From 40a06771ff2a22f3801dfe174ca318cf4f67c1b1 Mon Sep 17 00:00:00 2001
From: Mike Macgirvin <mike@macgirvin.com>
Date: Thu, 5 Aug 2010 02:57:03 -0700
Subject: reciprocal verification on notify, poll

---
 mod/dfrn_poll.php | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

(limited to 'mod/dfrn_poll.php')

diff --git a/mod/dfrn_poll.php b/mod/dfrn_poll.php
index dadcd3148..8d93700d6 100644
--- a/mod/dfrn_poll.php
+++ b/mod/dfrn_poll.php
@@ -174,7 +174,15 @@ function dfrn_poll_content(&$a) {
 
 		openssl_private_encrypt($hash,$challenge,$r[0]['prvkey']);
 		$challenge = bin2hex($challenge);
-		echo '<?xml version="1.0" encoding="UTF-8"?><dfrn_poll><status>' .$status . '</status><dfrn_id>' . $_GET['dfrn_id'] . '</dfrn_id>'
+
+		$encrypted_id = '';
+		$id_str = $_GET['dfrn_id'] . '.' . mt_rand(1000,9999);
+
+		openssl_private_encrypt($id_str,$encrypted_id,$r[0]['prvkey']);
+		$encrypted_id = bin2hex($encrypted_id);
+
+
+		echo '<?xml version="1.0" encoding="UTF-8"?><dfrn_poll><status>' .$status . '</status><dfrn_id>' . $encrypted_id . '</dfrn_id>'
 			. '<challenge>' . $challenge . '</challenge></dfrn_poll>' . "\r\n" ;
 		session_write_close();
 		exit;		
-- 
cgit v1.2.3