From 27e694f591657fe260e1bc4e21189e47cd511c74 Mon Sep 17 00:00:00 2001 From: Dmitry Petrov Date: Wed, 17 Dec 2025 16:20:34 -0500 Subject: [PATCH] fix: Add '=' after '_h' for Horde_Url objects in signUrl()/signQueryString() The most recent version of Horde_Url restored the original behavior ('=' is not added for parameters with empty values). --- lib/Horde.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/Horde.php b/lib/Horde.php index bea99aff..86d44eb3 100644 --- a/lib/Horde.php +++ b/lib/Horde.php @@ -183,7 +183,7 @@ public static function signUrl($url, $now = null) $url->add( '_h', Horde_Url::uriB64Encode( - hash_hmac('sha1', $url, $conf['secret_key'], true) + hash_hmac('sha1', $url . '=', $conf['secret_key'], true) ) ); return $url; @@ -284,7 +284,7 @@ public static function signQueryString($queryString, $now = null) if ($queryString instanceof Horde_Url) { $queryString->setRaw(true)->add(['_t' => $now, '_h' => '']); $query = parse_url($queryString, PHP_URL_QUERY); - $queryString->add('_h', Horde_Url::uriB64Encode(hash_hmac('sha1', $query, $GLOBALS['conf']['secret_key'], true))); + $queryString->add('_h', Horde_Url::uriB64Encode(hash_hmac('sha1', $query . '=', $GLOBALS['conf']['secret_key'], true))); return $queryString; }