190fceaf5c
This is a fix for public messages, where a malicious pod could spoof a message from someone a user was connected to, as the verified signatures were not checked that the object was also from said sender. This hole only affected public messages, and the private part of code had the correct checks THX to s-f-s(Stephan Schulz) for reporting and tracking down this issue, and props to Raven24(florian.staudacher@gmx.at) for helping me test the patch
21 lines
664 B
Ruby
21 lines
664 B
Ruby
# Copyright (c) 2010-2011, Diaspora Inc. This file is
|
|
# licensed under the Affero General Public License version 3 or later. See
|
|
# the COPYRIGHT file.
|
|
|
|
|
|
class Postzord::Receiver
|
|
require Rails.root.join('lib', 'postzord', 'receiver', 'private')
|
|
require Rails.root.join('lib', 'postzord', 'receiver', 'public')
|
|
|
|
def perform!
|
|
self.receive!
|
|
end
|
|
|
|
def author_does_not_match_xml_author?
|
|
if (@author.diaspora_handle != xml_author)
|
|
FEDERATION_LOGGER.info("event=receive status=abort reason='author in xml does not match retrieved person' payload_type=#{@object.class} sender=#{@author.diaspora_handle}")
|
|
return true
|
|
end
|
|
end
|
|
end
|
|
|