WordPress Social Share, Social Login and Social Comments Plugin – Super Socializer - Version 1.0.2

Version Description

  • Fixed the bug due to redeclaration of Twitter OAuth class
Download this release

Release Info

Developer the_champ
Plugin Icon 128x128 WordPress Social Share, Social Login and Social Comments Plugin – Super Socializer
Version 1.0.2
Comparing to
See all releases

Code changes from version 1.0.1 to 1.0.2

Files changed (4) hide show
  1. library/OAuth.php +860 -840
  2. library/twitteroauth.php +232 -230
  3. readme.txt +8 -2
  4. super_socializer.php +2 -2
library/OAuth.php CHANGED
@@ -9,866 +9,886 @@ if (!class_exists('OAuthException')) {
9
  }
10
  }
11
 
12
- class OAuthConsumer {
13
- public $key;
14
- public $secret;
15
-
16
- function __construct($key, $secret, $callback_url=NULL) {
17
- $this->key = $key;
18
- $this->secret = $secret;
19
- $this->callback_url = $callback_url;
20
- }
21
-
22
- function __toString() {
23
- return "OAuthConsumer[key=$this->key,secret=$this->secret]";
24
- }
 
 
25
  }
26
 
27
- class OAuthToken {
28
- // access tokens and request tokens
29
- public $key;
30
- public $secret;
31
-
32
- /**
33
- * key = the token
34
- * secret = the token secret
35
- */
36
- function __construct($key, $secret) {
37
- $this->key = $key;
38
- $this->secret = $secret;
39
- }
40
-
41
- /**
42
- * generates the basic string serialization of a token that a server
43
- * would respond to request_token and access_token calls with
44
- */
45
- function to_string() {
46
- return "oauth_token=" .
47
- OAuthUtil::urlencode_rfc3986($this->key) .
48
- "&oauth_token_secret=" .
49
- OAuthUtil::urlencode_rfc3986($this->secret);
50
- }
51
-
52
- function __toString() {
53
- return $this->to_string();
54
- }
 
 
55
  }
56
 
57
- /**
58
- * A class for implementing a Signature Method
59
- * See section 9 ("Signing Requests") in the spec
60
- */
61
- abstract class OAuthSignatureMethod {
62
- /**
63
- * Needs to return the name of the Signature Method (ie HMAC-SHA1)
64
- * @return string
65
- */
66
- abstract public function get_name();
67
-
68
- /**
69
- * Build up the signature
70
- * NOTE: The output of this function MUST NOT be urlencoded.
71
- * the encoding is handled in OAuthRequest when the final
72
- * request is serialized
73
- * @param OAuthRequest $request
74
- * @param OAuthConsumer $consumer
75
- * @param OAuthToken $token
76
- * @return string
77
- */
78
- abstract public function build_signature($request, $consumer, $token);
79
-
80
- /**
81
- * Verifies that a given signature is correct
82
- * @param OAuthRequest $request
83
- * @param OAuthConsumer $consumer
84
- * @param OAuthToken $token
85
- * @param string $signature
86
- * @return bool
87
- */
88
- public function check_signature($request, $consumer, $token, $signature) {
89
- $built = $this->build_signature($request, $consumer, $token);
90
- return $built == $signature;
91
- }
 
 
92
  }
93
 
94
- /**
95
- * The HMAC-SHA1 signature method uses the HMAC-SHA1 signature algorithm as defined in [RFC2104]
96
- * where the Signature Base String is the text and the key is the concatenated values (each first
97
- * encoded per Parameter Encoding) of the Consumer Secret and Token Secret, separated by an '&'
98
- * character (ASCII code 38) even if empty.
99
- * - Chapter 9.2 ("HMAC-SHA1")
100
- */
101
- class OAuthSignatureMethod_HMAC_SHA1 extends OAuthSignatureMethod {
102
- function get_name() {
103
- return "HMAC-SHA1";
104
- }
105
-
106
- public function build_signature($request, $consumer, $token) {
107
- $base_string = $request->get_signature_base_string();
108
- $request->base_string = $base_string;
109
-
110
- $key_parts = array(
111
- $consumer->secret,
112
- ($token) ? $token->secret : ""
113
- );
114
-
115
- $key_parts = OAuthUtil::urlencode_rfc3986($key_parts);
116
- $key = implode('&', $key_parts);
117
-
118
- return base64_encode(hash_hmac('sha1', $base_string, $key, true));
119
- }
 
 
120
  }
121
 
122
- /**
123
- * The PLAINTEXT method does not provide any security protection and SHOULD only be used
124
- * over a secure channel such as HTTPS. It does not use the Signature Base String.
125
- * - Chapter 9.4 ("PLAINTEXT")
126
- */
127
- class OAuthSignatureMethod_PLAINTEXT extends OAuthSignatureMethod {
128
- public function get_name() {
129
- return "PLAINTEXT";
130
- }
131
-
132
- /**
133
- * oauth_signature is set to the concatenated encoded values of the Consumer Secret and
134
- * Token Secret, separated by a '&' character (ASCII code 38), even if either secret is
135
- * empty. The result MUST be encoded again.
136
- * - Chapter 9.4.1 ("Generating Signatures")
137
- *
138
- * Please note that the second encoding MUST NOT happen in the SignatureMethod, as
139
- * OAuthRequest handles this!
140
- */
141
- public function build_signature($request, $consumer, $token) {
142
- $key_parts = array(
143
- $consumer->secret,
144
- ($token) ? $token->secret : ""
145
- );
146
-
147
- $key_parts = OAuthUtil::urlencode_rfc3986($key_parts);
148
- $key = implode('&', $key_parts);
149
- $request->base_string = $key;
150
-
151
- return $key;
152
- }
 
 
153
  }
154
 
155
- /**
156
- * The RSA-SHA1 signature method uses the RSASSA-PKCS1-v1_5 signature algorithm as defined in
157
- * [RFC3447] section 8.2 (more simply known as PKCS#1), using SHA-1 as the hash function for
158
- * EMSA-PKCS1-v1_5. It is assumed that the Consumer has provided its RSA public key in a
159
- * verified way to the Service Provider, in a manner which is beyond the scope of this
160
- * specification.
161
- * - Chapter 9.3 ("RSA-SHA1")
162
- */
163
- abstract class OAuthSignatureMethod_RSA_SHA1 extends OAuthSignatureMethod {
164
- public function get_name() {
165
- return "RSA-SHA1";
166
- }
167
-
168
- // Up to the SP to implement this lookup of keys. Possible ideas are:
169
- // (1) do a lookup in a table of trusted certs keyed off of consumer
170
- // (2) fetch via http using a url provided by the requester
171
- // (3) some sort of specific discovery code based on request
172
- //
173
- // Either way should return a string representation of the certificate
174
- protected abstract function fetch_public_cert(&$request);
175
-
176
- // Up to the SP to implement this lookup of keys. Possible ideas are:
177
- // (1) do a lookup in a table of trusted certs keyed off of consumer
178
- //
179
- // Either way should return a string representation of the certificate
180
- protected abstract function fetch_private_cert(&$request);
181
-
182
- public function build_signature($request, $consumer, $token) {
183
- $base_string = $request->get_signature_base_string();
184
- $request->base_string = $base_string;
185
-
186
- // Fetch the private key cert based on the request
187
- $cert = $this->fetch_private_cert($request);
188
-
189
- // Pull the private key ID from the certificate
190
- $privatekeyid = openssl_get_privatekey($cert);
191
-
192
- // Sign using the key
193
- $ok = openssl_sign($base_string, $signature, $privatekeyid);
194
-
195
- // Release the key resource
196
- openssl_free_key($privatekeyid);
197
-
198
- return base64_encode($signature);
199
- }
200
-
201
- public function check_signature($request, $consumer, $token, $signature) {
202
- $decoded_sig = base64_decode($signature);
203
-
204
- $base_string = $request->get_signature_base_string();
205
-
206
- // Fetch the public key cert based on the request
207
- $cert = $this->fetch_public_cert($request);
208
-
209
- // Pull the public key ID from the certificate
210
- $publickeyid = openssl_get_publickey($cert);
211
-
212
- // Check the computed signature against the one passed in the query
213
- $ok = openssl_verify($base_string, $decoded_sig, $publickeyid);
214
-
215
- // Release the key resource
216
- openssl_free_key($publickeyid);
217
-
218
- return $ok == 1;
219
- }
 
