2013-04-19 00:55:35 +00:00
< ? php /** @file */
2011-09-26 09:25:43 +00:00
/**
* Zot endpoint
*/
2012-08-09 01:50:04 +00:00
require_once ( 'include/zot.php' );
2013-01-22 03:16:21 +00:00
function post_init ( & $a ) {
2013-03-27 02:37:33 +00:00
// Most access to this endpoint is via the post method.
2013-01-22 03:16:21 +00:00
// Here we will pick out the magic auth params which arrive
2013-03-27 02:37:33 +00:00
// as a get request, and the only communications to arrive this way.
2013-01-22 03:16:21 +00:00
if ( argc () > 1 ) {
$webbie = argv ( 1 );
if ( array_key_exists ( 'auth' , $_REQUEST )) {
2013-03-26 23:20:44 +00:00
logger ( 'mod_zot: auth request received.' );
2013-01-22 03:16:21 +00:00
$address = $_REQUEST [ 'auth' ];
$dest = $_REQUEST [ 'dest' ];
$sec = $_REQUEST [ 'sec' ];
$version = $_REQUEST [ 'version' ];
switch ( $dest ) {
case 'channel' :
$desturl = z_root () . '/channel/' . $webbie ;
break ;
case 'photos' :
$desturl = z_root () . '/photos/' . $webbie ;
break ;
case 'profile' :
$desturl = z_root () . '/profile/' . $webbie ;
break ;
default :
$desturl = $dest ;
break ;
}
$c = q ( " select * from channel where channel_address = '%s' limit 1 " ,
dbesc ( $webbie )
);
if ( ! $c ) {
logger ( 'mod_zot: auth: unable to find channel ' . $webbie );
2013-01-24 00:06:01 +00:00
// They'll get a notice when they hit the page, we don't need two of them.
2013-01-22 03:16:21 +00:00
goaway ( $desturl );
}
// Try and find a hubloc for the person attempting to auth
2013-05-30 03:55:49 +00:00
$x = q ( " select * from hubloc left join xchan on xchan_hash = hubloc_hash where hubloc_addr = '%s' order by hubloc_id desc limit 1 " ,
2013-01-22 03:16:21 +00:00
dbesc ( $address )
);
if ( ! $x ) {
// finger them if they can't be found.
$ret = zot_finger ( $addr , null );
if ( $ret [ 'success' ]) {
$j = json_decode ( $ret [ 'body' ], true );
if ( $j )
import_xchan ( $j );
2013-05-30 03:55:49 +00:00
$x = q ( " select * from hubloc left join xchan on xchan_hash = hubloc_hash where hubloc_addr = '%s' order by hubloc_id desc limit 1 " ,
2013-01-22 03:16:21 +00:00
dbesc ( $address )
);
}
}
2013-01-25 03:45:08 +00:00
if ( ! $x ) {
logger ( 'mod_zot: auth: unable to finger ' . $addr );
2013-01-22 03:16:21 +00:00
goaway ( $desturl );
2013-01-25 03:45:08 +00:00
}
logger ( 'mod_zot: auth request received from ' . $x [ 0 ][ 'xchan_addr' ] . ' for ' . $webbie );
2013-01-22 03:16:21 +00:00
// check credentials and access
2013-01-24 00:06:01 +00:00
// If they are already authenticated and haven't changed credentials,
// we can save an expensive network round trip and improve performance.
