bitPickups/friendica_2019-12_sharedHosting_hotFix
1
1
Fork 0
Code Pull requests Activity

Merge pull request #6454 from annando/sig-notice

Browse source 
Avoid a notice in HTTP signature check, preparation for authentication
This commit is contained in:
Hypolite Petovan 2019-01-15 08:07:12 -05:00 committed by GitHub
parent b00481ce2b ae2a8b796c
commit f13b8f8ec4
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 20 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/Module/Objects.php
View file

@ -9,6 +9,7 @@ use Friendica\Protocol\ActivityPub;
use Friendica\Core\System;
use Friendica\Model\Item;
use Friendica\Database\DBA;
use Friendica\Util\HTTPSignature;
/**
* ActivityPub Objects
@ -27,6 +28,9 @@ class Objects extends BaseModule
$a->internalRedirect(str_replace('objects/', 'display/', $a->query_string));
}
/// @todo Add Authentication to enable fetching of non public content
// $requester = HTTPSignature::getSigner('', $_SERVER);
$item = Item::selectFirst(['id'], ['guid' => $a->argv[1], 'origin' => true, 'private' => false]);
if (!DBA::isResult($item)) {
System::httpExit(404);

4
src/Module/Outbox.php
View file

@ -8,6 +8,7 @@ use Friendica\BaseModule;
use Friendica\Protocol\ActivityPub;
use Friendica\Core\System;
use Friendica\Model\User;
use Friendica\Util\HTTPSignature;
/**
* ActivityPub Outbox
@ -29,6 +30,9 @@ class Outbox extends BaseModule
$page = defaults($_REQUEST, 'page', null);
/// @todo Add Authentication to enable fetching of non public content
// $requester = HTTPSignature::getSigner('', $_SERVER);
$outbox = ActivityPub\Transmitter::getOutbox($owner, $page);
header('Content-Type: application/activity+json');

17
src/Util/HTTPSignature.php
View file

@ -217,7 +217,7 @@ class HTTPSignature
$ret['signature'] = base64_decode(preg_replace('/\s+/', '', $matches[1]));
}
if (($ret['signature']) && ($ret['algorithm']) && (!$ret['headers'])) {
if (!empty($ret['signature']) && !empty($ret['algorithm']) && empty($ret['headers'])) {
$ret['headers'] = ['date'];
}
@ -376,13 +376,20 @@ class HTTPSignature
*/
public static function getSigner($content, $http_headers)
{
$object = json_decode($content, true);
if (empty($object)) {
if (empty($http_headers['HTTP_SIGNATURE'])) {
return false;
}
$actor = JsonLD::fetchElement($object, 'actor', 'id');
if (!empty($content)) {
$object = json_decode($content, true);
if (empty($object)) {
return false;
}
$actor = JsonLD::fetchElement($object, 'actor', 'id');
} else {
$actor = '';
}
$headers = [];
$headers['(request-target)'] = strtolower($http_headers['REQUEST_METHOD']) . ' ' . $http_headers['REQUEST_URI'];