eliseuamaro
/
gnu-social
forked from GNUsocial/gnu-social
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

SalmonAction now updates remote URI if it was stale. 

After doublechecking two identities so that they match (like one that was
previously http:// but now is https://) we update the URI in our database
to match.

This has to be verified so it's not easy to fool our script and thus make
us replace legitimate URIs with fake ones. I believe the callback method
is safe, but I'm not sure how well it handles HTTP MITM attacks etc.
This commit is contained in:
Mikael Nordfeldth 2015-02-17 17:35:45 +01:00
parent 282f4d6a89
commit 59763ceecb
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
plugins/OStatus/lib/salmonaction.php
View File

@ -245,7 +245,12 @@ class SalmonAction extends Action
// Step 4: Is the newly introduced https://example.com/user/1 URI in the list of aliases
// presented by http://example.com/user/1 (i.e. do they both say they are the same identity?)
if (in_array($e->object_uri, $doublecheck_aliases)) {
common_debug('These identities both say they are each other: "'.$aliased_uri.'" and "'.$e->object_uri);
common_debug('URIFIX These identities both say they are each other: "'.$aliased_uri.'" and "'.$e->object_uri.'"');
$orig = clone($oprofile);
$oprofile->uri = $e->object_uri;
common_debug('URIFIX Updating Ostatus_profile URI for '.$aliased_uri.' to '.$oprofile->uri);
$oprofile->updateWithKeys($orig);
unset($orig);
$this->oprofile = $oprofile;
break; // don't iterate through aliases anymore
}