Merge remote-tracking branch 'mike/master' into dev

7 files changed, 210 insertions, 49 deletions

diff --git a/Zotlabs/Daemon/Gprobe.php b/Zotlabs/Daemon/Gprobe.php
index 43cce93c3..f1ffb2d81 100644
--- a/Zotlabs/Daemon/Gprobe.php
+++ b/Zotlabs/Daemon/Gprobe.php
@@ -17,7 +17,7 @@ class Gprobe {
 		if(! strpos($url,'@'))
 			return;
 
-		$r = q("select * from xchan where xchan_addr = '%s' limit 1",
+		$r = q("select * from hubloc where hubloc_addr = '%s' limit 1",
 			dbesc($url)
 		);
 
diff --git a/Zotlabs/Module/Cdav.php b/Zotlabs/Module/Cdav.php
index d0619ef0b..abaec26a6 100644
--- a/Zotlabs/Module/Cdav.php
+++ b/Zotlabs/Module/Cdav.php
@@ -3,31 +3,81 @@ namespace Zotlabs\Module;
 
 require_once('include/event.php');
 
+require_once('include/auth.php');
+require_once('include/security.php');
+
 class Cdav extends \Zotlabs\Web\Controller {
 
 	function init() {
 
+		$record = null;
+		$channel_login = false;
+
 		if((argv(1) !== 'calendar') && (argv(1) !== 'addressbook')) {
 
-			// workaround for HTTP-auth in CGI mode
-			if (x($_SERVER, 'REDIRECT_REMOTE_USER')) {
-				$userpass = base64_decode(substr($_SERVER["REDIRECT_REMOTE_USER"], 6)) ;
-				if(strlen($userpass)) {
-					list($name, $password) = explode(':', $userpass);
-					$_SERVER['PHP_AUTH_USER'] = $name;
-					$_SERVER['PHP_AUTH_PW'] = $password;
+			foreach([ 'REDIRECT_REMOTE_USER', 'HTTP_AUTHORIZATION' ] as $head) {
+
+				/* Basic authentication */
+
+				if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,5) === 'Basic') {
+					$userpass = @base64_decode(substr(trim($_SERVER[$head]),6)) ;
+					if(strlen($userpass)) {
+						list($name, $password) = explode(':', $userpass);
+						$_SERVER['PHP_AUTH_USER'] = $name;
+						$_SERVER['PHP_AUTH_PW']   = $password;
+					}
+					break;
 				}
-			}
 
-			if (x($_SERVER, 'HTTP_AUTHORIZATION')) {
-				$userpass = base64_decode(substr($_SERVER["HTTP_AUTHORIZATION"], 6)) ;
-				if(strlen($userpass)) {
-					list($name, $password) = explode(':', $userpass);
-					$_SERVER['PHP_AUTH_USER'] = $name;
-					$_SERVER['PHP_AUTH_PW'] = $password;
+				/* Signature authentication */
+
+				if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,9) === 'Signature') {
+					if($head !== 'HTTP_AUTHORIZATION') {
+						$_SERVER['HTTP_AUTHORIZATION'] = $_SERVER[$head];
+						continue;
+					}
+
+					$sigblock = \Zotlabs\Web\HTTPSig::parse_sigheader($_SERVER[$head]);
+					if($sigblock) {
+						$keyId = $sigblock['keyId'];
+						if($keyId) {
+							$r = q("select * from hubloc where hubloc_addr = '%s' limit 1",
+								dbesc($keyId)
+							);
+							if($r) {
+								$c = channelx_by_hash($r[0]['hubloc_hash']);
+								if($c) {
+									$a = q("select * from account where account_id = %d limit 1",
+										intval($c['channel_account_id'])
+									);
+									if($a) {
+										$record = [ 'channel' => $c, 'account' => $a[0] ];
+										$channel_login = $c['channel_id'];
+									}
+								}
+							}
+							if(! $record)
+								continue;
+
+							if($record) {
+								$verified = \Zotlabs\Web\HTTPSig::verify('',$record['channel']['channel_pubkey']);
+								if(! ($verified && $verified['header_signed'] && $verified['header_valid'])) {
+									$record = null;
+								}
+								if($record['account']) {
+							        authenticate_success($record['account']);
+							        if($channel_login) {
+							            change_channel($channel_login);
+									}
+								}
+								break;
+							}
+						}
+					}
 				}
 			}
 
