aboutsummaryrefslogtreecommitdiffstats
path: root/Zotlabs
diff options
context:
space:
mode:
authorzotlabs <mike@macgirvin.com>2017-09-04 21:49:44 -0700
committerzotlabs <mike@macgirvin.com>2017-09-04 22:35:44 -0700
commit83d0e48ebe4ba4b8b3ca5918bde98a1aaf005c31 (patch)
treecf72420d7aac8603958b602f5415ace26cca7221 /Zotlabs
parentca58ef80ae665ab2b9da125e17fdb33a1ea90a40 (diff)
downloadvolse-hubzilla-83d0e48ebe4ba4b8b3ca5918bde98a1aaf005c31.tar.gz
volse-hubzilla-83d0e48ebe4ba4b8b3ca5918bde98a1aaf005c31.tar.bz2
volse-hubzilla-83d0e48ebe4ba4b8b3ca5918bde98a1aaf005c31.zip
some preliminary work on Zot VI
Diffstat (limited to 'Zotlabs')
-rw-r--r--Zotlabs/Module/Zfinger.php3
-rw-r--r--Zotlabs/Zot/Finger.php22
2 files changed, 19 insertions, 6 deletions
diff --git a/Zotlabs/Module/Zfinger.php b/Zotlabs/Module/Zfinger.php
index b978b9769..0f7f6a64b 100644
--- a/Zotlabs/Module/Zfinger.php
+++ b/Zotlabs/Module/Zfinger.php
@@ -25,7 +25,8 @@ class Zfinger extends \Zotlabs\Web\Controller {
if($chan) {
$hash = \Zotlabs\Web\HTTPSig::generate_digest($ret,false);
$headers['Digest'] = 'SHA-256=' . $hash;
- \Zotlabs\Web\HTTPSig::create_sig('',$headers,$chan['channel_prvkey'],z_root() . '/channel/' . $chan['channel_address'],true);
+ \Zotlabs\Web\HTTPSig::create_sig('',$headers,$chan['channel_prvkey'],
+ 'acct:' . $chan['channel_address'] . '@' . \App::get_hostname(),true);
}
else {
foreach($headers as $k => $v) {
diff --git a/Zotlabs/Zot/Finger.php b/Zotlabs/Zot/Finger.php
index 9871b5bbd..865e78517 100644
--- a/Zotlabs/Zot/Finger.php
+++ b/Zotlabs/Zot/Finger.php
@@ -22,6 +22,7 @@ class Finger {
*
* @return zotinfo array (with 'success' => true) or array('success' => false);
*/
+
static public function run($webbie, $channel = null, $autofallback = true) {
$ret = array('success' => false);
@@ -84,18 +85,27 @@ class Finger {
'token' => self::$token
);
- $result = z_post_url($url . $rhs,$postvars);
+ $headers = [];
+ $headers['X-Zot-Channel'] = $channel['channel_address'] . '@' . \App::get_hostname();
+ $headers['X-Zot-Nonce'] = random_string();
+ $xhead = \Zotlabs\Web\HTTPSig::create_sig('',$headers,$channel['channel_prvkey'],
+ 'acct:' . $channel['channel_address'] . '@' . \App::get_hostname(),false);
+
+ $retries = 0;
+
+ $result = z_post_url($url . $rhs,$postvars,$retries, [ 'headers' => $xhead ]);
if ((! $result['success']) && ($autofallback)) {
if ($https) {
logger('zot_finger: https failed. falling back to http');
- $result = z_post_url('http://' . $host . $rhs,$postvars);
+ $result = z_post_url('http://' . $host . $rhs,$postvars, $retries, [ 'headers' => $xhead ]);
}
}
- } else {
+ }
+ else {
$rhs .= '?f=&address=' . urlencode($address) . '&token=' . self::$token;
- $result = z_fetch_url($url . $rhs);
+ $result = z_fetch_url($url . $rhs);
if((! $result['success']) && ($autofallback)) {
if($https) {
logger('zot_finger: https failed. falling back to http');
@@ -110,8 +120,10 @@ class Finger {
return $ret;
}
+ $verify = \Zotlabs\Web\HTTPSig::verify($result);
+
$x = json_decode($result['body'], true);
- if($x) {
+ if($x && (! $verify['header_valid'])) {
$signed_token = ((is_array($x) && array_key_exists('signed_token', $x)) ? $x['signed_token'] : null);
if($signed_token) {
$valid = rsa_verify('token.' . self::$token, base64url_decode($signed_token), $x['key']);