Server: do not forget to check the signature when another pod wants to

quit us

server/controllers/api/v1/pods.js

@@ -10,6 +10,7 @@ const friends = require('../../../lib/friends')
 const middlewares = require('../../../middlewares')
 const admin = middlewares.admin
 const oAuth = middlewares.oauth
+const checkSignature = middlewares.secure.checkSignature
 const validators = middlewares.validators.pods
 const signatureValidator = middlewares.validators.remote.signature
 
@@ -31,7 +32,11 @@ router.get('/quitfriends',
   quitFriends
 )
 // Post because this is a secured request
-router.post('/remove', signatureValidator, removePods)
+router.post('/remove',
+  signatureValidator,
+  checkSignature,
+  removePods
+)
 
 // ---------------------------------------------------------------------------
 

server/controllers/api/v1/remote.js

@@ -16,6 +16,7 @@ const Video = mongoose.model('Video')
 router.post('/videos',
   validators.signature,
   validators.dataToDecrypt,
+  secureMiddleware.checkSignature,
   secureMiddleware.decryptBody,
   validators.remoteVideos,
   remoteVideos