2013-01-22 03:16:21 +00:00
2013-01-24 00:06:01 +00:00
$remote = remote_user ();
$result = null ;
2013-01-22 03:16:21 +00:00
2013-01-24 00:06:01 +00:00
$already_authed = ((( $remote ) && ( $x [ 0 ][ 'hubloc_hash' ] == $remote )) ? true : false );
if ( ! $already_authed ) {
// Auth packets MUST use ultra top-secret hush-hush mode
$p = zot_build_packet ( $c [ 0 ], $type = 'auth_check' ,
array ( array ( 'guid' => $x [ 0 ][ 'hubloc_guid' ], 'guid_sig' => $x [ 0 ][ 'hubloc_guid_sig' ])),
$x [ 0 ][ 'hubloc_sitekey' ], $sec );
$result = zot_zot ( $x [ 0 ][ 'hubloc_callback' ], $p );
2013-01-25 03:45:08 +00:00
if ( ! $result [ 'success' ]) {
logger ( 'mod_zot: auth_check callback failed.' );
2013-01-24 00:06:01 +00:00
goaway ( $desturl );
2013-01-25 03:45:08 +00:00
}
2013-01-22 03:16:21 +00:00
$j = json_decode ( $result [ 'body' ], true );
}
2013-03-26 23:20:44 +00:00
if ( $already_authed || $j [ 'success' ]) {
2013-04-15 03:41:58 +00:00
if ( $j [ 'success' ]) {
// legit response, but we do need to check that this wasn't answered by a man-in-middle
if ( ! rsa_verify ( $sec . $x [ 0 ][ 'xchan_hash' ], base64url_decode ( $j [ 'confirm' ]), $x [ 0 ][ 'xchan_pubkey' ])) {
logger ( 'mod_zot: auth: final confirmation failed.' );
goaway ( $desturl );
}
}
2013-01-24 00:06:01 +00:00
// everything is good... maybe
if ( local_user ()) {
2013-03-26 23:20:44 +00:00
// tell them to logout if they're logged in locally as anything but the target remote account
// in which case just shut up because they don't need to be doing this at all.
if ( $a -> channel [ 'channel_hash' ] != $x [ 0 ][ 'xchan_hash' ]) {
logger ( 'mod_zot: auth: already authenticated locally as somebody else.' );
notice ( t ( 'Remote authentication blocked. You are logged into this site locally. Please logout and retry.' ) . EOL );
}
2013-01-24 00:06:01 +00:00
goaway ( $desturl );
}
// log them in
$_SESSION [ 'authenticated' ] = 1 ;
$_SESSION [ 'visitor_id' ] = $x [ 0 ][ 'xchan_hash' ];
2013-05-15 09:20:46 +00:00
$_SESSION [ 'my_address' ] = $address ;
2013-05-15 09:41:35 +00:00
$arr = array ( 'xchan' => $x [ 0 ], 'url' => $desturl , 'channel_address' => $webbie );
2013-05-15 09:20:46 +00:00
call_hooks ( 'magic_auth_success' , $arr );
2013-01-24 00:06:01 +00:00
$a -> set_observer ( $x [ 0 ]);
require_once ( 'include/security.php' );
$a -> set_groups ( init_groups_visitor ( $_SESSION [ 'visitor_id' ]));
info ( sprintf ( t ( 'Welcome %s. Remote authentication successful.' ), $x [ 0 ][ 'xchan_name' ]));
2013-01-25 03:45:08 +00:00
logger ( 'mod_zot: auth success from ' . $x [ 0 ][ 'xchan_addr' ] . ' for ' . $webbie );
2013-09-11 11:59:45 +00:00
} else {
logger ( 'mod_zot: still not authenticated: ' . $x [ 0 ][ 'xchan_addr' ]);
2013-09-11 13:24:26 +00:00
q ( " update hubloc set hubloc_status = (hubloc_status | %d ) where hubloc_addr = '%s' " ,
2013-09-11 11:59:45 +00:00
intval ( HUBLOC_RECEIVE_ERROR ),
$x [ 0 ][ xchan_addr ]
);
2013-01-24 00:06:01 +00:00
}
2013-02-13 10:33:13 +00:00
// FIXME - we really want to save the return_url in the session before we visit rmagic.
// This does however prevent a recursion if you visit rmagic directly, as it would otherwise send you back here again.
// But z_root() probably isn't where you really want to go.
