From df09d3940c8ecc95d96099a34a5515fe1c985146 Mon Sep 17 00:00:00 2001
From: Quinn Chrzan <quinnchrzan@gmail.com>
Date: Thu, 29 May 2014 17:33:34 -0400
Subject: Removing xor_encode from Encrypt library

---
 system/libraries/Encrypt.php | 77 +++++++++-----------------------------------
 1 file changed, 15 insertions(+), 62 deletions(-)

(limited to 'system/libraries/Encrypt.php')

diff --git a/system/libraries/Encrypt.php b/system/libraries/Encrypt.php
index b30a8cf0b..b6758d98f 100644
--- a/system/libraries/Encrypt.php
+++ b/system/libraries/Encrypt.php
@@ -18,7 +18,7 @@
 /**
  * CodeIgniter Encryption Class
  *
- * Provides two-way keyed encoding using XOR Hashing and Mcrypt
+ * Provides two-way keyed encoding using Mcrypt
  *
  * @package		CodeIgniter
  * @subpackage	Libraries
@@ -45,6 +45,12 @@ class CI_Encrypt {
 	{
 		$this->CI =& get_instance();
 		$this->_mcrypt_exists = ( ! function_exists('mcrypt_encrypt')) ? FALSE : TRUE;
+
+		if ($this->_mcrypt_exists === FALSE)
+		{
+			show_error('The Encrypt library requires the Mcrypt extension.');
+		}
+
 		log_message('debug', "Encrypt Class Initialized");
 	}
 
@@ -103,10 +109,10 @@ class CI_Encrypt {
 	 * Encodes the message string using bitwise XOR encoding.
 	 * The key is combined with a random hash, and then it
 	 * too gets converted using XOR. The whole thing is then run
-	 * through mcrypt (if supported) using the randomized key.
-	 * The end result is a double-encrypted message string
-	 * that is randomized with each call to this function,
-	 * even if the supplied message and key are the same.
+	 * through mcrypt using the randomized key. The end result
+	 * is a double-encrypted message string that is randomized
+	 * with each call to this function, even if the supplied
+	 * message and key are the same.
 	 *
 	 * @access	public
 	 * @param	string	the string to encode
@@ -116,15 +122,7 @@ class CI_Encrypt {
 	function encode($string, $key = '')
 	{
 		$key = $this->get_key($key);
-
-		if ($this->_mcrypt_exists === TRUE)
-		{
-			$enc = $this->mcrypt_encode($string, $key);
-		}
-		else
-		{
-			$enc = $this->_xor_encode($string, $key);
-		}
+		$enc = $this->mcrypt_encode($string, $key);
 
 		return base64_encode($enc);
 	}
@@ -152,16 +150,9 @@ class CI_Encrypt {
 
 		$dec = base64_decode($string);
 
-		if ($this->_mcrypt_exists === TRUE)
-		{
-			if (($dec = $this->mcrypt_decode($dec, $key)) === FALSE)
-			{
-				return FALSE;
-			}
-		}
-		else
+		if (($dec = $this->mcrypt_decode($dec, $key)) === FALSE)
 		{
-			$dec = $this->_xor_decode($dec, $key);
+			return FALSE;
 		}
 
 		return $dec;
@@ -187,12 +178,6 @@ class CI_Encrypt {
 	 */
 	function encode_from_legacy($string, $legacy_mode = MCRYPT_MODE_ECB, $key = '')
 	{
-		if ($this->_mcrypt_exists === FALSE)
-		{
-			log_message('error', 'Encoding from legacy is available only when Mcrypt is in use.');
-			return FALSE;
-		}
-
 		// decode it first
 		// set mode temporarily to what it was when string was encoded with the legacy
 		// algorithm - typically MCRYPT_MODE_ECB
@@ -224,38 +209,6 @@ class CI_Encrypt {
 
 	// --------------------------------------------------------------------
 
-	/**
-	 * XOR Encode
-	 *
-	 * Takes a plain-text string and key as input and generates an
-	 * encoded bit-string using XOR
-	 *
-	 * @access	private
-	 * @param	string
-	 * @param	string
-	 * @return	string
-	 */
-	function _xor_encode($string, $key)
-	{
-		$rand = '';
-		while (strlen($rand) < 32)
-		{
-			$rand .= mt_rand(0, mt_getrandmax());
-		}
-
-		$rand = $this->hash($rand);
-
-		$enc = '';
-		for ($i = 0; $i < strlen($string); $i++)
-		{
-			$enc .= substr($rand, ($i % strlen($rand)), 1).(substr($rand, ($i % strlen($rand)), 1) ^ substr($string, $i, 1));
-		}
-
-		return $this->_xor_merge($enc, $key);
-	}
-
-	// --------------------------------------------------------------------
-
 	/**
 	 * XOR Decode
 	 *
@@ -544,4 +497,4 @@ class CI_Encrypt {
 // END CI_Encrypt class
 
 /* End of file Encrypt.php */
-/* Location: ./system/libraries/Encrypt.php */
\ No newline at end of file
+/* Location: ./system/libraries/Encrypt.php */
-- 
cgit v1.2.3-24-g4f1b