harukin/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

some changes after testing server-to-server magic auth

Browse Source
This commit is contained in:
zotlabs 2017-08-31 21:38:03 -07:00
parent b413beeb36
commit ae8cdc3b42
4 changed files with 36 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
Zotlabs/Module/Cdav.php
View File

@ -32,6 +32,11 @@ class Cdav extends \Zotlabs\Web\Controller {
/* Signature authentication */ /* Signature authentication */
if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,9) === 'Signature') { if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,9) === 'Signature') {
if($head !== 'HTTP_AUTHORIZATION') {
$_SERVER['HTTP_AUTHORIZATION'] = $_SERVER[$head];
continue;
}
$sigblock = \Zotlabs\Web\HTTPSig::parse_sigheader($_SERVER[$head]); $sigblock = \Zotlabs\Web\HTTPSig::parse_sigheader($_SERVER[$head]);
if($sigblock) { if($sigblock) {
$keyId = $sigblock['keyId']; $keyId = $sigblock['keyId'];
@ -43,20 +48,17 @@ class Cdav extends \Zotlabs\Web\Controller {
$c = channelx_by_hash($r[0]['hubloc_hash']); $c = channelx_by_hash($r[0]['hubloc_hash']);
if($c) { if($c) {
$a = q("select * from account where account_id = %d limit 1", $a = q("select * from account where account_id = %d limit 1",
intval($c[0]['channel_account_id']) intval($c['channel_account_id'])
); );
if($a) { if($a) {
$record = [ 'channel' => $c[0], 'account' => $a[0] ]; $record = [ 'channel' => $c, 'account' => $a[0] ];
$channel_login = $c[0]['channel_id']; $channel_login = $c['channel_id'];
} }
} }
} }
if(! $record) if(! $record)
continue; continue;
if($head !== 'HTTP_AUTHORIZATION') {
$_SERVER['HTTP_AUTHORIZATION'] = $_SERVER[$head];
}
if($record) { if($record) {
$verified = \Zotlabs\Web\HTTPSig::verify('',$record['channel']['channel_pubkey']); $verified = \Zotlabs\Web\HTTPSig::verify('',$record['channel']['channel_pubkey']);
if(! ($verified && $verified['header_signed'] && $verified['header_valid'])) { if(! ($verified && $verified['header_signed'] && $verified['header_valid'])) {

15
Zotlabs/Module/Dav.php
View File

@ -41,6 +41,11 @@ class Dav extends \Zotlabs\Web\Controller {
/* Signature authentication */ /* Signature authentication */
if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,9) === 'Signature') { if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,9) === 'Signature') {
if($head !== 'HTTP_AUTHORIZATION') {
$_SERVER['HTTP_AUTHORIZATION'] = $_SERVER[$head];
continue;
}
$sigblock = \Zotlabs\Web\HTTPSig::parse_sigheader($_SERVER[$head]); $sigblock = \Zotlabs\Web\HTTPSig::parse_sigheader($_SERVER[$head]);
if($sigblock) { if($sigblock) {
$keyId = $sigblock['keyId']; $keyId = $sigblock['keyId'];
@ -52,19 +57,17 @@ class Dav extends \Zotlabs\Web\Controller {
$c = channelx_by_hash($r[0]['hubloc_hash']); $c = channelx_by_hash($r[0]['hubloc_hash']);
if($c) { if($c) {
$a = q("select * from account where account_id = %d limit 1", $a = q("select * from account where account_id = %d limit 1",
intval($c[0]['channel_account_id']) intval($c['channel_account_id'])
); );
if($a) { if($a) {
$record = [ 'channel' => $c[0], 'account' => $a[0] ]; $record = [ 'channel' => $c, 'account' => $a[0] ];
$channel_login = $c[0]['channel_id']; $channel_login = $c['channel_id'];
} }
} }
} }
if(! $record) if(! $record)
continue; continue;
if($head !== 'HTTP_AUTHORIZATION') {
$_SERVER['HTTP_AUTHORIZATION'] = $_SERVER[$head];
}
if($record) { if($record) {
$verified = \Zotlabs\Web\HTTPSig::verify('',$record['channel']['channel_pubkey']); $verified = \Zotlabs\Web\HTTPSig::verify('',$record['channel']['channel_pubkey']);
if(! ($verified && $verified['header_signed'] && $verified['header_valid'])) { if(! ($verified && $verified['header_signed'] && $verified['header_valid'])) {

