Class: Insight::ParamsSignature

Inherits:
Object
  • Object
show all
Extended by:
ERB::Util
Defined in:
lib/insight/params_signature.rb

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(request) ⇒ ParamsSignature

Returns a new instance of ParamsSignature.



23
24
25
 
# File 'lib/insight/params_signature.rb', line 23

def initialize(request)
  @request = request
end

Instance Attribute Details

#request ⇒ Object (readonly)

Returns the value of attribute request.



21
22
23
 
# File 'lib/insight/params_signature.rb', line 21

def request
  @request
end

Class Method Details

.sign(request, hash) ⇒ Object 



8
9
10
11
12
13
14
15
16
17
18
19
 
# File 'lib/insight/params_signature.rb', line 8

def self.sign(request, hash)
  parts = []

  hash.keys.sort.each do |key|
    parts << "#{key}=#{u(hash[key])}"
  end

  signature = new(request).signature(hash)
  parts << "hash=#{u(signature)}"

  parts.join("&amp;")
end

Instance Method Details

#secret_key ⇒ Object 



27
28
29
 
# File 'lib/insight/params_signature.rb', line 27

def secret_key
  @request.env['insight.secret_key']
end

#secret_key_blank? ⇒ Boolean

Returns:

  • (Boolean) 


31
32
33
 
# File 'lib/insight/params_signature.rb', line 31

def secret_key_blank?
  secret_key.nil? || secret_key == ""
end

#signature(params) ⇒ Object 



43
44
45
 
# File 'lib/insight/params_signature.rb', line 43

def signature(params)
  Digest::SHA1.hexdigest(signature_base(params))
end

#signature_base(params) ⇒ Object 



47
48
49
50
51
52
53
54
55
56
57
 
# File 'lib/insight/params_signature.rb', line 47

def signature_base(params)
  signature = []
  signature << secret_key

  params.keys.sort.each do |key|
    next if key == "hash"
    signature << params[key].to_s
  end

  signature.join(":")
end

#validate! ⇒ Object 



35
36
37
38
39
40
41
 
# File 'lib/insight/params_signature.rb', line 35

def validate!
  if secret_key_blank?
    raise SecurityError.new("Missing secret key")
  elsif request.params["hash"] != signature(request.params)
    raise SecurityError.new("Invalid query hash.")
  end
end