+
 			/**
 			 * This server combines both CardDAV and CalDAV functionality into a single
 			 * server. It is assumed that the server runs at the root of a HTTP domain (be
diff --git a/Zotlabs/Module/Dav.php b/Zotlabs/Module/Dav.php
index 8ae2e8991..d506fe9f5 100644
--- a/Zotlabs/Module/Dav.php
+++ b/Zotlabs/Module/Dav.php
@@ -12,6 +12,9 @@ use \Sabre\DAV as SDAV;
 use \Zotlabs\Storage;
 
 require_once('include/attach.php');
+require_once('include/auth.php');
+require_once('include/security.php');
+
 
 class Dav extends \Zotlabs\Web\Controller {
 
@@ -21,22 +24,65 @@ class Dav extends \Zotlabs\Web\Controller {
 	 */
 	function init() {
 
-		// workaround for HTTP-auth in CGI mode
-		if (x($_SERVER, 'REDIRECT_REMOTE_USER')) {
- 			$userpass = base64_decode(substr($_SERVER["REDIRECT_REMOTE_USER"], 6)) ;
-			if(strlen($userpass)) {
-			 	list($name, $password) = explode(':', $userpass);
-				$_SERVER['PHP_AUTH_USER'] = $name;
-				$_SERVER['PHP_AUTH_PW'] = $password;
+		foreach([ 'REDIRECT_REMOTE_USER', 'HTTP_AUTHORIZATION' ] as $head) {
+
+			/* Basic authentication */
+
+			if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,5) === 'Basic') {
+				$userpass = @base64_decode(substr(trim($_SERVER[$head]),6)) ;
+				if(strlen($userpass)) {
+					list($name, $password) = explode(':', $userpass);
+					$_SERVER['PHP_AUTH_USER'] = $name;
+					$_SERVER['PHP_AUTH_PW']   = $password;
+				}
+				break;
 			}
-		}
 
-		if (x($_SERVER, 'HTTP_AUTHORIZATION')) {
-			$userpass = base64_decode(substr($_SERVER["HTTP_AUTHORIZATION"], 6)) ;
-			if(strlen($userpass)) {
-				list($name, $password) = explode(':', $userpass);
-				$_SERVER['PHP_AUTH_USER'] = $name;
-				$_SERVER['PHP_AUTH_PW'] = $password;
+			/* Signature authentication */
+
+			if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,9) === 'Signature') {
+				if($head !== 'HTTP_AUTHORIZATION') {
+					$_SERVER['HTTP_AUTHORIZATION'] = $_SERVER[$head];
+					continue;
+				}
+
+				$sigblock = \Zotlabs\Web\HTTPSig::parse_sigheader($_SERVER[$head]);
+				if($sigblock) {
+					$keyId = $sigblock['keyId'];
+					if($keyId) {
+						$r = q("select * from hubloc where hubloc_addr = '%s' limit 1",
+							dbesc($keyId)
+						);
+						if($r) {
+							$c = channelx_by_hash($r[0]['hubloc_hash']);
+							if($c) {
+								$a = q("select * from account where account_id = %d limit 1",
+									intval($c['channel_account_id'])
+								);
+								if($a) {
+									$record = [ 'channel' => $c, 'account' => $a[0] ];
+									$channel_login = $c['channel_id'];
+								}
+							}
+						}
+						if(! $record)
+							continue;
+
+						if($record) {
+							$verified = \Zotlabs\Web\HTTPSig::verify('',$record['channel']['channel_pubkey']);
+							if(! ($verified && $verified['header_signed'] && $verified['header_valid'])) {
+								$record = null;
+							}
+							if($record['account']) {
+						        authenticate_success($record['account']);
+						        if($channel_login) {
+						            change_channel($channel_login);
+								}
+							}
+							break;
+						}
+					}
+				}
 			}
 		}
 
