Skip to content

Commit e5e485d

Browse files
cryptoapicryptoapi
committed
ver 1.4.1
1 parent 294dcbb commit e5e485d

File tree

7 files changed

+1372
-1242
lines changed

7 files changed

+1372
-1242
lines changed

‎gourl.php

Lines changed: 92 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
final class gourlclass
88
{
99
private $options = array(); // global setting values
10+
private $hash_url = ""; // security; save your gourl public/private keys sha1 hash in file (db and file)
1011
private $errors = array(); // global setting errors
1112
private $payments = array(); // global activated payments (bitcoin, litecoin, etc)
1213

@@ -52,7 +53,8 @@ final class gourlclass
5253
*/
5354
public function __construct()
5455
{
55-
56+
$this->hash_url = GOURL_DIR."files/gourl.hash"; // you can change path
57+
5658
$this->coin_names = self::coin_names();
5759
$this->coin_chain = self::coin_chain();
5860
$this->coin_www = self::coin_www();
@@ -755,6 +757,35 @@ private function get_settings()
755757
if (!$this->options[$k."url"]) $this->options[$k] = 0;
756758
}
757759

760+
761+
762+
// Additional Security - compare gourl public/private keys sha1 hash with hash stored in file $this->hash_url
763+
// ------------------
764+
$txt = (is_readable($this->hash_url)) ? file_get_contents($this->hash_url) : "";
765+
$arr = json_decode($txt, true);
766+
767+
if (isset($arr["nonce"]) && $arr["nonce"] != sha1(md5(NONCE_KEY)))
768+
{
769+
$this->save_cryptokeys_hash(); // admin changed NONCE_KEY
770+
$txt = (is_readable($this->hash_url)) ? file_get_contents($this->hash_url) : "";
771+
$arr = json_decode($txt, true);
772+
}
773+
774+
foreach($this->coin_names as $k => $v)
775+
{
776+
$pub = $v."public_key";
777+
$prv = $v."private_key";
778+
if (($this->options[$pub] || $this->options[$prv]) &&
779+
(!isset($arr[$pub]) || !isset($arr[$prv]) ||
780+
$arr[$pub] != sha1($this->options[$pub].NONCE_KEY.$this->options[$pub]) ||
781+
$arr[$prv] != sha1($this->options[$prv].NONCE_KEY.$this->options[$prv])))
782+
{
783+
$this->options[$pub] = $this->options[$prv] = "";
784+
update_option(GOURL.$pub, "");
785+
update_option(GOURL.$prv, "");
786+
}
787+
}
788+
758789
return true;
759790
}
760791

@@ -838,6 +869,9 @@ private function check_settings()
838869
if (!function_exists( 'mysqli_connect' )) $this->errors[] = sprintf(__("Error. Please enable <a target='_blank' href='%s'>MySQLi extension</a> in PHP. <a target='_blank' href='%s'>Read here &#187;</a>", GOURL), "http://php.net/manual/en/book.mysqli.php", "http://crybit.com/how-to-enable-mysqli-extension-on-web-server/");
839870
if (version_compare(phpversion(), '5.4.0', '<')) $this->errors[] = sprintf(__("Error. You need PHP 5.4.0 (or greater). Current php version: %s", GOURL), phpversion());
840871

872+
// writable directory
873+
if (!file_exists($this->hash_url) && !is_writable(dirname($this->hash_url))) $this->errors[] = sprintf(__("Error. Cannot write file %s - please make directory %s writable.", GOURL), $this->hash_url, dirname($this->hash_url));
874+
841875
return true;
842876
}
843877

