harukin/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

perform input validation on xchan_store and re-enable the post method of the xchan api endpoint.

Browse Source
This commit is contained in:
zotlabs 2016-12-26 13:10:24 -08:00
parent 56219f9f61
commit b530d1d449
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/api_zot.php
View File

@ -335,7 +335,7 @@
require_once('include/hubloc.php'); require_once('include/hubloc.php');
if($_SERVER['REQUEST_METHOD'] === 'POST') { if($_SERVER['REQUEST_METHOD'] === 'POST') {
// $r = xchan_store($_REQUEST); $r = xchan_store($_REQUEST);
} }
$r = xchan_fetch($_REQUEST); $r = xchan_fetch($_REQUEST);
json_return_and_die($r); json_return_and_die($r);

8
include/hubloc.php
View File

@ -200,6 +200,14 @@ function xchan_store($arr) {
if(! $arr['photo']) if(! $arr['photo'])
$arr['photo'] = z_root() . '/' . get_default_profile_photo(); $arr['photo'] = z_root() . '/' . get_default_profile_photo();
if($arr['network'] === 'zot') {
if((! $arr['key']) || (! rsa_verify($arr['guid'],base64url_decode($arr['guid_sig']),$arr['key']))) {
logger('Unable to verify signature for ' . $arr['hash']);
return false;
}
}
$r = q("insert into xchan ( xchan_hash, xchan_guid, xchan_guid_sig, xchan_pubkey, xchan_addr, xchan_url, xchan_connurl, xchan_follow, xchan_connpage, xchan_name, xchan_network, xchan_instance_url, xchan_hidden, xchan_orphan, xchan_censored, xchan_selfcensored, xchan_system, xchan_pubforum, xchan_deleted, xchan_name_date ) values ('%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s','%s','%s','%s',%d, %d, %d, %d, %d, %d, %d, '%s') ", $r = q("insert into xchan ( xchan_hash, xchan_guid, xchan_guid_sig, xchan_pubkey, xchan_addr, xchan_url, xchan_connurl, xchan_follow, xchan_connpage, xchan_name, xchan_network, xchan_instance_url, xchan_hidden, xchan_orphan, xchan_censored, xchan_selfcensored, xchan_system, xchan_pubforum, xchan_deleted, xchan_name_date ) values ('%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s','%s','%s','%s',%d, %d, %d, %d, %d, %d, %d, '%s') ",
dbesc($arr['hash']), dbesc($arr['hash']),
dbesc($arr['guid']), dbesc($arr['guid']),