kopia lustrzana https://github.com/friendica/friendica
Diaspora: The signature of likes are checked now correctly.
enter the commit message for your changes. Lines startingpull/1446/head
rodzic
e016db8bc6
commit
b40f19262a
|
@ -1952,7 +1952,12 @@ function diaspora_like($importer,$xml,$msg) {
|
|||
who sent the salmon
|
||||
*/
|
||||
|
||||
$signed_data = $guid . ';' . $target_type . ';' . $parent_guid . ';' . $positive . ';' . $diaspora_handle;
|
||||
// Diaspora has changed the way they are signing the likes.
|
||||
// Just to make sure that we don't miss any likes we will check the old and the current way.
|
||||
$old_signed_data = $guid . ';' . $target_type . ';' . $parent_guid . ';' . $positive . ';' . $diaspora_handle;
|
||||
|
||||
$signed_data = $positive . ';' . $guid . ';' . $target_type . ';' . $parent_guid . ';' . $diaspora_handle;
|
||||
|
||||
$key = $msg['key'];
|
||||
|
||||
if ($parent_author_signature) {
|
||||
|
@ -1962,16 +1967,13 @@ function diaspora_like($importer,$xml,$msg) {
|
|||
|
||||
$parent_author_signature = base64_decode($parent_author_signature);
|
||||
|
||||
if(! rsa_verify($signed_data,$parent_author_signature,$key,'sha256')) {
|
||||
if (intval(get_config('system','ignore_diaspora_like_signature')))
|
||||
logger('diaspora_like: top-level owner verification failed. Proceeding anyway.');
|
||||
else {
|
||||
if (!rsa_verify($signed_data,$parent_author_signature,$key,'sha256') AND
|
||||
!rsa_verify($old_signed_data,$parent_author_signature,$key,'sha256')) {
|
||||
|
||||
logger('diaspora_like: top-level owner verification failed.');
|
||||
return;
|
||||
}
|
||||
}
|
||||
}
|
||||
else {
|
||||
} else {
|
||||
// If there's no parent_author_signature, then we've received the like
|
||||
// from the like creator. In that case, the person is "like"ing
|
||||
// our post, so he/she must be a contact of ours and his/her public key
|
||||
|
@ -1979,15 +1981,13 @@ function diaspora_like($importer,$xml,$msg) {
|
|||
|
||||
$author_signature = base64_decode($author_signature);
|
||||
|
||||
if(! rsa_verify($signed_data,$author_signature,$key,'sha256')) {
|
||||
if (intval(get_config('system','ignore_diaspora_like_signature')))
|
||||
logger('diaspora_like: like creator verification failed. Proceeding anyway');
|
||||
else {
|
||||
if (!rsa_verify($signed_data,$author_signature,$key,'sha256') AND
|
||||
!rsa_verify($old_signed_data,$author_signature,$key,'sha256')) {
|
||||
|
||||
logger('diaspora_like: like creator verification failed.');
|
||||
return;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Phew! Everything checks out. Now create an item.
|
||||
|
||||
|
|
Ładowanie…
Reference in New Issue