mirror/pixelfed
1
0
Fork 1
mirror of https://github.com/pixelfed/pixelfed.git synced 2024-12-26 01:36:43 +00:00
Code Issues Releases Wiki Activity

Update FederationController

Browse source
This commit is contained in:
Daniel Supernault 2019-06-09 19:23:13 -06:00
parent 0e7f2bd0be
commit e89c7d8056
No known key found for this signature in database
GPG key ID: 0DEF1C662C9033F7
1 changed files with 13 additions and 69 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

78
app/Http/Controllers/FederationController.php
View file

@ -215,82 +215,20 @@ class FederationController extends Controller
return; return;
} }
// Deprecated
protected function verifySignature(Request $request, Profile $profile) protected function verifySignature(Request $request, Profile $profile)
{ {
$body = $request->getContent();
$bodyDecoded = json_decode($body, true, 8);
$signature = $request->header('signature');
$date = $request->header('date');
if(!$signature) {
abort(400, 'Missing signature header');
}
if(!$date) {
abort(400, 'Missing date header');
}
if(!now()->parse($date)->gt(now()->subDays(1)) || !now()->parse($date)->lt(now()->addDays(1))) {
abort(400, 'Invalid date');
}
$signatureData = HttpSignature::parseSignatureHeader($signature);
$keyId = Helpers::validateUrl($signatureData['keyId']);
$id = Helpers::validateUrl($bodyDecoded['id']);
$keyDomain = parse_url($keyId, PHP_URL_HOST);
$idDomain = parse_url($id, PHP_URL_HOST);
if(isset($bodyDecoded['object'])
&& is_array($bodyDecoded['object'])
&& isset($bodyDecoded['object']['attributedTo'])
) {
if(parse_url($bodyDecoded['object']['attributedTo'], PHP_URL_HOST) !== $keyDomain) {
abort(400, 'Invalid request');
}
}
if(!$keyDomain || !$idDomain || $keyDomain !== $idDomain) {
abort(400, 'Invalid request');
}
$actor = Profile::whereKeyId($keyId)->first();
if(!$actor) {
$actor = Helpers::profileFirstOrNew($bodyDecoded['actor']);
}
if(!$actor) {
return false; return false;
} }
$pkey = openssl_pkey_get_public($actor->public_key);
$inboxPath = "/users/{$profile->username}/inbox"; // Deprecated
list($verified, $headers) = HTTPSignature::verify($pkey, $signatureData, $request->headers->all(), $inboxPath, $body);
if($verified == 1) {
return true;
} else {
return false;
}
}
protected function blindKeyRotation(Request $request, Profile $profile) protected function blindKeyRotation(Request $request, Profile $profile)
{ {
$signature = $request->header('signature');
$date = $request->header('date');
if(!$signature) {
abort(400, 'Missing signature header');
}
if(!$date) {
abort(400, 'Missing date header');
}
if(!now()->parse($date)->gt(now()->subDays(1)) || !now()->parse($date)->lt(now()->addDays(1))) {
abort(400, 'Invalid date');
}
$signatureData = HttpSignature::parseSignatureHeader($signature);
$keyId = Helpers::validateUrl($signatureData['keyId']);
$actor = Profile::whereKeyId($keyId)->whereNotNull('remote_url')->firstOrFail();
$res = Zttp::timeout(5)->withHeaders([
'Accept' => 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"',
'User-Agent' => 'PixelfedBot v0.1 - https://pixelfed.org',
])->get($actor->remote_url);
$res = json_decode($res->body(), true, 8);
if($res['publicKey']['id'] !== $actor->key_id) {
return false; return false;
} }
$actor->public_key = $res['publicKey']['publicKeyPem'];
$actor->save();
return $this->verifySignature($request, $profile);
}
public function userFollowing(Request $request, $username) public function userFollowing(Request $request, $username)
{ {
@ -300,6 +238,9 @@ class FederationController extends Controller
->whereUsername($username) ->whereUsername($username)
->whereIsPrivate(false) ->whereIsPrivate(false)
->firstOrFail(); ->firstOrFail();
return [];
if($profile->status != null) { if($profile->status != null) {
return []; return [];
} }
@ -323,6 +264,9 @@ class FederationController extends Controller
->whereUsername($username) ->whereUsername($username)
->whereIsPrivate(false) ->whereIsPrivate(false)
->firstOrFail(); ->firstOrFail();
return [];
if($profile->status != null) { if($profile->status != null) {
return []; return [];
} }