From cd8f1cf656614bb0151699dbbd483cda5232d53b Mon Sep 17 00:00:00 2001
From: Penny Leach <penny@liip.ch>
Date: Tue, 2 Feb 2010 02:13:25 +0000
Subject: [PATCH] mnet MDL-16858  verify the signature in the xmlrpc response

---
 mnet/xmlrpc/client.php | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/mnet/xmlrpc/client.php b/mnet/xmlrpc/client.php
index 7c801bc1ff7..538a6ebab8c 100644
--- a/mnet/xmlrpc/client.php
+++ b/mnet/xmlrpc/client.php
@@ -281,6 +281,13 @@ class mnet_xmlrpc_client {
             }
             $this->error[] = $this->response['faultCode'] . " : " . $this->response['faultString'] ."\n".$guidance;
         }
+
+        // ok, it's signed, but is it signed with the right certificate ?
+        // do this *after* we check for an out of date key
+        if (!openssl_verify($this->xmlrpcresponse, base64_decode($sig_parser->signature), $mnet_peer->public_key)) {
+            $this->error[] = 'Invalid signature';
+        }
+
         return empty($this->error);
     }