From e21395eda0527b5f13c09a8b5b3c202b8ceef72c Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Wed, 15 May 2024 10:28:18 +0200 Subject: [PATCH] fix: Correctly check result of function Signed-off-by: Joas Schilling --- index.php | 4 ++-- lib/Updater.php | 4 ++-- updater.phar | Bin 1172816 -> 1172822 bytes 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/index.php b/index.php index 31cf1f7f..84cb41e8 100644 --- a/index.php +++ b/index.php @@ -710,12 +710,12 @@ public function verifyIntegrity(): void { -----END CERTIFICATE----- EOF; - $validSignature = (bool)openssl_verify( + $validSignature = openssl_verify( file_get_contents($this->getDownloadedFilePath()), base64_decode($response['signature']), $certificate, OPENSSL_ALGO_SHA512 - ); + ) === 1; if ($validSignature === false) { throw new \Exception('Signature of update is not valid'); diff --git a/lib/Updater.php b/lib/Updater.php index 1833d070..9ee2d5ce 100644 --- a/lib/Updater.php +++ b/lib/Updater.php @@ -672,12 +672,12 @@ public function verifyIntegrity(): void { -----END CERTIFICATE----- EOF; - $validSignature = (bool)openssl_verify( + $validSignature = openssl_verify( file_get_contents($this->getDownloadedFilePath()), base64_decode($response['signature']), $certificate, OPENSSL_ALGO_SHA512 - ); + ) === 1; if ($validSignature === false) { throw new \Exception('Signature of update is not valid'); diff --git a/updater.phar b/updater.phar index f2d8d6ec4d420dbd681ebb7bc18706d10e65a067..50e18c9804e664e2f919f1dae1b12631ef07504c 100755 GIT binary patch delta 8414 zcma($d0bRg+joZ9?yUE+Gi(F0i!kgAdoGCys9BmTvWQtKlv||;X=Q36deVbSN}5?( zE-`srK+zV;N2Bs?^EbH5^6Z z>4rnEQ3VN1%zGd>XZ1$~R4`Ym$(0yodv8Gqin;xP6K&3pWtcQSL6~sr&S)oEm6OU; z&I7S?JQi+<~bbclk*GQqq+}Nm&6Tx7V2dc^OU=r_v6Nz~Nlbz^HZUn=`!Fk&W zotqQ&5kncq4J@3Uq>Xl>SH#{7vkgR#OiKFOiGuYx3?l*83l}cMInhD!NrqVoXL9O) zo9RTw@zzCVF8n%(dU?#vb57JAY(@ROwYarS)}cBdGvis)PY^0+7z|GIx@Qu@lz9lk zgWXYQC?*8|Qze__XR^3s6z*}~k?lk)x^~L)lb5~7$rOf8YrO#JF>rG16j_$@6FHf} zx9%VK#EF)Ar88AE!I1yp8AqIGPYh!