L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-16301 address issue.

Browse Source
This commit is contained in:
peterbulmer
2008-09-07 05:08:35 +00:00
parent 98e9f88177
commit d74fddbd58
1 changed files with 16 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mnet/xmlrpc/server.php
+16 -9
View File
@@ -206,20 +206,27 @@ function mnet_server_strip_wrappers($HTTP_RAW_POST_DATA) {
// Does the signature match the data and the public cert?
$signature_verified = openssl_verify($payload, base64_decode($sig_parser->signature), $certificate);
if ($signature_verified == 1) {
$MNET_REMOTE_CLIENT->touch();
// Parse the XML
} elseif ($signature_verified == 0) {
if ($signature_verified == 0) {
// $signature was not generated for $payload using $certificate
// Get the key the remote peer is currently publishing:
$currkey = mnet_get_public_key($MNET_REMOTE_CLIENT->wwwroot, $MNET_REMOTE_CLIENT->application->xmlrpc_server_url);
// If the key the remote peer is currently publishing is different to $certificate
if($currkey != $certificate) {
// Has the server updated its certificate since our last
// handshake?
if(!$MNET_REMOTE_CLIENT->refresh_key()) {
// If we can't get the server's new key through trusted means, exit.
if(!$MNET_REMOTE_CLIENT->refresh_key()){
exit(mnet_server_fault(7026, 'verifysignature-invalid'));
}
} else {
exit(mnet_server_fault(710, 'verifysignature-invalid'));
// If we did manage to re-key, try to verify the signature again against the new public key.
$certificate = $MNET_REMOTE_CLIENT->public_key;
$signature_verified = openssl_verify($payload, base64_decode($sig_parser->signature), $certificate);
}
}
if ($signature_verified == 1) {
$MNET_REMOTE_CLIENT->touch();
} elseif ($signature_verified == 0) {
exit(mnet_server_fault(710, 'verifysignature-invalid'));
} else {
exit(mnet_server_fault(711, 'verifysignature-error'));
}