Re: com web/master: fix the signature verification: github-webhook.php
| From: | Ferenc Kovacs | Date: | Tue, 10 Jun 2014 20:02:49 +0000 |
| Subject: | Re: com web/master: fix the signature verification: github-webhook.php | ||
| References: | 1 2 | Groups: | php.webmaster |
| Request: | Send a blank email to php-webmaster+get-19225@lists.php.net to get a copy of this message | ||
On Tue, Jun 10, 2014 at 9:11 PM, Hannes Magnusson <
hannes.magnusson@gmail.com> wrote:
> On Tue, Jun 10, 2014 at 11:50 AM, Ferenc Kovacs <tyrael@php.net> wrote:
> > Commit: 399ecb7fbc24279b0b04b887c99ef08397358e1b
> > Author: kovacs.ferenc <kovacs.ferenc@ustream.tv> Tue, 10 Jun
> 2014 20:50:50 +0200
> > Parents: acbafe16189ee1b8ab8bd1ef061f13456880ebcd
> > Branches: master
> >
> > Link:
>
> http://git.php.net/?p=web/master.git;a=commitdiff;h=399ecb7fbc24279b0b04b887c99ef08397358e1b
> >
> > Log:
> > fix the signature verification
> >
> > Changed paths:
> > M github-webhook.php
> >
> >
> > Diff:
> > diff --git a/github-webhook.php b/github-webhook.php
> > index 70f15e8..8b57684 100644
> > --- a/github-webhook.php
> > +++ b/github-webhook.php
> > @@ -6,18 +6,19 @@ $config = array(
> > 'pecl-' => 'pecl-dev@lists.php.net',
> > ),
> > );
> > -if (
> > - !isset($_SERVER['HTTP_X_HUB_SIGNATURE'],
> $_SERVER['HTTP_X_GITHUB_EVENT'])
> > - && $_SERVER['HTTP_X_HUB_SIGNATURE'] !==
> 'sha1=e2a3e7a586aa08d7c9d3c73482e618164c7c75b1'
> > -) {
> > +
> > +$body = file_get_contents("php://input");
> > +
> > +if (!verify_signature($body)) {
> > header('HTTP/1.1 403 Forbidden');
> > exit;
> > }
> > +
> > switch ($_SERVER['HTTP_X_GITHUB_EVENT']) {
> > case 'ping':
> > break;
> > case 'pull_request':
> > - $payload = json_decode(file_get_contents("php://input"));
> > + $payload = json_decode($body);
>
> There is already a $body variable used here few lines below... Maybe
> picka different name?
>
> -Hannes
>
thanks, fixed (albeit I was lucky enough that I was only expecting the
values which ended up being in the variable by sheer luck)