Skip to content
GitLab
Projects
Groups
Snippets
Help
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
addons
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
26
Issues
26
List
Boards
Labels
Service Desk
Milestones
Merge Requests
3
Merge Requests
3
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Operations
Operations
Incidents
Environments
Analytics
Analytics
CI / CD
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
hubzilla
addons
Commits
4f943677
Commit
4f943677
authored
Nov 08, 2020
by
Mario
1
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
fix ld signatures check
parent
d6febe92
Changes
2
Hide whitespace changes
Inline
Side-by-side
Showing
2 changed files
with
74 additions
and
35 deletions
+74
-35
pubcrawl/Mod_Inbox.php
pubcrawl/Mod_Inbox.php
+66
-31
pubcrawl/as.php
pubcrawl/as.php
+8
-4
No files found.
pubcrawl/Mod_Inbox.php
View file @
4f943677
...
...
@@ -56,52 +56,98 @@ class Inbox extends \Zotlabs\Web\Controller {
return
;
}
if
(
is_array
(
$AS
->
actor
)
&&
array_key_exists
(
'id'
,
$AS
->
actor
))
{
as_actor_store
(
$AS
->
actor
[
'id'
],
$AS
->
actor
);
}
if
(
is_array
(
$AS
->
obj
)
&&
ActivityStreams
::
is_an_actor
(
$AS
->
obj
[
'type'
]))
{
as_actor_store
(
$AS
->
obj
[
'id'
],
$AS
->
obj
);
}
if
(
is_array
(
$AS
->
obj
)
&&
is_array
(
$AS
->
obj
[
'actor'
])
&&
array_key_exists
(
'id'
,
$AS
->
obj
[
'actor'
])
&&
$AS
->
obj
[
'actor'
][
'id'
]
!==
$AS
->
actor
[
'id'
])
{
as_actor_store
(
$AS
->
obj
[
'actor'
][
'id'
],
$AS
->
obj
[
'actor'
]);
}
if
(
$AS
->
type
==
'Announce'
&&
is_array
(
$AS
->
obj
)
&&
array_key_exists
(
'attributedTo'
,
$AS
->
obj
))
{
$arr
=
[];
$arr
[
'author'
][
'url'
]
=
as_get_attributed_to_person
(
$AS
);
pubcrawl_import_author
(
$arr
);
}
$observer_hash
=
''
;
// $observer_hash in this case is the sender
// Validate that the channel that sent us this activity has authority to do so.
// Require a valid HTTPSignature with a signed Digest header.
// Only permit relayed activities if the activity is signed with LDSigs
// AND the signature is valid AND the signer is the actor.
/* TODO: this doesnot seem to work as expected yet.
if
(
$hsig
[
'header_valid'
]
&&
$hsig
[
'content_valid'
]
&&
$hsig
[
'portable_id'
])
{
$observer_hash = $hsig['portable_id'];
// fetch the portable_id for the actor, which may or may not be the sender
$v
=
q
(
"select hubloc_hash from hubloc where hubloc_id_url = '%s' or hubloc_hash = '%s'"
,
dbesc
(
$AS
->
actor
[
'id'
]),
dbesc
(
$AS
->
actor
[
'id'
])
);
// only allow relayed activities if the activity is signed with LDSigs
// AND the signature is valid AND the signer is the actor.
if ($v && $v[0]['hubloc_hash'] !== $observer_hash) {
if ($AS->signer && $AS->signer !== $AS->actor['id']) {
if
(
$v
&&
$v
[
0
][
'hubloc_hash'
]
!==
$hsig
[
'portable_id'
])
{
// The sender is not actually the activity actor, so verify the LD signature.
// litepub activities (with no LD signature) will always have a matching actor and sender
if
(
$AS
->
signer
&&
$AS
->
signer
[
'id'
]
!==
$AS
->
actor
[
'id'
])
{
// the activity wasn't signed by the activity actor
logger
(
'activity not signed by activity actor: '
.
print_r
(
$hsig
,
true
),
LOGGER_DEBUG
);
logger
(
'http signer hubloc: '
.
print_r
(
$v
,
true
));
logger
(
'AS: '
.
print_r
(
$AS
,
true
));
return
;
}
if
(
!
$AS
->
sigok
)
{
// The activity signature isn't valid.
logger
(
'activity signature not valid: '
.
print_r
(
$hsig
,
true
),
LOGGER_DEBUG
);
logger
(
'http signer hubloc: '
.
print_r
(
$v
,
true
));
logger
(
'AS: '
.
print_r
(
$AS
,
true
));
return
;
}
}
}
else {
$observer_hash = $AS->actor['id'];
}
*/
$observer_hash
=
$AS
->
actor
[
'id'
];
if
(
$v
)
{
// The sender has been validated and stored
$observer_hash
=
$hsig
[
'portable_id'
];
}
}
if
(
!
