Event-Federation/wordpress-activitypub
Event-Federation/wordpress-activitypub
7
1
Fork 0
Code Issues 3 Pull requests Projects Releases Wiki Activity Actions

use WP_Error

Browse source
This commit is contained in:
Matthias Pfefferle 2023-05-09 11:51:53 +02:00
parent 378f5dacdc
commit c42edfce68
1 changed files with 7 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
includes/class-signature.php
View file

@ -1,6 +1,7 @@
<?php <?php
namespace Activitypub; namespace Activitypub;
use WP_Error;
use DateTime; use DateTime;
use DateTimeZone; use DateTimeZone;
@ -142,7 +143,7 @@ class Signature {
} }
if ( ! isset( $headers['signature'] ) ) { if ( ! isset( $headers['signature'] ) ) {
return new \WP_Error( 'activitypub_signature', 'Request not signed', array( 'status' => 403 ) ); return new WP_Error( 'activitypub_signature', 'Request not signed', array( 'status' => 403 ) );
} }
if ( array_key_exists( 'signature', $headers ) ) { if ( array_key_exists( 'signature', $headers ) ) {
@ -152,7 +153,7 @@ class Signature {
} }
if ( ! isset( $signature_block ) || ! $signature_block ) { if ( ! isset( $signature_block ) || ! $signature_block ) {
return new \WP_Error( 'activitypub_signature', 'Incompatible request signature. keyId and signature are required', array( 'status' => 403 ) ); return new WP_Error( 'activitypub_signature', 'Incompatible request signature. keyId and signature are required', array( 'status' => 403 ) );
} }
$signed_headers = $signature_block['headers']; $signed_headers = $signature_block['headers'];
@ -162,12 +163,12 @@ class Signature {
$signed_data = self::get_signed_data( $signed_headers, $signature_block, $headers ); $signed_data = self::get_signed_data( $signed_headers, $signature_block, $headers );
if ( ! $signed_data ) { if ( ! $signed_data ) {
return new \WP_Error( 'activitypub_signature', 'Signed request date outside acceptable time window', array( 'status' => 403 ) ); return new WP_Error( 'activitypub_signature', 'Signed request date outside acceptable time window', array( 'status' => 403 ) );
} }
$algorithm = self::get_signature_algorithm( $signature_block ); $algorithm = self::get_signature_algorithm( $signature_block );
if ( ! $algorithm ) { if ( ! $algorithm ) {
return new \WP_Error( 'activitypub_signature', 'Unsupported signature algorithm (only rsa-sha256 and hs2019 are supported)', array( 'status' => 403 ) ); return new WP_Error( 'activitypub_signature', 'Unsupported signature algorithm (only rsa-sha256 and hs2019 are supported)', array( 'status' => 403 ) );
} }
if ( \in_array( 'digest', $signed_headers, true ) && isset( $body ) ) { if ( \in_array( 'digest', $signed_headers, true ) && isset( $body ) ) {
@ -183,7 +184,7 @@ class Signature {
} }
if ( \base64_encode( \hash( $hashalg, $body, true ) ) !== $digest[1] ) { // phpcs:ignore if ( \base64_encode( \hash( $hashalg, $body, true ) ) !== $digest[1] ) { // phpcs:ignore
return new \WP_Error( 'activitypub_signature', 'Invalid Digest header', array( 'status' => 403 ) ); return new WP_Error( 'activitypub_signature', 'Invalid Digest header', array( 'status' => 403 ) );
} }
} }
@ -193,7 +194,7 @@ class Signature {
} }
$verified = \openssl_verify( $signed_data, $signature_block['signature'], $public_key, $algorithm ) > 0; $verified = \openssl_verify( $signed_data, $signature_block['signature'], $public_key, $algorithm ) > 0;
if ( ! $verified ) { if ( ! $verified ) {
return new \WP_Error( 'activitypub_signature', 'Invalid signature', array( 'status' => 403 ) ); return new WP_Error( 'activitypub_signature', 'Invalid signature', array( 'status' => 403 ) );
} }
return $verified; return $verified;
} }