validate the security context

2017-09-03 23:50:18 -07:00
parent 3d0a7f4fc5
commit fc62f07a08
3 changed files with 11 additions and 3 deletions
--- a/include/zot.php
+++ b/include/zot.php
@@ -4621,6 +4621,7 @@ function zot_reply_auth_check($data,$encrypted_packet) {
 	// First verify their signature. We will have obtained a zot-info packet from them as part of the sender
 	// verification.

+	// needs a nonce!!!!
 	if ((! $y) || (! rsa_verify($data['secret'], base64url_decode($data['secret_sig']),$y[0]['xchan_pubkey']))) {
 		logger('mod_zot: auth_check: sender not found or secret_sig invalid.');
 		$ret['message'] .= 'sender not found or sig invalid ' . print_r($y,true) . EOL;