{"action":"created","comment":{"url":"https://api.github.com/repos/BOINC/boinc/pulls/comments/139642275","pull_request_review_id":63601429,"id":139642275,"diff_hunk":"@@ -0,0 +1,134 @@\n+<?php\n+// This file is part of BOINC.\n+// http://boinc.berkeley.edu\n+// Copyright (C) 2008 University of California\n+//\n+// BOINC is free software; you can redistribute it and/or modify it\n+// under the terms of the GNU Lesser General Public License\n+// as published by the Free Software Foundation,\n+// either version 3 of the License, or (at your option) any later version.\n+//\n+// BOINC is distributed in the hope that it will be useful,\n+// but WITHOUT ANY WARRANTY; without even the implied warranty of\n+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.\n+// See the GNU Lesser General Public License for more details.\n+//\n+// You should have received a copy of the GNU Lesser General Public License\n+// along with BOINC.  If not, see <http://www.gnu.org/licenses/>.\n+\n+require_once(\"../inc/boinc_db.inc\");\n+require_once(\"../inc/user.inc\");\n+require_once(\"../inc/util.inc\");\n+\n+// Needs to be defined, unknown use.\n+check_get_args(array(\"tnow\", \"ttok\"));\n+\n+// Check the user is online\n+$user = get_logged_in_user();\n+check_tokens($user->authenticator);\n+\n+// For some reason, I'm only able to use numbers, no letters.\n+// Need to provide security, but full functionality is likewise desirable.\n+$user_data = sanitize_tags(post_str(\"user_data\", true));\n+\n+// Following line a potential bug.\n+// $user_data = BoincDb::escape_string($user_data);\n+\n+//Has the user entered data with length > 0 & <= 256?\n+if (($user_data) && (strlen($user_data) <= 256)) {\n+\t// Retrieve the logged in user's UserID.\n+\t$userid = $user->id;\n+\n+\t// Create the message which will be signed.\n+\t$message_data = \"$userid $user_data\";","path":"html/user/openssl_sign_action.php","position":43,"original_position":43,"commit_id":"7b47dadbd9a90bf3dcc14a89b58004c54d46c525","original_commit_id":"7b47dadbd9a90bf3dcc14a89b58004c54d46c525","user":{"login":"grctest","id":15861527,"avatar_url":"https://avatars1.githubusercontent.com/u/15861527?v=4","gravatar_id":"","url":"https://api.github.com/users/grctest","html_url":"https://github.com/grctest","followers_url":"https://api.github.com/users/grctest/followers","following_url":"https://api.github.com/users/grctest/following{/other_user}","gists_url":"https://api.github.com/users/grctest/gists{/gist_id}","starred_url":"https://api.github.com/users/grctest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/grctest/subscriptions","organizations_url":"https://api.github.com/users/grctest/orgs","repos_url":"https://api.github.com/users/grctest/repos","events_url":"https://api.github.com/users/grctest/events{/privacy}","received_events_url":"https://api.github.com/users/grctest/received_events","type":"User","site_admin":false},"body":"I changed my proposal after your reply on steemit, the timestamp was removed because:\r\n* The external system key should be sufficient to prevent cross-network beacon replay attacks (stealing a registration from A to register on B).\r\n* Since UserID doesn't change, the beacon containing this 2-way handshake data should be permanent. If a beacon is invalidated due to external network issues, then perhaps the beacon could be replayed but if the old beacon isn't available for comparison then a timestamp wouldn't stop a replay. Ultimately they could replay but they couldn't change the external system key, so an attacker would just be re-advertising your legit beacon for you (not really an attack).\r\n\r\nThink the timestamp should be reintroduced?","created_at":"2017-09-19T09:35:00Z","updated_at":"2017-09-19T09:35:00Z","html_url":"https://github.com/BOINC/boinc/pull/2134#discussion_r139642275","pull_request_url":"https://api.github.com/repos/BOINC/boinc/pulls/2134","author_association":"NONE","_links":{"self":{"href":"https://api.github.com/repos/BOINC/boinc/pulls/comments/139642275"},"html":{"href":"https://github.com/BOINC/boinc/pull/2134#discussion_r139642275"},"pull_request":{"href":"https://api.github.com/repos/BOINC/boinc/pulls/2134"}},"in_reply_to_id":139619146},"pull_request":{"url":"https://api.github.com/repos/BOINC/boinc/pulls/2134","id":141740549,"html_url":"https://github.com/BOINC/boinc/pull/2134","diff_url":"https://github.com/BOINC/boinc/pull/2134.diff","patch_url":"https://github.com/BOINC/boinc/pull/2134.patch","issue_url":"https://api.github.com/repos/BOINC/boinc/issues/2134","number":2134,"state":"open","locked":false,"title":"Proof