Browse Source

Avoid a notice in HTTP signature check, preparation for authentication

pull/6454/head
Michael 2 years ago
parent
commit
ae2a8b796c
3 changed files with 20 additions and 5 deletions
  1. +4
    -0
      src/Module/Objects.php
  2. +4
    -0
      src/Module/Outbox.php
  3. +12
    -5
      src/Util/HTTPSignature.php

+ 4
- 0
src/Module/Objects.php View File

@ -9,6 +9,7 @@ use Friendica\Protocol\ActivityPub;
use Friendica\Core\System;
use Friendica\Model\Item;
use Friendica\Database\DBA;
use Friendica\Util\HTTPSignature;
/**
* ActivityPub Objects
@ -27,6 +28,9 @@ class Objects extends BaseModule
$a->internalRedirect(str_replace('objects/', 'display/', $a->query_string));
}
/// @todo Add Authentication to enable fetching of non public content
// $requester = HTTPSignature::getSigner('', $_SERVER);
$item = Item::selectFirst(['id'], ['guid' => $a->argv[1], 'origin' => true, 'private' => false]);
if (!DBA::isResult($item)) {
System::httpExit(404);


+ 4
- 0
src/Module/Outbox.php View File

@ -8,6 +8,7 @@ use Friendica\BaseModule;
use Friendica\Protocol\ActivityPub;
use Friendica\Core\System;
use Friendica\Model\User;
use Friendica\Util\HTTPSignature;
/**
* ActivityPub Outbox
@ -29,6 +30,9 @@ class Outbox extends BaseModule
$page = defaults($_REQUEST, 'page', null);
/// @todo Add Authentication to enable fetching of non public content
// $requester = HTTPSignature::getSigner('', $_SERVER);
$outbox = ActivityPub\Transmitter::getOutbox($owner, $page);
header('Content-Type: application/activity+json');


+ 12
- 5
src/Util/HTTPSignature.php View File

@ -217,7 +217,7 @@ class HTTPSignature
$ret['signature'] = base64_decode(preg_replace('/\s+/', '', $matches[1]));
}
if (($ret['signature']) && ($ret['algorithm']) && (!$ret['headers'])) {
if (!empty($ret['signature']) && !empty($ret['algorithm']) && empty($ret['headers'])) {
$ret['headers'] = ['date'];
}
@ -376,13 +376,20 @@ class HTTPSignature
*/
public static function getSigner($content, $http_headers)
{
$object = json_decode($content, true);
if (empty($object)) {
if (empty($http_headers['HTTP_SIGNATURE'])) {
return false;
}
$actor = JsonLD::fetchElement($object, 'actor', 'id');
if (!empty($content)) {
$object = json_decode($content, true);
if (empty($object)) {
return false;
}
$actor = JsonLD::fetchElement($object, 'actor', 'id');
} else {
$actor = '';
}
$headers = [];
$headers['(request-target)'] = strtolower($http_headers['REQUEST_METHOD']) . ' ' . $http_headers['REQUEST_URI'];


Loading…
Cancel
Save