 
220
  }
221
 
222
- class OAuthRequest {
223
- private $parameters;
224
- private $http_method;
225
- private $http_url;
226
- // for debug purposes
227
- public $base_string;
228
- public static $version = '1.0';
229
- public static $POST_INPUT = 'php://input';
230
-
231
- function __construct($http_method, $http_url, $parameters=NULL) {
232
- @$parameters or $parameters = array();
233
- $parameters = array_merge( OAuthUtil::parse_parameters(parse_url($http_url, PHP_URL_QUERY)), $parameters);
234
- $this->parameters = $parameters;
235
- $this->http_method = $http_method;
236
- $this->http_url = $http_url;
237
- }
238
-
239
-
240
- /**
241
- * attempt to build up a request from what was passed to the server
242
- */
243
- public static function from_request($http_method=NULL, $http_url=NULL, $parameters=NULL) {
244
- $scheme = (!isset($_SERVER['HTTPS']) || $_SERVER['HTTPS'] != "on")
245
- ? 'http'
246
- : 'https';
247
- @$http_url or $http_url = $scheme .
248
- '://' . $_SERVER['HTTP_HOST'] .
249
- ':' .
250
- $_SERVER['SERVER_PORT'] .
251
- $_SERVER['REQUEST_URI'];
252
- @$http_method or $http_method = $_SERVER['REQUEST_METHOD'];
253
-
254
- // We weren't handed any parameters, so let's find the ones relevant to
255
- // this request.
256
- // If you run XML-RPC or similar you should use this to provide your own
257
- // parsed parameter-list
258
- if (!$parameters) {
259
- // Find request headers
260
- $request_headers = OAuthUtil::get_headers();
261
-
262
- // Parse the query-string to find GET parameters
263
- $parameters = OAuthUtil::parse_parameters($_SERVER['QUERY_STRING']);
264
-
265
- // It's a POST request of the proper content-type, so parse POST
266
- // parameters and add those overriding any duplicates from GET
267
- if ($http_method == "POST"
268
- && @strstr($request_headers["Content-Type"],
269
- "application/x-www-form-urlencoded")
270
- ) {
271
- $post_data = OAuthUtil::parse_parameters(
272
- file_get_contents(self::$POST_INPUT)
273
- );
274
- $parameters = array_merge($parameters, $post_data);
275
- }
276
-
277
- // We have a Authorization-header with OAuth data. Parse the header
278
- // and add those overriding any duplicates from GET or POST
279
- if (@substr($request_headers['Authorization'], 0, 6) == "OAuth ") {
280
- $header_parameters = OAuthUtil::split_header(
281
- $request_headers['Authorization']
282
- );
283
- $parameters = array_merge($parameters, $header_parameters);
284
- }
285
-
286
- }
287
-
288
- return new OAuthRequest($http_method, $http_url, $parameters);
289
- }
290
-
291
- /**
292
- * pretty much a helper function to set up the request
293
- */
294
- public static function from_consumer_and_token($consumer, $token, $http_method, $http_url, $parameters=NULL) {
295
- @$parameters or $parameters = array();
296
- $defaults = array("oauth_version" => OAuthRequest::$version,
297
- "oauth_nonce" => OAuthRequest::generate_nonce(),
298
- "oauth_timestamp" => OAuthRequest::generate_timestamp(),
299
- "oauth_consumer_key" => $consumer->key);
300
- if ($token)
301
- $defaults['oauth_token'] = $token->key;
302
-
303
- $parameters = array_merge($defaults, $parameters);
304
-
305
- return new OAuthRequest($http_method, $http_url, $parameters);
306
- }
307
-
308
- public function set_parameter($name, $value, $allow_duplicates = true) {
309
- if ($allow_duplicates && isset($this->parameters[$name])) {
310
- // We have already added parameter(s) with this name, so add to the list
311
- if (is_scalar($this->parameters[$name])) {
312
- // This is the first duplicate, so transform scalar (string)
313
- // into an array so we can add the duplicates
314
- $this->parameters[$name] = array($this->parameters[$name]);
315
- }
316
-
317
- $this->parameters[$name][] = $value;
318
- } else {
319
- $this->parameters[$name] = $value;
320
- }
321
- }
322
-
323
- public function get_parameter($name) {
324
- return isset($this->parameters[$name]) ? $this->parameters[$name] : null;
325
- }
326
-
327
- public function get_parameters() {
328
- return $this->parameters;
329
- }
330
-
331
- public function unset_parameter($name) {
332
- unset($this->parameters[$name]);
333
- }
334
-
335
- /**
336
- * The request parameters, sorted and concatenated into a normalized string.
337
- * @return string
338
- */
339
- public function get_signable_parameters() {
340
- // Grab all parameters
341
- $params = $this->parameters;
342
-
343
- // Remove oauth_signature if present
344
- // Ref: Spec: 9.1.1 ("The oauth_signature parameter MUST be excluded.")
345
- if (isset($params['oauth_signature'])) {
346
- unset($params['oauth_signature']);
347
- }
348
-
349
- return OAuthUtil::build_http_query($params);
350
- }
351
-
352
- /**
353
- * Returns the base string of this request
354
- *
355
- * The base string defined as the method, the url
356
- * and the parameters (normalized), each urlencoded
357
- * and the concated with &.
358
- */
359
- public function get_signature_base_string() {
360
- $parts = array(
361
- $this->get_normalized_http_method(),
362
- $this->get_normalized_http_url(),
363
- $this->get_signable_parameters()
364
- );
365
-
366
- $parts = OAuthUtil::urlencode_rfc3986($parts);
367
-
368
- return implode('&', $parts);
369
- }
370
-
371
- /**
372
- * just uppercases the http method
373
- */
374
- public function get_normalized_http_method() {
375
- return strtoupper($this->http_method);
376
- }
377
-
378
- /**
379
- * parses the url and rebuilds it to be
380
- * scheme://host/path
381
- */
382
- public function get_normalized_http_url() {
383
- $parts = parse_url($this->http_url);
384
-
385
- $port = @$parts['port'];
386
- $scheme = $parts['scheme'];
387
- $host = $parts['host'];
388
- $path = @$parts['path'];
389
-
390
- $port or $port = ($scheme == 'https') ? '443' : '80';
391
-
392
- if (($scheme == 'https' && $port != '443')
393
- || ($scheme == 'http' && $port != '80')) {
394
- $host = "$host:$port";
395
- }
396
- return "$scheme://$host$path";
397
- }
398
-
399
- /**
400
- * builds a url usable for a GET request
401
- */
402
- public function to_url() {
403
- $post_data = $this->to_postdata();
404
- $out = $this->get_normalized_http_url();
405
- if ($post_data) {
406
- $out .= '?'.$post_data;
407
- }
408
- return $out;
409
- }
410
-
411
- /**
412
- * builds the data one would send in a POST request
413
- */
414
- public function to_postdata() {
415
- return OAuthUtil::build_http_query($this->parameters);
416
- }
417
-
418
- /**
419
- * builds the Authorization: header
420
- */
421
- public function to_header($realm=null) {
422
- $first = true;
423
- if($realm) {
424
- $out = 'Authorization: OAuth realm="' . OAuthUtil::urlencode_rfc3986($realm) . '"';
425
- $first = false;
426
- } else
427
- $out = 'Authorization: OAuth';
428
-
429
- $total = array();
430
- foreach ($this->parameters as $k => $v) {
431
- if (substr($k, 0, 5) != "oauth") continue;
432
- if (is_array($v)) {
433
- throw new OAuthException('Arrays not supported in headers');
434
- }
435
- $out .= ($first) ? ' ' : ',';
436
- $out .= OAuthUtil::urlencode_rfc3986($k) .
437
- '="' .
438
- OAuthUtil::urlencode_rfc3986($v) .
439
- '"';
440
- $first = false;
441
- }
442
- return $out;
443
- }
444
-
445
- public function __toString() {
446
- return $this->to_url();
447
- }
448
-
449
-
450
- public function sign_request($signature_method, $consumer, $token) {
451
- $this->set_parameter(
452
- "oauth_signature_method",
453
- $signature_method->get_name(),
454
- false
455
- );
456
- $signature = $this->build_signature($signature_method, $consumer, $token);
457
- $this->set_parameter("oauth_signature", $signature, false);
458
- }
459
-
460
- public function build_signature($signature_method, $consumer, $token) {
461
- $signature = $signature_method->build_signature($this, $consumer, $token);
462
- return $signature;
463
- }
464
-
465
- /**
466
- * util function: current timestamp
467
- */
468
- private static function generate_timestamp() {
469
- return time();
470
- }
471
-
472
- /**
473
- * util function: current nonce
474
- */
475
- private static function generate_nonce() {
476
- $mt = microtime();
477
- $rand = mt_rand();
478
-
479
- return md5($mt . $rand); // md5s look nicer than numbers
480
- }
 
 
481
  }
482
 
483
- class OAuthServer {
484
- protected $timestamp_threshold = 300; // in seconds, five minutes
485
- protected $version = '1.0'; // hi blaine
486
- protected $signature_methods = array();
487
-
488
- protected $data_store;
489
-
490
- function __construct($data_store) {
491
- $this->data_store = $data_store;
492
- }
493
-
494
- public function add_signature_method($signature_method) {
495
- $this->signature_methods[$signature_method->get_name()] =
496
- $signature_method;
497
- }
498
-
499
- // high level functions
500
-
501
- /**
502
- * process a request_token request
503
- * returns the request token on success
504
- */
505
- public function fetch_request_token(&$request) {
506
- $this->get_version($request);
507
-
508
- $consumer = $this->get_consumer($request);
509
-
510
- // no token required for the initial token request
511
- $token = NULL;
512
-
513
- $this->check_signature($request, $consumer, $token);
514
-
515
- // Rev A change
516
- $callback = $request->get_parameter('oauth_callback');
517
- $new_token = $this->data_store->new_request_token($consumer, $callback);
518
-
519
- return $new_token;
520
- }
521
-
522
- /**
523
- * process an access_token request
524
- * returns the access token on success
525
- */
526
- public function fetch_access_token(&$request) {
527
- $this->get_version($request);
528
-
529
- $consumer = $this->get_consumer($request);
530
-
531
- // requires authorized request token
532
- $token = $this->get_token($request, $consumer, "request");
533
-
534
- $this->check_signature($request, $consumer, $token);
535
-
536
- // Rev A change
537
- $verifier = $request->get_parameter('oauth_verifier');
538
- $new_token = $this->data_store->new_access_token($token, $consumer, $verifier);
539
-
540
- return $new_token;
541
- }
542
-
543
- /**
544
- * verify an api call, checks all the parameters
545
- */
546
- public function verify_request(&$request) {
547
- $this->get_version($request);
548
- $consumer = $this->get_consumer($request);
549
- $token = $this->get_token($request, $consumer, "access");
550
- $this->check_signature($request, $consumer, $token);
551
- return array($consumer, $token);
552
- }
553
-
554
- // Internals from here
555
- /**
556
- * version 1
557
- */
558
- private function get_version(&$request) {
559
- $version = $request->get_parameter("oauth_version");
560
- if (!$version) {
561
- // Service Providers MUST assume the protocol version to be 1.0 if this parameter is not present.
562
- // Chapter 7.0 ("Accessing Protected Ressources")
563
- $version = '1.0';
564
- }
565
- if ($version !== $this->version) {
566
- throw new OAuthException("OAuth version '$version' not supported");
567
- }
568
- return $version;
569
- }
570
-
571
- /**
572
- * figure out the signature with some defaults
573
- */
574
- private function get_signature_method(&$request) {
575
- $signature_method =
576
- @$request->get_parameter("oauth_signature_method");
577
-
578
- if (!$signature_method) {
579
- // According to chapter 7 ("Accessing Protected Ressources") the signature-method
580
- // parameter is required, and we can't just fallback to PLAINTEXT
581
- throw new OAuthException('No signature method parameter. This parameter is required');
582
- }
583
-
584
- if (!in_array($signature_method,
585
- array_keys($this->signature_methods))) {
586
- throw new OAuthException(
587
- "Signature method '$signature_method' not supported " .
588
- "try one of the following: " .
589
- implode(", ", array_keys($this->signature_methods))
590
- );
591
- }
592
- return $this->signature_methods[$signature_method];
593
- }
594
-
595
- /**
596
- * try to find the consumer for the provided request's consumer key
597
- */
598
- private function get_consumer(&$request) {
599
- $consumer_key = @$request->get_parameter("oauth_consumer_key");
600
- if (!$consumer_key) {
601
- throw new OAuthException("Invalid consumer key");
602
- }
603
-
604
- $consumer = $this->data_store->lookup_consumer($consumer_key);
605
- if (!$consumer) {
606
- throw new OAuthException("Invalid consumer");
607
- }
608
-
609
- return $consumer;
610
- }
611
-
612
- /**
613
- * try to find the token for the provided request's token key
614
- */
615
- private function get_token(&$request, $consumer, $token_type="access") {
616
- $token_field = @$request->get_parameter('oauth_token');
617
- $token = $this->data_store->lookup_token(
618
- $consumer, $token_type, $token_field
619
- );
620
- if (!$token) {
621
- throw new OAuthException("Invalid $token_type token: $token_field");
622
- }
623
- return $token;
624
- }
625
-
626
- /**
627
- * all-in-one function to check the signature on a request
628
- * should guess the signature method appropriately
629
- */
630
- private function check_signature(&$request, $consumer, $token) {
631
- // this should probably be in a different method
632
- $timestamp = @$request->get_parameter('oauth_timestamp');
633
- $nonce = @$request->get_parameter('oauth_nonce');
634
-
635
- $this->check_timestamp($timestamp);
636
- $this->check_nonce($consumer, $token, $nonce, $timestamp);
637
-
638
- $signature_method = $this->get_signature_method($request);
639
-
640
- $signature = $request->get_parameter('oauth_signature');
641
- $valid_sig = $signature_method->check_signature(
642
- $request,
643
- $consumer,
644
- $token,
645
- $signature
646
- );
647
-
648
- if (!$valid_sig) {
649
- throw new OAuthException("Invalid signature");
650
- }
651
- }
652
-
653
- /**
654
- * check that the timestamp is new enough
655
- */
656
- private function check_timestamp($timestamp) {
657
- if( ! $timestamp )
658
- throw new OAuthException(
659
- 'Missing timestamp parameter. The parameter is required'
660
- );
661
-
662
- // verify that timestamp is recentish
663
- $now = time();
664
- if (abs($now - $timestamp) > $this->timestamp_threshold) {
665
- throw new OAuthException(
666
- "Expired timestamp, yours $timestamp, ours $now"
667
- );
668
- }
669
- }
670
-
671
- /**
672
- * check that the nonce is not repeated
673
- */
674
- private function check_nonce($consumer, $token, $nonce, $timestamp) {
675
- if( ! $nonce )
676
- throw new OAuthException(
677
- 'Missing nonce parameter. The parameter is required'
678
- );
679
-
680
- // verify that the nonce is uniqueish
681
- $found = $this->data_store->lookup_nonce(
682
- $consumer,
683
- $token,
684
- $nonce,
685
- $timestamp
686
- );
687
- if ($found) {
688
- throw new OAuthException("Nonce already used: $nonce");
689
- }
690
- }
691
-
 
 
692
  }
693
 
694
- class OAuthDataStore {
695
- function lookup_consumer($consumer_key) {
696
- // implement me
697
- }
698
-
699
- function lookup_token($consumer, $token_type, $token) {
700
- // implement me
701
- }
702
 
703
- function lookup_nonce($consumer, $token, $nonce, $timestamp) {
704
- // implement me
705
- }
706
 
707
- function new_request_token($consumer, $callback = null) {
708
- // return a new token attached to this consumer
709
- }
710
 
711
- function new_access_token($token, $consumer, $verifier = null) {
712
- // return a new access token attached to this consumer
713
- // for the user associated with this token if the request token
714
- // is authorized
715
- // should also invalidate the request token
716
- }
717
 
718
- }
 
 
 
 
 
719
 
720
- class OAuthUtil {
721
- public static function urlencode_rfc3986($input) {
722
- if (is_array($input)) {
723
- return array_map(array('OAuthUtil', 'urlencode_rfc3986'), $input);
724
- } else if (is_scalar($input)) {
725
- return str_replace(
726
- '+',
727
- ' ',
728
- str_replace('%7E', '~', rawurlencode($input))
729
- );
730
- } else {
731
- return '';
732
- }
733
  }
734
 
735
-
736
- // This decode function isn't taking into consideration the above
737
- // modifications to the encoding process. However, this method doesn't
738
- // seem to be used anywhere so leaving it as is.
739
- public static function urldecode_rfc3986($string) {
740
- return urldecode($string);
741
- }
742
-
743
- // Utility function for turning the Authorization: header into
744
- // parameters, has to do some unescaping
745
- // Can filter out any non-oauth parameters if needed (default behaviour)
746
- public static function split_header($header, $only_allow_oauth_parameters = true) {
747
- $pattern = '/(([-_a-z]*)=("([^"]*)"|([^,]*)),?)/';
748
- $offset = 0;
749
- $params = array();
750
- while (preg_match($pattern, $header, $matches, PREG_OFFSET_CAPTURE, $offset) > 0) {
751
- $match = $matches[0];
752
- $header_name = $matches[2][0];
753
- $header_content = (isset($matches[5])) ? $matches[5][0] : $matches[4][0];
754
- if (preg_match('/^oauth_/', $header_name) || !$only_allow_oauth_parameters) {
755
- $params[$header_name] = OAuthUtil::urldecode_rfc3986($header_content);
756
- }
757
- $offset = $match[1] + strlen($match[0]);
758
- }
759
-
760
- if (isset($params['realm'])) {
761
- unset($params['realm']);
762
- }
763
-
764
- return $params;
765
- }
766
-
767
- // helper to try to sort out headers for people who aren't running apache
768
- public static function get_headers() {
769
- if (function_exists('apache_request_headers')) {
770
- // we need this to get the actual Authorization: header
771
- // because apache tends to tell us it doesn't exist
772
- $headers = apache_request_headers();
773
-
774
- // sanitize the output of apache_request_headers because
775
- // we always want the keys to be Cased-Like-This and arh()
776
- // returns the headers in the same case as they are in the
777
- // request
778
- $out = array();
779
- foreach( $headers AS $key => $value ) {
780
- $key = str_replace(
781
- " ",
782
- "-",
783
- ucwords(strtolower(str_replace("-", " ", $key)))
784
- );
785
- $out[$key] = $value;
786
- }
787
- } else {
788
- // otherwise we don't have apache and are just going to have to hope
789
- // that $_SERVER actually contains what we need
790
- $out = array();
791
- if( isset($_SERVER['CONTENT_TYPE']) )
792
- $out['Content-Type'] = $_SERVER['CONTENT_TYPE'];
793
- if( isset($_ENV['CONTENT_TYPE']) )
794
- $out['Content-Type'] = $_ENV['CONTENT_TYPE'];
795
-
796
- foreach ($_SERVER as $key => $value) {
797
- if (substr($key, 0, 5) == "HTTP_") {
798
- // this is chaos, basically it is just there to capitalize the first
799
- // letter of every word that is not an initial HTTP and strip HTTP
800
- // code from przemek
801
- $key = str_replace(
802
- " ",
803
- "-",
804
- ucwords(strtolower(str_replace("_", " ", substr($key, 5))))
805
- );
806
- $out[$key] = $value;
807
- }
808
- }
809
- }
810
- return $out;
811
- }
812
-
813
- // This function takes a input like a=b&a=c&d=e and returns the parsed
814
- // parameters like this
815
- // array('a' => array('b','c'), 'd' => 'e')
816
- public static function parse_parameters( $input ) {
817
- if (!isset($input) || !$input) return array();
818
-
819
- $pairs = explode('&', $input);
820
-
821
- $parsed_parameters = array();
822
- foreach ($pairs as $pair) {
823
- $split = explode('=', $pair, 2);
824
- $parameter = OAuthUtil::urldecode_rfc3986($split[0]);
825
- $value = isset($split[1]) ? OAuthUtil::urldecode_rfc3986($split[1]) : '';
826
-
827
- if (isset($parsed_parameters[$parameter])) {
828
- // We have already recieved parameter(s) with this name, so add to the list
829
- // of parameters with this name
830
-
831
- if (is_scalar($parsed_parameters[$parameter])) {
832
- // This is the first duplicate, so transform scalar (string) into an array
833
- // so we can add the duplicates
834
- $parsed_parameters[$parameter] = array($parsed_parameters[$parameter]);
835
- }
836
-
837
- $parsed_parameters[$parameter][] = $value;
838
- } else {
839
- $parsed_parameters[$parameter] = $value;
840
- }
841
- }
842
- return $parsed_parameters;
843
- }
844
-
845
- public static function build_http_query($params) {
846
- if (!$params) return '';
847
-
848
- // Urlencode both keys and values
849
- $keys = OAuthUtil::urlencode_rfc3986(array_keys($params));
850
- $values = OAuthUtil::urlencode_rfc3986(array_values($params));
851
- $params = array_combine($keys, $values);
852
-
853
- // Parameters are sorted by name, using lexicographical byte value ordering.
854
- // Ref: Spec: 9.1.1 (1)
855
- uksort($params, 'strcmp');
856
-
857
- $pairs = array();
858
- foreach ($params as $parameter => $value) {
859
- if (is_array($value)) {
860
- // If two or more parameters share the same name, they are sorted by their value
861
- // Ref: Spec: 9.1.1 (1)
862
- natsort($value);
863
- foreach ($value as $duplicate_value) {
864
- $pairs[] = $parameter . '=' . $duplicate_value;
865
- }
866
- } else {
867
- $pairs[] = $parameter . '=' . $value;
868
- }
869
- }
870
- // For each parameter, the name is separated from the corresponding value by an '=' character (ASCII code 61)
871
- // Each name-value pair is separated by an '&' character (ASCII code 38)
872
- return implode('&', $pairs);
873
- }
874
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
9
  }
10
  }
11
 
12
+ if (!class_exists('OAuthConsumer')) {
13
+ class OAuthConsumer {
14
+ public $key;
15
+ public $secret;
16
+
17
+ function __construct($key, $secret, $callback_url=NULL) {
18
+ $this->key = $key;
19
+ $this->secret = $secret;
20
+ $this->callback_url = $callback_url;
21
+ }
22
+
23
+ function __toString() {
24
+ return "OAuthConsumer[key=$this->key,secret=$this->secret]";
25
+ }
26
+ }
27
  }
28
 
29
+ if (!class_exists('OAuthToken')) {
30
+ class OAuthToken {
31
+ // access tokens and request tokens
32
+ public $key;
33
+ public $secret;
34
+
35
+ /**
36
+ * key = the token
37
+ * secret = the token secret
38
+ */
39
+ function __construct($key, $secret) {
40
+ $this->key = $key;
41
+ $this->secret = $secret;
42
+ }
43
+
44
+ /**
45
+ * generates the basic string serialization of a token that a server
46
+ * would respond to request_token and access_token calls with
47
+ */
48
+ function to_string() {
49
+ return "oauth_token=" .
50
+ OAuthUtil::urlencode_rfc3986($this->key) .
51
+ "&oauth_token_secret=" .
52
+ OAuthUtil::urlencode_rfc3986($this->secret);
53
+ }
54
+
55
+ function __toString() {
56
+ return $this->to_string();
57
+ }
58
+ }
59
  }
60
 
