash(MHASH_SHA256, $string));
110:         }
111: 
112:         if (function_exists('hash')) {
113:             return hash($type, $string);
114:         }
115:         return md5($string);
116:     }
117: 
118: /**
119:  * Sets the default hash method for the Security object.  This affects all objects using
120:  * Security::hash().
121:  *
122:  * @param string $hash Method to use (sha1/sha256/md5)
123:  * @return void
124:  * @see Security::hash()
125:  */
126:     public static function setHash($hash) {
127:         self::$hashType = $hash;
128:     }
129: 
130: /**
131:  * Encrypts/Decrypts a text using the given key.
132:  *
133:  * @param string $text Encrypted string to decrypt, normal string to encrypt
134:  * @param string $key Key to use
135:  * @return string Encrypted/Decrypted string
136:  */
137:     public static function cipher($text, $key) {
138:         if (empty($key)) {
139:             trigger_error(__d('cake_dev', 'You cannot use an empty key for Security::cipher()'), E_USER_WARNING);
140:             return '';
141:         }
142: 
143:         srand(Configure::read('Security.cipherSeed'));
144:         $out = '';
145:         $keyLength = strlen($key);
146:         for ($i = 0, $textLength = strlen($text); $i < $textLength; $i++) {
147:             $j = ord(substr($key, $i % $keyLength, 1));
148:             while ($j--) {
149:                 rand(0, 255);
150:             }
151:             $mask = rand(0, 255);
152:             $out .= chr(ord(substr($text, $i, 1)) ^ $mask);
153:         }
154:         srand();
155:         return $out;
156:     }
157: }
158: