|
|
|
|
@ -281,10 +281,6 @@ class Installer { |
|
|
|
|
// Check if the signature actually matches the downloaded content |
|
|
|
|
$certificate = openssl_get_publickey($app['certificate']); |
|
|
|
|
$verified = (bool)openssl_verify(file_get_contents($tempFile), base64_decode($app['releases'][0]['signature']), $certificate, OPENSSL_ALGO_SHA512); |
|
|
|
|
// PHP 8+ deprecates openssl_free_key and automatically destroys the key instance when it goes out of scope |
|
|
|
|
if ((PHP_VERSION_ID < 80000)) { |
|
|
|
|
openssl_free_key($certificate); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
if ($verified === true) { |
|
|
|
|
// Seems to match, let's proceed |
|
|
|
|
@ -305,6 +301,15 @@ class Installer { |
|
|
|
|
$folders = array_diff($allFiles, ['.', '..']); |
|
|
|
|
$folders = array_values($folders); |
|
|
|
|
|
|
|
|
|
if (count($folders) < 1) { |
|
|
|
|
throw new \Exception( |
|
|
|
|
sprintf( |
|
|
|
|
'Extracted app %s has no folders', |
|
|
|
|
$appId |
|
|
|
|
) |
|
|
|
|
); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
if (count($folders) > 1) { |
|
|
|
|
throw new \Exception( |
|
|
|
|
sprintf( |
|
|
|
|
@ -315,13 +320,17 @@ class Installer { |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
// Check if appinfo/info.xml has the same app ID as well |
|
|
|
|
if ((PHP_VERSION_ID < 80000)) { |
|
|
|
|
$loadEntities = libxml_disable_entity_loader(false); |
|
|
|
|
$xml = simplexml_load_string(file_get_contents($extractDir . '/' . $folders[0] . '/appinfo/info.xml')); |
|
|
|
|
libxml_disable_entity_loader($loadEntities); |
|
|
|
|
} else { |
|
|
|
|
$xml = simplexml_load_string(file_get_contents($extractDir . '/' . $folders[0] . '/appinfo/info.xml')); |
|
|
|
|
$xml = simplexml_load_string(file_get_contents($extractDir . '/' . $folders[0] . '/appinfo/info.xml')); |
|
|
|
|
|
|
|
|
|
if ($xml === false) { |
|
|
|
|
throw new \Exception( |
|
|
|
|
sprintf( |
|
|
|
|
'Failed to load info.xml for app id %s', |
|
|
|
|
$appId, |
|
|
|
|
) |
|
|
|
|
); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
if ((string)$xml->id !== $appId) { |
|
|
|
|
throw new \Exception( |
|
|
|
|
sprintf( |
|
|
|
|
|