61
+ if (!class_exists('OAuthSignatureMethod')) {
62
+ /**
63
+ * A class for implementing a Signature Method
64
+ * See section 9 ("Signing Requests") in the spec
65
+ */
66
+ abstract class OAuthSignatureMethod {
67
+ /**
68
+ * Needs to return the name of the Signature Method (ie HMAC-SHA1)
69
+ * @return string
70
+ */
71
+ abstract public function get_name();
72
+
73
+ /**
74
+ * Build up the signature
75
+ * NOTE: The output of this function MUST NOT be urlencoded.
76
+ * the encoding is handled in OAuthRequest when the final
77
+ * request is serialized
78
+ * @param OAuthRequest $request
79
+ * @param OAuthConsumer $consumer
80
+ * @param OAuthToken $token
81
+ * @return string
82
+ */
83
+ abstract public function build_signature($request, $consumer, $token);
84
+
85
+ /**
86
+ * Verifies that a given signature is correct
87
+ * @param OAuthRequest $request
88
+ * @param OAuthConsumer $consumer
89
+ * @param OAuthToken $token
90
+ * @param string $signature
91
+ * @return bool
92
+ */
93
+ public function check_signature($request, $consumer, $token, $signature) {
94
+ $built = $this->build_signature($request, $consumer, $token);
95
+ return $built == $signature;
96
+ }
97
+ }
98
  }
99
 
100
+ if (!class_exists('OAuthSignatureMethod_HMAC_SHA1')) {
101
+ /**
102
+ * The HMAC-SHA1 signature method uses the HMAC-SHA1 signature algorithm as defined in [RFC2104]
103
+ * where the Signature Base String is the text and the key is the concatenated values (each first
104
+ * encoded per Parameter Encoding) of the Consumer Secret and Token Secret, separated by an '&'
105
+ * character (ASCII code 38) even if empty.
106
+ * - Chapter 9.2 ("HMAC-SHA1")
107
+ */
108
+ class OAuthSignatureMethod_HMAC_SHA1 extends OAuthSignatureMethod {
109
+ function get_name() {
110
+ return "HMAC-SHA1";
111
+ }
112
+
113
+ public function build_signature($request, $consumer, $token) {
114
+ $base_string = $request->get_signature_base_string();
115
+ $request->base_string = $base_string;
116
+
117
+ $key_parts = array(
118
+ $consumer->secret,
119
+ ($token) ? $token->secret : ""
120
+ );
121
+
122
+ $key_parts = OAuthUtil::urlencode_rfc3986($key_parts);
123
+ $key = implode('&', $key_parts);
124
+
125
+ return base64_encode(hash_hmac('sha1', $base_string, $key, true));
126
+ }
127
+ }
128
  }
129
 
130
+ if (!class_exists('OAuthSignatureMethod_PLAINTEXT')) {
131
+ /**
132
+ * The PLAINTEXT method does not provide any security protection and SHOULD only be used
133
+ * over a secure channel such as HTTPS. It does not use the Signature Base String.
134
+ * - Chapter 9.4 ("PLAINTEXT")
135
+ */
136
+ class OAuthSignatureMethod_PLAINTEXT extends OAuthSignatureMethod {
137
+ public function get_name() {
138
+ return "PLAINTEXT";
139
+ }
140
+
141
+ /**
142
+ * oauth_signature is set to the concatenated encoded values of the Consumer Secret and
143
+ * Token Secret, separated by a '&' character (ASCII code 38), even if either secret is
144
+ * empty. The result MUST be encoded again.
145
+ * - Chapter 9.4.1 ("Generating Signatures")
146
+ *
147
+ * Please note that the second encoding MUST NOT happen in the SignatureMethod, as
148
+ * OAuthRequest handles this!
149
+ */
150
+ public function build_signature($request, $consumer, $token) {
151
+ $key_parts = array(
152
+ $consumer->secret,
153
+ ($token) ? $token->secret : ""
154
+ );
155
+
156
+ $key_parts = OAuthUtil::urlencode_rfc3986($key_parts);
157
+ $key = implode('&', $key_parts);
158
+ $request->base_string = $key;
159
+
160
+ return $key;
161
+ }
162
+ }
163
  }
164
 
165
+ if (!class_exists('OAuthSignatureMethod_RSA_SHA1')) {
166
+ /**
167
+ * The RSA-SHA1 signature method uses the RSASSA-PKCS1-v1_5 signature algorithm as defined in
168
+ * [RFC3447] section 8.2 (more simply known as PKCS#1), using SHA-1 as the hash function for
169
+ * EMSA-PKCS1-v1_5. It is assumed that the Consumer has provided its RSA public key in a
170
+ * verified way to the Service Provider, in a manner which is beyond the scope of this
171
+ * specification.
172
+ * - Chapter 9.3 ("RSA-SHA1")
173
+ */
174
+ abstract class OAuthSignatureMethod_RSA_SHA1 extends OAuthSignatureMethod {
175
+ public function get_name() {
176
+ return "RSA-SHA1";
177
+ }
178
+
179
+ // Up to the SP to implement this lookup of keys. Possible ideas are:
180
+ // (1) do a lookup in a table of trusted certs keyed off of consumer
181
+ // (2) fetch via http using a url provided by the requester
182
+ // (3) some sort of specific discovery code based on request
183
+ //
184
+ // Either way should return a string representation of the certificate
185
+ protected abstract function fetch_public_cert(&$request);
186
+
187
+ // Up to the SP to implement this lookup of keys. Possible ideas are:
188
+ // (1) do a lookup in a table of trusted certs keyed off of consumer
189
+ //
190
+ // Either way should return a string representation of the certificate
191
+ protected abstract function fetch_private_cert(&$request);
192
+
193
+ public function build_signature($request, $consumer, $token) {
194
+ $base_string = $request->get_signature_base_string();
195
+ $request->base_string = $base_string;
196
+
197
+ // Fetch the private key cert based on the request
198
+ $cert = $this->fetch_private_cert($request);
199
+
200
+ // Pull the private key ID from the certificate
201
+ $privatekeyid = openssl_get_privatekey($cert);
202
+
203
+ // Sign using the key
204
+ $ok = openssl_sign($base_string, $signature, $privatekeyid);
205
+
206
+ // Release the key resource
207
+ openssl_free_key($privatekeyid);
208
+
209
+ return base64_encode($signature);
210
+ }
211
+
212
+ public function check_signature($request, $consumer, $token, $signature) {
213
+ $decoded_sig = base64_decode($signature);
214
+
215
+ $base_string = $request->get_signature_base_string();
216
+
217
+ // Fetch the public key cert based on the request
218
+ $cert = $this->fetch_public_cert($request);
219
+
220
+ // Pull the public key ID from the certificate
221
+ $publickeyid = openssl_get_publickey($cert);
222
+
223
+ // Check the computed signature against the one passed in the query
224
+ $ok = openssl_verify($base_string, $decoded_sig, $publickeyid);
225
+
226
+ // Release the key resource
227
+ openssl_free_key($publickeyid);
228
+
229
+ return $ok == 1;
230
+ }
231
+ }
232
  }
233
 
234
+ if (!class_exists('OAuthRequest')) {
235
+ class OAuthRequest {
236
+ private $parameters;
237
+ private $http_method;
238
+ private $http_url;
239
+ // for debug purposes
240
+ public $base_string;
241
+ public static $version = '1.0';
242
+ public static $POST_INPUT = 'php://input';
243
+
244
+ function __construct($http_method, $http_url, $parameters=NULL) {
245
+ @$parameters or $parameters = array();
246
+ $parameters = array_merge( OAuthUtil::parse_parameters(parse_url($http_url, PHP_URL_QUERY)), $parameters);
247
+ $this->parameters = $parameters;
248
+ $this->http_method = $http_method;
249
+ $this->http_url = $http_url;
250
+ }
251
+
252
+
253
+ /**
254
+ * attempt to build up a request from what was passed to the server
255
+ */
256
+ public static function from_request($http_method=NULL, $http_url=NULL, $parameters=NULL) {
257
+ $scheme = (!isset($_SERVER['HTTPS']) || $_SERVER['HTTPS'] != "on")
258
+ ? 'http'
259
+ : 'https';
260
+ @$http_url or $http_url = $scheme .
261
+ '://' . $_SERVER['HTTP_HOST'] .
262
+ ':' .
263
+ $_SERVER['SERVER_PORT'] .
264
+ $_SERVER['REQUEST_URI'];
265
+ @$http_method or $http_method = $_SERVER['REQUEST_METHOD'];
266
+
267
+ // We weren't handed any parameters, so let's find the ones relevant to
268
+ // this request.
269
+ // If you run XML-RPC or similar you should use this to provide your own
270
+ // parsed parameter-list
271
+ if (!$parameters) {
272
+ // Find request headers
273
+ $request_headers = OAuthUtil::get_headers();
274
+
275
+ // Parse the query-string to find GET parameters
276
+ $parameters = OAuthUtil::parse_parameters($_SERVER['QUERY_STRING']);
277
+
278
+ // It's a POST request of the proper content-type, so parse POST
279
+ // parameters and add those overriding any duplicates from GET
280
+ if ($http_method == "POST"
281
+ && @strstr($request_headers["Content-Type"],
282
+ "application/x-www-form-urlencoded")
283
+ ) {
284
+ $post_data = OAuthUtil::parse_parameters(
285
+ file_get_contents(self::$POST_INPUT)
286
+ );
287
+ $parameters = array_merge($parameters, $post_data);
288
+ }
289
+
290
+ // We have a Authorization-header with OAuth data. Parse the header
291
+ // and add those overriding any duplicates from GET or POST
292
+ if (@substr($request_headers['Authorization'], 0, 6) == "OAuth ") {
293
+ $header_parameters = OAuthUtil::split_header(
294
+ $request_headers['Authorization']
295
+ );
296
+ $parameters = array_merge($parameters, $header_parameters);
297
+ }
298
+
299
+ }
300
+
301
+ return new OAuthRequest($http_method, $http_url, $parameters);
302
+ }
303
+
304
+ /**
305
+ * pretty much a helper function to set up the request
306
+ */
307
+ public static function from_consumer_and_token($consumer, $token, $http_method, $http_url, $parameters=NULL) {
308
+ @$parameters or $parameters = array();
309
+ $defaults = array("oauth_version" => OAuthRequest::$version,
310
+ "oauth_nonce" => OAuthRequest::generate_nonce(),
311
+ "oauth_timestamp" => OAuthRequest::generate_timestamp(),
312
+ "oauth_consumer_key" => $consumer->key);
313
+ if ($token)
314
+ $defaults['oauth_token'] = $token->key;
315
+
316
+ $parameters = array_merge($defaults, $parameters);
317
+
318
+ return new OAuthRequest($http_method, $http_url, $parameters);
319
+ }
320
+
321
+ public function set_parameter($name, $value, $allow_duplicates = true) {
322
+ if ($allow_duplicates && isset($this->parameters[$name])) {
323
+ // We have already added parameter(s) with this name, so add to the list
324
+ if (is_scalar($this->parameters[$name])) {
325
+ // This is the first duplicate, so transform scalar (string)
326
+ // into an array so we can add the duplicates
327
+ $this->parameters[$name] = array($this->parameters[$name]);
328
+ }
329
+
330
+ $this->parameters[$name][] = $value;
331
+ } else {
332
+ $this->parameters[$name] = $value;
333
+ }
334
+ }
335
+
336
+ public function get_parameter($name) {
337
+ return isset($this->parameters[$name]) ? $this->parameters[$name] : null;
338
+ }
339
+
340
+ public function get_parameters() {
341
+ return $this->parameters;
342
+ }
343
+
344
+ public function unset_parameter($name) {
345
+ unset($this->parameters[$name]);
346
+ }
347
+
348
+ /**
349
+ * The request parameters, sorted and concatenated into a normalized string.
350
+ * @return string
351
+ */
352
+ public function get_signable_parameters() {
353
+ // Grab all parameters
354
+ $params = $this->parameters;
355
+
356
+ // Remove oauth_signature if present
357
+ // Ref: Spec: 9.1.1 ("The oauth_signature parameter MUST be excluded.")
358
+ if (isset($params['oauth_signature'])) {
359
+ unset($params['oauth_signature']);
360
+ }
361
+
362
+ return OAuthUtil::build_http_query($params);
363
+ }
364
+
365
+ /**
366
+ * Returns the base string of this request
367
+ *
368
+ * The base string defined as the method, the url
369
+ * and the parameters (normalized), each urlencoded
370
+ * and the concated with &.
371
+ */
372
+ public function get_signature_base_string() {
373
+ $parts = array(
374
+ $this->get_normalized_http_method(),
375
+ $this->get_normalized_http_url(),
376
+ $this->get_signable_parameters()
377
+ );
378
+
379
+ $parts = OAuthUtil::urlencode_rfc3986($parts);
380
+
381
+ return implode('&', $parts);
382
+ }
383
+
384
+ /**
385
+ * just uppercases the http method
386
+ */
387
+ public function get_normalized_http_method() {
388
+ return strtoupper($this->http_method);
389
+ }
390
+
391
+ /**
392
+ * parses the url and rebuilds it to be
393
+ * scheme://host/path
394
+ */
395
+ public function get_normalized_http_url() {
396
+ $parts = parse_url($this->http_url);
397
+
398
+ $port = @$parts['port'];
399
+ $scheme = $parts['scheme'];
400
+ $host = $parts['host'];
401
+ $path = @$parts['path'];
402
+
403
+ $port or $port = ($scheme == 'https') ? '443' : '80';
404
+
405
+ if (($scheme == 'https' && $port != '443')
406
+ || ($scheme == 'http' && $port != '80')) {
407
+ $host = "$host:$port";
408
+ }
409
+ return "$scheme://$host$path";
410
+ }
411
+
412
+ /**
413
+ * builds a url usable for a GET request
414
+ */
415
+ public function to_url() {
416
+ $post_data = $this->to_postdata();
417
+ $out = $this->get_normalized_http_url();
418
+ if ($post_data) {
419
+ $out .= '?'.$post_data;
420
+ }
421
+ return $out;
422
+ }
423
+
424
+ /**
425
+ * builds the data one would send in a POST request
426
+ */
427
+ public function to_postdata() {
428
+ return OAuthUtil::build_http_query($this->parameters);
429
+ }
430
+
431
+ /**
432
+ * builds the Authorization: header
433
+ */
434
+ public function to_header($realm=null) {
435
+ $first = true;
436
+ if($realm) {
437
+ $out = 'Authorization: OAuth realm="' . OAuthUtil::urlencode_rfc3986($realm) . '"';
438
+ $first = false;
439
+ } else
440
+ $out = 'Authorization: OAuth';
441
+
442
+ $total = array();
443
+ foreach ($this->parameters as $k => $v) {
444
+ if (substr($k, 0, 5) != "oauth") continue;
445
+ if (is_array($v)) {
446
+ throw new OAuthException('Arrays not supported in headers');
447
+ }
448
+ $out .= ($first) ? ' ' : ',';
449
+ $out .= OAuthUtil::urlencode_rfc3986($k) .
450
+ '="' .
451
+ OAuthUtil::urlencode_rfc3986($v) .
452
+ '"';
453
+ $first = false;
454
+ }
455
+ return $out;
456
+ }
457
+
458
+ public function __toString() {
459
+ return $this->to_url();
460
+ }
461
+
462
+
463
+ public function sign_request($signature_method, $consumer, $token) {
464
+ $this->set_parameter(
465
+ "oauth_signature_method",
466
+ $signature_method->get_name(),
467
+ false
468
+ );
469
+ $signature = $this->build_signature($signature_method, $consumer, $token);
470
+ $this->set_parameter("oauth_signature", $signature, false);
471
+ }
472
+
473
+ public function build_signature($signature_method, $consumer, $token) {
474
+ $signature = $signature_method->build_signature($this, $consumer, $token);
475
+ return $signature;
476
+ }
477
+
478
+ /**
479
+ * util function: current timestamp
480
+ */
481
+ private static function generate_timestamp() {
482
+ return time();
483
+ }
484
+
485
+ /**
486
+ * util function: current nonce
487
+ */
488
+ private static function generate_nonce() {
489
+ $mt = microtime();
490
+ $rand = mt_rand();
491
+
492
+ return md5($mt . $rand); // md5s look nicer than numbers
493
+ }
494
+ }
495
  }
496
 
497
+ if (!class_exists('OAuthServer')) {
498
+ class OAuthServer {
499
+ protected $timestamp_threshold = 300; // in seconds, five minutes
500
+ protected $version = '1.0'; // hi blaine
501
+ protected $signature_methods = array();
502
+
503
+ protected $data_store;
504
+
505
+ function __construct($data_store) {
506
+ $this->data_store = $data_store;
507
+ }
508
+
509
+ public function add_signature_method($signature_method) {
510
+ $this->signature_methods[$signature_method->get_name()] =
511
+ $signature_method;
512
+ }
513
+
514
+ // high level functions
515
+
516
+ /**
517
+ * process a request_token request
518
+ * returns the request token on success
519
+ */
520
+ public function fetch_request_token(&$request) {
521
+ $this->get_version($request);
522
+
523
+ $consumer = $this->get_consumer($request);
524
+
525
+ // no token required for the initial token request
526
+ $token = NULL;
527
+
528
+ $this->check_signature($request, $consumer, $token);
529
+
530
+ // Rev A change
531
+ $callback = $request->get_parameter('oauth_callback');
532
+ $new_token = $this->data_store->new_request_token($consumer, $callback);
533
+
534
+ return $new_token;
535
+ }
536
+
537
+ /**
538
+ * process an access_token request
539
+ * returns the access token on success
540
+ */
541
+ public function fetch_access_token(&$request) {
542
+ $this->get_version($request);
543
+
544
+ $consumer = $this->get_consumer($request);
545
+
546
+ // requires authorized request token
547
+ $token = $this->get_token($request, $consumer, "request");
548
+
549
+ $this->check_signature($request, $consumer, $token);
550
+
551
+ // Rev A change
552
+ $verifier = $request->get_parameter('oauth_verifier');
553
+ $new_token = $this->data_store->new_access_token($token, $consumer, $verifier);
554
+
555
+ return $new_token;
556
+ }
557
+
558
+ /**
559
+ * verify an api call, checks all the parameters
560
+ */
561
+ public function verify_request(&$request) {
562
+ $this->get_version($request);
563
+ $consumer = $this->get_consumer($request);
564
+ $token = $this->get_token($request, $consumer, "access");
565
+ $this->check_signature($request, $consumer, $token);
566
+ return array($consumer, $token);
567
+ }
568
+
569
+ // Internals from here
570
+ /**
571
+ * version 1
572
+ */
573
+ private function get_version(&$request) {
574
+ $version = $request->get_parameter("oauth_version");
575
+ if (!$version) {
576
+ // Service Providers MUST assume the protocol version to be 1.0 if this parameter is not present.
577
+ // Chapter 7.0 ("Accessing Protected Ressources")
578
+ $version = '1.0';
579
+ }
580
+ if ($version !== $this->version) {
581
+ throw new OAuthException("OAuth version '$version' not supported");
582
+ }
583
+ return $version;
584
+ }
585
+
586
+ /**
587
+ * figure out the signature with some defaults
588
+ */
589
+ private function get_signature_method(&$request) {
590
+ $signature_method =
591
+ @$request->get_parameter("oauth_signature_method");
592
+
593
+ if (!$signature_method) {
594
+ // According to chapter 7 ("Accessing Protected Ressources") the signature-method
595
+ // parameter is required, and we can't just fallback to PLAINTEXT
596
+ throw new OAuthException('No signature method parameter. This parameter is required');
597
+ }
598
+
599
+ if (!in_array($signature_method,
600
+ array_keys($this->signature_methods))) {
601
+ throw new OAuthException(
602
+ "Signature method '$signature_method' not supported " .
603
+ "try one of the following: " .
604
+ implode(", ", array_keys($this->signature_methods))
605
+ );
606
+ }
607
+ return $this->signature_methods[$signature_method];
608
+ }
609
+
610
+ /**
611
+ * try to find the consumer for the provided request's consumer key
612
+ */
613
+ private function get_consumer(&$request) {
614
+ $consumer_key = @$request->get_parameter("oauth_consumer_key");
615
+ if (!$consumer_key) {
616
+ throw new OAuthException("Invalid consumer key");
617
+ }
618
+
619
+ $consumer = $this->data_store->lookup_consumer($consumer_key);
620
+ if (!$consumer) {
621
+ throw new OAuthException("Invalid consumer");
622
+ }
623
+
624
+ return $consumer;
625
+ }
626
+
627
+ /**
628
+ * try to find the token for the provided request's token key
629
+ */
630
+ private function get_token(&$request, $consumer, $token_type="access") {
631
+ $token_field = @$request->get_parameter('oauth_token');
632
+ $token = $this->data_store->lookup_token(
633
+ $consumer, $token_type, $token_field
634
+ );
635
+ if (!$token) {
636
+ throw new OAuthException("Invalid $token_type token: $token_field");
637
+ }
638
+ return $token;
639
+ }
640
+
641
+ /**
642
+ * all-in-one function to check the signature on a request
643
+ * should guess the signature method appropriately
644
+ */
645
+ private function check_signature(&$request, $consumer, $token) {
646
+ // this should probably be in a different method
647
+ $timestamp = @$request->get_parameter('oauth_timestamp');
648
+ $nonce = @$request->get_parameter('oauth_nonce');
649
+
650
+ $this->check_timestamp($timestamp);
651
+ $this->check_nonce($consumer, $token, $nonce, $timestamp);
652
+
653
+ $signature_method = $this->get_signature_method($request);
654
+
655
+ $signature = $request->get_parameter('oauth_signature');
656
+ $valid_sig = $signature_method->check_signature(
657
+ $request,
658
+ $consumer,
659
+ $token,
660
+ $signature
661
+ );
662
+
663
+ if (!$valid_sig) {
664
+ throw new OAuthException("Invalid signature");
665
+ }
666
+ }
667
+
668
+ /**
669
+ * check that the timestamp is new enough
670
+ */
671
+ private function check_timestamp($timestamp) {
672
+ if( ! $timestamp )
673
+ throw new OAuthException(
674
+ 'Missing timestamp parameter. The parameter is required'
675
+ );
676
+
677
+ // verify that timestamp is recentish
678
+ $now = time();
679
+ if (abs($now - $timestamp) > $this->timestamp_threshold) {
680
+ throw new OAuthException(
681
+ "Expired timestamp, yours $timestamp, ours $now"
682
+ );
683
+ }
684
+ }
685
+
686
+ /**
687
+ * check that the nonce is not repeated
688
+ */
689
+ private function check_nonce($consumer, $token, $nonce, $timestamp) {
690
+ if( ! $nonce )
691
+ throw new OAuthException(
692
+ 'Missing nonce parameter. The parameter is required'
693
+ );
694
+
695
+ // verify that the nonce is uniqueish
696
+ $found = $this->data_store->lookup_nonce(
697
+ $consumer,
698
+ $token,
699
+ $nonce,
700
+ $timestamp
701
+ );
702
+ if ($found) {
703
+ throw new OAuthException("Nonce already used: $nonce");
704
+ }
705
+ }
706
+
707
+ }
708
  }
709
 
