From 612d671fbc02c3406eddbb03b37c5e9d0627bc2a Mon Sep 17 00:00:00 2001
From: Penny Leach <penny@liip.ch>
Date: Tue, 21 Dec 2010 10:30:41 +0800
Subject: [PATCH] mnet MDL-16858 xmlrpc client signature verification code

---
 mnet/xmlrpc/client.php | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/mnet/xmlrpc/client.php b/mnet/xmlrpc/client.php
index 477056582fb..bb517d74d6d 100644
--- a/mnet/xmlrpc/client.php
+++ b/mnet/xmlrpc/client.php
@@ -332,6 +332,14 @@ class mnet_xmlrpc_client {
                 $this->error[] = $this->response['faultCode'] . " : " . $this->response['faultString'];
             }
         }
+
+        // ok, it's signed, but is it signed with the right certificate ?
+        // do this *after* we check for an out of date key
+        if (!openssl_verify($this->xmlrpcresponse, base64_decode($sig_parser->signature), 
+                $mnet_peer->public_key)) {
+            $this->error[] = 'Invalid signature';
+        }
+
         return empty($this->error);
     }
 }