verify proposal signature over raw tx

lib/server.js

@@ -1449,6 +1449,12 @@ WalletService.prototype.sendTx = function(opts, cb) {
       if (!txp) return cb(Errors.TX_NOT_FOUND);
       if (!txp.isTemporary()) return cb();
 
+      var raw = txp.getRawTx();
+      var validSignature = self._verifySignature(raw, opts.proposalSignature, opts.proposalSignaturePubKey);
+      if (!validSignature) {
+        return cb(new ClientError('Invalid proposal signature'));
+      }
+
       // Verify UTXOs are still available
       self.getUtxos({}, function(err, utxos) {
         if (err) return cb(err);

test/integration/helpers.js

@@ -394,6 +394,20 @@ helpers.createProposalOpts2 = function(outputs, moreOpts, inputs) {
   return opts;
 };
 
+helpers.getProposalSignatureOpts = function(txp, signingKey) {
+  var raw = txp.getRawTx();
+  var proposalSignature = helpers.signMessage(raw, signingKey);
+  var x = new Bitcore.PrivateKey(signingKey).toPublicKey().toString();
+
+  return {
+    txProposalId: txp.id,
+    proposalSignature: proposalSignature,
+    proposalSignaturePubKey: new Bitcore.PrivateKey(signingKey).toPublicKey().toString(),
+    proposalSignaturePubKeySig: 'dummy',
+  }
+};
+
+
 helpers.createProposalOpts = function(type, outputs, signingKey, moreOpts, inputs) {
   _.each(outputs, function(output) {
     output.amount = helpers.toSatoshi(output.amount);

test/integration/server.js

@@ -2366,7 +2366,7 @@ describe('Wallet service', function() {
       });
     });
 
-    it('should be able to send a temporary tx proposal', function(done) {
+    it.only('should be able to send a temporary tx proposal', function(done) {
       helpers.stubUtxos(server, wallet, [1, 2], function() {
         var txOpts = helpers.createProposalOpts2([{
           toAddress: '18PzpUFkFZE8zKWUPvfykkTxmB9oMR8qP7',
@@ -2375,15 +2375,11 @@ describe('Wallet service', function() {
           message: 'some message',
           customData: 'some custom data',
         });
-        server.createTx(txOpts, function(err, tx) {
+        server.createTx(txOpts, function(err, txp) {
           should.not.exist(err);
-          should.exist(tx);
+          should.exist(txp);
-          server.sendTx({
+          var sendOpts = helpers.getProposalSignatureOpts(txp, TestData.copayers[0].privKey_1H_0);
-            txProposalId: tx.id,
+          server.sendTx(sendOpts, function(err) {
-            proposalSignature: 'dummy',
-            proposalSignaturePubKey: 'dummy',
-            proposalSignaturePubKeySig: 'dummy',
-          }, function(err) {
             should.not.exist(err);
             server.getPendingTxs({}, function(err, txs) {
               should.not.exist(err);