of UserID ownership using public key cryptography (openssl)","user":{"login":"grctest","id":15861527,"avatar_url":"https://avatars1.githubusercontent.com/u/15861527?v=4","gravatar_id":"","url":"https://api.github.com/users/grctest","html_url":"https://github.com/grctest","followers_url":"https://api.github.com/users/grctest/followers","following_url":"https://api.github.com/users/grctest/following{/other_user}","gists_url":"https://api.github.com/users/grctest/gists{/gist_id}","starred_url":"https://api.github.com/users/grctest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/grctest/subscriptions","organizations_url":"https://api.github.com/users/grctest/orgs","repos_url":"https://api.github.com/users/grctest/repos","events_url":"https://api.github.com/users/grctest/events{/privacy}","received_events_url":"https://api.github.com/users/grctest/received_events","type":"User","site_admin":false},"body":"Introducing an openssl signing function to prove within any external system that you are the owner of an UserID for an individual BOINC project, without storing external system data within the BOINC project's servers.\r\n\r\nIt outputs a text file download containing:\r\n```\r\n-----BEGIN USERID VERIFICATION-----\r\nUSER_ID: \r\nUSER_DATA: \r\nMSG: User_ID USER_DATA\r\nSHA512_MSG_DIGEST: \r\nBASE64_SIGNATURE: \r\nVerification: \r\n-----END USERID VERIFICATION-----\r\n```\r\n\r\nWould it be more appropriate to include this tool within the 'account keys' page? Or is there a better location for the hyperlink?\r\n\r\nRelevant issue for more information: https://github.com/BOINC/boinc/issues/2118","created_at":"2017-09-19T01:45:05Z","updated_at":"2017-09-19T09:35:00Z","closed_at":null,"merged_at":null,"merge_commit_sha":"85d275a46a5c8ab67d3b8ab491c73f1eb7688f37","assignee":null,"assignees":[],"requested_reviewers":[],"milestone":null,"commits_url":"https://api.github.com/repos/BOINC/boinc/pulls/2134/commits","review_comments_url":"https://api.github.com/repos/BOINC/boinc/pulls/2134/comments","review_comment_url":"https://api.github.com/repos/BOINC/boinc/pulls/comments{/number}","comments_url":"https://api.github.com/repos/BOINC/boinc/issues/2134/comments","statuses_url":"https://api.github.com/repos/BOINC/boinc/statuses/7b47dadbd9a90bf3dcc14a89b58004c54d46c525","head":{"label":"grctest:PublicKeyCrypto","ref":"PublicKeyCrypto","sha":"7b47dadbd9a90bf3dcc14a89b58004c54d46c525","user":{"login":"grctest","id":15861527,"avatar_url":"https://avatars1.githubusercontent.com/u/15861527?v=4","gravatar_id":"","url":"https://api.github.com/users/grctest","html_url":"https://github.com/grctest","followers_url":"https://api.github.com/users/grctest/followers","following_url":"https://api.github.com/users/grctest/following{/other_user}","gists_url":"https://api.github.com/users/grctest/gists{/gist_id}","starred_url":"https://api.github.com/users/grctest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/grctest/subscriptions","organizations_url":"https://api.github.com/users/grctest/orgs","repos_url":"https://api.github.com/users/grctest/repos","events_url":"https://api.github.com/users/grctest/events{/privacy}","received_events_url":"https://api.github.com/users/grctest/received_events","type":"User","site_admin":false},"repo":{"id":104009713,"name":"boinc","full_name":"grctest/boinc","owner":{"login":"grctest","id":15861527,"avatar_url":"https://avatars1.githubusercontent.com/u/15861527?v=4","gravatar_id":"","url":"https://api.github.com/users/grctest","html_url":"https://github.com/grctest","followers_url":"https://api.github.com/users/grctest/followers","following_url":"https://api.github.com/users/grctest/following{/other_user}","gists_url":"https://api.github.com/users/grctest/gists{/gist_id}","starred_url":"https://api.github.com/users/grctest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/grctest/subscriptions","organizations_url":"https://api.github.com/users/grctest/orgs","repos_url":"https://api.github.com/users/grctest/repos","events_url":"https://api.github.com/users/grctest/events{/privacy}","received_events_url":"https://api.github.com/users/grctest/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/grctest/boinc","description":"Open-source software for volunteer computing and grid