OAuthSignatureMethod.php

Go to the documentation of this file.

<?php
 
namespace IMSGlobal\LTI\OAuth;
 
abstract class OAuthSignatureMethod {
    abstract public function get_name();
 
    abstract public function build_signature($request, $consumer, $token);
 
    public function check_signature($request, $consumer, $token, $signature) {
 
        $built = $this->build_signature($request, $consumer, $token);
 
        // Check for zero length, although unlikely here
        if (strlen($built) == 0 || strlen($signature) == 0) {
            return false;
        }
 
        if (strlen($built) != strlen($signature)) {
            return false;
        }
 
        // Avoid a timing leak with a (hopefully) time insensitive compare
        $result = 0;
        for ($i = 0; $i < strlen($signature); $i++) {
            $result |= ord($built{$i}) ^ ord($signature{$i});
        }
 
        return $result == 0;
 
    }
 
}