710
+ if (!class_exists('OAuthDataStore')) {
711
+ class OAuthDataStore {
712
+ function lookup_consumer($consumer_key) {
713
+ // implement me
714
+ }
 
 
 
715
 
716
+ function lookup_token($consumer, $token_type, $token) {
717
+ // implement me
718
+ }
719
 
720
+ function lookup_nonce($consumer, $token, $nonce, $timestamp) {
721
+ // implement me
722
+ }
723
 
724
+ function new_request_token($consumer, $callback = null) {
725
+ // return a new token attached to this consumer
726
+ }
 
 
 
727
 
728
+ function new_access_token($token, $consumer, $verifier = null) {
729
+ // return a new access token attached to this consumer
730
+ // for the user associated with this token if the request token
731
+ // is authorized
732
+ // should also invalidate the request token
733
+ }
734
 
735
+ }
 
 
 
 
 
 
 
 
 
 
 
 
736
  }
737
 
738
+ if (!class_exists('OAuthUtil')) {
739
+ class OAuthUtil {
740
+ public static function urlencode_rfc3986($input) {
741
+ if (is_array($input)) {
742
+ return array_map(array('OAuthUtil', 'urlencode_rfc3986'), $input);
743
+ } else if (is_scalar($input)) {
744
+ return str_replace(
745
+ '+',
746
+ ' ',
747
+ str_replace('%7E', '~', rawurlencode($input))
748
+ );
749
+ } else {
750
+ return '';
751
+ }
752
+ }
753
+
754
+
755
+ // This decode function isn't taking into consideration the above
756
+ // modifications to the encoding process. However, this method doesn't
757
+ // seem to be used anywhere so leaving it as is.
758
+ public static function urldecode_rfc3986($string) {
759
+ return urldecode($string);
760
+ }
761
+
762
+ // Utility function for turning the Authorization: header into
763
+ // parameters, has to do some unescaping
764
+ // Can filter out any non-oauth parameters if needed (default behaviour)
765
+ public static function split_header($header, $only_allow_oauth_parameters = true) {
766
+ $pattern = '/(([-_a-z]*)=("([^"]*)"|([^,]*)),?)/';
767
+ $offset = 0;
768
+ $params = array();
769
+ while (preg_match($pattern, $header, $matches, PREG_OFFSET_CAPTURE, $offset) > 0) {
770
+ $match = $matches[0];
771
+ $header_name = $matches[2][0];
772
+ $header_content = (isset($matches[5])) ? $matches[5][0] : $matches[4][0];
773
+ if (preg_match('/^oauth_/', $header_name) || !$only_allow_oauth_parameters) {
774
+ $params[$header_name] = OAuthUtil::urldecode_rfc3986($header_content);
775
+ }
776
+ $offset = $match[1] + strlen($match[0]);
777
+ }
778
+
779
+ if (isset($params['realm'])) {
780
+ unset($params['realm']);
781
+ }
782
+
783
+ return $params;
784
+ }
785
+
786
+ // helper to try to sort out headers for people who aren't running apache
787
+ public static function get_headers() {
788
+ if (function_exists('apache_request_headers')) {
789
+ // we need this to get the actual Authorization: header
790
+ // because apache tends to tell us it doesn't exist
791
+ $headers = apache_request_headers();
792
+
793
+ // sanitize the output of apache_request_headers because
794
+ // we always want the keys to be Cased-Like-This and arh()
795
+ // returns the headers in the same case as they are in the
796
+ // request
797
+ $out = array();
798
+ foreach( $headers AS $key => $value ) {
799
+ $key = str_replace(
800
+ " ",
801
+ "-",
802
+ ucwords(strtolower(str_replace("-", " ", $key)))
803
+ );
804
+ $out[$key] = $value;
805
+ }
806
+ } else {
807
+ // otherwise we don't have apache and are just going to have to hope
808
+ // that $_SERVER actually contains what we need
809
+ $out = array();
810
+ if( isset($_SERVER['CONTENT_TYPE']) )
811
+ $out['Content-Type'] = $_SERVER['CONTENT_TYPE'];
812
+ if( isset($_ENV['CONTENT_TYPE']) )
813
+ $out['Content-Type'] = $_ENV['CONTENT_TYPE'];
814
+
815
+ foreach ($_SERVER as $key => $value) {
816
+ if (substr($key, 0, 5) == "HTTP_") {
817
+ // this is chaos, basically it is just there to capitalize the first
818
+ // letter of every word that is not an initial HTTP and strip HTTP
819
+ // code from przemek
820
+ $key = str_replace(
821
+ " ",
822
+ "-",
823
+ ucwords(strtolower(str_replace("_", " ", substr($key, 5))))
824
+ );
825
+ $out[$key] = $value;
826
+ }
827
+ }
828
+ }
829
+ return $out;
830
+ }
831
+
832
+ // This function takes a input like a=b&a=c&d=e and returns the parsed
833
+ // parameters like this
834
+ // array('a' => array('b','c'), 'd' => 'e')
835
+ public static function parse_parameters( $input ) {
836
+ if (!isset($input) || !$input) return array();
837
+
838
+ $pairs = explode('&', $input);
839
+
840
+ $parsed_parameters = array();
841
+ foreach ($pairs as $pair) {
842
+ $split = explode('=', $pair, 2);
843
+ $parameter = OAuthUtil::urldecode_rfc3986($split[0]);
844
+ $value = isset($split[1]) ? OAuthUtil::urldecode_rfc3986($split[1]) : '';
845
+
846
+ if (isset($parsed_parameters[$parameter])) {
847
+ // We have already recieved parameter(s) with this name, so add to the list
848
+ // of parameters with this name
849
+
850
+ if (is_scalar($parsed_parameters[$parameter])) {
851
+ // This is the first duplicate, so transform scalar (string) into an array
852
+ // so we can add the duplicates
853
+ $parsed_parameters[$parameter] = array($parsed_parameters[$parameter]);
854
+ }
855
+
856
+ $parsed_parameters[$parameter][] = $value;
857
+ } else {
858
+ $parsed_parameters[$parameter] = $value;
859
+ }
860
+ }
861
+ return $parsed_parameters;
862
+ }
863
+
864
+ public static function build_http_query($params) {
865
+ if (!$params) return '';
866
+
867
+ // Urlencode both keys and values
868
+ $keys = OAuthUtil::urlencode_rfc3986(array_keys($params));
869
+ $values = OAuthUtil::urlencode_rfc3986(array_values($params));
870
+ $params = array_combine($keys, $values);
871
+
872
+ // Parameters are sorted by name, using lexicographical byte value ordering.
873
+ // Ref: Spec: 9.1.1 (1)
874
+ uksort($params, 'strcmp');
875
+
876
+ $pairs = array();
877
+ foreach ($params as $parameter => $value) {
878
+ if (is_array($value)) {
879
+ // If two or more parameters share the same name, they are sorted by their value
880
+ // Ref: Spec: 9.1.1 (1)
881
+ natsort($value);
882
+ foreach ($value as $duplicate_value) {
883
+ $pairs[] = $parameter . '=' . $duplicate_value;
884
+ }
885
+ } else {
886
+ $pairs[] = $parameter . '=' . $value;
887
+ }
888
+ }
889
+ // For each parameter, the name is separated from the corresponding value by an '=' character (ASCII code 61)
890
+ // Each name-value pair is separated by an '&' character (ASCII code 38)
891
+ return implode('&', $pairs);
892
+ }
893
+ }
894
+ }
library/twitteroauth.php CHANGED
@@ -9,233 +9,235 @@
9
  /* Load OAuth lib. You can find it at http://oauth.net */
10
  require_once('OAuth.php');
11
 
