mag/WMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

now favicons

Browse Source
This commit is contained in:
Mark Gregory
2026-06-10 13:10:09 +01:00
parent c59b16d791
commit 9518ff889b
37 changed files with 324 additions and 168 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Modules/InternalApi/app/Http/Middleware/VerifyInternalApiSignature.php
+14 -3
View File
@@ -18,11 +18,22 @@ class VerifyInternalApiSignature
$signature = (string) $request->header('X-WMS-Signature');
abort_if($secret === '' || $timestamp === '' || $signature === '', 401);
abort_if(strtotime($timestamp) === false, 401, 'Invalid internal API timestamp.');
abort_if(abs(now()->timestamp - strtotime($timestamp)) > 300, 401, 'Expired internal API signature.');
$expected = hash_hmac('sha256', $timestamp . '.' . $request->getContent(), $secret);
abort_unless(hash_equals($expected, $signature), 401, 'Invalid internal API signature.');
$body = $request->getContent();
$payloads = array_unique([
$timestamp . '.' . $body,
$timestamp . '.',
$timestamp . '.[]',
]);
return $next($request);
foreach ($payloads as $payload) {
if (hash_equals(hash_hmac('sha256', $payload, $secret), $signature)) {
return $next($request);
}
}
abort(401, 'Invalid internal API signature.');
}
}