Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

PLAT-10806 authenticate uri #9413

Merged
merged 4 commits into from May 18, 2020
Merged

PLAT-10806 authenticate uri #9413

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ca2efb7
PLAT-10806 authenticate uri
gotlieb May 13, 2020
048e1d9
PLAT-10806
gotlieb May 18, 2020
b78c49a
PLAT-10806
gotlieb May 18, 2020
53f37a5
PLAT-10806
gotlieb May 18, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
49 changes: 49 additions & 0 deletions alpha/apps/kaltura/lib/request/kNetworkUtils.php
View file
Open in desktop
@@ -0,0 +1,49 @@
<?php
/**
* @package server-infra
* @subpackage request
*/
class kNetworkUtils
{
const KALTURA_AUTH_HEADER = 'HTTP_X_KALTURA_AUTH';
/**
* @return bool
* @throws Exception
*/
public static function isAuthenticatedURI()
{
if (!isset($_SERVER[self::KALTURA_AUTH_HEADER]))
{
KalturaLog::warning("Missing Header Parameter - ". self::KALTURA_AUTH_HEADER);
return false;
}
$xKalturaAuth = $_SERVER[self::KALTURA_AUTH_HEADER];
$parts = explode(',', $xKalturaAuth);
if (count($parts) != 3)
{
KalturaLog::warning('Invalid Fromat for ' . self::KALTURA_AUTH_HEADER);
return false;
}

$version = $parts[0];
$timestamp = $parts[1];
$expectedSignature = $parts[2];
$url = $_SERVER['REQUEST_URI'];
$secret = kConf::get('authentication_secret','local', null);
gotlieb marked this conversation as resolved.
Show resolved Hide resolved
if (!$secret)
{
KalturaLog::warning("Missing authentication_secret in configuration");
return false;
}

$actualSignature = base64_encode(hash_hmac('sha256', "$version,$timestamp,$url", $secret, true));
KalturaLog::debug("Actual Signature [$actualSignature] - Expected Signature [$expectedSignature]" );
if ( $actualSignature !== $expectedSignature)
{
KalturaLog::warning("Could not authenticate X-Kaltura-Auth");
return false;
}

return true;
}
}
4 changes: 2 additions & 2 deletions alpha/apps/kaltura/modules/extwidget/actions/serveFlavorAction.class.php
View file
Open in desktop
Expand Up @@ -26,7 +26,7 @@ protected static function jsonEncode($obj)
}
return json_encode($obj, $options);
}

public function getFileSyncFullPath(FileSync $fileSync, $local = true)
{
if(!$local)
Expand Down Expand Up @@ -482,7 +482,7 @@ public function execute()

$syncKey = $flavorAsset->getSyncKey(flavorAsset::FILE_SYNC_FLAVOR_ASSET_SUB_TYPE_ASSET, $version);

if ($this->pathOnly && kIpAddressUtils::isInternalIp($_SERVER['REMOTE_ADDR']))
if ($this->pathOnly && (kIpAddressUtils::isInternalIp($_SERVER['REMOTE_ADDR'])) || kNetworkUtils::isAuthenticatedURI())
{
$path = '';
$parent_file_sync = null;
Expand Down
1 change: 1 addition & 0 deletions configurations/local.template.ini
View file
Open in desktop
Expand Up @@ -17,6 +17,7 @@ push_server_secret = @TOKEN@
push_server_secret_iv = @TOKEN_IV@
push_server_exchange = @EXCHANGE_NAME@
live_packager_secure_token = @LIVE_PACKAGER_TOKEN@
authentication_secret = @AUTHENTICATION_SECRET@

; Define a packager url for thumbs and volume_map (https://kaltura.atlassian.net/browse/PLAT-10835).
; The value set in the below directive will be concatenated to that set in packager_url
Expand Down