~cCP?N`O`-bVkeII5-6TeFw8-vAP{ZiNGBQ| zz=fYZF6;5hW3s1w0zyh33M*sR$2ifA*v>OHxd()RJ`@gESytvmHpqLej|MXl#m8k2 zc`+!Y4~2tgHW;0#&O3`K9syi?YfjfY(K+T7uc5dE$k5FGkVTFSM}gi(c7A4tAm{?W zyx2j}V%t$LwB@KAAlJIel)}-QHqC$J3_XJ?{d}2-Dj?7M#lHWMA3(Or16e`oVT=x6sJ`j1^@Vy& z<`iFdnRU$RVo1&TgXJCl&>hJJe{8FRGHh|@Raznn!f(@mY3g83VIq%K2*M@z{(pik zaxTM^bPzEQ|6S9XFmr&k+?j zXlfidCksmZ9amH+oHSzik4{vR#@Q=p%Nit^Bz$TK_&?Qkj>7D;XVR&NzD#irV8(n{ zcgu-#OwTZXdjsbCx4XJ^_?wBIFeV_Ii5q$y3c0ZFPhcp-AA=ST`5!g6kHWidaZvRu z4XI4{U+}jqzj+(41iR#i=S>5v%fmSXg_A$t0^y+9uuENV)e`83cU{I(Soht&a3{*J zjA5o#sue=n`Ph~Y)1HP@*cMs5&^UJ;Iv@qGL+5)6LgdLF$2$%^^Z21*QV_FjT7w{b z_QL2LPPEZ7jA44F2*Ui@`!GrdbfL!hp>1Y9^1cI?|A_s@-HEQpGYa;*Dw*UHfTjmtDJr!n03C z&!V}@U{2=&=7p0395g|pxaN6Ti&n*HvHfcpe9uYTEDC$yfBFk2dcvN`xU^92SKPO@ zQI~o$Ocu!5^5QQLyghN*4CCc42y@gazI2-BG0bp-AgsMTX{Qs7Oy|0A)@a#Xe%96e z6n5_w_A?#Nowj%})^r%^y9OSDWpOUDlVrlV6|zaTx!5W6_Ab6dH-$^Q<#}1-MI)Re zb5|(*YexDW>TV=X{aCj8slY1wPkGhvR1wX+UY}KOxBhVCt4U1 zjhlx;ss8S&0SY~v--BfjaYUPgyD+n#g1^0QM#1b|7{b>;GeqvWk=18e43I6vh%Vs$1G|xMa|!AqD&Rb}xCE z*3GqiE|kJ)r=OWf6B&x`+k=_;eIZ(o!|y=+AX>Qffb1nda8(n9A1ovfX(;%8r$6N3 zR#n%pxQ;ffh)0c+HMsSlY>}fJTn&Xc{S&@}E((mrtG2+(T?^MF`cU|5%Z48)sep~S zG?=!ziwDi>DA?{$uvXl^Ne;sC1)_*P3DhwwhXZFww+S9}$nrbur;w-W*A`!+>$?X# z^O{W%Y68wfWq%To&oGO?0aE=IENR+tAXQK8@xXbX$tu4gpqf4u{`KFgZ#zuLd1OMd zQ&!{6PFW>Cgs{_x!j>whJ~;QJ&X6jKuJ)<^b{ySWOB zLi^mpFkbkhB0NxAI3EnVBLpEO{vD`DdXE7LesQgAl`omOP6`bnU;T%A$_1mUNN=XI z0BX7Z+?*AUNLX42)98>lXQlAY3;r-@>9p#wNssEnd01ydfZlj99BQ{ZDv?Pnfx4aX zw|NwE5S_AyGi(A(#wiElHu9>Q5N1H>;qHt=(@?tM^gJgj2wLKvkL&L%Cq+>cJ&P<*wA9OS3BaYHHW(sJrXM-nn23E}w7_hmo12d!k^-4;*&y{m=-3n< zX-dLvt6*+y1w-gV;mj3BU}$$}#rL0pt}(JU5CjS*6yNO$q8-dC581OnXQlAc+pEXW zuHgpbk&SYYyxvt<6!sqdTj67(=TOm6;0=8!{P5jF%P5_%HF}-?e%UJjjyBfe#zQi^ zlvD!OT-PO>!tFg4K=adbX7rZBa47RIYz)EW6@^_k`*Vv};a)|pR zdZX;e!sLWLKC>IJ0i z{9S||PDEFu_-jicIJahNIbY*#fa17=L6gTGNvhCnX2t?EH*%fW(LV~3!YjfT6{I}Sc7 z$3oQp^jUg^MlFS%afgcZzjFarGTkRMx0?!Nv)`1_6DHBEGRZYQDa_b8EP`GddNIaO z$nje*y$M69qbPvUgf|q*7StZgV_FaDO8rlIfdSq4^o|BOx0lsk;=KnP{_>A56%@|A z9+K1{P><$W`33kI)ZdupYu|FB=vX^f4tYGX5OO>zyC50z%hQ^f-Pa z+z^BOyyRW3J356|C)>t$DA2KEyEeikUGF+V;lRRz1#EVq{%N7CZ#M$gXKPI9<73O( zp~EVxT^&kc{OG!I^o|nB$a(!