12
- /**
13
- * Twitter OAuth class
14
- */
15
- class TwitterOAuth {
16
- /* Contains the last HTTP status code returned. */
17
- public $http_code;
18
- /* Contains the last API call. */
19
- public $url;
20
- /* Set up the API root URL. */
21
- public $host = "https://api.twitter.com/1.1/";
22
- /* Set timeout default. */
23
- public $timeout = 30;
24
- /* Set connect timeout. */
25
- public $connecttimeout = 30;
26
- /* Verify SSL Cert. */
27
- public $ssl_verifypeer = FALSE;
28
- /* Respons format. */
29
- public $format = 'json';
30
- /* Decode returned json data. */
31
- public $decode_json = TRUE;
32
- /* Contains the last HTTP headers returned. */
33
- public $http_info;
34
- /* Set the useragnet. */
35
- public $useragent = 'TwitterOAuth v0.2.0-beta2';
36
- /* Immediately retry the API call if the response was not successful. */
37
- //public $retry = TRUE;
38
-
39
-
40
-
41
-
42
- /**
43
- * Set API URLS
44
- */
45
- function accessTokenURL() { return 'https://api.twitter.com/oauth/access_token'; }
46
- function authenticateURL() { return 'https://api.twitter.com/oauth/authenticate'; }
47
- function authorizeURL() { return 'https://api.twitter.com/oauth/authorize'; }
48
- function requestTokenURL() { return 'https://api.twitter.com/oauth/request_token'; }
49
-
50
- /**
51
- * Debug helpers
52
- */
53
- function lastStatusCode() { return $this->http_status; }
54
- function lastAPICall() { return $this->last_api_call; }
55
-
56
- /**
57
- * construct TwitterOAuth object
58
- */
59
- function __construct($consumer_key, $consumer_secret, $oauth_token = NULL, $oauth_token_secret = NULL) {
60
- $this->sha1_method = new OAuthSignatureMethod_HMAC_SHA1();
61
- $this->consumer = new OAuthConsumer($consumer_key, $consumer_secret);
62
- if (!empty($oauth_token) && !empty($oauth_token_secret)) {
63
- $this->token = new OAuthConsumer($oauth_token, $oauth_token_secret);
64
- } else {
65
- $this->token = NULL;
66
- }
67
- }
68
-
69
-
70
- /**
71
- * Get a request_token from Twitter
72
- *
73
- * @returns a key/value array containing oauth_token and oauth_token_secret
74
- */
75
- function getRequestToken($oauth_callback) {
76
- $parameters = array();
77
- $parameters['oauth_callback'] = $oauth_callback;
78
- $request = $this->oAuthRequest($this->requestTokenURL(), 'GET', $parameters);
79
- $token = OAuthUtil::parse_parameters($request);
80
- $this->token = new OAuthConsumer($token['oauth_token'], $token['oauth_token_secret']);
81
- return $token;
82
- }
83
-
84
- /**
85
- * Get the authorize URL
86
- *
87
- * @returns a string
88
- */
89
- function getAuthorizeURL($token, $sign_in_with_twitter = TRUE) {
90
- if (is_array($token)) {
91
- $token = $token['oauth_token'];
92
- }
93
- if (empty($sign_in_with_twitter)) {
94
- return $this->authorizeURL() . "?oauth_token={$token}";
95
- } else {
96
- return $this->authenticateURL() . "?oauth_token={$token}";
97
- }
98
- }
99
-
100
- /**
101
- * Exchange request token and secret for an access token and
102
- * secret, to sign API calls.
103
- *
104
- * @returns array("oauth_token" => "the-access-token",
105
- * "oauth_token_secret" => "the-access-secret",
106
- * "user_id" => "9436992",
107
- * "screen_name" => "abraham")
108
- */
109
- function getAccessToken($oauth_verifier) {
110
- $parameters = array();
111
- $parameters['oauth_verifier'] = $oauth_verifier;
112
- $request = $this->oAuthRequest($this->accessTokenURL(), 'GET', $parameters);
113
- $token = OAuthUtil::parse_parameters($request);
114
- $this->token = new OAuthConsumer($token['oauth_token'], $token['oauth_token_secret']);
115
- return $token;
116
- }
117
-
118
- /**
119
- * One time exchange of username and password for access token and secret.
120
- *
121
- * @returns array("oauth_token" => "the-access-token",
122
- * "oauth_token_secret" => "the-access-secret",
123
- * "user_id" => "9436992",
124
- * "screen_name" => "abraham",
125
- * "x_auth_expires" => "0")
126
- */
127
- function getXAuthToken($username, $password) {
128
- $parameters = array();
129
- $parameters['x_auth_username'] = $username;
130
- $parameters['x_auth_password'] = $password;
131
- $parameters['x_auth_mode'] = 'client_auth';
132
- $request = $this->oAuthRequest($this->accessTokenURL(), 'POST', $parameters);
133
- $token = OAuthUtil::parse_parameters($request);
134
- $this->token = new OAuthConsumer($token['oauth_token'], $token['oauth_token_secret']);
135
- return $token;
136
- }
137
-
138
- /**
139
- * GET wrapper for oAuthRequest.
140
- */
141
- function get($url, $parameters = array()) {
142
- $response = $this->oAuthRequest($url, 'GET', $parameters);
143
- if ($this->format === 'json' && $this->decode_json) {
144
- return json_decode($response);
145
- }
146
- return $response;
147
- }
148
-
149
- /**
150
- * POST wrapper for oAuthRequest.
151
- */
152
- function post($url, $parameters = array()) {
153
- $response = $this->oAuthRequest($url, 'POST', $parameters);
154
- if ($this->format === 'json' && $this->decode_json) {
155
- return json_decode($response);
156
- }
157
- return $response;
158
- }
159
-
160
- /**
161
- * DELETE wrapper for oAuthReqeust.
162
- */
163
- function delete($url, $parameters = array()) {
164
- $response = $this->oAuthRequest($url, 'DELETE', $parameters);
165
- if ($this->format === 'json' && $this->decode_json) {
166
- return json_decode($response);
167
- }
168
- return $response;
169
- }
170
-
171
- /**
172
- * Format and sign an OAuth / API request
173
- */
174
- function oAuthRequest($url, $method, $parameters) {
175
- if (strrpos($url, 'https://') !== 0 && strrpos($url, 'http://') !== 0) {
176
- $url = "{$this->host}{$url}.{$this->format}";
177
- }
178
- $request = OAuthRequest::from_consumer_and_token($this->consumer, $this->token, $method, $url, $parameters);
179
- $request->sign_request($this->sha1_method, $this->consumer, $this->token);
180
- switch ($method) {
181
- case 'GET':
182
- return $this->http($request->to_url(), 'GET');
183
- default:
184
- return $this->http($request->get_normalized_http_url(), $method, $request->to_postdata());
185
- }
186
- }
187
-
188
- /**
189
- * Make an HTTP request
190
- *
191
- * @return API results
192
- */
193
- function http($url, $method, $postfields = NULL) {
194
- $this->http_info = array();
195
- $ci = curl_init();
196
- /* Curl settings */
197
- curl_setopt($ci, CURLOPT_USERAGENT, $this->useragent);
198
- curl_setopt($ci, CURLOPT_CONNECTTIMEOUT, $this->connecttimeout);
199
- curl_setopt($ci, CURLOPT_TIMEOUT, $this->timeout);
200
- curl_setopt($ci, CURLOPT_RETURNTRANSFER, TRUE);
201
- curl_setopt($ci, CURLOPT_HTTPHEADER, array('Expect:'));
202
- curl_setopt($ci, CURLOPT_SSL_VERIFYPEER, $this->ssl_verifypeer);
203
- curl_setopt($ci, CURLOPT_HEADERFUNCTION, array($this, 'getHeader'));
204
- curl_setopt($ci, CURLOPT_HEADER, FALSE);
205
-
206
- switch ($method) {
207
- case 'POST':
208
- curl_setopt($ci, CURLOPT_POST, TRUE);
209
- if (!empty($postfields)) {
210
- curl_setopt($ci, CURLOPT_POSTFIELDS, $postfields);
211
- }
212
- break;
213
- case 'DELETE':
214
- curl_setopt($ci, CURLOPT_CUSTOMREQUEST, 'DELETE');
215
- if (!empty($postfields)) {
216
- $url = "{$url}?{$postfields}";
217
- }
218
- }
219
-
220
- curl_setopt($ci, CURLOPT_URL, $url);
221
- $response = curl_exec($ci);
222
- $this->http_code = curl_getinfo($ci, CURLINFO_HTTP_CODE);
223
- $this->http_info = array_merge($this->http_info, curl_getinfo($ci));
224
- $this->url = $url;
225
- curl_close ($ci);
226
- return $response;
227
- }
228
-
229
- /**
230
- * Get the header info to store.
231
- */
232
- function getHeader($ch, $header) {
233
- $i = strpos($header, ':');
234
- if (!empty($i)) {
235
- $key = str_replace('-', '_', strtolower(substr($header, 0, $i)));
236
- $value = trim(substr($header, $i + 2));
237
- $this->http_header[$key] = $value;
238
- }
239
- return strlen($header);
240
- }
241
- }
 
 
9
  /* Load OAuth lib. You can find it at http://oauth.net */
10
  require_once('OAuth.php');
11
 