@@ -849,24 +883,65 @@ private function check_settings()
849883
*/
850884
private function save_settings()
851885
{
886+
$arr = array();
852887
foreach ($this->options as $key => $value)
853888
{
854-
update_option(GOURL.$key, $value);
889+
$boxkey = (strpos($key, "public_key") || strpos($key, "private_key")) ? true : false;
890+
if (!(file_exists($this->hash_url) && !is_writable($this->hash_url) && $boxkey))
891+
{
892+
if ($boxkey && get_option(GOURL.$key) != $value) $arr[$key] = array("old_key" => get_option(GOURL.$key), "new_key" => $value);
893+
update_option(GOURL.$key, $value);
894+
}
855895
}
856-
896+
897+
if ($arr)
898+
{
899+
wp_mail(get_bloginfo('admin_email'), 'Notification - GoUrl Bitcoin Payment Gateway Plugin - Cryptobox Keys Changed',
900+
date("r")."\n\nGoUrl Bitcoin Payment Gateway for Wordpress plugin\n\nFollowing crypto payment box/es keys was changed on your website -\n\n".print_r($arr, true));
901+
}
902+
903+
$this->save_cryptokeys_hash();
904+
857905
return true;
858906
}
859907

860908

861909

910+
/*
911+
* 12b. Additional Security
912+
* Save gourl public/private keys sha1 hash in file $this->hash_url
913+
*/
914+
private function save_cryptokeys_hash()
915+
{
916+
if (!file_exists($this->hash_url) || is_writable($this->hash_url))
917+
{
918+
$arr = array("nonce" => sha1(md5(NONCE_KEY)));
919+
foreach($this->coin_names as $k => $v)
920+
{
921+
$pub = $v."public_key";
922+
$prv = $v."private_key";
923+
if ($this->options[$pub] && $this->options[$prv])
924+
{
925+
$arr[$pub] = sha1($this->options[$pub].NONCE_KEY.$this->options[$pub]);
926+
$arr[$prv] = sha1($this->options[$prv].NONCE_KEY.$this->options[$prv]);
927+
}
928+
}
929+
930+
file_put_contents($this->hash_url, json_encode($arr));
931+
}
932+
933+
return true;
934+
}
935+
862936

863937

864938
/*
865939
* 13.
866940
*/
867941
public function page_settings()
868942
{
869-
943+
$readonly = (file_exists($this->hash_url) && !is_writable($this->hash_url)) ? 'readonly' : '';
944+
870945
if ($this->errors) $message = "<div class='error'>".__('Please fix errors below:', GOURL)."<ul><li>- ".implode("</li><li>- ", $this->errors)."</li></ul></div>";
871946
elseif ($this->updated) $message = '<div class="updated"><p>'.__('Settings have been updated <strong>successfully</strong>', GOURL).'</p></div>';
872947
else $message = "";
@@ -895,8 +970,9 @@ public function page_settings()
895970
$tmp .= '<input type="hidden" name="ak_action" value="'.GOURL.'save_settings" />';
896971

897972
$tmp .= '<p>'.sprintf(__( "If you use multiple websites online, please create separate <a target='_blank' href='%s'>GoUrl Payment Box</a> records (with unique payment box public/private keys) for each of your websites. Do not use the same GoUrl Payment Box with the same public/private keys on your different websites.", GOURL ), "https://gourl.io/editrecord/coin_boxes/0") . '</p>';
898-
$tmp .= '<p>'.sprintf(__( "If you want to use plugin in a language other than English, see the page <a href='%s'>Languages and Translations</a>. &#160; This enables you to easily customize the texts of all the labels visible to your users.", GOURL ), "https://gourl.io/languages.html", "https://gourl.io/languages.html") . '</p><br><br>';
899-
973+
$tmp .= '<p>'.sprintf(__( "If you want to use plugin in a language other than English, see the page <a href='%s'>Languages and Translations</a>. &#160; This enables you to easily customize the texts of all the labels visible to your users.", GOURL ), "https://gourl.io/languages.html", "https://gourl.io/languages.html") . '</p>';
974+
if (!$readonly) $tmp .= '<p>'.sprintf(__( "Additional Security - You can make file <a href='%s'>%s</a> - <a target='_blank' href='%s'>readonly</a>. GoUrl Public/Private keys on page below will be not editable anymore (readonly mode).", GOURL ), $this->hash_url, "<b>".basename($this->hash_url)."</b>", "https://www.cyberciti.biz/faq/linux-write-protecting-a-file/") . '</p>';
975+
$tmp .= '<br><br>';
900976
$tmp .= '<div class="alignright">';
901977
$tmp .= '<img id="gourlsubmitloading" src="'.plugins_url('/images/loading.gif', __FILE__).'" border="0">';
902978
$tmp .= '<input type="submit" onclick="this.value=\''.__('Please wait...', GOURL).'\';document.getElementById(\'gourlsubmitloading\').style.display=\'inline\';return true;" class="'.GOURL.'button button-primary" name="submit" value="'.__('Save Settings', GOURL).'">';
@@ -918,10 +994,11 @@ public function page_settings()
918994

