keith/friendica
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Date check added for HTTP signatures

Browse source
This commit is contained in:
Michael 2019-01-14 16:03:13 +00:00
parent 90e25faf44
commit 2f2184cf12
1 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
src/Util/HTTPSignature.php
View file

@ -459,7 +459,14 @@ class HTTPSignature
}
}
/// @todo Check if the signed date field is in an acceptable range
// Check if the signed date field is in an acceptable range
if (in_array('date', $sig_block['headers'])) {
$diff = abs(strtotime($headers['date']) - time());
if ($diff > 300) {
Logger::log("Header date '" . $headers['date'] . "' is with " . $diff . " seconds out of the 300 second frame. The signature is invalid.");
return false;
}
}
// Check the content-length when it is part of the signed data
if (in_array('content-length', $sig_block['headers'])) {