From c6bfd5e7befedf79ab6f7e70902e5fb2aa69fa6f Mon Sep 17 00:00:00 2001
From: zotlabs <mike@macgirvin.com>
Date: Thu, 11 Oct 2018 21:28:47 -0700
Subject: verify some edge case http signatures

---
 Zotlabs/Web/HTTPSig.php | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

(limited to 'Zotlabs/Web')

diff --git a/Zotlabs/Web/HTTPSig.php b/Zotlabs/Web/HTTPSig.php
index ec7bb0d67..f27aa0556 100644
--- a/Zotlabs/Web/HTTPSig.php
+++ b/Zotlabs/Web/HTTPSig.php
@@ -52,6 +52,7 @@ class HTTPSig {
 			$h = new \Zotlabs\Web\HTTPHeaders($data['header']);
 			$headers = $h->fetcharr();
 			$body = $data['body'];
+			$headers['(request-target)'] = $data['request_target'];
 		}
 
 		else {
@@ -60,6 +61,7 @@ class HTTPSig {
 				strtolower($_SERVER['REQUEST_METHOD']) . ' ' .
 				$_SERVER['REQUEST_URI'];
 			$headers['content-type'] = $_SERVER['CONTENT_TYPE'];
+			$headers['content-length'] = $_SERVER['CONTENT_LENGTH'];
 
 			foreach($_SERVER as $k => $v) {
 				if(strpos($k,'HTTP_') === 0) {
@@ -104,10 +106,6 @@ class HTTPSig {
 			if(strpos($h,'.')) {
 				$spoofable = true;
 			}
-			if($h === 'host' && (strpos(strtolower(\App::get_hostname()),strtolower($headers[$h])) === false)) {
-				logger('bad host: ' . $sig_block['keyId'] . ' != ' . $headers[$h]);
-				return $result;
-			}
 			if($h === 'date') {
 				$d = new \DateTime($headers[$h]);
 				$d->setTimeZone(new \DateTimeZone('UTC'));
-- 
cgit v1.2.3