2c3a8a0584
API / Security: - Add api/_helpers.php: shared send_security_headers(), verify_origin(), get_hmac_secret(), check_rate_limit(), read_json_locked(), write_json_locked() - shorten.php: remove Access-Control-Allow-Origin:*, restrict to same-origin, rate-limit 20 req/h per IP, atomic JSON read+lock, HMAC secret from file - verify.php: rate-limit GET (30/min) and POST (10/h) per IP, atomic lock, prevent overwriting existing proofs, origin check on POST - node.php: fix rate limit from 1000 to 60 req/min, add security headers, origin check - check-short.php: add security headers, re-derive signature server-side - s.php: use file-based HMAC secret via get_hmac_secret(), hash_equals() for timing-safe comparison Service Worker: - sw.js: navigation requests (mode=navigate) never served from cache; network-first with offline fallback to prevent stale invoice state Documentation (honest claims): - README: tagline "No backend" -> "No tracking"; new Architecture table listing exactly what server sees for each feature; Security Model section - index.html: meta description and footer updated from "No Backend" to "Minimal Backend" - i18n.js footer: already updated in previous commit
43 lines
1.3 KiB
PHP
43 lines
1.3 KiB
PHP
<?php
|
|
$code = trim($_SERVER['PATH_INFO'] ?? $_GET['c'] ?? '', '/');
|
|
|
|
if (empty($code) || !preg_match('/^[a-z0-9]{4,10}$/', $code)) {
|
|
http_response_code(404);
|
|
echo 'Not found';
|
|
exit;
|
|
}
|
|
|
|
$dbFile = __DIR__ . '/data/urls.json';
|
|
if (!file_exists($dbFile)) {
|
|
http_response_code(404);
|
|
echo 'Not found';
|
|
exit;
|
|
}
|
|
|
|
$urls = json_decode(file_get_contents($dbFile), true) ?: [];
|
|
|
|
if (!isset($urls[$code])) {
|
|
http_response_code(404);
|
|
echo 'Not found';
|
|
exit;
|
|
}
|
|
|
|
// Support both old format (string) and new format (array with hash & signature)
|
|
$data = $urls[$code];
|
|
$hash = is_array($data) ? $data['h'] : $data;
|
|
$signature = is_array($data) ? $data['s'] : null;
|
|
|
|
// Verify HMAC signature if present (detect server-side tampering)
|
|
if ($signature) {
|
|
require_once __DIR__ . '/api/_helpers.php';
|
|
$expected_sig = hash_hmac('sha256', $hash, get_hmac_secret());
|
|
if (!hash_equals($expected_sig, $signature)) {
|
|
// Signature mismatch — possible tampering, log and proceed (graceful degradation)
|
|
error_log("xmrpay: Signature mismatch for code $code");
|
|
}
|
|
}
|
|
|
|
$base = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? 'https' : 'http') . '://' . $_SERVER['HTTP_HOST'];
|
|
header('Location: ' . $base . '/#' . $hash . '&c=' . $code, true, 302);
|
|
exit;
|