kaiyuan/chatgpt-on-wechat
1
0
Fork 0
mirror of https://github.com/zhayujie/chatgpt-on-wechat.git synced 2026-07-17 11:07:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(wechatmp): reject webhook requests when wechatmp_token is empty

Browse Source
This commit is contained in:
zhayujie
2026-06-05 15:14:28 +08:00
parent 72a477f10c
commit 3d7c68bac6
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
channel/wechatmp/common.py
View File

@@ -19,9 +19,15 @@ def verify_server(data):
nonce = data.nonce nonce = data.nonce
echostr = data.get("echostr", None) echostr = data.get("echostr", None)
token = conf().get("wechatmp_token") # 请按照公众平台官网\基本配置中信息填写 token = conf().get("wechatmp_token") # 请按照公众平台官网\基本配置中信息填写
# Reject when token is empty: an empty token reduces signature verification
# to a predictable hash over attacker-controlled values.
if not token:
raise web.Forbidden("wechatmp_token is not configured")
check_signature(token, signature, timestamp, nonce) check_signature(token, signature, timestamp, nonce)
return echostr return echostr
except InvalidSignatureException: except InvalidSignatureException:
raise web.Forbidden("Invalid signature") raise web.Forbidden("Invalid signature")
except web.Forbidden:
raise
except Exception as e: except Exception as e:
raise web.Forbidden(str(e)) raise web.Forbidden(str(e))