Pronamic\WordPress\Pay\Gateways\IDealAdvancedV3\Settings::save_post()

Complexity

Conditions	13
Paths	48

Size

Total Lines	108
Code Lines	59

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
	public function save_post( $data ) {
		// Files
		$files = array(
			'_pronamic_gateway_ideal_private_key_file' => '_pronamic_gateway_ideal_private_key',
			'_pronamic_gateway_ideal_private_certificate_file' => '_pronamic_gateway_ideal_private_certificate',
		);

		foreach ( $files as $name => $meta_key ) {
			if ( isset( $_FILES[ $name ] ) && UPLOAD_ERR_OK === $_FILES[ $name ]['error'] ) { // WPCS: input var okay.
				$value = file_get_contents( $_FILES[ $name ]['tmp_name'] ); // WPCS: input var okay. // WPCS: sanitization ok.

				$data[ $meta_key ] = $value;
			}
		}

		// Generate private key and certificate
		if ( empty( $data['_pronamic_gateway_ideal_private_key_password'] ) ) {
			// Without private key password we can't create private key and certifiate.
			return $data;
		}

		if ( ! in_array( 'aes-128-cbc', openssl_get_cipher_methods(), true ) ) {
			// Without AES-128-CBC ciphter method we can't create private key and certificate.
			return $data;
		}

		// Private key
		$pkey = openssl_pkey_get_private( $data['_pronamic_gateway_ideal_private_key'], $data['_pronamic_gateway_ideal_private_key_password'] );

		if ( false === $pkey ) {
			// If we can't open the private key we will create a new private key and certificate.

			if ( defined( 'OPENSSL_CIPHER_AES_128_CBC' ) ) {
				$cipher = OPENSSL_CIPHER_AES_128_CBC;
			} elseif ( defined( 'OPENSSL_CIPHER_3DES' ) ) {
				// @link https://www.pronamic.nl/wp-content/uploads/2011/12/iDEAL_Advanced_PHP_EN_V2.2.pdf
				$cipher = OPENSSL_CIPHER_3DES;
			} else {
				// Unable to create private key without cipher.
				return $data;
			}

			$args = array(
				'digest_alg'             => 'SHA256',
				'private_key_bits'       => 2048,
				'private_key_type'       => OPENSSL_KEYTYPE_RSA,
				'encrypt_key'            => true,
				'encrypt_key_cipher'     => $cipher,
				'subjectKeyIdentifier'   => 'hash',
				'authorityKeyIdentifier' => 'keyid:always,issuer:always',
				'basicConstraints'       => 'CA:true',
			);

			$pkey = openssl_pkey_new( $args );

			if ( false === $pkey ) {
				return $data;
			}

			// Export key
			$result = openssl_pkey_export( $pkey, $private_key, $data['_pronamic_gateway_ideal_private_key_password'], $args );

			if ( false === $result ) {
				return $data;
			}

			$data['_pronamic_gateway_ideal_private_key'] = $private_key;
			// Delete private certificate since this is no longer valid.
			$data['_pronamic_gateway_ideal_private_certificate'] = null;
		}

		// Certificate
		if ( empty( $data['_pronamic_gateway_ideal_private_certificate'] ) ) {
			$required_keys = array(
				'countryName',
				'stateOrProvinceName',
				'localityName',
				'organizationName',
				'commonName',
				'emailAddress',
			);

			$distinguished_name = array(
				'countryName'            => $data['_pronamic_gateway_country'],
				'stateOrProvinceName'    => $data['_pronamic_gateway_state_or_province'],
				'localityName'           => $data['_pronamic_gateway_locality'],
				'organizationName'       => $data['_pronamic_gateway_organization'],
				'organizationalUnitName' => $data['_pronamic_gateway_organization_unit'],
				'commonName'             => $data['_pronamic_gateway_organization'],
				'emailAddress'           => $data['_pronamic_gateway_email'],
			);

			$distinguished_name = array_filter( $distinguished_name );

			// Create certificate only if distinguished name contains all required elements
			// @link http://stackoverflow.com/questions/13169588/how-to-check-if-multiple-array-keys-exists
			if ( count( array_intersect_key( array_flip( $required_keys ), $distinguished_name ) ) === count( $required_keys ) ) {
				$csr = openssl_csr_new( $distinguished_name, $pkey );

				$cert = openssl_csr_sign( $csr, null, $pkey, $data['_pronamic_gateway_number_days_valid'], $args, time() );

The variable $args does not seem to be defined for all execution paths leading up to this point.

				openssl_x509_export( $cert, $certificate );

				$data['_pronamic_gateway_ideal_private_certificate'] = $certificate;
			}
		}

		return $data;
	}