<commit_before><?php

declare(strict_types=1);

/*
 * This file is part of the Superdesk Web Publisher Core Bundle.
 *
 * Copyright 2018 Sourcefabric z.ú. and contributors.
 *
 * For the full copyright and license information, please see the
 * AUTHORS and LICENSE files distributed with this source code.
 *
 * @copyright 2018 Sourcefabric z.ú
 * @license http://www.superdesk.org/license
 */

namespace SWP\Bundle\CoreBundle\EventListener;

use Superdesk\ContentApiSdk\Exception\AuthenticationException;
use SWP\Bundle\CoreBundle\Model\OrganizationInterface;
use SWP\Component\MultiTenancy\Context\TenantContextInterface;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\HttpKernel\Event\GetResponseEvent;

class SecuredContentPushListener
{
    private const SUPERDESK_HEADER = 'x-superdesk-signature';
    private const PUBLISHER_HEADER = 'x-publisher-signature';

    /**
     * @var TenantContextInterface
     */
    protected $tenantContext;

    /**
     * SecuredContentPushListener constructor.
     *
     * @param TenantContextInterface $tenantContext
     */
    public function __construct(TenantContextInterface $tenantContext)
    {
        $this->tenantContext = $tenantContext;
    }

    /**
     * @param GetResponseEvent $event
     *
     * @throws AuthenticationException
     */
    public function onKernelRequest(GetResponseEvent $event)
    {
        $request = $event->getRequest();
        $routeName = $request->attributes->get('_route');
        if (
            'swp_api_content_push' !== $routeName &&
            'swp_api_assets_push' !== $routeName &&
            'swp_api_core_add_extra_data' !== $routeName &&
            'swp_api_core_get_extra_data' !== $routeName
        ) {
            return;
        }

        $signature = null;
        if ($request->headers->has(self::SUPERDESK_HEADER)) {
            $signature = $request->headers->get(self::SUPERDESK_HEADER);
        } elseif ($request->headers->has(self::PUBLISHER_HEADER)) {
            $signature = $request->headers->get(self::PUBLISHER_HEADER);
        }

        /** @var OrganizationInterface $organization */
        $organization = $this->tenantContext->getTenant()->getOrganization();
        $organizationToken = $organization->getSecretToken();
        if (null === $organizationToken && null !== $signature) {
            return;
        }

        if (null === $organizationToken) {
            $event->setResponse(new Response('Bad credentials', 401));
            $event->stopPropagation();

            return;
        }

        $token = hash_hmac('sha1', $request->getContent(), $organizationToken);
        if ($signature !== 'sha1='.$token) {
            $event->setResponse(new Response('Bad credentials', 401));
            $event->stopPropagation();
        }
    }
}<commit_msg>fix condition in secured content push listener<commit_after><?php

declare(strict_types=1);

/*
 * This file is part of the Superdesk Web Publisher Core Bundle.
 *
 * Copyright 2018 Sourcefabric z.ú. and contributors.
 *
 * For the full copyright and license information, please see the
 * AUTHORS and LICENSE files distributed with this source code.
 *
 * @copyright 2018 Sourcefabric z.ú
 * @license http://www.superdesk.org/license
 */

namespace SWP\Bundle\CoreBundle\EventListener;

use Superdesk\ContentApiSdk\Exception\AuthenticationException;
use SWP\Bundle\CoreBundle\Model\OrganizationInterface;
use SWP\Component\MultiTenancy\Context\TenantContextInterface;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\HttpKernel\Event\GetResponseEvent;

class SecuredContentPushListener
{
    private const SUPERDESK_HEADER = 'x-superdesk-signature';

    private const PUBLISHER_HEADER = 'x-publisher-signature';

    /**
     * @var TenantContextInterface
     */
    protected $tenantContext;

    /**
     * SecuredContentPushListener constructor.
     *
     * @param TenantContextInterface $tenantContext
     */
    public function __construct(TenantContextInterface $tenantContext)
    {
        $this->tenantContext = $tenantContext;
    }

    /**
     * @param GetResponseEvent $event
     *
     * @throws AuthenticationException
     */
    public function onKernelRequest(GetResponseEvent $event)
    {
        $request = $event->getRequest();
        $routeName = $request->attributes->get('_route');
        if (
            'swp_api_content_push' !== $routeName &&
            'swp_api_assets_push' !== $routeName &&
            'swp_api_core_add_extra_data' !== $routeName &&
            'swp_api_core_get_extra_data' !== $routeName
        ) {
            return;
        }

        $signature = null;
        if ($request->headers->has(self::SUPERDESK_HEADER)) {
            $signature = $request->headers->get(self::SUPERDESK_HEADER);
        } elseif ($request->headers->has(self::PUBLISHER_HEADER)) {
            $signature = $request->headers->get(self::PUBLISHER_HEADER);
        }

        /** @var OrganizationInterface $organization */
        $organization = $this->tenantContext->getTenant()->getOrganization();
        $organizationToken = $organization->getSecretToken();
        if (null === $organizationToken && null === $signature) {
            return;
        }

        if (null === $organizationToken) {
            $event->setResponse(new Response('Bad credentials', 401));
            $event->stopPropagation();

            return;
        }

        $token = hash_hmac('sha1', $request->getContent(), $organizationToken);
        if ($signature !== 'sha1='.$token) {
            $event->setResponse(new Response('Bad credentials', 401));
            $event->stopPropagation();
        }
    }
}
{'fraction_non_alphanumeric': 0.12249208025343189, 'fraction_numerical': 0.00598380851812742, 'mean_word_length': 2.9139118457300275, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 45, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6962201', 'n_tokens_mistral': 1622, 'n_tokens_neox': 1551, 'n_words': 302}