diff --git a/Zotlabs/Web/HTTPSig.php b/Zotlabs/Web/HTTPSig.php
index 537cd52a1..1f485a881 100644
--- a/Zotlabs/Web/HTTPSig.php
+++ b/Zotlabs/Web/HTTPSig.php
@@ -145,7 +145,7 @@ class HTTPSig {
 
 
 
-	static function create_sig($request,$head,$prvkey,$keyid = 'Key',$send_headers = false,$alg = 'sha256') {
+	static function create_sig($request,$head,$prvkey,$keyid = 'Key',$send_headers = false,$auth = false,$alg = 'sha256') {
 
 		$return_headers = [];
 
@@ -155,8 +155,14 @@ class HTTPSig {
 
 		$x = self::sign($request,$head,$prvkey,$alg);			
 
-		$sighead = 'Signature: keyId="' . $keyid . '",algorithm="' . $algorithm
+		if($auth) {
+			$sighead = 'Authorization: Signature keyId="' . $keyid . '",algorithm="' . $algorithm
 			. '",headers="' . $x['headers'] . '",signature="' . $x['signature'] . '"';
+		}
+		else {
+			$sighead = 'Signature: keyId="' . $keyid . '",algorithm="' . $algorithm
+			. '",headers="' . $x['headers'] . '",signature="' . $x['signature'] . '"';
+		}
 
 		if($head) {
 			foreach($head as $k => $v) {
diff --git a/Zotlabs/Web/Router.php b/Zotlabs/Web/Router.php
index 3190369c8..710aa2844 100644
--- a/Zotlabs/Web/Router.php
+++ b/Zotlabs/Web/Router.php
@@ -119,6 +119,18 @@ class Router {
 
 			if(! (\App::$module_loaded)) {
 
+				// undo the setting of a letsencrypt acme-challenge rewrite rule
+				// which blocks access to our .well-known routes.
+				// Also provide a config setting for sites that have a legitimate need
+				// for a custom .htaccess in the .well-known directory; but they should
+				// make the file read-only so letsencrypt doesn't modify it
+
+				if(strpos($_SERVER['REQUEST_URI'],'/.well-known/') === 0) {
+					if(file_exists('.well-known/.htaccess') && get_config('system','fix_apache_acme',true)) {
+						rename('.well-known/.htaccess','.well-known/.htaccess.old');
+					}
+				}
+
 				$x = [ 
 					'module' => $module, 
 					'installed' => \App::$module_loaded, 
diff --git a/include/api_auth.php b/include/api_auth.php
index e5cd7cab3..0818fa54b 100644
--- a/include/api_auth.php
+++ b/include/api_auth.php
@@ -7,6 +7,8 @@
 function api_login(&$a){
 
 	$record = null;
+	$remote_auth = false;
+	$sigblock = null;
 
 	require_once('include/oauth.php');
 
@@ -33,21 +35,66 @@ function api_login(&$a){
 		
 	// workarounds for HTTP-auth in CGI mode
 
-	if(x($_SERVER,'REDIRECT_REMOTE_USER')) {
-		$userpass = base64_decode(substr($_SERVER["REDIRECT_REMOTE_USER"],6)) ;
-		if(strlen($userpass)) {
-			list($name, $password) = explode(':', $userpass);
-			$_SERVER['PHP_AUTH_USER'] = $name;
-			$_SERVER['PHP_AUTH_PW'] = $password;
+	foreach([ 'REDIRECT_REMOTE_USER', 'HTTP_AUTHORIZATION' ] as $head) {
+
+		/* Basic authentication */
+
+		if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,5) === 'Basic') {
+			$userpass = @base64_decode(substr(trim($_SERVER[$head]),6)) ;
+			if(strlen($userpass)) {
+				list($name, $password) = explode(':', $userpass);
+				$_SERVER['PHP_AUTH_USER'] = $name;
+				$_SERVER['PHP_AUTH_PW']   = $password;
+			}
+			break;
 		}
-	}
 
