mnet MDL-16858 xmlrpc client signature verification code

2010-12-21 10:30:41 +08:00
parent 3703965f09
commit 612d671fbc
1 changed files with 8 additions and 0 deletions
@@ -332,6 +332,14 @@ class mnet_xmlrpc_client {
                $this->error[] = $this->response['faultCode'] . " : " . $this->response['faultString'];
            }
        }
+
+        // ok, it's signed, but is it signed with the right certificate ?
+        // do this *after* we check for an out of date key
+        if (!openssl_verify($this->xmlrpcresponse, base64_decode($sig_parser->signature), 
+                $mnet_peer->public_key)) {
+            $this->error[] = 'Invalid signature';
+        }
+
        return empty($this->error);
    }
 }