Skip to content

Conversation

@amulet1
Copy link
Contributor

@amulet1 amulet1 commented Jul 6, 2025

The verification code in verifySignedUrl and verifySignedQueryString methods expects the $data string to be in the following format: {url_with_timestamp}&_h={hash}. The supplied hash is checked against the hash computed on {url_with_timestamp}&_h= part.

However, both signUrl and signQueryString add an extra = (only in case if the supplied parameter is an instance of Horde_Url class), i.e. a hash is computed on {url_with_timestamp}&_h==, and the subsequent verification fails.

This is required (but not enough) in order to resolve horde/base#12

@amulet1
Copy link
Contributor Author

amulet1 commented Jul 6, 2025

@ralflang, please review.

@amulet1 amulet1 deleted the branch horde:FRAMEWORK_6_0 July 8, 2025 20:25
@amulet1 amulet1 closed this Jul 8, 2025
@amulet1 amulet1 deleted the FRAMEWORK_6_0 branch July 8, 2025 20:25
@amulet1 amulet1 restored the FRAMEWORK_6_0 branch July 8, 2025 20:26
@amulet1 amulet1 reopened this Jul 8, 2025
@amulet1 amulet1 marked this pull request as draft July 8, 2025 20:28
@amulet1 amulet1 closed this Jul 8, 2025
@TDannhauer TDannhauer requested review from ralflang and removed request for ralflang August 13, 2025 19:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Messed up URL when redirecting to auth during login or refresh

1 participant