-	if(x($_SERVER,'HTTP_AUTHORIZATION')) {
-		$userpass = base64_decode(substr($_SERVER["HTTP_AUTHORIZATION"],6)) ;
-		if(strlen($userpass)) {
-			list($name, $password) = explode(':', $userpass);
-			$_SERVER['PHP_AUTH_USER'] = $name;
-			$_SERVER['PHP_AUTH_PW'] = $password;
+		/* Signature authentication */
+
+		if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,9) === 'Signature') {
+			if($head !== 'HTTP_AUTHORIZATION') {
+				$_SERVER['HTTP_AUTHORIZATION'] = $_SERVER[$head];
+				continue;
+			}
+
+			$sigblock = \Zotlabs\Web\HTTPSig::parse_sigheader($_SERVER[$head]);
+			if($sigblock) {
+				$keyId = $sigblock['keyId'];
+				if($keyId) {
+					$r = q("select * from hubloc where hubloc_addr = '%s' limit 1",
+						dbesc($keyId)
+					);
+					if($r) {
+						$c = channelx_by_hash($r[0]['hubloc_hash']);
+						if($c) {
+							$a = q("select * from account where account_id = %d limit 1",
+								intval($c['channel_account_id'])
+							);
+							if($a) {
+								$record = [ 'channel' => $c, 'account' => $a[0] ];
+								$channel_login = $c['channel_id'];
+							}
+							else {
+								continue;
+							}
+						}
+						else {
+							continue;
+						}
+					}
+					else {
+						continue;
+					}
+
+					if($record) {					
+						$verified = \Zotlabs\Web\HTTPSig::verify('',$record['channel']['channel_pubkey']);
+						if(! ($verified && $verified['header_signed'] && $verified['header_valid'])) {
+							$record = null;
+						}
+						break;
+					}
+				}
+			}
 		}
 	}
 
@@ -64,8 +111,6 @@ function api_login(&$a){
 		}
 	}
 
-
-
 	if($record['account']) {
 		authenticate_success($record['account']);
 
@@ -85,8 +130,8 @@ function api_login(&$a){
 }
 
 
-function retry_basic_auth() {
-	header('WWW-Authenticate: Basic realm="Hubzilla"');
+function retry_basic_auth($method = 'Basic') {
+	header('WWW-Authenticate: ' . $method . ' realm="Hubzilla"');
 	header('HTTP/1.0 401 Unauthorized');
 	echo('This api requires login');
 	killme();
diff --git a/include/channel.php b/include/channel.php
index efa39dcac..faf28df28 100644
--- a/include/channel.php
+++ b/include/channel.php
@@ -1616,13 +1616,15 @@ function get_my_address() {
 function zid_init() {
 	$tmp_str = get_my_address();
 	if(validate_email($tmp_str)) {
-		Zotlabs\Daemon\Master::Summon(array('Gprobe',bin2hex($tmp_str)));
 		$arr = array('zid' => $tmp_str, 'url' => App::$cmd);
 		call_hooks('zid_init',$arr);
 		if(! local_channel()) {
 			$r = q("select * from hubloc where hubloc_addr = '%s' order by hubloc_connected desc limit 1",
 				dbesc($tmp_str)
 			);
+			if(! $r) {
+				Zotlabs\Daemon\Master::Summon(array('Gprobe',bin2hex($tmp_str)));
+			}
 			if($r && remote_channel() && remote_channel() === $r[0]['hubloc_hash'])
 				return;
 			logger('zid_init: not authenticated. Invoking reverse magic-auth for ' . $tmp_str);