nprasad2077/docs
1
1
Fork 0
mirror of https://gitea.com/gitea/docs.git synced 2026-09-19 04:28:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

proper signature validation (#13523)

Browse Source 
$header_signature could be a typed float (start with 0e and then only numbers) and a float does equal a string when comparing with typed juggle.
eg: 0e123 != "abc" does return false, but 0e123 !== "abc" returns true.

you previously could circumvent the signature check when providing a header signature in the float format (0e...)

Co-authored-by: techknowlogick <[email protected]>
Co-authored-by: Lunny Xiao <[email protected]>
This commit is contained in:
Cacciuc
2020-11-13 13:28:15 -05:00
committed by GitHub
co-authored by techknowlogick Lunny Xiao
parent f3b8916d37
commit 7c010e3c1b
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/features/webhooks.en-us.md
+1 -1
View File
@@ -168,7 +168,7 @@ if (empty($header_signature)) {
$payload_signature = hash_hmac('sha256', $payload, $secret_key, false);
// check payload signature against header signature
if ($header_signature != $payload_signature) {
if ($header_signature !== $payload_signature) {
error_log('FAILED - payload signature');
exit();
}