computing.","fork":true,"url":"https://api.github.com/repos/grctest/boinc","forks_url":"https://api.github.com/repos/grctest/boinc/forks","keys_url":"https://api.github.com/repos/grctest/boinc/keys{/key_id}","collaborators_url":"https://api.github.com/repos/grctest/boinc/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/grctest/boinc/teams","hooks_url":"https://api.github.com/repos/grctest/boinc/hooks","issue_events_url":"https://api.github.com/repos/grctest/boinc/issues/events{/number}","events_url":"https://api.github.com/repos/grctest/boinc/events","assignees_url":"https://api.github.com/repos/grctest/boinc/assignees{/user}","branches_url":"https://api.github.com/repos/grctest/boinc/branches{/branch}","tags_url":"https://api.github.com/repos/grctest/boinc/tags","blobs_url":"https://api.github.com/repos/grctest/boinc/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/grctest/boinc/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/grctest/boinc/git/refs{/sha}","trees_url":"https://api.github.com/repos/grctest/boinc/git/trees{/sha}","statuses_url":"https://api.github.com/repos/grctest/boinc/statuses/{sha}","languages_url":"https://api.github.com/repos/grctest/boinc/languages","stargazers_url":"https://api.github.com/repos/grctest/boinc/stargazers","contributors_url":"https://api.github.com/repos/grctest/boinc/contributors","subscribers_url":"https://api.github.com/repos/grctest/boinc/subscribers","subscription_url":"https://api.github.com/repos/grctest/boinc/subscription","commits_url":"https://api.github.com/repos/grctest/boinc/commits{/sha}","git_commits_url":"https://api.github.com/repos/grctest/boinc/git/commits{/sha}","comments_url":"https://api.github.com/repos/grctest/boinc/comments{/number}","issue_comment_url":"https://api.github.com/repos/grctest/boinc/issues/comments{/number}","contents_url":"https://api.github.com/repos/grctest/boinc/contents/{+path}","compare_url":"https://api.github.com/repos/grctest/boinc/compare/{base}...{head}","merges_url":"https://api.github.com/repos/grctest/boinc/merges","archive_url":"https://api.github.com/repos/grctest/boinc/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/grctest/boinc/downloads","issues_url":"https://api.github.com/repos/grctest/boinc/issues{/number}","pulls_url":"https://api.github.com/repos/grctest/boinc/pulls{/number}","milestones_url":"https://api.github.com/repos/grctest/boinc/milestones{/number}","notifications_url":"https://api.github.com/repos/grctest/boinc/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/grctest/boinc/labels{/name}","releases_url":"https://api.github.com/repos/grctest/boinc/releases{/id}","deployments_url":"https://api.github.com/repos/grctest/boinc/deployments","created_at":"2017-09-19T01:19:11Z","updated_at":"2017-09-19T01:19:27Z","pushed_at":"2017-09-19T01:43:12Z","git_url":"git://github.com/grctest/boinc.git","ssh_url":"git@github.com:grctest/boinc.git","clone_url":"https://github.com/grctest/boinc.git","svn_url":"https://github.com/grctest/boinc","homepage":"http://boinc.berkeley.edu","size":208385,"stargazers_count":0,"watchers_count":0,"language":"PHP","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"BOINC:master","ref":"master","sha":"4ed6909e36a15cc9fb95fad56ea9eadc821ffe6e","user":{"login":"BOINC","id":985688,"avatar_url":"https://avatars3.githubusercontent.com/u/985688?v=4","gravatar_id":"","url":"https://api.github.com/users/BOINC","html_url":"https://github.com/BOINC","followers_url":"https://api.github.com/users/BOINC/followers","following_url":"https://api.github.com/users/BOINC/following{/other_user}","gists_url":"https://api.github.com/users/BOINC/gists{/gist_id}","starred_url":"https://api.github.com/users/BOINC/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BOINC/subscriptions","organizations_url":"https://api.github.com/users/BOINC/orgs","repos_url":"https://api.github.com/users/BOINC/repos","events_url":"https://api.github.com/users/BOINC/events{/privacy}","received_events_url":"https://api.github.com/users/BOINC/received_events","type":"Organization","site_admin":false},"repo":{"id":30260406,"name":"boinc","full_name":"BOINC/boinc","owner":{"login":"BOINC","id":985688,"avatar_url":"https://avatars3.githubusercontent.com/u/985688?v=4","gravatar_id":"","url":"https://api.github.com/users/BOINC","html_url":"https://github.com/BOINC","followers_url":"https://api.github.com/users/BOINC/followers","following_url":"https://api.github.com/users/BOINC/following{/other_user}","gists_url":"https://api.github.com/users/BOINC/gists{/gist_id}","starred_url":"https://api.github.com/users/BOINC/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BOINC/subscriptions","organizations_url":"https://api.github.com/users/BOINC/orgs","repos_url":"https://api.github.com/users/BOINC/repos","events_url":"https://api.github.com/users/BOINC/events{/privacy}","received_events_url":"https://api.github.com/users/BOINC/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/BOINC/boinc","description":"Open-source