diff --git a/app/Http/Middleware/VerifyHttpSignature.php b/app/Http/Middleware/VerifyHttpSignature.php index 85c0e7ded..edc62a1cb 100644 --- a/app/Http/Middleware/VerifyHttpSignature.php +++ b/app/Http/Middleware/VerifyHttpSignature.php @@ -342,8 +342,19 @@ protected function isDateValid(string $dateHeader): bool return false; } - // @phpstan-ignore-next-line - return $date->diffInRealSeconds(now()) <= 3600; + $now = now('UTC'); + + // Reject if more than 1 hour in the future + if ($date->isAfter($now->copy()->addHour())) { + return false; + } + + // Reject if more than 1 hour in the past + if ($date->isBefore($now->copy()->subHour())) { + return false; + } + + Return true; } protected function fetchActorData(string $actorUrl) diff --git a/app/Http/Middleware/VerifyUserHttpSignature.php b/app/Http/Middleware/VerifyUserHttpSignature.php index 5d3e28ac0..bd29346c7 100644 --- a/app/Http/Middleware/VerifyUserHttpSignature.php +++ b/app/Http/Middleware/VerifyUserHttpSignature.php @@ -248,8 +248,19 @@ protected function isDateValid(string $dateHeader): bool return false; } - // @phpstan-ignore-next-line - return $date->diffInRealSeconds(now()) <= 3600; + $now = now('UTC'); + + // Reject if more than 1 hour in the future + if ($date->isAfter($now->copy()->addHour())) { + return false; + } + + // Reject if more than 1 hour in the past + if ($date->isBefore($now->copy()->subHour())) { + return false; + } + + Return true; } protected function fetchActorData(string $actorUrl)