10
Zotlabs/Web/HTTPSig.php
View File

@ -145,7 +145,7 @@ class HTTPSig {
static function create_sig($request,$head,$prvkey,$keyid = 'Key',$send_headers = false,$alg = 'sha256') { static function create_sig($request,$head,$prvkey,$keyid = 'Key',$send_headers = false,$auth = false,$alg = 'sha256') {
$return_headers = []; $return_headers = [];
@ -155,8 +155,14 @@ class HTTPSig {
$x = self::sign($request,$head,$prvkey,$alg); $x = self::sign($request,$head,$prvkey,$alg);
$sighead = 'Signature: keyId="' . $keyid . '",algorithm="' . $algorithm if($auth) {
$sighead = 'Authorization: Signature keyId="' . $keyid . '",algorithm="' . $algorithm
. '",headers="' . $x['headers'] . '",signature="' . $x['signature'] . '"'; . '",headers="' . $x['headers'] . '",signature="' . $x['signature'] . '"';
}
else {
$sighead = 'Signature: keyId="' . $keyid . '",algorithm="' . $algorithm
. '",headers="' . $x['headers'] . '",signature="' . $x['signature'] . '"';
}
if($head) { if($head) {
foreach($head as $k => $v) { foreach($head as $k => $v) {

19
include/api_auth.php
View File

@ -8,6 +8,7 @@ function api_login(&$a){
$record = null; $record = null;
$remote_auth = false; $remote_auth = false;
$sigblock = null;
require_once('include/oauth.php'); require_once('include/oauth.php');
@ -51,6 +52,11 @@ function api_login(&$a){
/* Signature authentication */ /* Signature authentication */
if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,9) === 'Signature') { if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,9) === 'Signature') {
if($head !== 'HTTP_AUTHORIZATION') {
$_SERVER['HTTP_AUTHORIZATION'] = $_SERVER[$head];
continue;
}
$sigblock = \Zotlabs\Web\HTTPSig::parse_sigheader($_SERVER[$head]); $sigblock = \Zotlabs\Web\HTTPSig::parse_sigheader($_SERVER[$head]);
if($sigblock) { if($sigblock) {
$keyId = $sigblock['keyId']; $keyId = $sigblock['keyId'];
@ -62,11 +68,11 @@ function api_login(&$a){
$c = channelx_by_hash($r[0]['hubloc_hash']); $c = channelx_by_hash($r[0]['hubloc_hash']);
if($c) { if($c) {
$a = q("select * from account where account_id = %d limit 1", $a = q("select * from account where account_id = %d limit 1",
intval($c[0]['channel_account_id']) intval($c['channel_account_id'])
); );
if($a) { if($a) {
$record = [ 'channel' => $c[0], 'account' => $a[0] ]; $record = [ 'channel' => $c, 'account' => $a[0] ];
$channel_login = $c[0]['channel_id']; $channel_login = $c['channel_id'];
} }
else { else {
continue; continue;
@ -80,9 +86,6 @@ function api_login(&$a){
continue; continue;
} }
if($head !== 'HTTP_AUTHORIZATION') {
$_SERVER['HTTP_AUTHORIZATION'] = $_SERVER[$head];
}
if($record) { if($record) {
$verified = \Zotlabs\Web\HTTPSig::verify('',$record['channel']['channel_pubkey']); $verified = \Zotlabs\Web\HTTPSig::verify('',$record['channel']['channel_pubkey']);
if(! ($verified && $verified['header_signed'] && $verified['header_valid'])) { if(! ($verified && $verified['header_signed'] && $verified['header_valid'])) {
@ -127,8 +130,8 @@ function api_login(&$a){
} }
function retry_basic_auth() { function retry_basic_auth($method = 'Basic') {
header('WWW-Authenticate: Basic realm="Hubzilla"'); header('WWW-Authenticate: ' . $method . ' realm="Hubzilla"');
header('HTTP/1.0 401 Unauthorized'); header('HTTP/1.0 401 Unauthorized');
echo('This api requires login'); echo('This api requires login');
killme(); killme();