101 lines
3.2 KiB
PHP
101 lines
3.2 KiB
PHP
|
<?php
|
|||
|
|
/**
|
|||
|
|
* 敏感字段加密。
|
|||
|
|
*
|
|||
|
|
* 身份证号、手机号这类个人信息，一律加密后再进库：
|
|||
|
|
* - 加密用 AES-256-CBC，密钥 = sha256(app_key)（app_key 是 32 位十六进制，
|
|||
|
|
* raw bytes 只有 16 字节，不够 256 位，所以必须再过一次 sha256）
|
|||
|
|
* - 手机号另存一份 sha256 明文哈希，专门用于「登录时按手机号查找」
|
|||
|
|
*
|
|||
|
|
* ⚠️ app_key 换掉，已有数据就再解开不了 —— 见 README 的备份说明。
|
|||
|
|
*/
|
|||
|
|
|
|||
|
|
declare(strict_types=1);
|
|||
|
|
|
|||
|
|
namespace App;
|
|||
|
|
|
|||
|
|
final class Crypto
|
|||
|
|
{
|
|||
|
|
private const CIPHER = 'aes-256-cbc';
|
|||
|
|
|
|||
|
|
private static function key(): string
|
|||
|
|
{
|
|||
|
|
$raw = $GLOBALS['config']['app_key'] ?? '';
|
|||
|
|
if ($raw === '' || strpos($raw, '请填写') === 0) {
|
|||
|
|
throw new \RuntimeException('config.php 里的 app_key 还没填写');
|
|||
|
|
}
|
|||
|
|
return hash('sha256', $raw, true);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
public static function encrypt(string $plain): string
|
|||
|
|
{
|
|||
|
|
if ($plain === '') {
|
|||
|
|
return '';
|
|||
|
|
}
|
|||
|
|
$iv = random_bytes(openssl_cipher_iv_length(self::CIPHER));
|
|||
|
|
$raw = openssl_encrypt($plain, self::CIPHER, self::key(), OPENSSL_RAW_DATA, $iv);
|
|||
|
|
if ($raw === false) {
|
|||
|
|
throw new \RuntimeException('加密失败');
|
|||
|
|
}
|
|||
|
|
return base64_encode($iv . $raw);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
/** 解密失败返回空串，不抛异常 —— 展示层宁可空白，也不让整页崩掉 */
|
|||
|
|
public static function decrypt(string $blob): string
|
|||
|
|
{
|
|||
|
|
if ($blob === '') {
|
|||
|
|
return '';
|
|||
|
|
}
|
|||
|
|
$data = base64_decode($blob, true);
|
|||
|
|
if ($data === false) {
|
|||
|
|
return '';
|
|||
|
|
}
|
|||
|
|
$len = openssl_cipher_iv_length(self::CIPHER);
|
|||
|
|
if (strlen($data) <= $len) {
|
|||
|
|
return '';
|
|||
|
|
}
|
|||
|
|
$iv = substr($data, 0, $len);
|
|||
|
|
$raw = substr($data, $len);
|
|||
|
|
$out = openssl_decrypt($raw, self::CIPHER, self::key(), OPENSSL_RAW_DATA, $iv);
|
|||
|
|
return $out === false ? '' : $out;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
/** 手机号 / 登录名查找用的哈希（确定性，不需要可逆） */
|
|||
|
|
public static function hash(string $plain): string
|
|||
|
|
{
|
|||
|
|
return hash('sha256', self::normalizePhone($plain));
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
/** 去掉号码里的空格、横线、加号前缀，避免"138 0000 0000"和"13800000000"存成两个人 */
|
|||
|
|
public static function normalizePhone(string $phone): string
|
|||
|
|
{
|
|||
|
|
$p = preg_replace('/[\s\-()]/', '', trim($phone));
|
|||
|
|
return preg_replace('/^\+?86/', '', $p) === '' ? '' : preg_replace('/^\+?86/', '', $p);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
/** 掩码显示：手机保留前 3 后 4，身份证保留前 6 后 4 */
|
|||
|
|
public static function maskPhone(string $phone): string
|
|||
|
|
{
|
|||
|
|
$p = self::decrypt($phone);
|
|||
|
|
if ($p === '') {
|
|||
|
|
return '—';
|
|||
|
|
}
|
|||
|
|
$n = strlen($p);
|
|||
|
|
return $n <= 7 ? substr($p, 0, 1) . str_repeat('*', max($n - 1, 0))
|
|||
|
|
: substr($p, 0, 3) . '****' . substr($p, -4);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
public static function maskIdCard(string $blob): string
|
|||
|
|
{
|
|||
|
|
$c = self::decrypt($blob);
|
|||
|
|
if ($c === '') {
|
|||
|
|
return '—';
|
|||
|
|
}
|
|||
|
|
$n = strlen($c);
|
|||
|
|
if ($n <= 10) {
|
|||
|
|
return str_repeat('*', $n);
|
|||
|
|
}
|
|||
|
|
return substr($c, 0, 6) . str_repeat('*', $n - 10) . substr($c, -4);
|
|||
|
|
}
|
|||
|
|
}
|