_Z~0@FYzluFcMD!Hs-ijh?f~fTA6;Y$yBF-t?{FZ7 zxz!3${xjxpsD_%fJ`8ge&JEZ59>Grz1*Y&lByJ1zVB&4(349|}Lal62@%C_}QsxCd7<^h+uw zHM=1#u<+v)o~h{pKU-|m@mk2M7ld(V%5OslYpwDN{Fp%DTdgs0U(eF<*W4LR;FBmYm^c$EOFKIlHkH*4| zehCiEjvkx?udrHf#5TZ(51R9f6TPqDF52MC(qZGmK^*@D8kGV0uhPqJxOO~++fQzSdq$y~gIOO7BX;|-mVF)8$97sD z=f-a!iy_97PKTVN)L&Q09(L8B9`SMZzAH7L_RejdERiGEVVF|OZ1ll#d1Fkhs+OUSU)NJjoH zHMrqn4H_#tG~_-Bdsq518^2wwG@(~M7>e6(N;W+5nxw-YrzlLs{+9gxP+YjjsKfJ$ zmHMsMq)i%f?{)bjHok4{NSElaCNDN9UoB$cG3rP)gzj^u>W z(u9hn3VTASJv}8cGFFdooRq?ebWGAKqW-^Z_{LAt0D_K7QwUP7*pm*EJ;c&EvZOKE=?*=PjrlCqHyLZ zX@@E$ARZD)QVulS$ZS^^sz-Z;EE9$i6?cX!cZ)p$!^Iflpmmy5sAM)CO{PzB)M+ zZ~k0!5$EjGcu`TFxWJ??XJicIcwD?p6ON1P)Nt3^pz*`4n>9MTqE0Pg%Q8(6{-I7i z1WU^`I&xu|rp=#BU#)ymN0ZQnY}=_EtDqnKiDQSdMnT-RD^nGC^G>CXB)2NV6eOfY zd0k00`;w|X%3sygQ+Mi=jreU)?lX0M7fJB}Wog*#`kP8pf78uNOUn1Dj`YM=EgE-n zIZidLfvo+@Einayga2SSYr%OYwUL0Q+Y~r1Ms)c{DFi47mH688N)s77QJE7#bYqnc zJr4k2{m8nd%A-1xVi3RfBZpODfrissRHDp-)2u_t3c>=lL-+Wk2;Nu+` ze>%tdT3Ik~!YM7%Wt+o0QCLDajpeN}W zhUFqbqYN?1|CKW2g8qz#A`5VBsZqk8R2qV)2iheEO(A4LfPSh!ZvVs(_lS>_F44D$ zB=ryd-9l`iBZ~OvKlFCSgKcjp960ufaXB94VN#Rt%M1$))Wp8D#nN$oDcF4xL%S5uMQLpvrloUz&*6Ew!*FLJ_L6X@YkFSHirj19S@y>e? z5K`oZr3^z50T2F}*lCVCK`X@)@v&$fSS)_3!(g=iF+V|RPkc6A)Z(8%5_{p@ewH8t zDQ)ge+^WodjnoMpc|mLH<&E3Q3>uPq*x1EEm3ZKv2a5wxy}z0)7%28r;p_86JuaLh z2H>wph}mRQy|_n34+fHZ^TbzFWb7QVR!Qt5M2}bktnaF6K+L!@!W4yT-ZzSP-fDvv z4$cBkF7^>~MVhxaA1gGL;Y~LTRrv2&ic}oD!k{Bf#|@JL$-++!SrIsIu`!mF1)jUw zP>5Ig8a3pu&KQ+TK+td>oVP@8r7DAXt^8XOvw(mF_eD}xZ7lV~tHMoYlA0)XfzoI& z>q+rS!x|`^1}L+}<%Zd$UxNYu<74^)Ft@(a&@Bqv@{NTo#{_bG%u22gGd>UhGZLor zA~W-il^$5SV_waRvF(z%5sJds($FbTL%z6U)+N&#)3fxD6${P#m~JoJ-qkXiN8->@ zb27f~V@#oC9^F}`xF}E^Lhe_a-}Jx_y^US*nf*qQjB7CO?MJF^o4dPp>Wxs4$=xi2 z^aM_faKi`EEG9BxfMu2s>DJv6qT$@NSM(bEO&61q#HU*xh`9P`i-G*}yk(7wGDPD3 zvlQ|8(V+$TmZLg~)RK|QjHlJ?BZiMAykm&cN+2^`)p&oJ-qlAmQv@3L3nhWBj^0R~ zOBWAIyu+d6{Yb-JV=o<505vkh(u>tFxs@-4=&@~%C@~6Ieao^=NwccOzb&v>@UmAe zdQx3u8Rt#o=Sw^`SQh2un#GnmN>y6K`4m)|wXB=o-NGMi=nX%!A9zjhUSXk4=mCeGG_rh68WwZRzbL+W3(n3d#K zrDcMGm-X&SOEOtG%~Gu(E#ocs6y)!zmX8%!s~Ye1HHjD~P4^_Gm!)B5 zGHmS!88wPH+0ku`>q=%TAN%s8S0l-; zr|G4ou~}i!;8lZ^;W+3EMIiaDMlr-e8V4ya>&Stpm7Cp2RFUGL5m!