diff options
| -rw-r--r-- | include/api_zot.php | 4 | ||||
| -rw-r--r-- | include/hubloc.php | 8 |
2 files changed, 10 insertions, 2 deletions
diff --git a/include/api_zot.php b/include/api_zot.php index d1979c3ae..82de85454 100644 --- a/include/api_zot.php +++ b/include/api_zot.php @@ -334,8 +334,8 @@ logger('api_xchan'); require_once('include/hubloc.php'); - if($_SERVER['REQUEST_METHOD'] === 'POST') { - // $r = xchan_store($_REQUEST); + if($_SERVER['REQUEST_METHOD'] === 'POST') { + $r = xchan_store($_REQUEST); } $r = xchan_fetch($_REQUEST); json_return_and_die($r); diff --git a/include/hubloc.php b/include/hubloc.php index 17f921f67..6f81ea31f 100644 --- a/include/hubloc.php +++ b/include/hubloc.php @@ -200,6 +200,14 @@ function xchan_store($arr) { if(! $arr['photo']) $arr['photo'] = z_root() . '/' . get_default_profile_photo(); + + if($arr['network'] === 'zot') { + if((! $arr['key']) || (! rsa_verify($arr['guid'],base64url_decode($arr['guid_sig']),$arr['key']))) { + logger('Unable to verify signature for ' . $arr['hash']); + return false; + } + } + $r = q("insert into xchan ( xchan_hash, xchan_guid, xchan_guid_sig, xchan_pubkey, xchan_addr, xchan_url, xchan_connurl, xchan_follow, xchan_connpage, xchan_name, xchan_network, xchan_instance_url, xchan_hidden, xchan_orphan, xchan_censored, xchan_selfcensored, xchan_system, xchan_pubforum, xchan_deleted, xchan_name_date ) values ('%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s','%s','%s','%s',%d, %d, %d, %d, %d, %d, %d, '%s') ", dbesc($arr['hash']), dbesc($arr['guid']), |