aboutsummaryrefslogtreecommitdiffhomepage
path: root/server/middlewares/secure.js
diff options
context:
space:
mode:
Diffstat (limited to 'server/middlewares/secure.js')
-rw-r--r--server/middlewares/secure.js42
1 files changed, 26 insertions, 16 deletions
diff --git a/server/middlewares/secure.js b/server/middlewares/secure.js
index 9779c14ac..58f824d14 100644
--- a/server/middlewares/secure.js
+++ b/server/middlewares/secure.js
@@ -7,10 +7,11 @@ const peertubeCrypto = require('../helpers/peertube-crypto')
7const Pod = mongoose.model('Pod') 7const Pod = mongoose.model('Pod')
8 8
9const secureMiddleware = { 9const secureMiddleware = {
10 decryptBody: decryptBody 10 checkSignature,
11 decryptBody
11} 12}
12 13
13function decryptBody (req, res, next) { 14function checkSignature (req, res, next) {
14 const url = req.body.signature.url 15 const url = req.body.signature.url
15 Pod.loadByUrl(url, function (err, pod) { 16 Pod.loadByUrl(url, function (err, pod) {
16 if (err) { 17 if (err) {
@@ -28,21 +29,30 @@ function decryptBody (req, res, next) {
28 const signatureOk = peertubeCrypto.checkSignature(pod.publicKey, url, req.body.signature.signature) 29 const signatureOk = peertubeCrypto.checkSignature(pod.publicKey, url, req.body.signature.signature)
29 30
30 if (signatureOk === true) { 31 if (signatureOk === true) {
31 peertubeCrypto.decrypt(req.body.key, req.body.data, function (err, decrypted) { 32 return next()
32 if (err) { 33 }
33 logger.error('Cannot decrypt data.', { error: err }) 34
34 return res.sendStatus(500) 35 logger.error('Signature is not okay in decryptBody for %s.', req.body.signature.url)
35 } 36 return res.sendStatus(403)
36 37 })
37 req.body.data = JSON.parse(decrypted) 38}
38 delete req.body.key 39
39 40function decryptBody (req, res, next) {
40 next() 41 peertubeCrypto.decrypt(req.body.key, req.body.data, function (err, decrypted) {
41 }) 42 if (err) {
42 } else { 43 logger.error('Cannot decrypt data.', { error: err })
43 logger.error('Signature is not okay in decryptBody for %s.', req.body.signature.url) 44 return res.sendStatus(500)
44 return res.sendStatus(403)
45 } 45 }
46
47 try {
48 req.body.data = JSON.parse(decrypted)
49 delete req.body.key
50 } catch (err) {
51 logger.error('Error in JSON.parse', { error: err })
52 return res.sendStatus(500)
53 }
54
55 next()
46 }) 56 })
47} 57}
48 58