12
+ if (!class_exists('TwitterOAuth')) {
13
+ /**
14
+ * Twitter OAuth class
15
+ */
16
+ class TwitterOAuth {
17
+ /* Contains the last HTTP status code returned. */
18
+ public $http_code;
19
+ /* Contains the last API call. */
20
+ public $url;
21
+ /* Set up the API root URL. */
22
+ public $host = "https://api.twitter.com/1.1/";
23
+ /* Set timeout default. */
24
+ public $timeout = 30;
25
+ /* Set connect timeout. */
26
+ public $connecttimeout = 30;
27
+ /* Verify SSL Cert. */
28
+ public $ssl_verifypeer = FALSE;
29
+ /* Respons format. */
30
+ public $format = 'json';
31
+ /* Decode returned json data. */
32
+ public $decode_json = TRUE;
33
+ /* Contains the last HTTP headers returned. */
34
+ public $http_info;
35
+ /* Set the useragnet. */
36
+ public $useragent = 'TwitterOAuth v0.2.0-beta2';
37
+ /* Immediately retry the API call if the response was not successful. */
38
+ //public $retry = TRUE;
39
+
40
+
41
+
42
+
43
+ /**
44
+ * Set API URLS
45
+ */
46
+ function accessTokenURL() { return 'https://api.twitter.com/oauth/access_token'; }
47
+ function authenticateURL() { return 'https://api.twitter.com/oauth/authenticate'; }
48
+ function authorizeURL() { return 'https://api.twitter.com/oauth/authorize'; }
49
+ function requestTokenURL() { return 'https://api.twitter.com/oauth/request_token'; }
50
+
51
+ /**
52
+ * Debug helpers
53
+ */
54
+ function lastStatusCode() { return $this->http_status; }
55
+ function lastAPICall() { return $this->last_api_call; }
56
+
57
+ /**
58
+ * construct TwitterOAuth object
59
+ */
60
+ function __construct($consumer_key, $consumer_secret, $oauth_token = NULL, $oauth_token_secret = NULL) {
61
+ $this->sha1_method = new OAuthSignatureMethod_HMAC_SHA1();
62
+ $this->consumer = new OAuthConsumer($consumer_key, $consumer_secret);
63
+ if (!empty($oauth_token) && !empty($oauth_token_secret)) {
64
+ $this->token = new OAuthConsumer($oauth_token, $oauth_token_secret);
65
+ } else {
66
+ $this->token = NULL;
67
+ }
68
+ }
69
+
70
+
71
+ /**
72
+ * Get a request_token from Twitter
73
+ *
74
+ * @returns a key/value array containing oauth_token and oauth_token_secret
75
+ */
76
+ function getRequestToken($oauth_callback) {
77
+ $parameters = array();
78
+ $parameters['oauth_callback'] = $oauth_callback;
79
+ $request = $this->oAuthRequest($this->requestTokenURL(), 'GET', $parameters);
80
+ $token = OAuthUtil::parse_parameters($request);
81
+ $this->token = new OAuthConsumer($token['oauth_token'], $token['oauth_token_secret']);
82
+ return $token;
83
+ }
84
+
85
+ /**
86
+ * Get the authorize URL
87
+ *
88
+ * @returns a string
89
+ */
90
+ function getAuthorizeURL($token, $sign_in_with_twitter = TRUE) {
91
+ if (is_array($token)) {
92
+ $token = $token['oauth_token'];
93
+ }
94
+ if (empty($sign_in_with_twitter)) {
95
+ return $this->authorizeURL() . "?oauth_token={$token}";
96
+ } else {
97
+ return $this->authenticateURL() . "?oauth_token={$token}";
98
+ }
99
+ }
100
+
101
+ /**
102
+ * Exchange request token and secret for an access token and
103
+ * secret, to sign API calls.
104
+ *
105
+ * @returns array("oauth_token" => "the-access-token",
106
+ * "oauth_token_secret" => "the-access-secret",
107
+ * "user_id" => "9436992",
108
+ * "screen_name" => "abraham")
109
+ */
110
+ function getAccessToken($oauth_verifier) {
111
+ $parameters = array();
112
+ $parameters['oauth_verifier'] = $oauth_verifier;
113
+ $request = $this->oAuthRequest($this->accessTokenURL(), 'GET', $parameters);
114
+ $token = OAuthUtil::parse_parameters($request);
115
+ $this->token = new OAuthConsumer($token['oauth_token'], $token['oauth_token_secret']);
116
+ return $token;
117
+ }
118
+
119
+ /**
120
+ * One time exchange of username and password for access token and secret.
121
+ *
122
+ * @returns array("oauth_token" => "the-access-token",
123
+ * "oauth_token_secret" => "the-access-secret",
124
+ * "user_id" => "9436992",
125
+ * "screen_name" => "abraham",
126
+ * "x_auth_expires" => "0")
127
+ */
128
+ function getXAuthToken($username, $password) {
129
+ $parameters = array();
130
+ $parameters['x_auth_username'] = $username;
131
+ $parameters['x_auth_password'] = $password;
132
+ $parameters['x_auth_mode'] = 'client_auth';
133
+ $request = $this->oAuthRequest($this->accessTokenURL(), 'POST', $parameters);
134
+ $token = OAuthUtil::parse_parameters($request);
135
+ $this->token = new OAuthConsumer($token['oauth_token'], $token['oauth_token_secret']);
136
+ return $token;
137
+ }
138
+
139
+ /**
140
+ * GET wrapper for oAuthRequest.
141
+ */
142
+ function get($url, $parameters = array()) {
143
+ $response = $this->oAuthRequest($url, 'GET', $parameters);
144
+ if ($this->format === 'json' && $this->decode_json) {
145
+ return json_decode($response);
146
+ }
147
+ return $response;
148
+ }
149
+
150
+ /**
151
+ * POST wrapper for oAuthRequest.
152
+ */
153
+ function post($url, $parameters = array()) {
154
+ $response = $this->oAuthRequest($url, 'POST', $parameters);
155
+ if ($this->format === 'json' && $this->decode_json) {
156
+ return json_decode($response);
157
+ }
158
+ return $response;
159
+ }
160
+
161
+ /**
162
+ * DELETE wrapper for oAuthReqeust.
163
+ */
164
+ function delete($url, $parameters = array()) {
165
+ $response = $this->oAuthRequest($url, 'DELETE', $parameters);
166
+ if ($this->format === 'json' && $this->decode_json) {
167
+ return json_decode($response);
168
+ }
169
+ return $response;
170
+ }
171
+
172
+ /**
173
+ * Format and sign an OAuth / API request
174
+ */
175
+ function oAuthRequest($url, $method, $parameters) {
176
+ if (strrpos($url, 'https://') !== 0 && strrpos($url, 'http://') !== 0) {
177
+ $url = "{$this->host}{$url}.{$this->format}";
178
+ }
179
+ $request = OAuthRequest::from_consumer_and_token($this->consumer, $this->token, $method, $url, $parameters);
180
+ $request->sign_request($this->sha1_method, $this->consumer, $this->token);
181
+ switch ($method) {
182
+ case 'GET':
183
+ return $this->http($request->to_url(), 'GET');
184
+ default:
185
+ return $this->http($request->get_normalized_http_url(), $method, $request->to_postdata());
186
+ }
187
+ }
188
+
189
+ /**
190
+ * Make an HTTP request
191
+ *
192
+ * @return API results
193
+ */
194
+ function http($url, $method, $postfields = NULL) {
195
+ $this->http_info = array();
196
+ $ci = curl_init();
197
+ /* Curl settings */
198
+ curl_setopt($ci, CURLOPT_USERAGENT, $this->useragent);
199
+ curl_setopt($ci, CURLOPT_CONNECTTIMEOUT, $this->connecttimeout);
200
+ curl_setopt($ci, CURLOPT_TIMEOUT, $this->timeout);
201
+ curl_setopt($ci, CURLOPT_RETURNTRANSFER, TRUE);
202
+ curl_setopt($ci, CURLOPT_HTTPHEADER, array('Expect:'));
203
+ curl_setopt($ci, CURLOPT_SSL_VERIFYPEER, $this->ssl_verifypeer);
204
+ curl_setopt($ci, CURLOPT_HEADERFUNCTION, array($this, 'getHeader'));
205
+ curl_setopt($ci, CURLOPT_HEADER, FALSE);
206
+
207
+ switch ($method) {
208
+ case 'POST':
209
+ curl_setopt($ci, CURLOPT_POST, TRUE);
210
+ if (!empty($postfields)) {
211
+ curl_setopt($ci, CURLOPT_POSTFIELDS, $postfields);
212
+ }
213
+ break;
214
+ case 'DELETE':
215
+ curl_setopt($ci, CURLOPT_CUSTOMREQUEST, 'DELETE');
216
+ if (!empty($postfields)) {
217
+ $url = "{$url}?{$postfields}";
218
+ }
219
+ }
220
+
221
+ curl_setopt($ci, CURLOPT_URL, $url);
222
+ $response = curl_exec($ci);
223
+ $this->http_code = curl_getinfo($ci, CURLINFO_HTTP_CODE);
224
+ $this->http_info = array_merge($this->http_info, curl_getinfo($ci));
225
+ $this->url = $url;
226
+ curl_close ($ci);
227
+ return $response;
228
+ }
229
+
230
+ /**
231
+ * Get the header info to store.
232
+ */
233
+ function getHeader($ch, $header) {
234
+ $i = strpos($header, ':');
235
+ if (!empty($i)) {
236
+ $key = str_replace('-', '_', strtolower(substr($header, 0, $i)));
237
+ $value = trim(substr($header, $i + 2));
238
+ $this->http_header[$key] = $value;
239
+ }
240
+ return strlen($header);
241
+ }
242
+ }
243
+ }
readme.txt CHANGED
@@ -4,7 +4,7 @@ Donate link: http://thechamplord.wordpress.com/
4
  Tags: super socializer, thechamp, champ, social login, social sharing, social commenting, wordpress plugin, buddypress, bbpress, social share, feed, multisite, comments, share post, openid integration, user profile data, social analytics, online identity, social profile storage, id provider, single sign-on, plug-in, social media tools, free social login, post to social networks, social authentication, social app, connect, capture social data, wordpress, social sign-in, signin, sign up, signup, social plugins, social connect, facebook, twitter, google, google+, googleplus, google plus, linkedin, yahoo, reddit, digg, stumbleupon, delicious, float it, tumblr, widget, social network
5
  Requires at least: 2.5.0
6
  Tested up to: 3.8.1
7
- Stable tag: 1.0.1
8
  License: GPLv2 or later
9
 
10
  A complete 360 degree solution to provide all the social features like Social Login, Social Commenting, Social Sharing, Social Feed and more
@@ -164,6 +164,9 @@ Yes, I can help you with it. Just drop me an email at lordofthechamps@gmail.com
164
  3. **Facebook Commenting**: Facebook commenting replaces the traditional comment form
165
 
166
  == Changelog ==
 
 
 
167
  = 1.0.1 =
168
  * Minor bug fixing in Facebook feed functionality
169
 
@@ -176,4 +179,7 @@ Yes, I can help you with it. Just drop me an email at lordofthechamps@gmail.com
176
  * First version of the plugin
177
 
178
  = 1.0.1 =
179
- * Minor bug fixing in Facebook feed functionality
 
 
 
4
  Tags: super socializer, thechamp, champ, social login, social sharing, social commenting, wordpress plugin, buddypress, bbpress, social share, feed, multisite, comments, share post, openid integration, user profile data, social analytics, online identity, social profile storage, id provider, single sign-on, plug-in, social media tools, free social login, post to social networks, social authentication, social app, connect, capture social data, wordpress, social sign-in, signin, sign up, signup, social plugins, social connect, facebook, twitter, google, google+, googleplus, google plus, linkedin, yahoo, reddit, digg, stumbleupon, delicious, float it, tumblr, widget, social network
5
  Requires at least: 2.5.0
6
  Tested up to: 3.8.1
7
+ Stable tag: 1.0.2
8
  License: GPLv2 or later
9
 
10
  A complete 360 degree solution to provide all the social features like Social Login, Social Commenting, Social Sharing, Social Feed and more
164
  3. **Facebook Commenting**: Facebook commenting replaces the traditional comment form
165
 
166
  == Changelog ==
167
+ = 1.0.2 =
168
+ * Fixed the bug due to redeclaration of Twitter OAuth class
169
+
170
  = 1.0.1 =
171
  * Minor bug fixing in Facebook feed functionality
172
 
179
  * First version of the plugin
180
 
181
  = 1.0.1 =
182
+ * Minor bug fixing in Facebook feed functionality
183
+
184
+ = 1.0.2 =
185
+ * Fixed the bug due to redeclaration of Twitter OAuth class
super_socializer.php CHANGED
@@ -3,12 +3,12 @@
3
  Plugin Name: Super Socializer
4
  Plugin URI: https://www.facebook.com/SocializerChamp
5
  Description: A complete 360 degree solution to provide all the social features like Social Login, Social Commenting, Social Sharing, Social Feed and more.
6
- Version: 1.0.1
7
  Author: The Champ
8
  Author URI: http://thechamplord.wordpress.com
9
  License: GPL2+
10
  */
11
- define('THE_CHAMP_SS_VERSION', '1.0.1');
12
  if(get_option('the_champ_ss_version') != THE_CHAMP_SS_VERSION){
13
  update_option('the_champ_ss_version', THE_CHAMP_SS_VERSION);
14
  }
3
  Plugin Name: Super Socializer
4
  Plugin URI: https://www.facebook.com/SocializerChamp
5
  Description: A complete 360 degree solution to provide all the social features like Social Login, Social Commenting, Social Sharing, Social Feed and more.
6
+ Version: 1.0.2
7
  Author: The Champ
8
  Author URI: http://thechamplord.wordpress.com
9
  License: GPL2+
10
  */
11
+ define('THE_CHAMP_SS_VERSION', '1.0.2');
12
  if(get_option('the_champ_ss_version') != THE_CHAMP_SS_VERSION){
13
  update_option('the_champ_ss_version', THE_CHAMP_SS_VERSION);
14
  }