919995
$tmp .= '<tr><th>'.$v2.' '.__('Payments', GOURL).':<br><a target="_blank" href="'.$this->coin_www[$v].'"><img title="'.$v2.' Payment API" src="'.plugins_url('/images/'.$v.'.png', __FILE__).'" border="0"></a></th>';
920996
$tmp .= '<td>';
921-
$tmp .= '<div>GoUrl '.$v2.' '.sprintf(__('Box (%s) Public Key', GOURL), $k).' -</div><input type="text" id="'.GOURL.$v.'public_key" name="'.GOURL.$v.'public_key" value="'.htmlspecialchars($this->options[$v.'public_key'], ENT_QUOTES).'" class="widefat">';
922-
$tmp .= '<div>GoUrl '.$v2.' '.sprintf(__('Box (%s) Private Key', GOURL), $k).' -</div><input type="text" id="'.GOURL.$v.'private_key" name="'.GOURL.$v.'private_key" value="'.htmlspecialchars($this->options[$v.'private_key'], ENT_QUOTES).'" class="widefat">';
923-
if ($this->options[$v.'public_key'] && $this->options[$v.'private_key'] && !$this->errors) $tmp .= '<em><span class="gourlpayments">'.sprintf(__("%s (%s) payments are active!", GOURL), $v2, $k).'</span></em>';
924-
else $tmp .= '<em>'.sprintf(__("<b>That is not a %s wallet private key!</b> &#160; GoUrl %s Box Private/Public Keys are used for communicating between your website and GoUrl.io Payment Gateway server (similar like paypal id/keys).<br>If you want to start accepting payments in <a target='_blank' href='%s'>%s (%s)</a>, please create a <a target='_blank' href='%s'>%s Payment Box</a> on GoUrl.io and then enter the received free GoUrl %s Box Public/Private Keys. Leave field blank if you do not accept payments in %s", GOURL), $v2, $v2, $this->coin_www[$v], $v2, $k, "https://gourl.io/editrecord/coin_boxes/0/", $v2, $v2, $v2).'</em>';
997+
$tmp .= '<div>GoUrl '.$v2.' '.sprintf(__('Box (%s) Public Key', GOURL), $k).' -</div><input type="text" '.$readonly.' id="'.GOURL.$v.'public_key" name="'.GOURL.$v.'public_key" value="'.htmlspecialchars($this->options[$v.'public_key'], ENT_QUOTES).'" class="widefat">';
998+
$tmp .= '<div>GoUrl '.$v2.' '.sprintf(__('Box (%s) Private Key', GOURL), $k).' -</div><input type="text" '.$readonly.' id="'.GOURL.$v.'private_key" name="'.GOURL.$v.'private_key" value="'.htmlspecialchars($this->options[$v.'private_key'], ENT_QUOTES).'" class="widefat">';
999+
if ($this->options[$v.'public_key'] && $this->options[$v.'private_key'] && !$this->errors) $tmp .= '<em><span class="gourlpayments"><b>'.sprintf(__("%s (%s) payments are active!", GOURL), $v2, $k).'</b></span></em>';
1000+
elseif (!$readonly) $tmp .= '<em>'.sprintf(__("<b>That is not a %s wallet private key!</b> &#160; GoUrl %s Box Private/Public Keys are used for communicating between your website and GoUrl.io Payment Gateway server (similar like paypal id/keys).<br>If you want to start accepting payments in <a target='_blank' href='%s'>%s (%s)</a>, please create a <a target='_blank' href='%s'>%s Payment Box</a> on GoUrl.io and then enter the received free GoUrl %s Box Public/Private Keys. Leave field blank if you do not accept payments in %s", GOURL), $v2, $v2, $this->coin_www[$v], $v2, $k, "https://gourl.io/editrecord/coin_boxes/0/", $v2, $v2, $v2).'</em>';
1001+
if ($readonly) $tmp .= '<em><span class="gourlpayments">'.sprintf(__("You cannot modify this values because security hash file <a href='%s'>%s</a> is readonly!", GOURL), $this->hash_url, basename($this->hash_url)).'</span></em>';
9251002
$tmp .= '</td></tr>';
9261003
}
9271004

