Fix signature verification

Author: srosset81

tools/bazar/controllers/ApiController.php

@@ -134,7 +134,7 @@ public function postFormActorInbox($formId, Request $request)
         if ($activityPubService->isEnabled($form)) {
             $activity = json_decode($request->getContent(), true);
 
-            // $httpSignatureService->verifySignature($request);
+            $httpSignatureService->verifySignature($request);
             $activityPubService->processActivity($activity, $form);
 
             return new ApiResponse(null, Response::HTTP_OK, ['Content-Type' => 'application/activity+json']);

tools/bazar/services/HttpSignatureService.php

@@ -112,10 +112,13 @@ public function verifySignature(Request $request) {
             throw new Exception('Malformed public key');
         }
 
+        // We cannot use getRequestUri() because it returns the real URI, eg. /?api/forms/2/actor
+        $requestUri = $request->getScriptName();
+
         $sigParts = [];
         foreach (explode(' ', $sigConf['headers']) as $headerKey) {
             if ($headerKey === '(request-target)') {
-                $sigParts[] = sprintf('%s: %s %s', $headerKey, strtolower($request->getMethod()), $request->getRequestUri());
+                $sigParts[] = sprintf('%s: %s %s', $headerKey, strtolower($request->getMethod()), $requestUri);
             } else {
                 if (!$request->headers->has($headerKey)) {
                     throw new Exception('Missing signature part: ' . $headerKey);
@@ -129,8 +132,6 @@ public function verifySignature(Request $request) {
         }
 
         if ($request->headers->get('Digest') !== $this->getDigest($request->getContent())) {
-            var_dump('DIGEST1', $request->headers->get($headerKey));
-            var_dump('DIGEST2', $this->getDigest($request->getContent()));
             throw new Exception('Digest mismatch');
         }
     }