PATH:
home
/
lab2454c
/
archfort.com
/
wp-content
/
plugins
/
wp-user-frontend-pro
/
modules
/
stripe
/
lib
/
stripe
/
lib
<?php namespace Stripe; abstract class WebhookSignature { const EXPECTED_SCHEME = "v1"; /** * Verifies the signature header sent by Stripe. Throws a * SignatureVerification exception if the verification fails for any * reason. * * @param string $payload the payload sent by Stripe. * @param string $header the contents of the signature header sent by * Stripe. * @param string $secret secret used to generate the signature. * @param int $tolerance maximum difference allowed between the header's * timestamp and the current time * @throws \Stripe\Error\SignatureVerification if the verification fails. * @return bool */ public static function verifyHeader($payload, $header, $secret, $tolerance = null) { // Extract timestamp and signatures from header $timestamp = self::getTimestamp($header); $signatures = self::getSignatures($header, self::EXPECTED_SCHEME); if ($timestamp == -1) { throw new Error\SignatureVerification( "Unable to extract timestamp and signatures from header", $header, $payload ); } if (empty($signatures)) { throw new Error\SignatureVerification( "No signatures found with expected scheme", $header, $payload ); } // Check if expected signature is found in list of signatures from // header $signedPayload = "$timestamp.$payload"; $expectedSignature = self::computeSignature($signedPayload, $secret); $signatureFound = false; foreach ($signatures as $signature) { if (Util\Util::secureCompare($expectedSignature, $signature)) { $signatureFound = true; break; } } if (!$signatureFound) { throw new Error\SignatureVerification( "No signatures found matching the expected signature for payload", $header, $payload ); } // Check if timestamp is within tolerance if (($tolerance > 0) && (abs(time() - $timestamp) > $tolerance)) { throw new Error\SignatureVerification( "Timestamp outside the tolerance zone", $header, $payload ); } return true; } /** * Extracts the timestamp in a signature header. * * @param string $header the signature header * @return int the timestamp contained in the header, or -1 if no valid * timestamp is found */ private static function getTimestamp($header) { $items = explode(",", $header); foreach ($items as $item) { $itemParts = explode("=", $item, 2); if ($itemParts[0] == "t") { if (!is_numeric($itemParts[1])) { return -1; } return intval($itemParts[1]); } } return -1; } /** * Extracts the signatures matching a given scheme in a signature header. * * @param string $header the signature header * @param string $scheme the signature scheme to look for. * @return array the list of signatures matching the provided scheme. */ private static function getSignatures($header, $scheme) { $signatures = []; $items = explode(",", $header); foreach ($items as $item) { $itemParts = explode("=", $item, 2); if ($itemParts[0] == $scheme) { array_push($signatures, $itemParts[1]); } } return $signatures; } /** * Computes the signature for a given payload and secret. * * The current scheme used by Stripe ("v1") is HMAC/SHA-256. * * @param string $payload the payload to sign. * @param string $secret the secret used to generate the signature. * @return string the signature as a string. */ private static function computeSignature($payload, $secret) { return hash_hmac("sha256", $payload, $secret); } }
[-] ThreeDSecure.php
[edit]
[-] WebhookEndpoint.php
[edit]
[+]
Terminal
[-] ApplicationFeeRefund.php
[edit]
[-] WebhookSignature.php
[edit]
[-] OrderItem.php
[edit]
[-] PaymentIntent.php
[edit]
[-] AlipayAccount.php
[edit]
[-] InvoiceItem.php
[edit]
[-] TransferReversal.php
[edit]
[+]
Sigma
[-] Coupon.php
[edit]
[-] File.php
[edit]
[-] OAuth.php
[edit]
[-] Review.php
[edit]
[-] FileLink.php
[edit]
[-] LoginLink.php
[edit]
[-] Charge.php
[edit]
[+]
..
[-] Discount.php
[edit]
[-] SubscriptionScheduleRevision.php
[edit]
[-] Balance.php
[edit]
[-] CustomerBalanceTransaction.php
[edit]
[-] Payout.php
[edit]
[-] TaxRate.php
[edit]
[-] ApplicationFee.php
[edit]
[-] SubscriptionSchedule.php
[edit]
[-] ApplePayDomain.php
[edit]
[-] SetupIntent.php
[edit]
[-] ApiResource.php
[edit]
[-] Plan.php
[edit]
[-] Refund.php
[edit]
[-] InvoiceLineItem.php
[edit]
[-] CountrySpec.php
[edit]
[-] EphemeralKey.php
[edit]
[-] BitcoinTransaction.php
[edit]
[-] Card.php
[edit]
[-] SourceTransaction.php
[edit]
[-] Order.php
[edit]
[-] TaxId.php
[edit]
[-] Subscription.php
[edit]
[-] Account.php
[edit]
[-] AccountLink.php
[edit]
[+]
Issuing
[-] Token.php
[edit]
[-] Stripe.php
[edit]
[-] Customer.php
[edit]
[-] Event.php
[edit]
[-] RequestTelemetry.php
[edit]
[-] ExchangeRate.php
[edit]
[+]
Checkout
[+]
ApiOperations
[-] Person.php
[edit]
[-] ApiResponse.php
[edit]
[-] Transfer.php
[edit]
[+]
Radar
[-] SKU.php
[edit]
[-] RecipientTransfer.php
[edit]
[-] Recipient.php
[edit]
[+]
HttpClient
[-] BalanceTransaction.php
[edit]
[-] IssuerFraudRecord.php
[edit]
[-] ApiRequestor.php
[edit]
[-] Product.php
[edit]
[+]
Reporting
[-] Capability.php
[edit]
[-] OrderReturn.php
[edit]
[-] CreditNote.php
[edit]
[-] UsageRecordSummary.php
[edit]
[-] PaymentMethod.php
[edit]
[-] FileUpload.php
[edit]
[-] UsageRecord.php
[edit]
[+]
Util
[-] Invoice.php
[edit]
[-] BankAccount.php
[edit]
[-] Source.php
[edit]
[-] Topup.php
[edit]
[+]
Error
[-] Dispute.php
[edit]
[-] SubscriptionItem.php
[edit]
[-] SingletonApiResource.php
[edit]
[-] StripeObject.php
[edit]
[-] Webhook.php
[edit]
[-] BitcoinReceiver.php
[edit]
[-] Collection.php
[edit]