From 84caa0839b45733f313d125f89222ad52df51624 Mon Sep 17 00:00:00 2001 From: Shlee Date: Sat, 10 Jan 2026 10:39:21 +0700 Subject: [PATCH 1/8] Update VerifyHttpSignature.php --- app/Http/Middleware/VerifyHttpSignature.php | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/app/Http/Middleware/VerifyHttpSignature.php b/app/Http/Middleware/VerifyHttpSignature.php index 85c0e7ded..d4936c8b5 100644 --- a/app/Http/Middleware/VerifyHttpSignature.php +++ b/app/Http/Middleware/VerifyHttpSignature.php @@ -342,8 +342,13 @@ protected function isDateValid(string $dateHeader): bool return false; } - // @phpstan-ignore-next-line - return $date->diffInRealSeconds(now()) <= 3600; + $now = now(); + + if ($date->isAfter($now)) { + return false; + } + + return $date->diffInRealSeconds($now, true) <= 3600; } protected function fetchActorData(string $actorUrl) From 7c6eed5064e489c17450c3c0ef2ab30af74e8722 Mon Sep 17 00:00:00 2001 From: Shlee Date: Sat, 10 Jan 2026 10:41:35 +0700 Subject: [PATCH 2/8] Update VerifyHttpSignature.php --- app/Http/Middleware/VerifyHttpSignature.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/app/Http/Middleware/VerifyHttpSignature.php b/app/Http/Middleware/VerifyHttpSignature.php index d4936c8b5..9c866db0f 100644 --- a/app/Http/Middleware/VerifyHttpSignature.php +++ b/app/Http/Middleware/VerifyHttpSignature.php @@ -344,10 +344,12 @@ protected function isDateValid(string $dateHeader): bool $now = now(); + // Reject future dates if ($date->isAfter($now)) { return false; } + // Accept dates within the past hour return $date->diffInRealSeconds($now, true) <= 3600; } From e4fc4a33fbded2d144179b93fa75d73281fa3276 Mon Sep 17 00:00:00 2001 From: Shlee Date: Sat, 10 Jan 2026 10:43:00 +0700 Subject: [PATCH 3/8] Update VerifyUserHttpSignature.php --- app/Http/Middleware/VerifyUserHttpSignature.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/Http/Middleware/VerifyUserHttpSignature.php b/app/Http/Middleware/VerifyUserHttpSignature.php index 5d3e28ac0..58ad1b5a6 100644 --- a/app/Http/Middleware/VerifyUserHttpSignature.php +++ b/app/Http/Middleware/VerifyUserHttpSignature.php @@ -249,7 +249,7 @@ protected function isDateValid(string $dateHeader): bool } // @phpstan-ignore-next-line - return $date->diffInRealSeconds(now()) <= 3600; + return $date->diffInRealSeconds(now(), true) <= 3600; } protected function fetchActorData(string $actorUrl) From 7d2943deea0dd8fe4323ae1e3d0536c61706ddd1 Mon Sep 17 00:00:00 2001 From: Shlee Date: Sat, 10 Jan 2026 10:53:29 +0700 Subject: [PATCH 4/8] Update VerifyUserHttpSignature.php --- app/Http/Middleware/VerifyUserHttpSignature.php | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/app/Http/Middleware/VerifyUserHttpSignature.php b/app/Http/Middleware/VerifyUserHttpSignature.php index 58ad1b5a6..c9447e078 100644 --- a/app/Http/Middleware/VerifyUserHttpSignature.php +++ b/app/Http/Middleware/VerifyUserHttpSignature.php @@ -248,6 +248,13 @@ protected function isDateValid(string $dateHeader): bool return false; } + // Reject future dates + $now = now(); + if ($date->isAfter($now)) { + return false; + } + + // Accept dates within the past hour // @phpstan-ignore-next-line return $date->diffInRealSeconds(now(), true) <= 3600; } From 750f1fe4c8b2f54fde3f824eb8dc4c1179bd0c73 Mon Sep 17 00:00:00 2001 From: Shlee Date: Sat, 10 Jan 2026 10:56:07 +0700 Subject: [PATCH 5/8] Update VerifyHttpSignature.php --- app/Http/Middleware/VerifyHttpSignature.php | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/app/Http/Middleware/VerifyHttpSignature.php b/app/Http/Middleware/VerifyHttpSignature.php index 9c866db0f..f5b00dbfa 100644 --- a/app/Http/Middleware/VerifyHttpSignature.php +++ b/app/Http/Middleware/VerifyHttpSignature.php @@ -342,15 +342,17 @@ protected function isDateValid(string $dateHeader): bool return false; } - $now = now(); - - // Reject future dates - if ($date->isAfter($now)) { + $now = now('UTC'); + + // Reject if more than 1 hour in the future + if ($date->isAfter($now->copy()->addHour())) { + return false; + } + + // Reject if more than 1 hour in the past + if ($date->isBefore($now->copy()->subHour())) { return false; } - - // Accept dates within the past hour - return $date->diffInRealSeconds($now, true) <= 3600; } protected function fetchActorData(string $actorUrl) From 677970a17c3cc5becce2b1437fdc3f1c738b1f19 Mon Sep 17 00:00:00 2001 From: Shlee Date: Sat, 10 Jan 2026 10:58:17 +0700 Subject: [PATCH 6/8] Update VerifyUserHttpSignature.php --- app/Http/Middleware/VerifyUserHttpSignature.php | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/app/Http/Middleware/VerifyUserHttpSignature.php b/app/Http/Middleware/VerifyUserHttpSignature.php index c9447e078..d43aff5fc 100644 --- a/app/Http/Middleware/VerifyUserHttpSignature.php +++ b/app/Http/Middleware/VerifyUserHttpSignature.php @@ -248,15 +248,17 @@ protected function isDateValid(string $dateHeader): bool return false; } - // Reject future dates - $now = now(); - if ($date->isAfter($now)) { + $now = now('UTC'); + + // Reject if more than 1 hour in the future + if ($date->isAfter($now->copy()->addHour())) { + return false; + } + + // Reject if more than 1 hour in the past + if ($date->isBefore($now->copy()->subHour())) { return false; } - - // Accept dates within the past hour - // @phpstan-ignore-next-line - return $date->diffInRealSeconds(now(), true) <= 3600; } protected function fetchActorData(string $actorUrl) From 832257b4cba583ec1336cfde15f6efed15a980ba Mon Sep 17 00:00:00 2001 From: Shlee Date: Sat, 10 Jan 2026 11:02:26 +0700 Subject: [PATCH 7/8] Update VerifyHttpSignature.php --- app/Http/Middleware/VerifyHttpSignature.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/app/Http/Middleware/VerifyHttpSignature.php b/app/Http/Middleware/VerifyHttpSignature.php index f5b00dbfa..edc62a1cb 100644 --- a/app/Http/Middleware/VerifyHttpSignature.php +++ b/app/Http/Middleware/VerifyHttpSignature.php @@ -353,6 +353,8 @@ protected function isDateValid(string $dateHeader): bool if ($date->isBefore($now->copy()->subHour())) { return false; } + + Return true; } protected function fetchActorData(string $actorUrl) From 8511839a22575672c83d281e2caacebaa6601654 Mon Sep 17 00:00:00 2001 From: Shlee Date: Sat, 10 Jan 2026 11:03:01 +0700 Subject: [PATCH 8/8] Update VerifyUserHttpSignature.php --- app/Http/Middleware/VerifyUserHttpSignature.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/app/Http/Middleware/VerifyUserHttpSignature.php b/app/Http/Middleware/VerifyUserHttpSignature.php index d43aff5fc..bd29346c7 100644 --- a/app/Http/Middleware/VerifyUserHttpSignature.php +++ b/app/Http/Middleware/VerifyUserHttpSignature.php @@ -259,6 +259,8 @@ protected function isDateValid(string $dateHeader): bool if ($date->isBefore($now->copy()->subHour())) { return false; } + + Return true; } protected function fetchActorData(string $actorUrl)