strk/friendica
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Merge pull request #6454 from annando/sig-notice

Browse source 
Avoid a notice in HTTP signature check, preparation for authentication
This commit is contained in:
Hypolite Petovan 2019-01-15 08:07:12 -05:00 committed by GitHub
commit f13b8f8ec4
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 20 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/Module/Objects.php
View file

@ -9,6 +9,7 @@ use Friendica\Protocol\ActivityPub;
use Friendica\Core\System; use Friendica\Core\System;
use Friendica\Model\Item; use Friendica\Model\Item;
use Friendica\Database\DBA; use Friendica\Database\DBA;
use Friendica\Util\HTTPSignature;
/** /**
* ActivityPub Objects * ActivityPub Objects
@ -27,6 +28,9 @@ class Objects extends BaseModule
$a->internalRedirect(str_replace('objects/', 'display/', $a->query_string)); $a->internalRedirect(str_replace('objects/', 'display/', $a->query_string));
} }
/// @todo Add Authentication to enable fetching of non public content
// $requester = HTTPSignature::getSigner('', $_SERVER);
$item = Item::selectFirst(['id'], ['guid' => $a->argv[1], 'origin' => true, 'private' => false]); $item = Item::selectFirst(['id'], ['guid' => $a->argv[1], 'origin' => true, 'private' => false]);
if (!DBA::isResult($item)) { if (!DBA::isResult($item)) {
System::httpExit(404); System::httpExit(404);

4
src/Module/Outbox.php
View file

@ -8,6 +8,7 @@ use Friendica\BaseModule;
use Friendica\Protocol\ActivityPub; use Friendica\Protocol\ActivityPub;
use Friendica\Core\System; use Friendica\Core\System;
use Friendica\Model\User; use Friendica\Model\User;
use Friendica\Util\HTTPSignature;
/** /**
* ActivityPub Outbox * ActivityPub Outbox
@ -29,6 +30,9 @@ class Outbox extends BaseModule
$page = defaults($_REQUEST, 'page', null); $page = defaults($_REQUEST, 'page', null);
/// @todo Add Authentication to enable fetching of non public content
// $requester = HTTPSignature::getSigner('', $_SERVER);
$outbox = ActivityPub\Transmitter::getOutbox($owner, $page); $outbox = ActivityPub\Transmitter::getOutbox($owner, $page);
header('Content-Type: application/activity+json'); header('Content-Type: application/activity+json');

11
src/Util/HTTPSignature.php
View file

@ -217,7 +217,7 @@ class HTTPSignature
$ret['signature'] = base64_decode(preg_replace('/\s+/', '', $matches[1])); $ret['signature'] = base64_decode(preg_replace('/\s+/', '', $matches[1]));
} }
if (($ret['signature']) && ($ret['algorithm']) && (!$ret['headers'])) { if (!empty($ret['signature']) && !empty($ret['algorithm']) && empty($ret['headers'])) {
$ret['headers'] = ['date']; $ret['headers'] = ['date'];
} }
@ -376,13 +376,20 @@ class HTTPSignature
*/ */
public static function getSigner($content, $http_headers) public static function getSigner($content, $http_headers)
{ {
$object = json_decode($content, true); if (empty($http_headers['HTTP_SIGNATURE'])) {
return false;
}
if (!empty($content)) {
$object = json_decode($content, true);
if (empty($object)) { if (empty($object)) {
return false; return false;
} }
$actor = JsonLD::fetchElement($object, 'actor', 'id'); $actor = JsonLD::fetchElement($object, 'actor', 'id');
} else {
$actor = '';
}
$headers = []; $headers = [];
$headers['(request-target)'] = strtolower($http_headers['REQUEST_METHOD']) . ' ' . $http_headers['REQUEST_URI']; $headers['(request-target)'] = strtolower($http_headers['REQUEST_METHOD']) . ' ' . $http_headers['REQUEST_URI'];