diff --git a/app/controllers/authorizations_controller.rb b/app/controllers/authorizations_controller.rb index 17f917b23..31ec29e8e 100644 --- a/app/controllers/authorizations_controller.rb +++ b/app/controllers/authorizations_controller.rb @@ -35,11 +35,12 @@ class AuthorizationsController < ApplicationController packaged_manifest = JSON.parse(RestClient.get("#{app_url}/manifest.json").body) public_key = OpenSSL::PKey::RSA.new(packaged_manifest['public_key']) manifest = JWT.decode(packaged_manifest['jwt'], public_key) + pp manifest message = verify(signed_string, Base64.decode64(params[:signature]), public_key, manifest) if not (message =='ok') render :text => message, :status => 403 - elsif manifest["homepage_url"].match(/^http:\/\/(localhost:\d+|chubbi\.es|cubbi\.es)\/$/).nil? + elsif manifest["homepage_url"].match(/^http:\/\/(localhost:\d+|chubbi\.es|cubbi\.es)$/).nil? # This will only be temporary (less than a month) while we iron out the kinks in Diaspora Connect. Essentially, # whatever we release people will try to work off of and it sucks to build things on top of non-stable things. # We also started writing a gem that we'll release (around the same time) that makes becoming a Diaspora enabled diff --git a/spec/chubbies/app.rb b/spec/chubbies/app.rb index f14f6c8a4..22b37845c 100644 --- a/spec/chubbies/app.rb +++ b/spec/chubbies/app.rb @@ -48,7 +48,7 @@ module Chubbies d.manifest_field(:name, "Chubbies") d.manifest_field(:description, "The best way to chub.") - d.manifest_field(:homepage_url, "http://localhost:9292/") + d.manifest_field(:homepage_url, "http://localhost:9292") d.manifest_field(:icon_url, "#") d.manifest_field(:permissions_overview, "Chubbi.es wants to post photos to your stream.") diff --git a/spec/controllers/authorizations_controller_spec.rb b/spec/controllers/authorizations_controller_spec.rb index 01784f339..0593bc568 100644 --- a/spec/controllers/authorizations_controller_spec.rb +++ b/spec/controllers/authorizations_controller_spec.rb @@ -56,32 +56,34 @@ describe AuthorizationsController do stub_request(:get, "http://#{url}/manifest.json"). to_return(:status => 200, :body => packaged_manifest, :headers => {}) - @params_hash = {:type => 'client_associate', :manifest_url => "http://#{url}/manifest.json" } + @signed_string = [url,'http://pod.pod',"#{Time.now.to_i}", @nonce].join(';') + @signature = @private_key.sign(OpenSSL::Digest::SHA256.new, @signed_string) + @params_hash = {:type => 'client_associate', :signed_string => Base64.encode64(@signed_string), :signature => Base64.encode64(@signature)} end it 'renders something for chubbies ' do - prepare_manifest("http://chubbi.es/") + prepare_manifest("http://chubbi.es") @controller.stub!(:verify).and_return('ok') post :token, @params_hash response.body.blank?.should be_false end it 'renders something for cubbies ' do - prepare_manifest("http://cubbi.es/") + prepare_manifest("http://cubbi.es") @controller.stub!(:verify).and_return('ok') post :token, @params_hash response.body.blank?.should be_false end it 'renders something for localhost' do - prepare_manifest("http://localhost:3423/") + prepare_manifest("http://localhost:3423") @controller.stub!(:verify).and_return('ok') post :token, @params_hash response.body.blank?.should be_false end it 'renders nothing for myspace' do - prepare_manifest("http://myspace.com/") + prepare_manifest("http://myspace.com") @controller.stub!(:verify).and_return('ok') post :token, @params_hash response.body.blank?.should be_true