Manager

Back Back Up Advanced Editor

<?php
/**
 * Implement nonce helper methods.
 *
 * @link       https://automattic.com
 * @since      1.0.0
 * @package    automattic/jetpack-boost
 */

namespace Automattic\Jetpack_Boost\Lib;

/**
 * Class Nonce
 */
class Nonce {
	/**
	 * This is a light clone of wp_create_nonce and wp_verify_nonce which skips the UID and cookie token parts,
	 * so it can be used in anonymous HTTP callbacks. It is therefore not as secure, so be careful.
	 *
	 * @param string $action The action.
	 */
	public static function create( $action ) {
		return substr( wp_hash( wp_nonce_tick() . '|' . $action, 'nonce' ), -12, 10 );
	}

/**
	 * Verify the nonce.
	 *
	 * @param string $nonce  The nonce.
	 * @param string $action The action.
	 */
	public static function verify( $nonce, $action ) {
		$i = wp_nonce_tick();

// Current nonce.
		$expected = substr( wp_hash( $i . '|' . $action, 'nonce' ), -12, 10 );
		if ( hash_equals( $expected, $nonce ) ) {
			return 1;
		}

// Nonce generated 12-24 hours ago.
		$expected = substr( wp_hash( ( $i - 1 ) . '|' . $action, 'nonce' ), -12, 10 );
		if ( hash_equals( $expected, $nonce ) ) {
			return 2;
		}

return false;
	}
}