2013-02-13 08:14:01 +00:00
if ( strstr ( $desturl , z_root () . '/rmagic' ))
goaway ( z_root ());
2013-02-13 10:33:13 +00:00
2013-01-22 03:16:21 +00:00
goaway ( $desturl );
}
logger ( 'mod_zot: invalid args: ' . print_r ( $a -> argv , true ));
killme ();
}
return ;
}
2011-09-26 09:25:43 +00:00
function post_post ( & $a ) {
2012-11-13 04:59:18 +00:00
logger ( 'mod_zot: ' . print_r ( $_REQUEST , true ), LOGGER_DEBUG );
2013-03-26 04:32:12 +00:00
$ret = array ( 'success' => false );
2011-09-26 09:25:43 +00:00
2012-11-20 04:45:12 +00:00
$data = json_decode ( $_REQUEST [ 'data' ], true );
2011-09-26 09:25:43 +00:00
2012-11-20 04:45:12 +00:00
logger ( 'mod_zot: data: ' . print_r ( $data , true ), LOGGER_DATA );
2013-03-27 02:37:33 +00:00
/**
* Many message packets will arrive encrypted . The existence of an 'iv' element
* tells us we need to unencapsulate the AES - 256 - CBC content using the site private key
*/
2012-11-20 04:45:12 +00:00
if ( array_key_exists ( 'iv' , $data )) {
$data = aes_unencapsulate ( $data , get_config ( 'system' , 'prvkey' ));
2013-01-25 03:45:08 +00:00
logger ( 'mod_zot: decrypt1: ' . $data , LOGGER_DATA );
2013-09-24 12:20:29 +00:00
2013-09-24 19:04:01 +00:00
// susceptible to Bleichenbacher's attack
2013-09-24 12:20:29 +00:00
// if(! $data) {
// $ret['message'] = 'Decryption failed.';
// json_return_and_die($ret);
// }
2013-09-12 23:52:58 +00:00
2012-11-20 04:45:12 +00:00
$data = json_decode ( $data , true );
2013-09-12 23:52:58 +00:00
}
if ( ! $data ) {
2013-09-24 12:20:29 +00:00
2013-09-24 19:04:01 +00:00
// possible Bleichenbacher's attack, just treat it as a
2013-09-24 12:20:29 +00:00
// message we have no handler for. It should fail a bit
// further along with "no hub". Our public key is public
// knowledge. There's no reason why anybody should get the
// encryption wrong unless they're fishing or hacking. If
// they're developing and made a goof, this can be discovered
// in the logs of the destination site. If they're fishing or
// hacking, the bottom line is we can't verify their hub.
// That's all we're going to tell them.
$data = array ( 'type' => 'bogus' );
2012-11-20 04:45:12 +00:00
}
2012-11-20 00:51:15 +00:00
2012-11-20 04:45:12 +00:00
logger ( 'mod_zot: decoded data: ' . print_r ( $data , true ), LOGGER_DATA );
2012-11-20 00:51:15 +00:00
2012-11-13 00:16:37 +00:00
$msgtype = (( array_key_exists ( 'type' , $data )) ? $data [ 'type' ] : '' );
2013-08-30 00:48:31 +00:00
if ( $msgtype === 'ping' ) {
// Useful to get a health check on a remote site.
// This will let us know if any important communication details
// that we may have stored are no longer valid, regardless of xchan details.
$ret [ 'success' ] = true ;
$ret [ 'site' ] = array ();
$ret [ 'site' ][ 'url' ] = z_root ();
$ret [ 'site' ][ 'url_sig' ] = base64url_encode ( rsa_sign ( z_root (), get_config ( 'system' , 'prvkey' )));
$ret [ 'site' ][ 'sitekey' ] = get_config ( 'system' , 'pubkey' );
json_return_and_die ( $ret );
}
2012-11-20 04:45:12 +00:00
if ( $msgtype === 'pickup' ) {
2013-03-26 04:32:12 +00:00
/**
* The 'pickup' message arrives with a tracking ID which is associated with a particular outq_hash
* First verify that that the returned signatures verify , then check that we have an outbound queue item
* with the correct hash .
