Commit 4f943677 authored by Mario's avatar Mario

fix ld signatures check

parent d6febe92
......@@ -56,52 +56,98 @@ class Inbox extends \Zotlabs\Web\Controller {
return;
}
if (is_array($AS->actor) && array_key_exists('id',$AS->actor)) {
as_actor_store($AS->actor['id'],$AS->actor);
}
if (is_array($AS->obj) && ActivityStreams::is_an_actor($AS->obj['type'])) {
as_actor_store($AS->obj['id'],$AS->obj);
}
if (is_array($AS->obj) && is_array($AS->obj['actor']) && array_key_exists('id',$AS->obj['actor']) && $AS->obj['actor']['id'] !== $AS->actor['id']) {
as_actor_store($AS->obj['actor']['id'],$AS->obj['actor']);
}
if($AS->type == 'Announce' && is_array($AS->obj) && array_key_exists('attributedTo',$AS->obj)) {
$arr = [];
$arr['author']['url'] = as_get_attributed_to_person($AS);
pubcrawl_import_author($arr);
}
$observer_hash = '';
// $observer_hash in this case is the sender
// Validate that the channel that sent us this activity has authority to do so.
// Require a valid HTTPSignature with a signed Digest header.
// Only permit relayed activities if the activity is signed with LDSigs
// AND the signature is valid AND the signer is the actor.
/* TODO: this doesnot seem to work as expected yet.
if ($hsig['header_valid'] && $hsig['content_valid'] && $hsig['portable_id']) {
$observer_hash = $hsig['portable_id'];
// fetch the portable_id for the actor, which may or may not be the sender
$v = q("select hubloc_hash from hubloc where hubloc_id_url = '%s' or hubloc_hash = '%s'",
dbesc($AS->actor['id']),
dbesc($AS->actor['id'])
);
// only allow relayed activities if the activity is signed with LDSigs
// AND the signature is valid AND the signer is the actor.
if ($v && $v[0]['hubloc_hash'] !== $observer_hash) {
if ($AS->signer && $AS->signer !== $AS->actor['id']) {
if ($v && $v[0]['hubloc_hash'] !== $hsig['portable_id']) {
// The sender is not actually the activity actor, so verify the LD signature.
// litepub activities (with no LD signature) will always have a matching actor and sender
if ($AS->signer && $AS->signer['id'] !== $AS->actor['id']) {
// the activity wasn't signed by the activity actor
logger('activity not signed by activity actor: ' . print_r($hsig,true), LOGGER_DEBUG);
logger('http signer hubloc: ' . print_r($v,true));
logger('AS: ' . print_r($AS,true));
return;
}
if (! $AS->sigok) {
// The activity signature isn't valid.
logger('activity signature not valid: ' . print_r($hsig,true), LOGGER_DEBUG);
logger('http signer hubloc: ' . print_r($v,true));
logger('AS: ' . print_r($AS,true));
return;
}
}
}
else {
$observer_hash = $AS->actor['id'];
}
*/
$observer_hash = $AS->actor['id'];
if ($v) {
// The sender has been validated and stored
$observer_hash = $hsig['portable_id'];
}
}
if (! $observer_hash) {
return;
}
// update the hubloc_connected timestamp, ignore failures
q("update hubloc set hubloc_connected = '%s' where hubloc_hash = '%s' and hubloc_network = 'activitypub'",
dbesc(datetime_convert()),
dbesc($observer_hash)
);
// verify that this site has permitted communication with the sender.
$m = parse_url($observer_hash);
if ($m['scheme'] && $m['host']) {
q("update site set site_dead = 0 where site_dead = 1 and site_url = '%s'",
if ($m && $m['scheme'] && $m['host']) {
if (! check_siteallowed($m['scheme'] . '://' . $m['host'])) {
http_status_exit(403,'Permission denied');
}
// this site obviously isn't dead because they are trying to communicate with us.
q("update site set site_dead = 0 where site_dead = 1 and site_url = '%s' ",
dbesc($m['scheme'] . '://' . $m['host'])
);
}
if (! check_channelallowed($observer_hash)) {
http_status_exit(403,'Permission denied');
}
// update the hubloc_connected timestamp, ignore failures
q("update hubloc set hubloc_connected = '%s' where hubloc_hash = '%s' and hubloc_network = 'activitypub'",
dbesc(datetime_convert()),
dbesc($observer_hash)
);
if($AS->type == 'Update' && $AS->obj['type'] == 'Person') {
$x['recipient']['xchan_network'] = 'activitypub';
$x['recipient']['xchan_hash'] = $observer_hash;
......@@ -109,17 +155,6 @@ class Inbox extends \Zotlabs\Web\Controller {
return;
}
if(is_array($AS->actor) && array_key_exists('id',$AS->actor)) {
as_actor_store($AS->actor['id'],$AS->actor);
}
if($AS->type == 'Announce' && is_array($AS->obj) && array_key_exists('attributedTo',$AS->obj)) {
$arr = [];
$arr['author']['url'] = as_get_attributed_to_person($AS);
pubcrawl_import_author($arr);
}
$is_public = false;
if(argc() == 1 || argv(1) === '[public]') {
......
......@@ -1377,10 +1377,10 @@ function as_create_note($channel,$observer_hash,$act) {
$announce_author = as_get_attributed_to_person($act);
$s['author_xchan'] = (($announce) ? $announce_author : $observer_hash);
$s['author_xchan'] = (($announce) ? $announce_author : $act->actor['id']);
$abook = q("select * from abook where abook_xchan = '%s' and abook_channel = %d limit 1",
dbesc($observer_hash),
dbesc($s['author_xchan']),
intval($channel['channel_id'])
);
......@@ -1515,6 +1515,10 @@ function as_create_note($channel,$observer_hash,$act) {
dbesc($s['parent_mid']),
intval($s['uid'])
);
if(! $p) {
logger('parent not found.');
return;
}
}
else {
logger('could not fetch parents');
......@@ -1827,7 +1831,7 @@ function as_like_note($channel,$observer_hash,$act) {
$parent_item = $r[0];
if($parent_item['owner_xchan'] === $channel['channel_hash']) {
if(! perm_is_allowed($channel['channel_id'],$observer_hash,'post_comments')) {
if(! perm_is_allowed($channel['channel_id'], $act->actor['id'], 'post_comments')) {
logger('no comment permission.');
return;
}
......@@ -1845,7 +1849,7 @@ function as_like_note($channel,$observer_hash,$act) {
// Make sure we use the zot6 identity where applicable
$s['owner_xchan'] = Activity::find_best_identity($parent_item['owner_xchan']);
$s['author_xchan'] = Activity::find_best_identity($observer_hash);
$s['author_xchan'] = Activity::find_best_identity($act->actor['id']);
if(!$s['author_xchan']) {
logger('No author: ' . print_r($act, true));
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment