iv-org-mirror/invidious-copy-2022-08-14
1
0
Fork 0
mirror of https://gitea.invidious.io/iv-org/invidious-copy-2022-08-14.git synced 2024-08-15 00:53:20 +00:00
Code Issues Projects Releases Packages Wiki Activity

Add nonce to pubsub token

Browse source
This commit is contained in:
Omar Roth 2019-03-04 07:53:31 -06:00
parent 5895604282
commit 004fb96b2f
2 changed files with 13 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/invidious.cr
View file

@ -92,7 +92,7 @@ PUBSUB_URL = URI.parse("https://pubsubhubbub.appspot.com")
TEXTCAPTCHA_URL = URI.parse("http://textcaptcha.com/omarroth@hotmail.com.json")
CURRENT_COMMIT = `git rev-list HEAD --max-count=1 --abbrev-commit`.strip
CURRENT_VERSION = `git describe --tags $(git rev-list --tags --max-count=1)`.strip
CURRENT_BRANCH = `git status | head -1`.strip
CURRENT_BRANCH = `git status | head -1`.strip
LOCALES = {
"ar" => load_locale("ar"),
@ -136,7 +136,7 @@ if config.statistics_enabled
"software" => {
"name" => "invidious",
"version" => "#{CURRENT_VERSION}-#{CURRENT_COMMIT}",
"branch" => "#{CURRENT_BRANCH}",
"branch" => "#{CURRENT_BRANCH}",
},
"openRegistrations" => config.registration_enabled,
"usage" => {
@ -2329,13 +2329,19 @@ get "/feed/webhook/:token" do |env|
challenge = env.params.query["hub.challenge"]
lease_seconds = env.params.query["hub.lease_seconds"]
time, signature = verify_token.split(":")
if verify_token.starts_with? "v1"
_, time, nonce, signature = verify_token.split(":")
data = "#{time}:#{nonce}"
else
time, signature = verify_token.split(":")
data = "#{time}"
end
if Time.now.to_unix - time.to_i > 600
halt env, status_code: 400
end
if OpenSSL::HMAC.hexdigest(:sha1, HMAC_KEY, time) != signature
if OpenSSL::HMAC.hexdigest(:sha1, HMAC_KEY, data) != signature
halt env, status_code: 400
end