diff options
| author | zotlabs <mike@macgirvin.com> | 2018-10-09 22:37:53 -0700 |
|---|---|---|
| committer | zotlabs <mike@macgirvin.com> | 2018-10-09 22:37:53 -0700 |
| commit | c6f3298f7864756f4a9b7827e8490a3ee859f82f (patch) | |
| tree | 6e59110dee7e48040421e3c4ac5b08688c13ad04 /Zotlabs/Module/Magic.php | |
| parent | 2cb52f88755aac62f208463e4754153bbf249c67 (diff) | |
| download | volse-hubzilla-c6f3298f7864756f4a9b7827e8490a3ee859f82f.tar.gz volse-hubzilla-c6f3298f7864756f4a9b7827e8490a3ee859f82f.tar.bz2 volse-hubzilla-c6f3298f7864756f4a9b7827e8490a3ee859f82f.zip | |
SECURITY: signature issue
Diffstat (limited to 'Zotlabs/Module/Magic.php')
| -rw-r--r-- | Zotlabs/Module/Magic.php | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/Zotlabs/Module/Magic.php b/Zotlabs/Module/Magic.php index be6866592..71737eef8 100644 --- a/Zotlabs/Module/Magic.php +++ b/Zotlabs/Module/Magic.php @@ -146,12 +146,17 @@ class Magic extends \Zotlabs\Web\Controller { $dest = strip_zids($dest); $dest = strip_query_param($dest,'f'); + $data = json_encode([ 'OpenWebAuth' => random_string() ]); + $headers = []; $headers['Accept'] = 'application/x-zot+json' ; $headers['X-Open-Web-Auth'] = random_string(); + $headers['Host'] = $parsed['host']; + $headers['Digest'] = 'SHA-256=' . \Zotlabs\Web\HTTPSig::generate_digest($data,false); + $headers = \Zotlabs\Web\HTTPSig::create_sig('',$headers,$channel['channel_prvkey'], 'acct:' . $channel['channel_address'] . '@' . \App::get_hostname(),false,true,'sha512'); - $x = z_fetch_url($basepath . '/owa',false,$redirects,[ 'headers' => $headers ]); + $x = z_post_url($basepath . '/owa',$data,$redirects,[ 'headers' => $headers ]); if($x['success']) { $j = json_decode($x['body'],true); |