makes possible right validation for temporary signed routes

akaunting · Jul 29, 2021 · 22617a9 · 22617a9
1 parent ad2eb04
commit 22617a9
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/app/Http/Middleware/ValidateSignature.php b/app/Http/Middleware/ValidateSignature.php
@@ -38,7 +38,7 @@ public function handle($request, Closure $next)
     public function hasValidSignature(Request $request, $absolute = true)
     {
         return $this->hasCorrectSignature($request, $absolute)
-            && $this->signatureHasNotExpired($request);
+        && $this->signatureHasNotExpired($request);
     }
 
     /**
@@ -50,10 +50,12 @@ public function hasValidSignature(Request $request, $absolute = true)
      */
     public function hasCorrectSignature(Request $request, $absolute = true)
     {
-        $url = $absolute ? $request->url() : '/'.$request->path();
+        $url = $absolute ? $request->url() : '/' . $request->path();
 
         $original = rtrim($url . '?' . Arr::query(
             Arr::only($request->query(), ['company_id'])
+        ) . Arr::query(
+            Arr::only($request->query(), ['expires'])
         ), '?');
 
         $signature = hash_hmac('sha256', $original, call_user_func(function () {
@@ -73,6 +75,6 @@ public function signatureHasNotExpired(Request $request)
     {
         $expires = $request->query('expires');
 
-        return ! ($expires && Carbon::now()->getTimestamp() > $expires);
+        return !($expires && Carbon::now()->getTimestamp() > $expires);
     }
 }