@@ -5824,13 +5901,14 @@ private function upgrade ()
58245901
$wpdb->query("ALTER TABLE `crypto_products` CHANGE `priceCoin` `priceCoin` DOUBLE(17,5) NOT NULL DEFAULT '0.00000'");
58255902
}
58265903

5827-
5828-
// current version
5829-
update_option(GOURL.'version', GOURL_VERSION);
5830-
58315904
// upload dir
58325905
gourl_retest_dir();
58335906

5907+
if (!file_exists($this->hash_url)) file_put_contents($this->hash_url, '{"nonce":"1"}');
5908+
5909+
// current version
5910+
update_option(GOURL.'version', GOURL_VERSION);
5911+
58345912
ob_flush();
58355913

58365914
return true;
@@ -7676,7 +7754,3 @@ function gourl_altcoin_btc_price ($altcoin, $interval = 1)
76767754

76777755
return 0;
76787756
}
7679-
7680-
7681-
7682-

‎gourl_wordpress.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
Plugin Name: GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership
44
Plugin URI: https://gourl.io/bitcoin-wordpress-plugin.html
55
Description: Official <a href="https://gourl.io">GoUrl.io</a> Bitcoin Payment Gateway Plugin for Wordpress. Provides <a href="https://gourl.io/lib/examples/pay-per-product-multi.php">Pay-Per-Product</a>, <a href="https://gourl.io/lib/examples/pay-per-download-multi.php">Pay-Per-Download</a>, <a href="https://gourl.io/lib/examples/pay-per-membership-multi.php">Pay-Per-Membership</a>, <a href="https://gourl.io/lib/examples/pay-per-page-multi.php">Pay-Per-View</a> and bitcoin/altcoin payment gateways for - <a href='https://gourl.io/bitcoin-payments-woocommerce.html'>WooCommerce</a>, <a href='https://gourl.io/bitcoin-payments-wp-ecommerce.html'>WP eCommerce</a>, <a href='https://gourl.io/bitcoin-payments-jigoshop.html'>Jigoshop</a>, <a href='https://gourl.io/bitcoin-payments-wpmudev-marketpress.html'>MarketPress</a>, <a href='https://gourl.io/bitcoin-appthemes-classipress-jobroller-vantage-etc.html'>AppThemes</a>, <a href='https://gourl.io/bitcoin-payments-paid-memberships-pro.html'>Paid Memberships Pro</a>, <a href='https://gourl.io/bbpress-premium-membership.html'>bbPress</a>, <a href='https://gourl.io/bitcoin-donations-wordpress-plugin.html'>Give Donations</a>, etc. Accept Bitcoin, BitcoinCash, Litecoin, Dash, Dogecoin, Speedcoin, Reddcoin, Potcoin, Feathercoin, Vertcoin, Peercoin, MonetaryUnit payments online. No Chargebacks, Global, Secure. All in automatic mode.
6-
Version: 1.4.0
6+
Version: 1.4.1
77
Author: GoUrl.io
88
Author URI: https://gourl.io
99
License: GPLv2
@@ -31,7 +31,7 @@
3131

3232
DEFINE('GOURL', "gourl");
3333
DEFINE('GOURL_PREVIEW', "gourladmin");
34-
DEFINE('GOURL_VERSION', "1.4.0");
34+
DEFINE('GOURL_VERSION', "1.4.1");
3535
DEFINE('GOURL_ADMIN', admin_url("admin.php?page="));
3636
DEFINE('GOURL_DIR', $dir_arr["basedir"]."/".GOURL.'/');
3737
DEFINE('GOURL_DIR2', $dir_arr["baseurl"]."/".GOURL.'/');

0 commit comments

Comments
 (0)