* If everything verifies , find any / all outbound messages in the queue for this hubloc and send them back
*
*/
2012-11-20 04:45:12 +00:00
if (( ! $data [ 'secret' ]) || ( ! $data [ 'secret_sig' ])) {
$ret [ 'message' ] = 'no verification signature' ;
2013-01-25 03:45:08 +00:00
logger ( 'mod_zot: pickup: ' . $ret [ 'message' ], LOGGER_DEBUG );
2012-11-20 04:45:12 +00:00
json_return_and_die ( $ret );
}
2013-05-17 04:06:01 +00:00
$r = q ( " select distinct hubloc_sitekey from hubloc where hubloc_url = '%s' and hubloc_callback = '%s' and hubloc_sitekey != '' group by hubloc_sitekey " ,
2012-11-20 04:45:12 +00:00
dbesc ( $data [ 'url' ]),
dbesc ( $data [ 'callback' ])
);
if ( ! $r ) {
$ret [ 'message' ] = 'site not found' ;
logger ( 'mod_zot: pickup: ' . $ret [ 'message' ]);
json_return_and_die ( $ret );
}
2013-05-17 03:21:12 +00:00
foreach ( $r as $hubsite ) {
// verify the url_sig
// If the server was re-installed at some point, there could be multiple hubs with the same url and callback.
// Only one will have a valid key.
$forgery = true ;
$secret_fail = true ;
$sitekey = $hubsite [ 'hubloc_sitekey' ];
2013-05-17 03:27:50 +00:00
logger ( 'mod_zot: Checking sitekey: ' . $sitekey );
2013-05-17 03:21:12 +00:00
if ( rsa_verify ( $data [ 'callback' ], base64url_decode ( $data [ 'callback_sig' ]), $sitekey )) {
$forgery = false ;
}
if ( rsa_verify ( $data [ 'secret' ], base64url_decode ( $data [ 'secret_sig' ]), $sitekey )) {
$secret_fail = false ;
}
if (( ! $forgery ) && ( ! $secret_fail ))
break ;
}
if ( $forgery ) {
2012-11-20 04:45:12 +00:00
$ret [ 'message' ] = 'possible site forgery' ;
logger ( 'mod_zot: pickup: ' . $ret [ 'message' ]);
json_return_and_die ( $ret );
}
2013-05-17 03:21:12 +00:00
if ( $secret_fail ) {
2012-11-20 04:45:12 +00:00
$ret [ 'message' ] = 'secret validation failed' ;
logger ( 'mod_zot: pickup: ' . $ret [ 'message' ]);
json_return_and_die ( $ret );
}
2013-03-26 04:32:12 +00:00
/**
* If we made it to here , the signatures verify , but we still don ' t know if the tracking ID is valid .
* It wouldn 't be an error if the tracking ID isn' t found , because we may have sent this particular
* queue item with another pickup ( after the tracking ID for the other pickup was verified ) .
*/
2012-11-20 04:45:12 +00:00
$r = q ( " select outq_posturl from outq where outq_hash = '%s' and outq_posturl = '%s' limit 1 " ,
dbesc ( $data [ 'secret' ]),
dbesc ( $data [ 'callback' ])
);
if ( ! $r ) {
$ret [ 'message' ] = 'nothing to pick up' ;
logger ( 'mod_zot: pickup: ' . $ret [ 'message' ]);
json_return_and_die ( $ret );
}
2013-03-26 04:32:12 +00:00
/**
* Everything is good if we made it here , so find all messages that are going to this location
* and send them all .
