3 Commits
1.0.4 ... 1.0.6

Author SHA1 Message Date
5deac6cf55 Fixed missing enum dependency
Used Taha Amin Ghafuri's (@tahaghafuri ) fork to replace the missing "cedx/enum" package with the "myclabs/php-enum" package
2023-05-18 21:10:14 -06:00
714d079287 owner.php - Typing fix 2023-05-18 21:10:14 -06:00
ea64578fd9 PushEvent - Updated the validateRequest() method
+ Added ability to skip secret key validation, which is useful for newer version of gitea (as its depreciated now)
2021-11-04 20:52:06 -06:00
5 changed files with 27 additions and 23 deletions

View File

@ -25,7 +25,7 @@
"php": ">=7.2.0",
"ext-curl": "*",
"ext-json": "*",
"cedx/enum": "^7.4.0",
"myclabs/php-enum": "^1.8",
"guzzlehttp/guzzle": "~6.0"
},
"require-dev": {

View File

@ -203,7 +203,7 @@ class Owner extends AbstractApiModel {
return $this;
}
public function getIsAdmin(): boolean {
public function getIsAdmin(): bool {
return $this->isAdmin;
}

View File

@ -1,11 +1,13 @@
<?php declare(strict_types=1);
<?php
declare(strict_types=1);
namespace Gitea\Model;
use Enum\{EnumTrait};
use MyCLabs\Enum\Enum;
/** Defines the state of a Gitea status. */
final class StatusState {
use EnumTrait;
final class StatusState extends Enum {
/** @var string The status is an error. */
const error = 'error';

View File

@ -1,11 +1,10 @@
<?php declare(strict_types=1);
namespace Gitea\Model;
use Enum\{EnumTrait};
use MyCLabs\Enum\Enum;
/** Defines the permission of a team. */
final class TeamPermission {
use EnumTrait;
final class TeamPermission extends Enum {
/** @var string The team has the administrator permission. */
const admin = 'admin';

View File

@ -59,9 +59,10 @@ class PushEvent extends AbstractApiModel {
* @param array $server The HTTP SERVER array for the push event
* @param string $body The raw data from the request body
* @param string $secretKey The secret key to from your server
* @return void
* @param bool $skipSecretValidation If set to true, secret key validation will be skipped (used for newer versions of Gitea)
* @return bool
*/
public static function validateRequest(array $server, string $body, string $secretKey)
public static function validateRequest(array $server, string $body, string $secretKey, bool $skipSecretValidation = false)
{
// Validate request protocol
if ($server['REQUEST_METHOD'] != 'POST') {
@ -80,18 +81,20 @@ class PushEvent extends AbstractApiModel {
throw new \RuntimeException("FAILED: Empty Body - The request has an empty body");
}
// Validate header signature
$headerSignature = isset($server['HTTP_X_GITEA_SIGNATURE']) ? $server['HTTP_X_GITEA_SIGNATURE'] : '';
if (empty($headerSignature)) {
throw new \RuntimeException("FAILED: Signature Missing - The request is missing the Gitea signature");
}
// calculate payload signature
$payload_signature = hash_hmac('sha256', $rawContent, $secretKey, false);
// check payload signature against header signature
if ($headerSignature != $payload_signature) {
throw new \RuntimeException("FAILED: Access Denied - The push event's secret does not match the expected secret");
if (!$skipSecretValidation) {
// Validate header signature
$headerSignature = isset($server['HTTP_X_GITEA_SIGNATURE']) ? $server['HTTP_X_GITEA_SIGNATURE'] : '';
if (empty($headerSignature)) {
throw new \RuntimeException("FAILED: Signature Missing - The request is missing the Gitea signature");
}
// calculate payload signature
$payload_signature = hash_hmac('sha256', $rawContent, $secretKey, false);
// check payload signature against header signature
if ($headerSignature != $payload_signature) {
throw new \RuntimeException("FAILED: Access Denied - The push event's secret does not match the expected secret");
}
}
return true;