aboutsummaryrefslogtreecommitdiffstats
path: root/include/api_auth.php
diff options
context:
space:
mode:
Diffstat (limited to 'include/api_auth.php')
-rw-r--r--include/api_auth.php52
1 files changed, 50 insertions, 2 deletions
diff --git a/include/api_auth.php b/include/api_auth.php
index 7fc8dec3a..4b1aae642 100644
--- a/include/api_auth.php
+++ b/include/api_auth.php
@@ -7,6 +7,7 @@
function api_login(&$a){
$record = null;
+ $remote_auth = false;
require_once('include/oauth.php');
@@ -34,6 +35,9 @@ function api_login(&$a){
// workarounds for HTTP-auth in CGI mode
foreach([ 'REDIRECT_REMOTE_USER', 'HTTP_AUTHORIZATION' ] as $head) {
+
+ /* Basic authentication */
+
if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,5) === 'Basic') {
$userpass = @base64_decode(substr(trim($_SERVER[$head]),6)) ;
if(strlen($userpass)) {
@@ -43,6 +47,52 @@ function api_login(&$a){
}
break;
}
+
+ /* Signature authentication */
+
+ if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,5) === 'Signature') {
+ $sigblock = \Zotlabs\Web\HTTPSig::parse_sigheader($_SERVER[$head]);
+ if($sigblock) {
+ $keyId = $sigblock['keyId'];
+ if($keyId) {
+ $r = q("select * from hubloc where hubloc_addr = '%s' limit 1",
+ dbesc($keyId)
+ );
+ if($r) {
+ $c = channelx_by_hash($r[0]['hubloc_hash']);
+ if($c) {
+ $a = q("select * from account where account_id = %d limit 1",
+ intval($c[0]['channel_account_id'])
+ );
+ if($a) {
+ $record = [ 'channel' => $c[0], 'account' => $a[0] ];
+ $channel_login = $c[0]['channel_id'];
+ }
+ else {
+ continue;
+ }
+ }
+ else {
+ continue;
+ }
+ }
+ else {
+ continue;
+ }
+
+ if($head !== 'HTTP_AUTHORIZATION') {
+ $_SERVER['HTTP_AUTHORIZATION'] = $_SERVER[$head];
+ }
+ if($record) {
+ $verified = \Zotlabs\Web\HTTPSig::verify('',$record['channel']['channel_pubkey']);
+ if(! ($verified && $verified['header_signed'] && $verified['header_valid'])) {
+ $record = null;
+ }
+ break;
+ }
+ }
+ }
+ }
}
require_once('include/auth.php');
@@ -58,8 +108,6 @@ function api_login(&$a){
}
}
-
-
if($record['account']) {
authenticate_success($record['account']);