aboutsummaryrefslogtreecommitdiffstats
path: root/Zotlabs/Web
diff options
context:
space:
mode:
authorzotlabs <mike@macgirvin.com>2018-10-11 21:28:47 -0700
committerzotlabs <mike@macgirvin.com>2018-10-11 21:28:47 -0700
commitc6bfd5e7befedf79ab6f7e70902e5fb2aa69fa6f (patch)
tree65b4ab7f32d8828044ac77aa7130427c28bde044 /Zotlabs/Web
parentc6f3298f7864756f4a9b7827e8490a3ee859f82f (diff)
downloadvolse-hubzilla-c6bfd5e7befedf79ab6f7e70902e5fb2aa69fa6f.tar.gz
volse-hubzilla-c6bfd5e7befedf79ab6f7e70902e5fb2aa69fa6f.tar.bz2
volse-hubzilla-c6bfd5e7befedf79ab6f7e70902e5fb2aa69fa6f.zip
verify some edge case http signatures
Diffstat (limited to 'Zotlabs/Web')
-rw-r--r--Zotlabs/Web/HTTPSig.php6
1 files changed, 2 insertions, 4 deletions
diff --git a/Zotlabs/Web/HTTPSig.php b/Zotlabs/Web/HTTPSig.php
index ec7bb0d67..f27aa0556 100644
--- a/Zotlabs/Web/HTTPSig.php
+++ b/Zotlabs/Web/HTTPSig.php
@@ -52,6 +52,7 @@ class HTTPSig {
$h = new \Zotlabs\Web\HTTPHeaders($data['header']);
$headers = $h->fetcharr();
$body = $data['body'];
+ $headers['(request-target)'] = $data['request_target'];
}
else {
@@ -60,6 +61,7 @@ class HTTPSig {
strtolower($_SERVER['REQUEST_METHOD']) . ' ' .
$_SERVER['REQUEST_URI'];
$headers['content-type'] = $_SERVER['CONTENT_TYPE'];
+ $headers['content-length'] = $_SERVER['CONTENT_LENGTH'];
foreach($_SERVER as $k => $v) {
if(strpos($k,'HTTP_') === 0) {
@@ -104,10 +106,6 @@ class HTTPSig {
if(strpos($h,'.')) {
$spoofable = true;
}
- if($h === 'host' && (strpos(strtolower(\App::get_hostname()),strtolower($headers[$h])) === false)) {
- logger('bad host: ' . $sig_block['keyId'] . ' != ' . $headers[$h]);
- return $result;
- }
if($h === 'date') {
$d = new \DateTime($headers[$h]);
$d->setTimeZone(new \DateTimeZone('UTC'));