aboutsummaryrefslogtreecommitdiffstats
path: root/Zotlabs/Module
diff options
context:
space:
mode:
authorMario <mario@mariovavti.com>2021-01-09 20:34:21 +0000
committerMario <mario@mariovavti.com>2021-01-09 20:34:21 +0000
commitd6fefc360356de638dd7fd03aa7320f0c6c37115 (patch)
tree7024deef02ccb936a5ac688590b7bc2daae32c56 /Zotlabs/Module
parentd89dc653304abf3c23e5c669350f125a95123290 (diff)
parentefb8a29b5fcacd491c5e080572581437b6000f87 (diff)
downloadvolse-hubzilla-d6fefc360356de638dd7fd03aa7320f0c6c37115.tar.gz
volse-hubzilla-d6fefc360356de638dd7fd03aa7320f0c6c37115.tar.bz2
volse-hubzilla-d6fefc360356de638dd7fd03aa7320f0c6c37115.zip
5.2RC3
Diffstat (limited to 'Zotlabs/Module')
-rw-r--r--Zotlabs/Module/Cdav.php2
-rw-r--r--Zotlabs/Module/Dav.php2
-rw-r--r--Zotlabs/Module/Getfile.php43
-rw-r--r--Zotlabs/Module/Zfinger.php8
4 files changed, 28 insertions, 27 deletions
diff --git a/Zotlabs/Module/Cdav.php b/Zotlabs/Module/Cdav.php
index f7e43e436..f5c5f4384 100644
--- a/Zotlabs/Module/Cdav.php
+++ b/Zotlabs/Module/Cdav.php
@@ -50,7 +50,7 @@ class Cdav extends Controller {
if($sigblock) {
$keyId = str_replace('acct:','',$sigblock['keyId']);
if($keyId) {
- $r = q("select * from hubloc where hubloc_addr = '%s'",
+ $r = q("select * from hubloc where hubloc_id_url = '%s'",
dbesc($keyId)
);
if($r) {
diff --git a/Zotlabs/Module/Dav.php b/Zotlabs/Module/Dav.php
index 949b89950..82d773139 100644
--- a/Zotlabs/Module/Dav.php
+++ b/Zotlabs/Module/Dav.php
@@ -51,7 +51,7 @@ class Dav extends \Zotlabs\Web\Controller {
if($sigblock) {
$keyId = str_replace('acct:','',$sigblock['keyId']);
if($keyId) {
- $r = q("select * from hubloc where hubloc_addr = '%s'",
+ $r = q("select * from hubloc where hubloc_id_url = '%s'",
dbesc($keyId)
);
if($r) {
diff --git a/Zotlabs/Module/Getfile.php b/Zotlabs/Module/Getfile.php
index 17d1c84b8..a867f5ff7 100644
--- a/Zotlabs/Module/Getfile.php
+++ b/Zotlabs/Module/Getfile.php
@@ -6,20 +6,20 @@ use Zotlabs\Lib\Libzot;
/**
* module: getfile
- *
+ *
* used for synchronising files and photos across clones
- *
+ *
* The site initiating the file operation will send a sync packet to known clones.
* They will respond by building the DB structures they require, then will provide a
* post request to this site to grab the file data. This is sent as a stream direct to
* disk at the other end, avoiding memory issues.
*
* Since magic-auth cannot easily be used by the CURL process at the other end,
- * we will require a signed request which includes a timestamp. This should not be
- * used without SSL and is potentially vulnerable to replay if an attacker decrypts
+ * we will require a signed request which includes a timestamp. This should not be
+ * used without SSL and is potentially vulnerable to replay if an attacker decrypts
* the SSL traffic fast enough. The amount of time slop is configurable but defaults
* to 3 minutes.
