wordpress-activitypub icon indicating copy to clipboard operation
wordpress-activitypub copied to clipboard

Signature: Enable digest check for REST Requests

Open obenland opened this issue 7 months ago • 0 comments

The digest check was essentially skipped, even if a digest header was available, since $body was never set. I suppose there's a good chance that requests might fail now that didn't use to fail? Not sure.

Proposed changes:

  • Enables Digest check for WP_REST_Requests.
  • Uses signed headers directly instead of in a separate variable.
  • Breaks down digest in separate variables.
  • Adds tests.

Other information:

  • [x] Have you written new tests for your changes, if applicable?

Testing instructions:

  • Apply this PR to a test site that can receive requests from the internet.
  • Send a request that includes a digest, like a like from Mastodon maybe?
  • Make sure that still works.

Changelog entry

  • [x] Automatically create a changelog entry from the details below.
Changelog Entry Details

Significance

  • [x] Patch
  • [ ] Minor
  • [ ] Major

Type

  • [ ] Added - for new features
  • [ ] Changed - for changes in existing functionality
  • [ ] Deprecated - for soon-to-be removed features
  • [ ] Removed - for now removed features
  • [x] Fixed - for any bug fixes
  • [ ] Security - in case of vulnerabilities

Message

When verifying signatures on incoming requests, the digest header now gets checked as expected.

obenland avatar Jun 19 '25 11:06 obenland