_zrjQkV6o*yh zSBGMog>0-;Y%}4JMG7NH8m92Hpo->D^8I+lDFs7f<5Mu{N4}sKu5ULG(yJ&;ha=C6YXl~(e&=pO(MOtWx=;07%pz96pfnKeAaP) zTbbT{vqDd1Sv?M+#U2~SoZ-@fnYl=rs|?033=zCQQvUfBKr0O_U$ AnE(I) delta 8035 zcma)AX?#@0vOj0mGwYd?ea~dFhmcJ6nGli)Mi2;uMG%lBE23zEtRjR63W5T`1{zr; z$`KR<6p%*QqE|stAQ2HnL6!^Rl|bAwL$=`X!kW{9APoBI@-7vvFN$ZB>lQ({ zdUn`m6`d$bW0apnLGT-W_)Qhn79}#uc95F1O>I)qt!_DtA{YeW!>7kTqN2Q_E{u|< z69nf8Nvoni3$qyI<3d3=nA7)Z6+KbdjZv0^p2^?FoK(^I?oQO92~<+efQA{9y9xSqejo@+6lEET<-AIGG2+XNwg=mN0W zoX@4E!bv}fPwB0q8Qt8BXDUb~x;K8QqBWi{r3%)mcPNJ5ST;jNJ-uAlD)7kn;Xe&m z(IHO)ldJ=~A4u))RncFb0!9(_f^cc+gBdEC=;3x3H$vX*N*}4BO}?|e19tz`WnHt1 zCVP{al-(o<8-Fb}si?2c#VA_fnV)4$1}k;F7-cuuGde5lmWo344=~EBKq+jzJV!-G zb%l)L0DB(0bR`XPAwCQ_0#X=t9AwBV`%9jING4KhFbY3yRXh+)dQOTRQSUvdqH`&9 z)ft#p_h{WE$PKzmQTNvcor>h-Fw|_9QSowS#UQFEw zDd;znQSQ$XghdT^EGkO%t7MdCRtm!Q$ErV2(SD_zQ7+yOiF>l=S3KO@4x4hq=N5{w zb(^7p-?i}Md~=o{JQJ4IPen>x7;@YEkn?#{u*XdUULMPxLGgpsLvXhAE|ez@t+H}o zd^<)EPF(z=s&j?6voC7|;fi0`?<%sxX(|67R)1z)IVAPvnHP3&KhPDAHJGh?@6P9MLw}73L)akWx>(VytRKLaDc06oAdhHypKeufZldU~EQdo;H&PrnXC)-b z408G-#^fs!740>cs%14#;$GiZ5PpAEr)-MYjV&nX0D@&}AP;p3B4kPCx{s?g3);e^5DJ`Afq;@;9}sVnkYVYav=2Kb15$Tev}xYT=y+e9Jl(7c`Ax=xzPSNesyO6 zb?WD7TUFE+?n2QYg@hh;a8(o^dhd*XXEP~869XYfol)q(b`x^Abj+N)klU|T&4Eii zBh`gl3}S-v2J~KP3&nr$+x!jNkS;|c_com}+}CU<-u$EPGwKr;YInvkeKVYbFgxO6 zjEbUS_+|St3>Re9Jn-lQCm%qzKxWRGvHUu%w1G_O5!foG>y!S>3a~L0wMX+>&4XQv zmJbCdDse8<5N<_|FdaG;$(!?eXxm-$zJjh+7Foi?VXPH(#ds%(p`(sVFRjZf!)-p*)6t;7;iE zOA@5@%!p)kZKqlJkCDqzJiWCD;@3aTg&j80hQ8lrR6=|s4#oS9O&&(0#p_`P)Nj^% z9WacYPotag)OiW2N_%(bIi|*UYF>p3Y%t$&1TIGI48I|~&2E|{0E`Nibj89uV0^t5DS^6B;SVqE? zpM1O&1NN>Brne1uet#&muNL1Ajh!23Lj(3&6@MQ;#e{{MZ1l2Ww&5`jF;qDQ0}?fk z;)elQL+BlFKZ~3haw&G-DY%sTCG=sG{t)luH;*T&s35+KQBJ{@*U4Z+v&)69-$+-Q zecMsYTKeMvZp?ri78Dup$7E>!Rc!wDMY>YNDDxplpL;x>mmR9TV?nbz6y-nyw~S&= z`b!Xv7#AO5HiZkqvp2J05Q&O$G5+>jX4ItGl&-$rDY_Sy#;NGT*q&^UBSC`j=VReI za6WX__F#$0&0Zgd#>VnmykZvwOUx(#p%ukt`avEvo?ozrI{!YVr4{mJ^&1+vlW7+? za41FzgAPFbN3m$iZ=do^I&jE@jwU#m%y6(aF#JzA-Ke-sMk$A&*59&^rFRb4(j^2r zUkOo4ef^T+`dw8yv>N*{{t~Fd?!EVuPX260y#Unt&%3A50^!