From cb74bed0bc5e5d5cc02af0a2e6cbda4f68416003 Mon Sep 17 00:00:00 2001 From: DariusIII Date: Sun, 17 Dec 2023 17:55:51 +0100 Subject: [PATCH] CS fixes --- app/Http/Controllers/BtcPaymentController.php | 3 ++- routes/web.php | 12 ++++++------ 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/app/Http/Controllers/BtcPaymentController.php b/app/Http/Controllers/BtcPaymentController.php index 8c57aab50..28c5141a5 100644 --- a/app/Http/Controllers/BtcPaymentController.php +++ b/app/Http/Controllers/BtcPaymentController.php @@ -113,8 +113,9 @@ class BtcPaymentController extends BasePageController public static function verify_webhook($data, $hmac_header): bool { - # Calculate HMAC + // Calculate HMAC $calculated_hmac = base64_encode(hash_hmac('sha256', $data, config('nntmux.btcpay_webhook_secret'), true)); + return hash_equals($hmac_header, $calculated_hmac); } } diff --git a/routes/web.php b/routes/web.php index 6599c83a9..5a15ff7e7 100644 --- a/routes/web.php +++ b/routes/web.php @@ -377,13 +377,13 @@ Route::post('2faVerify', function () { })->name('2faVerify')->middleware('2fa'); Route::post('btcpay/webhook', function (Illuminate\Http\Request $request) { - # Extract the signature header + // Extract the signature header $hmac_header = $_SERVER['btcpay-sig']; - # Get the raw body + // Get the raw body $data = file_get_contents('php://input'); - # Compare HMACs + // Compare HMACs $verified = BtcPaymentController::verify_webhook($data, $hmac_header); if ($verified) { $payload = json_decode($request->getContent(), true); @@ -411,13 +411,13 @@ Route::post('btcpay/webhook', function (Illuminate\Http\Request $request) { } }); Route::get('btcpay/webhook', function (Illuminate\Http\Request $request) { - # Extract the signature header + // Extract the signature header $hmac_header = $_SERVER['btcpay-sig']; - # Get the raw body + // Get the raw body $data = file_get_contents('php://input'); - # Compare HMACs + // Compare HMACs $verified = BtcPaymentController::verify_webhook($data, $hmac_header); if ($verified) { $payload = json_decode($request->getContent(), true);