diff options
| -rw-r--r-- | include/api_auth.php | 52 |
1 files changed, 50 insertions, 2 deletions
diff --git a/include/api_auth.php b/include/api_auth.php index 7fc8dec3a..4b1aae642 100644 --- a/include/api_auth.php +++ b/include/api_auth.php @@ -7,6 +7,7 @@ function api_login(&$a){ $record = null; + $remote_auth = false; require_once('include/oauth.php'); @@ -34,6 +35,9 @@ function api_login(&$a){ // workarounds for HTTP-auth in CGI mode foreach([ 'REDIRECT_REMOTE_USER', 'HTTP_AUTHORIZATION' ] as $head) { + + /* Basic authentication */ + if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,5) === 'Basic') { $userpass = @base64_decode(substr(trim($_SERVER[$head]),6)) ; if(strlen($userpass)) { @@ -43,6 +47,52 @@ function api_login(&$a){ } break; } + + /* Signature authentication */ + + if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,5) === 'Signature') { + $sigblock = \Zotlabs\Web\HTTPSig::parse_sigheader($_SERVER[$head]); + if($sigblock) { + $keyId = $sigblock['keyId']; + if($keyId) { + $r = q("select * from hubloc where hubloc_addr = '%s' limit 1", + dbesc($keyId) + ); + if($r) { + $c = channelx_by_hash($r[0]['hubloc_hash']); + if($c) { + $a = q("select * from account where account_id = %d limit 1", + intval($c[0]['channel_account_id']) + ); + if($a) { + $record = [ 'channel' => $c[0], 'account' => $a[0] ]; + $channel_login = $c[0]['channel_id']; + } + else { + continue; + } + } + else { + continue; + } + } + else { + continue; + } + + if($head !== 'HTTP_AUTHORIZATION') { + $_SERVER['HTTP_AUTHORIZATION'] = $_SERVER[$head]; + } + if($record) { + $verified = \Zotlabs\Web\HTTPSig::verify('',$record['channel']['channel_pubkey']); + if(! ($verified && $verified['header_signed'] && $verified['header_valid'])) { + $record = null; + } + break; + } + } + } + } } require_once('include/auth.php'); @@ -58,8 +108,6 @@ function api_login(&$a){ } } - - if($record['account']) { authenticate_success($record['account']); |