diff options
| -rw-r--r-- | extlib/OAuth.php | 135 |
1 files changed, 75 insertions, 60 deletions
diff --git a/extlib/OAuth.php b/extlib/OAuth.php index 6dc6b3f35..029166175 100644 --- a/extlib/OAuth.php +++ b/extlib/OAuth.php @@ -16,6 +16,10 @@ class OAuthConsumer {/*{{{*/ $this->secret = $secret; $this->callback_url = $callback_url; }/*}}}*/ + + function __toString() {/*{{{*/ + return "OAuthConsumer[key=$this->key,secret=$this->secret]"; + }/*}}}*/ }/*}}}*/ class OAuthToken {/*{{{*/ @@ -37,8 +41,8 @@ class OAuthToken {/*{{{*/ * would respond to request_token and access_token calls with */ function to_string() {/*{{{*/ - return "oauth_token=" . OAuthUtil::urlencodeRFC3986($this->key) . - "&oauth_token_secret=" . OAuthUtil::urlencodeRFC3986($this->secret); + return "oauth_token=" . OAuthUtil::urlencode_rfc3986($this->key) . + "&oauth_token_secret=" . OAuthUtil::urlencode_rfc3986($this->secret); }/*}}}*/ function __toString() {/*{{{*/ @@ -67,7 +71,7 @@ class OAuthSignatureMethod_HMAC_SHA1 extends OAuthSignatureMethod {/*{{{*/ ($token) ? $token->secret : "" ); - $key_parts = array_map(array('OAuthUtil','urlencodeRFC3986'), $key_parts); + $key_parts = OAuthUtil::urlencode_rfc3986($key_parts); $key = implode('&', $key_parts); return base64_encode( hash_hmac('sha1', $base_string, $key, true)); @@ -81,11 +85,11 @@ class OAuthSignatureMethod_PLAINTEXT extends OAuthSignatureMethod {/*{{{*/ public function build_signature($request, $consumer, $token) {/*{{{*/ $sig = array( - OAuthUtil::urlencodeRFC3986($consumer->secret) + OAuthUtil::urlencode_rfc3986($consumer->secret) ); if ($token) { - array_push($sig, OAuthUtil::urlencodeRFC3986($token->secret)); + array_push($sig, OAuthUtil::urlencode_rfc3986($token->secret)); } else { array_push($sig, ''); } @@ -94,7 +98,7 @@ class OAuthSignatureMethod_PLAINTEXT extends OAuthSignatureMethod {/*{{{*/ // for debug purposes $request->base_string = $raw; - return OAuthUtil::urlencodeRFC3986($raw); + return OAuthUtil::urlencode_rfc3986($raw); }/*}}}*/ }/*}}}*/ @@ -182,7 +186,7 @@ class OAuthRequest {/*{{{*/ */ public static function from_request($http_method=NULL, $http_url=NULL, $parameters=NULL) {/*{{{*/ $scheme = (!isset($_SERVER['HTTPS']) || $_SERVER['HTTPS'] != "on") ? 'http' : 'https'; - @$http_url or $http_url = $scheme . '://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']; + @$http_url or $http_url = $scheme . '://' . $_SERVER['HTTP_HOST'] . ':' . $_SERVER['SERVER_PORT'] . $_SERVER['REQUEST_URI']; @$http_method or $http_method = $_SERVER['REQUEST_METHOD']; $request_headers = OAuthRequest::get_headers(); @@ -192,27 +196,23 @@ class OAuthRequest {/*{{{*/ // do this if ($parameters) { $req = new OAuthRequest($http_method, $http_url, $parameters); + } else { + // collect request parameters from query string (GET) and post-data (POST) if appropriate (note: POST vars have priority) + $req_parameters = $_GET; + if ($http_method == "POST" && @strstr($request_headers["Content-Type"], "application/x-www-form-urlencoded") ) { + $req_parameters = array_merge($req_parameters, $_POST); + } + + // next check for the auth header, we need to do some extra stuff + // if that is the case, namely suck in the parameters from GET or POST + // so that we can include them in the signature + if (@substr($request_headers['Authorization'], 0, 6) == "OAuth ") { + $header_parameters = OAuthRequest::split_header($request_headers['Authorization']); + $parameters = array_merge($req_parameters, $header_parameters); + $req = new OAuthRequest($http_method, $http_url, $parameters); + } else $req = new OAuthRequest($http_method, $http_url, $req_parameters); } - // next check for the auth header, we need to do some extra stuff - // if that is the case, namely suck in the parameters from GET or POST - // so that we can include them in the signature - else if (@substr($request_headers['Authorization'], 0, 5) == "OAuth") { - $header_parameters = OAuthRequest::split_header($request_headers['Authorization']); - if ($http_method == "GET") { - $req_parameters = $_GET; - } - else if ($http_method == "POST") { - $req_parameters = $_POST; - } - $parameters = array_merge($header_parameters, $req_parameters); - $req = new OAuthRequest($http_method, $http_url, $parameters); - } - else if ($http_method == "GET") { - $req = new OAuthRequest($http_method, $http_url, $_GET); - } - else if ($http_method == "POST") { - $req = new OAuthRequest($http_method, $http_url, $_POST); - } + return $req; }/*}}}*/ @@ -238,7 +238,7 @@ class OAuthRequest {/*{{{*/ }/*}}}*/ public function get_parameter($name) {/*{{{*/ - return $this->parameters[$name]; + return isset($this->parameters[$name]) ? $this->parameters[$name] : null; }/*}}}*/ public function get_parameters() {/*{{{*/ @@ -267,12 +267,12 @@ class OAuthRequest {/*{{{*/ } // Urlencode both keys and values - $keys = array_map(array('OAuthUtil', 'urlencodeRFC3986'), array_keys($params)); - $values = array_map(array('OAuthUtil', 'urlencodeRFC3986'), array_values($params)); + $keys = OAuthUtil::urlencode_rfc3986(array_keys($params)); + $values = OAuthUtil::urlencode_rfc3986(array_values($params)); $params = array_combine($keys, $values); // Sort by keys (natsort) - uksort($params, 'strnatcmp'); + uksort($params, 'strcmp'); // Generate key=value pairs $pairs = array(); @@ -307,7 +307,7 @@ class OAuthRequest {/*{{{*/ $this->get_signable_parameters() ); - $parts = array_map(array('OAuthUtil', 'urlencodeRFC3986'), $parts); + $parts = OAuthUtil::urlencode_rfc3986($parts); return implode('&', $parts); }/*}}}*/ @@ -351,11 +351,21 @@ class OAuthRequest {/*{{{*/ /** * builds the data one would send in a POST request + * + * TODO(morten.fangel): + * this function might be easily replaced with http_build_query() + * and corrections for rfc3986 compatibility.. but not sure */ public function to_postdata() {/*{{{*/ $total = array(); foreach ($this->parameters as $k => $v) { - $total[] = OAuthUtil::urlencodeRFC3986($k) . "=" . OAuthUtil::urlencodeRFC3986($v); + if (is_array($v)) { + foreach ($v as $va) { + $total[] = OAuthUtil::urlencode_rfc3986($k) . "[]=" . OAuthUtil::urlencode_rfc3986($va); + } + } else { + $total[] = OAuthUtil::urlencode_rfc3986($k) . "=" . OAuthUtil::urlencode_rfc3986($v); + } } $out = implode("&", $total); return $out; @@ -364,12 +374,13 @@ class OAuthRequest {/*{{{*/ /** * builds the Authorization: header */ - public function to_header($realm="") {/*{{{*/ - $out ='"Authorization: OAuth realm="' . $realm . '",'; + public function to_header() {/*{{{*/ + $out ='Authorization: OAuth realm=""'; $total = array(); foreach ($this->parameters as $k => $v) { if (substr($k, 0, 5) != "oauth") continue; - $out .= ',' . OAuthUtil::urlencodeRFC3986($k) . '="' . OAuthUtil::urlencodeRFC3986($v) . '"'; + if (is_array($v)) throw new OAuthException('Arrays not supported in headers'); + $out .= ',' . OAuthUtil::urlencode_rfc3986($k) . '="' . OAuthUtil::urlencode_rfc3986($v) . '"'; } return $out; }/*}}}*/ @@ -412,24 +423,22 @@ class OAuthRequest {/*{{{*/ * parameters, has to do some unescaping */ private static function split_header($header) {/*{{{*/ - // remove 'OAuth ' at the start of a header - $header = substr($header, 6); - - // error cases: commas in parameter values? - $parts = explode(",", $header); - $out = array(); - foreach ($parts as $param) { - $param = ltrim($param); - // skip the "realm" param, nobody ever uses it anyway - if (substr($param, 0, 5) != "oauth") continue; - - $param_parts = explode("=", $param); - - // rawurldecode() used because urldecode() will turn a "+" in the - // value into a space - $out[$param_parts[0]] = rawurldecode(substr($param_parts[1], 1, -1)); + $pattern = '/(([-_a-z]*)=("([^"]*)"|([^,]*)),?)/'; + $offset = 0; + $params = array(); + while (preg_match($pattern, $header, $matches, PREG_OFFSET_CAPTURE, $offset) > 0) { + $match = $matches[0]; + $header_name = $matches[2][0]; + $header_content = (isset($matches[5])) ? $matches[5][0] : $matches[4][0]; + $params[$header_name] = OAuthUtil::urldecode_rfc3986( $header_content ); + $offset = $match[1] + strlen($match[0]); } - return $out; + + if (isset($params['realm'])) { + unset($params['realm']); + } + + return $params; }/*}}}*/ /** @@ -506,6 +515,7 @@ class OAuthServer {/*{{{*/ // requires authorized request token $token = $this->get_token($request, $consumer, "request"); + $this->check_signature($request, $consumer, $token); $new_token = $this->data_store->new_access_token($token, $consumer); @@ -654,11 +664,11 @@ class OAuthDataStore {/*{{{*/ // implement me }/*}}}*/ - function fetch_request_token($consumer) {/*{{{*/ + function new_request_token($consumer) {/*{{{*/ // return a new token attached to this consumer }/*}}}*/ - function fetch_access_token($token, $consumer) {/*{{{*/ + function new_access_token($token, $consumer) {/*{{{*/ // return a new access token attached to this consumer // for the user associated with this token if the request token // is authorized @@ -737,17 +747,22 @@ class SimpleOAuthDataStore extends OAuthDataStore {/*{{{*/ }/*}}}*/ class OAuthUtil {/*{{{*/ - public static function urlencodeRFC3986($string) {/*{{{*/ - return str_replace('+', ' ', - str_replace('%7E', '~', rawurlencode($string))); - + public static function urlencode_rfc3986($input) {/*{{{*/ + if (is_array($input)) { + return array_map(array('OAuthUtil','urlencode_rfc3986'), $input); + } else if (is_scalar($input)) { + return str_replace('+', ' ', + str_replace('%7E', '~', rawurlencode($input))); + } else { + return ''; + } }/*}}}*/ // This decode function isn't taking into consideration the above // modifications to the encoding process. However, this method doesn't // seem to be used anywhere so leaving it as is. - public static function urldecodeRFC3986($string) {/*{{{*/ + public static function urldecode_rfc3986($string) {/*{{{*/ return rawurldecode($string); }/*}}}*/ }/*}}}*/ |