Sha256: 6a955ff94d6c58592608c679552083a0d25c8dcfaf69b3f6a96ae56697d23b73
Contents?: true
Size: 1.47 KB
Versions: 2
Compression:
Stored size: 1.47 KB
Contents
module SignedForm class GateKeeper attr_reader :allowed_attributes def initialize(controller) @controller = controller @params = controller.params @request = controller.request extract_and_verify_form_signature verify_destination verify_digest end def options @options ||= {} end def extract_and_verify_form_signature data, signature = @params['form_signature'].split('--', 2) hmac = SignedForm::HMAC.new secret_key: SignedForm.secret_key signature ||= '' raise Errors::InvalidSignature, "Form signature is not valid" unless hmac.verify signature, data @allowed_attributes = Marshal.load Base64.strict_decode64(data) @options = allowed_attributes.delete(:_options_) end def verify_destination return unless options[:method] && options[:url] raise Errors::InvalidURL if options[:method].to_s.casecmp(@request.request_method) != 0 url = @controller.url_for(options[:url]) raise Errors::InvalidURL if url != @request.fullpath && url != @request.url end def verify_digest return unless options[:digest] return if options[:digest_expiration] && Time.now < options[:digest_expiration] digestor = options[:digest] given_digest = digestor.to_s digestor.view_paths = @controller.view_paths.map(&:to_s) digestor.refresh raise Errors::ExpiredForm unless given_digest == digestor.to_s end end end
Version data entries
2 entries across 2 versions & 1 rubygems
Version | Path |
---|---|
signed_form-0.5.0 | lib/signed_form/gate_keeper.rb |
signed_form-0.2.0 | lib/signed_form/gate_keeper.rb |