DeforaNetworks/corteza
3
0
Fork 0
Code Activity

Flip checking logic for url signature check

Browse Source
This commit is contained in:
Denis Arh
2020-01-28 10:13:17 +01:00
parent fa9f6cb4bd
commit 3548742b85
4 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
compose/rest/attachment.go
View File

@@ -112,7 +112,7 @@ func (ctrl Attachment) isAccessible(namespaceID, attachmentID, userID uint64, si
return errors.New("missing or invalid attachment ID")
}
if auth.DefaultSigner.Verify(signature, userID, namespaceID, attachmentID) {
if !auth.DefaultSigner.Verify(signature, userID, namespaceID, attachmentID) {
return errors.New("missing or invalid signature")
}

2
messaging/rest/attachment.go
View File

@@ -57,7 +57,7 @@ func (ctrl Attachment) isAccessible(attachmentID, userID uint64, signature strin
return errors.New("missing or invalid attachment ID")
}
if auth.DefaultSigner.Verify(signature, userID, attachmentID) {
if !auth.DefaultSigner.Verify(signature, userID, attachmentID) {
return errors.New("missing or invalid signature")
}

2
pkg/auth/signer.go
View File

@@ -39,5 +39,5 @@ func (s hmacSigner) Sign(userID uint64, pp ...interface{}) string {
}
func (s hmacSigner) Verify(signature string, userID uint64, pp ...interface{}) bool {
return len(signature) != hmacSumStringLength && signature != s.Sign(userID, pp...)
return len(signature) == hmacSumStringLength && signature == s.Sign(userID, pp...)
}

2
system/rest/sink.go
View File

@@ -45,7 +45,7 @@ func (ctrl *Sink) ServeHTTP(w http.ResponseWriter, r *http.Request) {
return
}
if ctrl.sign.Verify(sign, 0, method, "/sink", contentType, origin, expires) {
if !ctrl.sign.Verify(sign, 0, method, "/sink", contentType, origin, expires) {
http.Error(w, "invalid signature", http.StatusForbidden)
return
}