aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMario Vavti <mario@mariovavti.com>2017-09-02 23:52:31 +0200
committerMario Vavti <mario@mariovavti.com>2017-09-02 23:52:31 +0200
commit1a0cf2666a757314edfb5f6f1ea40c5e1e8750ea (patch)
tree1b08dc710e25d16fdea0b451c29529e7ba489345
parente935473c5c05a40194c110fbb024825a30ca5a4b (diff)
parent7bff60edacd68ef3dccf6f956e9c57092919950a (diff)
downloadvolse-hubzilla-1a0cf2666a757314edfb5f6f1ea40c5e1e8750ea.tar.gz
volse-hubzilla-1a0cf2666a757314edfb5f6f1ea40c5e1e8750ea.tar.bz2
volse-hubzilla-1a0cf2666a757314edfb5f6f1ea40c5e1e8750ea.zip
Merge remote-tracking branch 'mike/master' into dev
-rw-r--r--Zotlabs/Module/Cdav.php2
-rw-r--r--Zotlabs/Module/Dav.php2
-rw-r--r--include/api_auth.php3
3 files changed, 6 insertions, 1 deletions
diff --git a/Zotlabs/Module/Cdav.php b/Zotlabs/Module/Cdav.php
index abaec26a6..ec177ae2a 100644
--- a/Zotlabs/Module/Cdav.php
+++ b/Zotlabs/Module/Cdav.php
@@ -64,6 +64,8 @@ class Cdav extends \Zotlabs\Web\Controller {
if(! ($verified && $verified['header_signed'] && $verified['header_valid'])) {
$record = null;
}
+// requires security review
+$record = null;
if($record['account']) {
authenticate_success($record['account']);
if($channel_login) {
diff --git a/Zotlabs/Module/Dav.php b/Zotlabs/Module/Dav.php
index d506fe9f5..5cd0c9c5e 100644
--- a/Zotlabs/Module/Dav.php
+++ b/Zotlabs/Module/Dav.php
@@ -73,6 +73,8 @@ class Dav extends \Zotlabs\Web\Controller {
if(! ($verified && $verified['header_signed'] && $verified['header_valid'])) {
$record = null;
}
+// requires security review
+$record = null;
if($record['account']) {
authenticate_success($record['account']);
if($channel_login) {
diff --git a/include/api_auth.php b/include/api_auth.php
index 0818fa54b..0acd4ac68 100644
--- a/include/api_auth.php
+++ b/include/api_auth.php
@@ -85,7 +85,8 @@ function api_login(&$a){
else {
continue;
}
-
+// requires security review
+$record = null;
if($record) {
$verified = \Zotlabs\Web\HTTPSig::verify('',$record['channel']['channel_pubkey']);
if(! ($verified && $verified['header_signed'] && $verified['header_valid'])) {