*/
2012-11-20 04:45:12 +00:00
$r = q ( " select * from outq where outq_posturl = '%s' " ,
dbesc ( $data [ 'callback' ])
);
if ( $r ) {
$ret [ 'success' ] = true ;
$ret [ 'pickup' ] = array ();
foreach ( $r as $rr ) {
2012-11-27 05:20:16 +00:00
$ret [ 'pickup' ][] = array ( 'notify' => json_decode ( $rr [ 'outq_notify' ], true ), 'message' => json_decode ( $rr [ 'outq_msg' ], true ));
2012-11-20 04:45:12 +00:00
$x = q ( " delete from outq where outq_hash = '%s' limit 1 " ,
dbesc ( $rr [ 'outq_hash' ])
);
}
}
$encrypted = aes_encapsulate ( json_encode ( $ret ), $sitekey );
json_return_and_die ( $encrypted );
2013-03-26 04:32:12 +00:00
/** pickup: end */
2012-11-20 04:45:12 +00:00
}
2013-03-26 04:32:12 +00:00
/**
* All other message types require us to verify the sender . This is a generic check , so we
* will do it once here and bail if anything goes wrong .
*/
2012-11-13 00:16:37 +00:00
if ( array_key_exists ( 'sender' , $data )) {
2012-11-20 00:51:15 +00:00
$sender = $data [ 'sender' ];
2012-11-11 07:26:12 +00:00
}
2013-03-26 04:32:12 +00:00
/** Check if the sender is already verified here */
2012-11-20 00:51:15 +00:00
$hub = zot_gethub ( $sender );
2013-03-26 04:32:12 +00:00
2012-11-11 04:08:07 +00:00
if ( ! $hub ) {
2013-03-26 04:32:12 +00:00
/** Have never seen this guid or this guid coming from this location. Check it and register it. */
2012-11-13 00:16:37 +00:00
// (!!) this will validate the sender
2012-11-20 00:51:15 +00:00
$result = zot_register_hub ( $sender );
2013-03-26 04:32:12 +00:00
2013-08-25 01:55:07 +00:00
if (( ! $result [ 'success' ]) || ( ! ( $hub = zot_gethub ( $sender )))) {
2012-11-11 04:08:07 +00:00
$ret [ 'message' ] = 'Hub not available.' ;
2012-11-13 04:59:18 +00:00
logger ( 'mod_zot: no hub' );
2012-11-11 04:08:07 +00:00
json_return_and_die ( $ret );
2012-08-10 03:31:06 +00:00
}
2012-11-11 04:08:07 +00:00
}
2013-08-25 01:55:07 +00:00
// Update our DB to show when we last communicated successfully with this hub
// This will allow us to prune dead hubs from using up resources
$r = q ( " update hubloc set hubloc_connected = '%s' where hubloc_id = %d limit 1 " ,
dbesc ( datetime_convert ()),
intval ( $hub [ 'hubloc_id' ])
);
2012-11-13 00:16:37 +00:00
// TODO: check which hub is primary and take action if mismatched
2012-11-11 04:08:07 +00:00
2012-11-13 00:16:37 +00:00
if ( array_key_exists ( 'recipients' , $data ))
2012-11-20 00:51:15 +00:00
$recipients = $data [ 'recipients' ];
2012-11-11 04:08:07 +00:00
2013-02-18 23:15:55 +00:00
if ( $msgtype === 'purge' ) {
if ( $recipients ) {
// basically this means "unfriend"
foreach ( $recipients as $recip ) {
2013-08-05 02:09:53 +00:00
$r = q ( " select channel.*,xchan.* from channel
left join xchan on channel_hash = xchan_hash
where channel_guid = '%s' and channel_guid_sig = '%s' limit 1 " ,
dbesc ( $recip [ 'guid' ]),
dbesc ( $recip [ 'guid_sig' ])
);
if ( $r ) {
$r = q ( " select abook_id from abook where uid = %d and abook_xchan = '%s' limit 1 " ,
intval ( $r [ 0 ][ 'channel_id' ]),
dbesc ( base64url_encode ( hash ( 'whirlpool' , $sender [ 'guid' ] . $sender [ 'guid_sig' ], true )))
);
if ( $r ) {
contact_remove ( $r [ 0 ][ 'channel_id' ], $r [ 0 ][ 'abook_id' ]);
}
}
2013-02-18 23:15:55 +00:00
}
}
else {
2013-03-26 04:32:12 +00:00
