diff --git a/src/Mailgun/Mailgun.php b/src/Mailgun/Mailgun.php index d31ed18..f4e9402 100644 --- a/src/Mailgun/Mailgun.php +++ b/src/Mailgun/Mailgun.php @@ -91,6 +91,9 @@ class Mailgun{ if($postData === null) { $postData = $_POST; } + if(!isset($postData['timestamp']) || !isset($postData['token']) || !isset($postData['signature'])) { + return false; + } $hmac = hash_hmac('sha256', "{$postData["timestamp"]}{$postData["token"]}", $this->apiKey); $sig = $postData['signature']; if(function_exists('hash_equals')) { diff --git a/tests/Mailgun/Tests/MailgunTest.php b/tests/Mailgun/Tests/MailgunTest.php index c73c1aa..38a6905 100644 --- a/tests/Mailgun/Tests/MailgunTest.php +++ b/tests/Mailgun/Tests/MailgunTest.php @@ -33,4 +33,10 @@ class MailgunTest extends \Mailgun\Tests\MailgunTestCase ); assert(!$client->verifyWebhookSignature($postData)); } + + public function testVerifyWebhookEmptyRequest() { + $client = new Mailgun('key-3ax6xnjp29jd6fds4gc373sgvjxteol0'); + $postData = array(); + assert(!$client->verifyWebhookSignature($postData)); + } }