j62
/
ctbrec
2
2
Fork 2
Code Issues 5 Pull Requests Packages Projects Releases 3 Wiki Activity

If HMAC is a request parameter, calculate it from the requested path

This commit is contained in:
0xboobface 2018-11-16 12:40:27 +01:00
parent 3241066303
commit 917dbbadaa
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/main/java/ctbrec/recorder/server/AbstractCtbrecServlet.java
View File

@ -19,6 +19,8 @@ public abstract class AbstractCtbrecServlet extends HttpServlet {
String reqParamHmac = req.getParameter("hmac"); String reqParamHmac = req.getParameter("hmac");
String httpHeaderHmac = req.getHeader("CTBREC-HMAC"); String httpHeaderHmac = req.getHeader("CTBREC-HMAC");
String hmac = null; String hmac = null;
String url = req.getRequestURI();
if(reqParamHmac != null) { if(reqParamHmac != null) {
hmac = reqParamHmac; hmac = reqParamHmac;
} }
@ -27,7 +29,8 @@ public abstract class AbstractCtbrecServlet extends HttpServlet {
} }
byte[] key = Config.getInstance().getSettings().key; byte[] key = Config.getInstance().getSettings().key;
authenticated = Hmac.validate(body, key, hmac); String msg = reqParamHmac != null ? url : body;
authenticated = Hmac.validate(msg, key, hmac);
} else { } else {
authenticated = true; authenticated = true;
} }