$observer_hash
)
{
return
;
}
// update the hubloc_connected timestamp, ignore failures
q
(
"update hubloc set hubloc_connected = '%s' where hubloc_hash = '%s' and hubloc_network = 'activitypub'"
,
dbesc
(
datetime_convert
()),
dbesc
(
$observer_hash
)
);
// verify that this site has permitted communication with the sender.
$m
=
parse_url
(
$observer_hash
);
if
(
$m
[
'scheme'
]
&&
$m
[
'host'
])
{
q
(
"update site set site_dead = 0 where site_dead = 1 and site_url = '%s'"
,
if
(
$m
&&
$m
[
'scheme'
]
&&
$m
[
'host'
])
{
if
(
!
check_siteallowed
(
$m
[
'scheme'
]
.
'://'
.
$m
[
'host'
]))
{
http_status_exit
(
403
,
'Permission denied'
);
}
// this site obviously isn't dead because they are trying to communicate with us.
q
(
"update site set site_dead = 0 where site_dead = 1 and site_url = '%s' "
,
dbesc
(
$m
[
'scheme'
]
.
'://'
.
$m
[
'host'
])
);
}
if
(
!
check_channelallowed
(
$observer_hash
))
{
http_status_exit
(
403
,
'Permission denied'
);
}
// update the hubloc_connected timestamp, ignore failures
q
(
"update hubloc set hubloc_connected = '%s' where hubloc_hash = '%s' and hubloc_network = 'activitypub'"
,
dbesc
(
datetime_convert
()),
dbesc
(
$observer_hash
)
);
if
(
$AS
->
type
==
'Update'
&&
$AS
->
obj
[
'type'
]
==
'Person'
)
{
$x
[
'recipient'
][
'xchan_network'
]
=
'activitypub'
;
$x
[
'recipient'
][
'xchan_hash'
]
=
$observer_hash
;
...
...
@@ -109,17 +155,6 @@ class Inbox extends \Zotlabs\Web\Controller {
return
;
}
if
(
is_array
(
$AS
->
actor
)
&&
array_key_exists
(
'id'
,
$AS
->
actor
))
{
as_actor_store
(
$AS
->
actor
[
'id'
],
$AS
->
actor
);
}
if
(
$AS
->
type
==
'Announce'
&&
is_array
(
$AS
->
obj
)
&&
array_key_exists
(
'attributedTo'
,
$AS
->
obj
))
{
$arr
=
[];
$arr
[
'author'
][
'url'
]
=
as_get_attributed_to_person
(
$AS
);
pubcrawl_import_author
(
$arr
);
}
$is_public
=
false
;
if
(
argc
()
==
1
||
argv
(
1
)
===
'[public]'
)
{
...
...
pubcrawl/as.php
View file @
4f943677
...
...
@@ -1377,10 +1377,10 @@ function as_create_note($channel,$observer_hash,$act) {
$announce_author
=
as_get_attributed_to_person
(
$act
);
$s
[
'author_xchan'
]
=
((
$announce
)
?
$announce_author
:
$
observer_hash
);
$s
[
'author_xchan'
]
=
((
$announce
)
?
$announce_author
:
$
act
->
actor
[
'id'
]
);
$abook
=
q
(
"select * from abook where abook_xchan = '%s' and abook_channel = %d limit 1"
,
dbesc
(
$
observer_hash
),
dbesc
(
$
s
[
'author_xchan'
]
),
intval
(
$channel
[
'channel_id'
])
);
...
...
@@ -1515,6 +1515,10 @@ function as_create_note($channel,$observer_hash,$act) {
dbesc
(
$s
[
'parent_mid'
]),
intval
(
$s
[
'uid'
])
);
if
(
!
$p
)
{
logger
(
'parent not found.'
);
return
;
}
}
else
{
logger
(
'could not fetch parents'
);
...
...
@@ -1827,7 +1831,7 @@ function as_like_note($channel,$observer_hash,$act) {
$parent_item
=
$r
[
0
];
if
(
$parent_item
[
'owner_xchan'
]
===
$channel
[
'channel_hash'
])
{
if
(
!
perm_is_allowed
(
$channel
[
'channel_id'
],
$observer_hash
,
'post_comments'
))
{
if
(
!
perm_is_allowed
(
$channel
[
'channel_id'
],
$act
->
actor
[
'id'
],
'post_comments'
))
{
logger
(
'no comment permission.'
);
return
;
}
...
...
@@ -1845,7 +1849,7 @@ function as_like_note($channel,$observer_hash,$act) {
// Make sure we use the zot6 identity where applicable
$s
[
'owner_xchan'
]
=
Activity
::
find_best_identity
(
$parent_item
[
'owner_xchan'
]);
$s
[
'author_xchan'
]
=
Activity
::
find_best_identity
(
$
observer_hash
);
$s
[
'author_xchan'
]
=
Activity
::
find_best_identity
(
$
act
->
actor
[
'id'
]
);
if
(
!
$s
[
'author_xchan'
])
{
logger
(
'No author: '
.
print_r
(
$act
,
true
));
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment