Friendica/friendica-github
1
0
Fork 0
mirror of https://github.com/friendica/friendica synced 2025-01-30 23:39:47 +00:00
Code Issues Projects Releases Packages Wiki Activity

Issue 14692: Prevent loops with remote servers

Browse source
This commit is contained in:
Michael 2025-01-15 07:51:30 +00:00
parent bb252e326f
commit 1eaab5e410
1 changed files with 10 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
src/Util/HTTPSignature.php
View file

@ -604,13 +604,14 @@ class HTTPSignature
/** /**
* Gets a signer from a given HTTP request * Gets a signer from a given HTTP request
* *
* @param string $content * @param string $content
* @param array $http_headers * @param array $http_headers
* @param ?boolean $update true = always update, false = never update, null = update when not found or outdated
* *
* @return string|null|false Signer * @return string|null|false Signer
* @throws \Friendica\Network\HTTPException\InternalServerErrorException * @throws \Friendica\Network\HTTPException\InternalServerErrorException
*/ */
public static function getSigner(string $content, array $http_headers) public static function getSigner(string $content, array $http_headers, bool $update = null)
{ {
if (empty($http_headers['HTTP_SIGNATURE'])) { if (empty($http_headers['HTTP_SIGNATURE'])) {
DI::logger()->debug('No HTTP_SIGNATURE header'); DI::logger()->debug('No HTTP_SIGNATURE header');
@ -700,7 +701,7 @@ class HTTPSignature
return false; return false;
} }
$key = self::fetchKey($sig_block['keyId'], $actor); $key = self::fetchKey($sig_block['keyId'], $actor, $update);
if (empty($key)) { if (empty($key)) {
DI::logger()->info('Empty key'); DI::logger()->info('Empty key');
return false; return false;
@ -802,17 +803,18 @@ class HTTPSignature
/** /**
* fetches a key for a given id and actor * fetches a key for a given id and actor
* *
* @param string $id * @param string $id
* @param string $actor * @param string $actor
* @param ?boolean $update true = always update, false = never update, null = update when not found or outdated
* *
* @return array with actor url and public key * @return array with actor url and public key
* @throws \Exception * @throws \Exception
*/ */
private static function fetchKey(string $id, string $actor): array private static function fetchKey(string $id, string $actor, bool $update = null): array
{ {
$url = (strpos($id, '#') ? substr($id, 0, strpos($id, '#')) : $id); $url = (strpos($id, '#') ? substr($id, 0, strpos($id, '#')) : $id);
$profile = APContact::getByURL($url); $profile = APContact::getByURL($url, $update);
if (!empty($profile)) { if (!empty($profile)) {
DI::logger()->info('Taking key from id', ['id' => $id]); DI::logger()->info('Taking key from id', ['id' => $id]);
return ['url' => $url, 'pubkey' => $profile['pubkey'], 'type' => $profile['type']]; return ['url' => $url, 'pubkey' => $profile['pubkey'], 'type' => $profile['type']];