// Unfriend everybody - basically this means the channel has committed suicide
2013-02-18 23:15:55 +00:00
$arr = $data [ 'sender' ];
$sender_hash = base64url_encode ( hash ( 'whirlpool' , $arr [ 'guid' ] . $arr [ 'guid_sig' ], true ));
require_once ( 'include/Contact.php' );
remove_all_xchan_resources ( $sender_hash );
2013-03-26 04:32:12 +00:00
$ret [ 'success' ] = true ;
2013-02-18 23:15:55 +00:00
json_return_and_die ( $ret );
}
}
2013-03-11 01:45:58 +00:00
2012-11-11 04:08:07 +00:00
if ( $msgtype === 'refresh' ) {
2012-11-13 00:16:37 +00:00
// remote channel info (such as permissions or photo or something)
// has been updated. Grab a fresh copy and sync it.
2012-11-11 04:08:07 +00:00
2012-11-20 00:51:15 +00:00
if ( $recipients ) {
2012-11-11 04:08:07 +00:00
2012-11-13 00:16:37 +00:00
// This would be a permissions update, typically for one connection
2012-11-11 04:08:07 +00:00
2012-11-20 00:51:15 +00:00
foreach ( $recipients as $recip ) {
2012-11-13 00:16:37 +00:00
$r = q ( " select channel.*,xchan.* from channel
left join xchan on channel_hash = xchan_hash
where channel_guid = '%s' and channel_guid_sig = '%s' limit 1 " ,
2012-11-20 00:51:15 +00:00
dbesc ( $recip [ 'guid' ]),
dbesc ( $recip [ 'guid_sig' ])
2012-11-13 00:16:37 +00:00
);
2012-11-11 04:08:07 +00:00
2012-11-13 00:16:37 +00:00
$x = zot_refresh ( array (
2012-11-20 00:51:15 +00:00
'xchan_guid' => $sender [ 'guid' ],
'xchan_guid_sig' => $sender [ 'guid_sig' ],
'hubloc_url' => $sender [ 'url' ]
2012-11-13 00:16:37 +00:00
), $r [ 0 ]);
}
}
else {
// system wide refresh
$x = zot_refresh ( array (
2012-11-20 00:51:15 +00:00
'xchan_guid' => $sender [ 'guid' ],
'xchan_guid_sig' => $sender [ 'guid_sig' ],
'hubloc_url' => $sender [ 'url' ]
2012-11-13 00:16:37 +00:00
), null );
}
2013-03-26 04:32:12 +00:00
$ret [ 'success' ] = true ;
2012-11-13 00:16:37 +00:00
json_return_and_die ( $ret );
2012-11-11 04:08:07 +00:00
}
if ( $msgtype === 'notify' ) {
2012-11-20 04:45:12 +00:00
$async = get_config ( 'system' , 'queued_fetch' );
if ( $async ) {
// add to receive queue
// qreceive_add($data);
}
else {
$x = zot_fetch ( $data );
2013-01-01 05:33:11 +00:00
$ret [ 'delivery_report' ] = $x ;
2012-11-20 04:45:12 +00:00
}
2011-09-26 09:25:43 +00:00
2013-03-26 04:32:12 +00:00
$ret [ 'success' ] = true ;
2012-08-09 01:50:04 +00:00
json_return_and_die ( $ret );
2012-11-20 00:51:15 +00:00
2012-08-09 01:50:04 +00:00
}
2011-09-26 09:25:43 +00:00
2013-01-22 03:16:21 +00:00
if ( $msgtype === 'auth_check' ) {
2013-03-26 23:20:44 +00:00
logger ( 'mod_zot: auth_check' );
2013-01-22 03:16:21 +00:00
$arr = $data [ 'sender' ];
$sender_hash = base64url_encode ( hash ( 'whirlpool' , $arr [ 'guid' ] . $arr [ 'guid_sig' ], true ));
2013-01-21 23:39:05 +00:00
2013-01-24 00:06:01 +00:00
// garbage collect any old unused notifications
q ( " delete from verify where type = 'auth' and created < UTC_TIMESTAMP() - INTERVAL 10 MINUTE " );
2013-01-22 03:16:21 +00:00
$y = q ( " select xchan_pubkey from xchan where xchan_hash = '%s' limit 1 " ,
dbesc ( $sender_hash )
);
2013-01-24 00:06:01 +00:00
// We created a unique hash in mod/magic.php when we invoked remote auth, and stored it in
// the verify table. It is now coming back to us as 'secret' and is signed by the other site.