|L2Y$RZ=j012+Lk$( z@wlKZ|9jKUH)%q-(AArYQV%ht_EM}5&V^K?cPI5nS$pt5ZjP^4tqbS1$yN^=ag-D4 zGYO_ws(|7z;Tgx+fw4PU3{*N`f4W3bT}tlqu2^+(rwS4?1CF$v3| z$y>QB#T}lYU7Z{;=(YH8)ccL44XRfRujs@eAN++8pUh z^T&3@=<8+_+x&L5u>MTXVMnh7@+aTJ5TRao2K|e>Cu(K5(%08zD0+{+1Pzj%unRl` zes?I=KyC`fC&%2lpL_1y8WT$W!=dc*RT#xNYg)ljIoZqN9#94|;|s5k`&-+tL_VqY zfPJDy#63W3C>d@0BU;(y>kJfoRbMXkg)Uh_M}GBJhQ@FUD8_U@)t}dQ3#<-Eie!6r zhuD1X8V^<3Y55nwIg}*dxhQT}c4QUJz#feM5y@>_2-<_NT zo50Y3+hZUD@_kOFn3r6B<6hlSNh4}MA}b4hlNQDIdoF?EO7Aj&ZM73JxOL;H?X*$5 zP}61wb<5@hvK|hbUcGn%FN~(mW}KjdRNUknoG1=1?YD&A`>>1}Hbp4SzQUmRd&(^h z?>Y@Re&}pAe^j0ZxgP!Y^rlw{e?qBdv;tyZQUU4{|5` z&r2{((96%6W|JN# zP9Ei!u68^iK-A;r0MV*Ufw6;zkK$_Qx}N;@ai$qis@ut|8V}|7d+;l5G(%nJTsjZJ zY&Z1j%4!%n>5K@L;jTfVO?kpse-yVI-#?3*mW0lB<&U1ZkUqUvh7@tXP*bGsP&%nl%erQ2}=V*W#2P_qBC>Ty-OpK zaTIBNBPvYv_K8I>f@~7`b74Jb9P{~In2egVap)xtAKl)Es{3~3ks0tMNXx&n{RMh6 zizBAM#jMR`w!8>mLKdbglmFY62vk;RRo?H#gHJIkB-7;XD8yaRgR&=TJD(YC5`JrAvra|AsfgS2j%61 z4M`QXwG)zYd6;80(S$oLcf+GrIpQhfi(35VK{<}>8RiJql9g*6$MyL0`HGeLHj)fL zBGTfBjj-wMRpK&oVTA}*F4`>rfXAjwX(TaT@|tnuQ(8aVeo1S>=^yCz(&9GaJhcG#JSwd^-fayw*HU}7yqaYBF# zF)aEM<#m0ONOue5%Dfx&7xZ*pN1j^?*KC3rl$8DpPl-@M% z7UwTLt0zm(8Ul?(_b+2+4lcc@Gm`ogCf znYgJ#y3Dr*VgP9zq95qO(^8CnrcFa+9MjAAE+(F+wN%WxJj##Nz)z8E5T%mR&%@n zkBv7;cz{l0!|xPp%%t+H=1L?EnxdUc4sFoh^%D4*mVq1BiMPpnPif0F1b%)al7AIz zo?VL@rb|KiZm`yfoo7Kf{WbAUe-b%TyF3`f|2Fc&Fl|pQ@e9#@Rz%+Ux3*a1_E8Da zd>$;@HAs5O@OM_;5f`HjhpN2OXysFilS?~Vo%<84{O`D<(; z_?XTbg&k|8DDw1ZOOXkWeb`ckuV-5HctNSfy<(}&g3BgKDR{ssDT~xaScsNPdf2i| zPhL;8w06Ox<1J?Lak6EN20NV=g*+N>nXV(HPD_UlJ6cVNxaE{Rj{DZ3F-gSxq#Fn2>5+Wx&04ngFsO+4>R`Zn4db zi}zTbq1N}nu#*)#=UHlTVYMR{mw9Ce{%f@qMA~%LD<)h7$Kc$QkpSb41nNcuUcAzl z_S@$RU9MjM!a&mUB-WHrk(jw`-C8x zCDCMMnEWi{=LmZrmbzp|z5V6h19BGd+lLPDJ#R0gZUXsYq^W+6OytN6eOnFt_s3(cLLq^4ys<72fi!yz