Update README

[github/Chocobozzz/PeerTube.git] / server / middlewares / secure.js

diff --git a/server/middlewares/secure.js b/server/middlewares/secure.js
index fd5bc51d6423babddf197cdbc797d287de77d5ff..7c5c72508d051dbc785521513cf17be2e83d103a 100644 (file)
--- a/server/middlewares/secure.js
+++ b/server/middlewares/secure.js
@@ -1,21 +1,18 @@
 'use strict'
 
+const db = require('../initializers/database')
 const logger = require('../helpers/logger')
-const mongoose = require('mongoose')
 const peertubeCrypto = require('../helpers/peertube-crypto')
 
-const Pod = mongoose.model('Pod')
-
 const secureMiddleware = {
-  checkSignature,
-  decryptBody
+  checkSignature
 }
 
 function checkSignature (req, res, next) {
   const host = req.body.signature.host
-  Pod.loadByHost(host, function (err, pod) {
+  db.Pod.loadByHost(host, function (err, pod) {
     if (err) {
-      logger.error('Cannot get signed host in decryptBody.', { error: err })
+      logger.error('Cannot get signed host in body.', { error: err })
       return res.sendStatus(500)
     }
 
@@ -24,35 +21,29 @@ function checkSignature (req, res, next) {
       return res.sendStatus(403)
     }
 
-    logger.debug('Decrypting body from %s.', host)
-
-    const signatureOk = peertubeCrypto.checkSignature(pod.publicKey, host, req.body.signature.signature)
+    logger.debug('Checking signature from %s.', host)
 
-    if (signatureOk === true) {
-      return next()
+    let signatureShouldBe
+    // If there is data in the body the sender used it for its signature
+    // If there is no data we just use its host as signature
+    if (req.body.data) {
+      signatureShouldBe = req.body.data
+    } else {
+      signatureShouldBe = host
     }
 
-    logger.error('Signature is not okay in decryptBody for %s.', req.body.signature.host)
-    return res.sendStatus(403)
-  })
-}
+    const signatureOk = peertubeCrypto.checkSignature(pod.publicKey, signatureShouldBe, req.body.signature.signature)
 
-function decryptBody (req, res, next) {
-  peertubeCrypto.decrypt(req.body.key, req.body.data, function (err, decrypted) {
-    if (err) {
-      logger.error('Cannot decrypt data.', { error: err })
-      return res.sendStatus(500)
-    }
+    if (signatureOk === true) {
+      res.locals.secure = {
+        pod
+      }
 
-    try {
-      req.body.data = JSON.parse(decrypted)
-      delete req.body.key
-    } catch (err) {
-      logger.error('Error in JSON.parse', { error: err })
-      return res.sendStatus(500)
+      return next()
     }
 
-    next()
+    logger.error('Signature is not okay in body for %s.', req.body.signature.host)
+    return res.sendStatus(403)
   })
 }