jakob/friendica
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Diaspora: Better handling for unrelayed comments and likes

Browse source
This commit is contained in:
Michael 2017-05-03 19:28:51 +00:00
parent 8510b4d4dd
commit d7b56db996
1 changed files with 24 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

39
include/diaspora.php
View file

@ -333,19 +333,20 @@ class Diaspora {
return false; return false;
} }
if (!self::valid_posting($msg, $fields)) { if (!($postdata = self::valid_posting($msg))) {
logger("Invalid posting"); logger("Invalid posting");
return false; return false;
} }
// Is it a an action (comment, like, ...) for our own post? $fields = $postdata['fields'];
if (isset($fields->parent_guid)) {
$guid = notags(unxmlify($fields->parent_guid));
// Is it a an action (comment, like, ...) for our own post?
if (isset($fields->parent_guid) AND !$postdata["relayed"]) {
$guid = notags(unxmlify($fields->parent_guid));
$importer = self::importer_for_guid($guid); $importer = self::importer_for_guid($guid);
if (is_array($importer)) { if (is_array($importer)) {
logger("delivering to origin: ".$importer["name"]); logger("delivering to origin: ".$importer["name"]);
$message_id = self::dispatch($importer, $msg); $message_id = self::dispatch($importer, $msg, $fields);
return $message_id; return $message_id;
} }
} }
@ -361,14 +362,14 @@ class Diaspora {
if (dbm::is_result($r)) { if (dbm::is_result($r)) {
foreach ($r as $rr) { foreach ($r as $rr) {
logger("delivering to: ".$rr["username"]); logger("delivering to: ".$rr["username"]);
self::dispatch($rr, $msg); self::dispatch($rr, $msg, $fields);
} }
} elseif (!Config::get('system', 'relay_subscribe', false)) { } elseif (!Config::get('system', 'relay_subscribe', false)) {
logger("Unwanted message from ".$sender." send by ".$_SERVER["REMOTE_ADDR"]." with ".$_SERVER["HTTP_USER_AGENT"].": ".print_r($msg, true), LOGGER_DEBUG); logger("Unwanted message from ".$msg["author"]." send by ".$_SERVER["REMOTE_ADDR"]." with ".$_SERVER["HTTP_USER_AGENT"].": ".print_r($msg, true), LOGGER_DEBUG);
} else { } else {
// Use a dummy importer to import the data for the public copy // Use a dummy importer to import the data for the public copy
$importer = array("uid" => 0, "page-flags" => PAGE_FREELOVE); $importer = array("uid" => 0, "page-flags" => PAGE_FREELOVE);
$message_id = self::dispatch($importer, $msg); $message_id = self::dispatch($importer, $msg, $fields);
} }
return $message_id; return $message_id;
@ -382,15 +383,19 @@ class Diaspora {
* *
* @return int The message id of the generated message, "true" or "false" if there was an error * @return int The message id of the generated message, "true" or "false" if there was an error
*/ */
public static function dispatch($importer, $msg) { public static function dispatch($importer, $msg, $fields = null) {
// The sender is the handle of the contact that sent the message. // The sender is the handle of the contact that sent the message.
// This will often be different with relayed messages (for example "like" and "comment") // This will often be different with relayed messages (for example "like" and "comment")
$sender = $msg["author"]; $sender = $msg["author"];
if (!self::valid_posting($msg, $fields)) { // This is only needed for private postings since this is already done for public ones before
logger("Invalid posting"); if (is_null($fields)) {
return false; if (!($postdata = self::valid_posting($msg))) {
logger("Invalid posting");
return false;
}
$fields = $postdata['fields'];
} }
$type = $fields->getName(); $type = $fields->getName();
@ -456,7 +461,7 @@ class Diaspora {
* *
* @return bool Is the posting valid? * @return bool Is the posting valid?
*/ */
private static function valid_posting($msg, &$fields) { private static function valid_posting($msg) {
$data = parse_xml_string($msg["message"], false); $data = parse_xml_string($msg["message"], false);
@ -552,7 +557,7 @@ class Diaspora {
// Only some message types have signatures. So we quit here for the other types. // Only some message types have signatures. So we quit here for the other types.
if (!in_array($type, array("comment", "message", "like"))) if (!in_array($type, array("comment", "message", "like")))
return true; return array("fields" => $fields, "relayed" => false);
// No author_signature? This is a must, so we quit. // No author_signature? This is a must, so we quit.
if (!isset($author_signature)) { if (!isset($author_signature)) {
@ -561,12 +566,16 @@ class Diaspora {
} }
if (isset($parent_author_signature)) { if (isset($parent_author_signature)) {
$relayed = true;
$key = self::key($msg["author"]); $key = self::key($msg["author"]);
if (!rsa_verify($signed_data, $parent_author_signature, $key, "sha256")) { if (!rsa_verify($signed_data, $parent_author_signature, $key, "sha256")) {
logger("No valid parent author signature for parent author ".$msg["author"]. " in type ".$type." - signed data: ".$signed_data." - Message: ".$msg["message"]." - Signature ".$parent_author_signature, LOGGER_DEBUG); logger("No valid parent author signature for parent author ".$msg["author"]. " in type ".$type." - signed data: ".$signed_data." - Message: ".$msg["message"]." - Signature ".$parent_author_signature, LOGGER_DEBUG);
return false; return false;
} }
} else {
$relayed = false;
} }
$key = self::key($fields->author); $key = self::key($fields->author);
@ -575,7 +584,7 @@ class Diaspora {
logger("No valid author signature for author ".$fields->author. " in type ".$type." - signed data: ".$signed_data." - Message: ".$msg["message"]." - Signature ".$author_signature, LOGGER_DEBUG); logger("No valid author signature for author ".$fields->author. " in type ".$type." - signed data: ".$signed_data." - Message: ".$msg["message"]." - Signature ".$author_signature, LOGGER_DEBUG);
return false; return false;
} else } else
return true; return array("fields" => $fields, "relayed" => $relayed);
} }
/** /**