// First verify their signature.
2013-01-22 03:40:25 +00:00
if (( ! $y ) || ( ! rsa_verify ( $data [ 'secret' ], base64url_decode ( $data [ 'secret_sig' ]), $y [ 0 ][ 'xchan_pubkey' ]))) {
2013-01-22 03:16:21 +00:00
logger ( 'mod_zot: auth_check: sender not found or secret_sig invalid.' );
json_return_and_die ( $ret );
}
2013-01-24 00:06:01 +00:00
// There should be exactly one recipient
2013-01-22 03:16:21 +00:00
if ( $data [ 'recipients' ]) {
$arr = $data [ 'recipients' ][ 0 ];
$recip_hash = base64url_encode ( hash ( 'whirlpool' , $arr [ 'guid' ] . $arr [ 'guid_sig' ], true ));
2013-04-15 03:41:58 +00:00
$c = q ( " select channel_id, channel_prvkey from channel where channel_hash = '%s' limit 1 " ,
2013-01-22 03:16:21 +00:00
dbesc ( $recip_hash )
);
if ( ! $c ) {
logger ( 'mod_zot: auth_check: recipient channel not found.' );
json_return_and_die ( $ret );
}
2013-01-24 00:06:01 +00:00
2013-04-15 03:41:58 +00:00
$confirm = base64url_encode ( rsa_sign ( $data [ 'secret' ] . $recip_hash , $c [ 0 ][ 'channel_prvkey' ]));
2013-01-24 00:06:01 +00:00
// This additionally checks for forged senders since we already stored the expected result in meta
// and we've already verified that this is them via zot_gethub() and that their key signed our token
$z = q ( " select id from verify where channel = %d and type = 'auth' and token = '%s' and meta = '%s' limit 1 " ,
2013-01-22 03:16:21 +00:00
intval ( $c [ 0 ][ 'channel_id' ]),
2013-01-24 00:06:01 +00:00
dbesc ( $data [ 'secret' ]),
dbesc ( $sender_hash )
2013-01-22 03:16:21 +00:00
);
if ( ! $z ) {
logger ( 'mod_zot: auth_check: verification key not found.' );
json_return_and_die ( $ret );
}
$r = q ( " delete from verify where id = %d limit 1 " ,
intval ( $z [ 0 ][ 'id' ])
);
2013-01-25 03:45:08 +00:00
logger ( 'mod_zot: auth_check: success' , LOGGER_DEBUG );
2013-03-26 04:32:12 +00:00
$ret [ 'success' ] = true ;
2013-04-15 03:41:58 +00:00
$ret [ 'confirm' ] = $confirm ;
2013-01-22 03:16:21 +00:00
json_return_and_die ( $ret );
}
json_return_and_die ( $ret );
2013-01-21 23:39:05 +00:00
}
2011-09-26 09:25:43 +00:00
2013-01-22 03:16:21 +00:00
// catchall
json_return_and_die ( $ret );
}
2012-08-09 01:50:04 +00:00