buffer update

server.js

@@ -1,19 +1,20 @@
 const express = require('express');
 const path = require('path');
-const bodyParser = require('body-parser')
-const crypto = require('crypto')
-const { exec } = require('child_process')
+const bodyParser = require('body-parser');
+const crypto = require('crypto');
+const { exec } = require('child_process');
 require('dotenv').config();
 
 const app = express();
 const PORT = process.env.PORT || 3000;
 const GITEA_SECRET = process.env.GITEA_SECRET;
+console.log('GITEA_SECRET:', process.env.GITEA_SECRET);
 
 // Serve static files from the 'public' directory
 app.use(express.static(path.join(__dirname, 'public')));
 
 // Middleware to parse JSON payloads
-app.use(bodyParser.json())
+app.use(bodyParser.json());
 
 // Custom middleware to handle URLs without .html for specific routes
 app.use((req, res, next) => {
@@ -72,13 +73,11 @@ app.post('/api', (req, res) => {
   const hmac = crypto.createHmac('sha256', GITEA_SECRET);
   const digest = `sha256=${hmac.update(payload).digest('hex')}`;
 
-	// Buffer lengths
+  // Ensure both buffers have the same length before comparing
   const bufferSignature = Buffer.from(signature);
   const bufferDigest = Buffer.from(digest);
 
-	console.log(bufferDigest, bufferSignature)
-  
-	if (crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(digest))) {
+  if (bufferSignature.length === bufferDigest.length && crypto.timingSafeEqual(bufferSignature, bufferDigest)) {
     // Secret is valid, update the repository
     exec('/home/gnome.sh', (err, stdout, stderr) => {
       if (err) {