com web/master: Improve GitHub signature validation: github-webhook.php
| From: | Nikita Popov | Date: | Thu, 24 Nov 2016 11:14:46 +0000 |
| Subject: | com web/master: Improve GitHub signature validation: github-webhook.php | ||
| Groups: | php.webmaster | ||
| Request: | Send a blank email to php-webmaster+get-25356@lists.php.net to get a copy of this message | ||
Commit: 01d6ba78b9253a4e00be402288b998527cf2dcab
Author: Nikita Popov <nikic@php.net> Thu, 24 Nov 2016 12:13:04 +0100
Parents: 608174ee7c426e5bc723ebe14e0da0aeb8b34c90
Branches: master
Link: http://git.php.net/?p=web/master.git;a=commitdiff;h=01d6ba78b9253a4e00be402288b998527cf2dcab
Log:
Improve GitHub signature validation
We should not let the client decide the authentication method, see
https://www.wordfence.com/blog/2016/11/hacking-27-web-via-wordpress-auto-update/
Changed paths:
M github-webhook.php
Diff:
diff --git a/github-webhook.php b/github-webhook.php
index f756e81..f52f1b4 100644
--- a/github-webhook.php
+++ b/github-webhook.php
@@ -1,10 +1,8 @@
<?php
function verify_signature($requestBody) {
- if(isset($_SERVER['HTTP_X_HUB_SIGNATURE'])){
- $parts = explode("=", $_SERVER['HTTP_X_HUB_SIGNATURE'], 2);
- if (count($parts) == 2) {
- return hash_hmac($parts[0], $requestBody, getenv('GITHUB_SECRET')) === $parts[1];
- }
+ if (isset($_SERVER['HTTP_X_HUB_SIGNATURE'])){
+ $sig = 'sha1=' . hash_hmac('sha1', $requestBody,
getenv('GITHUB_SECRET'));
+ return $sig === $_SERVER['HTTP_X_HUB_SIGNATURE'];
}
return false;
}