- *
+ *
*/
@@ -54,13 +54,14 @@ class Getfile extends \Zotlabs\Web\Controller {
$keyId = $sigblock['keyId'];
if($keyId) {
- $r = q("select * from hubloc left join xchan on hubloc_hash = xchan_hash
- where hubloc_addr = '%s'",
- dbesc(str_replace('acct:','',$keyId))
+ $r = q("SELECT * FROM hubloc LEFT JOIN xchan ON hubloc_hash = xchan_hash
+ WHERE hubloc_addr = '%s' OR hubloc_id_url = '%s'",
+ dbesc(str_replace('acct:','',$keyId)),
+ dbesc($keyId)
);
if($r) {
$hubloc = Libzot::zot_record_preferred($r);
- $verified = HTTPSig::verify('',$hubloc['xchan_pubkey']);
+ $verified = HTTPSig::verify('',$hubloc['xchan_pubkey']);
if($verified && $verified['header_signed'] && $verified['header_valid'] && $hash == $hubloc['hubloc_hash']) {
$header_verified = true;
}
@@ -74,15 +75,15 @@ class Getfile extends \Zotlabs\Web\Controller {
logger('post: ' . print_r($_POST,true),LOGGER_DEBUG,LOG_INFO);
if($header_verified) {
logger('HTTPSig verified');
- }
-
+ }
+
$channel = channelx_by_hash($hash);
if((! $channel) || (! $time) || (! $sig)) {
logger('error: missing info');
killme();
}
-
+
if(isset($_POST['resolution']))
$resolution = intval($_POST['resolution']);
elseif(substr($resource,-2,1) == '-') {
@@ -91,21 +92,21 @@ class Getfile extends \Zotlabs\Web\Controller {
}
else {
$resolution = (-1);
- }
+ }
$slop = intval(get_pconfig($channel['channel_id'],'system','getfile_time_slop'));
if($slop < 1)
$slop = 3;
-
+
$d1 = datetime_convert('UTC','UTC',"now + $slop minutes");
- $d2 = datetime_convert('UTC','UTC',"now - $slop minutes");
-
+ $d2 = datetime_convert('UTC','UTC',"now - $slop minutes");
+
if(! $header_verified) {
if(($time > $d1) || ($time < $d2)) {
logger('time outside allowable range');
killme();
}
-
+
if(! rsa_verify($hash . '.' . $time,base64url_decode($sig),$channel['channel_pubkey'])) {
logger('verify failed.');
killme();
@@ -137,20 +138,20 @@ class Getfile extends \Zotlabs\Web\Controller {
else {
echo dbunescbin($r[0]['content']);
}
- }
+ }
killme();
}
$r = attach_by_hash($resource,$channel['channel_hash'],$revision);
-
+
if(! $r['success']) {
logger('attach_by_hash failed: ' . $r['message']);
notice( $r['message'] . EOL);
return;
}
-
+
$unsafe_types = array('text/html','text/css','application/javascript');
-
+
if(in_array($r['data']['filetype'],$unsafe_types) && (! channel_codeallowed($channel['channel_id']))) {
header('Content-type: text/plain');
}
diff --git a/Zotlabs/Module/Zfinger.php b/Zotlabs/Module/Zfinger.php
index 533f0a5db..ce7117ad8 100644
--- a/Zotlabs/Module/Zfinger.php
+++ b/Zotlabs/Module/Zfinger.php
@@ -7,7 +7,7 @@ use Zotlabs\Lib\Libzot;
class Zfinger extends \Zotlabs\Web\Controller {
function init() {
-
+
require_once('include/zot.php');
require_once('include/crypto.php');
@@ -26,7 +26,7 @@ class Zfinger extends \Zotlabs\Web\Controller {
if($chan) {
$headers['Digest'] = HTTPSig::generate_digest_header($ret);
- $h = HTTPSig::create_sig($headers,$chan['channel_prvkey'],'acct:' . channel_reddress($chan));
+ $h = HTTPSig::create_sig($headers,$chan['channel_prvkey'], channel_url($chan));
HTTPSig::set_headers($h);
}
else {
@@ -37,7 +37,7 @@ class Zfinger extends \Zotlabs\Web\Controller {
echo $ret;
killme();
-
+
}
-
+
}