From 7e01f7932157750043d166bf3e3b664a57bf50c7 Mon Sep 17 00:00:00 2001
From: Daniel Supernault <danielsupernault@gmail.com>
Date: Mon, 10 Jun 2019 12:36:50 -0600
Subject: [PATCH] Update FederationController

---
 app/Http/Controllers/FederationController.php | 94 +++++++++++++++++--
 1 file changed, 85 insertions(+), 9 deletions(-)

diff --git a/app/Http/Controllers/FederationController.php b/app/Http/Controllers/FederationController.php
index ba944a96e..cb65e99b8 100644
--- a/app/Http/Controllers/FederationController.php
+++ b/app/Http/Controllers/FederationController.php
@@ -209,25 +209,101 @@ class FederationController extends Controller
         abort_if(!config('federation.activitypub.enabled'), 404);
         abort_if(!config('federation.activitypub.inbox'), 404);
 
-        $headers = $request->headers->all();
-        $payload = $request->getContent();
-        InboxValidator::dispatch($username, $headers, $payload);
+        // $headers = $request->headers->all();
+        // $payload = $request->getContent();
+        // InboxValidator::dispatch($username, $headers, $payload);
+        $profile = Profile::whereNull('domain')->whereUsername($username)->firstOrFail();
+        if($profile->status != null) {
+            return ProfileController::accountCheck($profile);
+        }
+        $body = $request->getContent();
+        $bodyDecoded = json_decode($body, true, 8);
+        if($this->verifySignature($request, $profile) == true) {
+            InboxWorker::dispatch($request->headers->all(), $profile, $bodyDecoded);
+        } else if($this->blindKeyRotation($request, $profile) == true) {
+            InboxWorker::dispatch($request->headers->all(), $profile, $bodyDecoded);
+        } else {
+            abort(400, 'Bad Signature');
+        }
         return;
     }
 
 
-    // Deprecated
-
     protected function verifySignature(Request $request, Profile $profile)
     {
-        return false;
+        $body = $request->getContent();
+        $bodyDecoded = json_decode($body, true, 8);
+        $signature = $request->header('signature');
+        $date = $request->header('date');
+        if(!$signature) {
+            abort(400, 'Missing signature header');
+        }
+        if(!$date) {
+            abort(400, 'Missing date header');
+        }
+        if(!now()->parse($date)->gt(now()->subDays(1)) || !now()->parse($date)->lt(now()->addDays(1))) {
+            abort(400, 'Invalid date');
+        }
+        $signatureData = HttpSignature::parseSignatureHeader($signature);
+        $keyId = Helpers::validateUrl($signatureData['keyId']);
+        $id = Helpers::validateUrl($bodyDecoded['id']);
+        $keyDomain = parse_url($keyId, PHP_URL_HOST);
+        $idDomain = parse_url($id, PHP_URL_HOST);
+        if(isset($bodyDecoded['object']) 
+            && is_array($bodyDecoded['object'])
+            && isset($bodyDecoded['object']['attributedTo'])
+        ) {
+            if(parse_url($bodyDecoded['object']['attributedTo'], PHP_URL_HOST) !== $keyDomain) {
+                abort(400, 'Invalid request');
+            }
+        }
+        if(!$keyDomain || !$idDomain || $keyDomain !== $idDomain) {
+            abort(400, 'Invalid request');
+        }
+        $actor = Profile::whereKeyId($keyId)->first();
+        if(!$actor) {
+            $actor = Helpers::profileFirstOrNew($bodyDecoded['actor']);
+        }
+        if(!$actor) {
+            return false;
+        }
+        $pkey = openssl_pkey_get_public($actor->public_key);
+        $inboxPath = "/users/{$profile->username}/inbox";
+        list($verified, $headers) = HTTPSignature::verify($pkey, $signatureData, $request->headers->all(), $inboxPath, $body);
+        if($verified == 1) { 
+            return true;
+        } else {
+            return false;
+        }
     }
 
-    // Deprecated
-
     protected function blindKeyRotation(Request $request, Profile $profile)
     {
-        return false;
+        $signature = $request->header('signature');
+        $date = $request->header('date');
+        if(!$signature) {
+            abort(400, 'Missing signature header');
+        }
+        if(!$date) {
+            abort(400, 'Missing date header');
+        }
+        if(!now()->parse($date)->gt(now()->subDays(1)) || !now()->parse($date)->lt(now()->addDays(1))) {
+            abort(400, 'Invalid date');
+        }
+        $signatureData = HttpSignature::parseSignatureHeader($signature);
+        $keyId = Helpers::validateUrl($signatureData['keyId']);
+        $actor = Profile::whereKeyId($keyId)->whereNotNull('remote_url')->firstOrFail();
+        $res = Zttp::timeout(5)->withHeaders([
+          'Accept'     => 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"',
+          'User-Agent' => 'PixelfedBot v0.1 - https://pixelfed.org',
+        ])->get($actor->remote_url);
+        $res = json_decode($res->body(), true, 8);
+        if($res['publicKey']['id'] !== $actor->key_id) {
+            return false;
+        }
+        $actor->public_key = $res['publicKey']['publicKeyPem'];
+        $actor->save();
+        return $this->verifySignature($request, $profile);
     }
 
     public function userFollowing(Request $request, $username)