wordpress-activitypub
wordpress-activitypub copied to clipboard
Signature: Enable digest check for REST Requests
The digest check was essentially skipped, even if a digest header was available, since $body was never set.
I suppose there's a good chance that requests might fail now that didn't use to fail? Not sure.
Proposed changes:
- Enables Digest check for
WP_REST_Requests. - Uses signed headers directly instead of in a separate variable.
- Breaks down digest in separate variables.
- Adds tests.
Other information:
- [x] Have you written new tests for your changes, if applicable?
Testing instructions:
- Apply this PR to a test site that can receive requests from the internet.
- Send a request that includes a digest, like a like from Mastodon maybe?
- Make sure that still works.
Changelog entry
- [x] Automatically create a changelog entry from the details below.
Changelog Entry Details
Significance
- [x] Patch
- [ ] Minor
- [ ] Major
Type
- [ ] Added - for new features
- [ ] Changed - for changes in existing functionality
- [ ] Deprecated - for soon-to-be removed features
- [ ] Removed - for now removed features
- [x] Fixed - for any bug fixes
- [ ] Security - in case of vulnerabilities
Message
When verifying signatures on incoming requests, the digest header now gets checked as expected.