From cd277e0937278c351a9f4fd00bfd7c9a9a316a01 Mon Sep 17 00:00:00 2001 From: vvzvlad Date: Fri, 7 Feb 2025 01:45:39 +0300 Subject: [PATCH] Enhance media URL signature verification with configurable signing key --- api_server.py | 2 +- url_signer.py | 19 +++++++++++-------- 2 files changed, 12 insertions(+), 9 deletions(-) diff --git a/api_server.py b/api_server.py index fd6a8fb..f159e8d 100644 --- a/api_server.py +++ b/api_server.py @@ -219,7 +219,7 @@ async def remove_old_cached_files(media_files: list, cache_dir: str) -> tuple[li if os.path.exists(cache_path): try: os.remove(cache_path) - # Попробуем удалить пустые родительские директории + # try to remove empty parent directories post_dir = os.path.dirname(cache_path) channel_dir = os.path.dirname(post_dir) if not os.listdir(post_dir): diff --git a/url_signer.py b/url_signer.py index 04235d1..75ad4a8 100644 --- a/url_signer.py +++ b/url_signer.py @@ -2,6 +2,9 @@ import hashlib import hmac import secrets import os +from config import get_settings + +Config = get_settings() SECRET_FILE = "data/media_digest.key" _signing_key = None @@ -41,12 +44,12 @@ def generate_media_digest(url: str) -> str: return signature.hexdigest()[:8] def verify_media_digest(url: str, digest: str | None) -> bool: - """ - Verify HMAC digest for media URL - Returns True if digest is valid - """ - if not digest: - return False + """Verify media URL signature""" + if not Config["media_url_signing_key"]: + return True # If no key configured, accept all requests - expected = generate_media_digest(url) - return hmac.compare_digest(expected, digest) + if digest is None: + return True # Accept requests without digest if signing is not enforced + + expected_digest = generate_media_digest(url) + return hmac.compare_digest(digest, expected_digest)