diff options
| author | Mario <mario@mariovavti.com> | 2018-03-09 11:12:18 +0100 |
|---|---|---|
| committer | Mario <mario@mariovavti.com> | 2018-03-09 11:12:18 +0100 |
| commit | 4baf5eab16d809977a44e7911ddcab0ff8383897 (patch) | |
| tree | 393f618c4cfc20f53264ecd8a26a08de0823d35d /Zotlabs/Web/HTTPSig.php | |
| parent | 577da0eb9eb1f90a4cf7a70cfb3582cfb49007ac (diff) | |
| parent | 7361af85b5488fc8bd1744389a3a332dc74276b0 (diff) | |
| download | volse-hubzilla-4baf5eab16d809977a44e7911ddcab0ff8383897.tar.gz volse-hubzilla-4baf5eab16d809977a44e7911ddcab0ff8383897.tar.bz2 volse-hubzilla-4baf5eab16d809977a44e7911ddcab0ff8383897.zip | |
Merge branch '3.2RC'3.2
Diffstat (limited to 'Zotlabs/Web/HTTPSig.php')
| -rw-r--r-- | Zotlabs/Web/HTTPSig.php | 21 |
1 files changed, 18 insertions, 3 deletions
diff --git a/Zotlabs/Web/HTTPSig.php b/Zotlabs/Web/HTTPSig.php index 63033ce5e..a27edb73d 100644 --- a/Zotlabs/Web/HTTPSig.php +++ b/Zotlabs/Web/HTTPSig.php @@ -137,7 +137,22 @@ class HTTPSig { } } - logger('Content_Valid: ' . $result['content_valid']); + + if(in_array('x-zot-digest',$signed_headers)) { + $result['content_signed'] = true; + $digest = explode('=', $headers['x-zot-digest']); + if($digest[0] === 'SHA-256') + $hashalg = 'sha256'; + if($digest[0] === 'SHA-512') + $hashalg = 'sha512'; + + // The explode operation will have stripped the '=' padding, so compare against unpadded base64 + if(rtrim(base64_encode(hash($hashalg,$_POST['data'],true)),'=') === $digest[1]) { + $result['content_valid'] = true; + } + } + + logger('Content_Valid: ' . (($result['content_valid']) ? 'true' : 'false')); return $result; @@ -194,8 +209,8 @@ class HTTPSig { . '",headers="' . $x['headers'] . '",signature="' . $x['signature'] . '"'; if($crypt_key) { - $x = crypto_encapsulate($headerval,$crypt_key,$crypt_alg); - $headerval = 'iv="' . $x['iv'] . '",key="' . $x['key'] . '",alg="' . $x['alg'] . '",data="' . $x['data']; + $x = crypto_encapsulate($headerval,$crypt_key,$crypt_algo); + $headerval = 'iv="' . $x['iv'] . '",key="' . $x['key'] . '",alg="' . $x['alg'] . '",data="' . $x['data'] . '"'; } if($auth) { |