software for volunteer computing and grid computing.","fork":false,"url":"https://api.github.com/repos/BOINC/boinc","forks_url":"https://api.github.com/repos/BOINC/boinc/forks","keys_url":"https://api.github.com/repos/BOINC/boinc/keys{/key_id}","collaborators_url":"https://api.github.com/repos/BOINC/boinc/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/BOINC/boinc/teams","hooks_url":"https://api.github.com/repos/BOINC/boinc/hooks","issue_events_url":"https://api.github.com/repos/BOINC/boinc/issues/events{/number}","events_url":"https://api.github.com/repos/BOINC/boinc/events","assignees_url":"https://api.github.com/repos/BOINC/boinc/assignees{/user}","branches_url":"https://api.github.com/repos/BOINC/boinc/branches{/branch}","tags_url":"https://api.github.com/repos/BOINC/boinc/tags","blobs_url":"https://api.github.com/repos/BOINC/boinc/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/BOINC/boinc/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/BOINC/boinc/git/refs{/sha}","trees_url":"https://api.github.com/repos/BOINC/boinc/git/trees{/sha}","statuses_url":"https://api.github.com/repos/BOINC/boinc/statuses/{sha}","languages_url":"https://api.github.com/repos/BOINC/boinc/languages","stargazers_url":"https://api.github.com/repos/BOINC/boinc/stargazers","contributors_url":"https://api.github.com/repos/BOINC/boinc/contributors","subscribers_url":"https://api.github.com/repos/BOINC/boinc/subscribers","subscription_url":"https://api.github.com/repos/BOINC/boinc/subscription","commits_url":"https://api.github.com/repos/BOINC/boinc/commits{/sha}","git_commits_url":"https://api.github.com/repos/BOINC/boinc/git/commits{/sha}","comments_url":"https://api.github.com/repos/BOINC/boinc/comments{/number}","issue_comment_url":"https://api.github.com/repos/BOINC/boinc/issues/comments{/number}","contents_url":"https://api.github.com/repos/BOINC/boinc/contents/{+path}","compare_url":"https://api.github.com/repos/BOINC/boinc/compare/{base}...{head}","merges_url":"https://api.github.com/repos/BOINC/boinc/merges","archive_url":"https://api.github.com/repos/BOINC/boinc/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/BOINC/boinc/downloads","issues_url":"https://api.github.com/repos/BOINC/boinc/issues{/number}","pulls_url":"https://api.github.com/repos/BOINC/boinc/pulls{/number}","milestones_url":"https://api.github.com/repos/BOINC/boinc/milestones{/number}","notifications_url":"https://api.github.com/repos/BOINC/boinc/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/BOINC/boinc/labels{/name}","releases_url":"https://api.github.com/repos/BOINC/boinc/releases{/id}","deployments_url":"https://api.github.com/repos/BOINC/boinc/deployments","created_at":"2015-02-03T19:28:28Z","updated_at":"2017-09-19T06:46:52Z","pushed_at":"2017-09-19T03:49:15Z","git_url":"git://github.com/BOINC/boinc.git","ssh_url":"git@github.com:BOINC/boinc.git","clone_url":"https://github.com/BOINC/boinc.git","svn_url":"https://github.com/BOINC/boinc","homepage":"http://boinc.berkeley.edu","size":208382,"stargazers_count":448,"watchers_count":448,"language":"PHP","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":160,"mirror_url":null,"open_issues_count":365,"forks":160,"open_issues":365,"watchers":448,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/BOINC/boinc/pulls/2134"},"html":{"href":"https://github.com/BOINC/boinc/pull/2134"},"issue":{"href":"https://api.github.com/repos/BOINC/boinc/issues/2134"},"comments":{"href":"https://api.github.com/repos/BOINC/boinc/issues/2134/comments"},"review_comments":{"href":"https://api.github.com/repos/BOINC/boinc/pulls/2134/comments"},"review_comment":{"href":"https://api.github.com/repos/BOINC/boinc/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/BOINC/boinc/pulls/2134/commits"},"statuses":{"href":"https://api.github.com/repos/BOINC/boinc/statuses/7b47dadbd9a90bf3dcc14a89b58004c54d46c525"}},"author_association":"NONE"}}
{"actor":{"display_login":"grctest"}}