Provides access to the Facebook Platform. More...

Inheritance diagram for BaseFacebook:

Collaboration diagram for BaseFacebook:

Public Member Functions
	__construct ($config)
	Initialize a Facebook Application. More...

	setAppId ($appId)
	Set the Application ID. More...

	getAppId ()
	Get the Application ID. More...

	setApiSecret ($apiSecret)
	Set the App Secret. More...

	setAppSecret ($appSecret)
	Set the App Secret. More...

	getApiSecret ()
	Get the App Secret. More...

	getAppSecret ()
	Get the App Secret. More...

	setFileUploadSupport ($fileUploadSupport)
	Set the file upload support status. More...

	getFileUploadSupport ()
	Get the file upload support status. More...

	useFileUploadSupport ()
	DEPRECATED! Please use getFileUploadSupport instead. More...

	setAccessToken ($access_token)
	Sets the access token for api calls. More...

	setExtendedAccessToken ()
	Extend an access token, while removing the short-lived token that might have been generated via client-side flow. More...

	getAccessToken ()
	Determines the access token that should be used for API calls. More...

	getSignedRequest ()
	Retrieve the signed request, either from a request parameter or, if not present, from a cookie. More...

	getUser ()
	Get the UID of the connected user, or 0 if the Facebook user is not connected. More...

	getLoginUrl ($params=array())
	Get a Login URL for use with redirects. More...

	getLogoutUrl ($params=array())
	Get a Logout URL suitable for use with redirects. More...

	getLoginStatusUrl ($params=array())
	Get a login status URL to fetch the status from Facebook. More...

	api ()
	Make an API call. More...

	destroySession ()
	Destroy the current session. More...

Data Fields
const	VERSION = '3.2.2'
	Version. More...

const	SIGNED_REQUEST_ALGORITHM = 'HMAC-SHA256'
	Signed Request Algorithm. More...

Static Public Attributes
static	$CURL_OPTS
	Default options for curl. More...

static	$DOMAIN_MAP
	Maps aliases to Facebook domains. More...

Protected Member Functions
	getUserAccessToken ()
	Determines and returns the user access token, first using the signed request if present, and then falling back on the authorization code if present. More...

	getUserFromAvailableData ()
	Determines the connected user by first examining any signed requests, then considering an authorization code, and then falling back to any persistent store storing the user. More...

	getSignedRequestCookieName ()
	Constructs and returns the name of the cookie that potentially houses the signed request for the app user. More...

	getMetadataCookieName ()
	Constructs and returns the name of the coookie that potentially contain metadata. More...

	getCode ()
	Get the authorization code from the query parameters, if it exists, and otherwise return false to signal no authorization code was discoverable. More...

	getUserFromAccessToken ()
	Retrieves the UID with the understanding that $this->accessToken has already been set and is seemingly legitimate. More...

	getApplicationAccessToken ()
	Returns the access token that should be used for logged out users when no authorization code is available. More...

	establishCSRFTokenState ()
	Lays down a CSRF state token for this process. More...

	getAccessTokenFromCode ($code, $redirect_uri=null)
	Retrieves an access token for the given authorization code (previously generated from www.facebook.com on behalf of a specific user). More...

	_restserver ($params)
	Invoke the old restserver.php endpoint. More...

	isVideoPost ($path, $method='GET')
	Return true if this is video post. More...

	_graph ($path, $method='GET', $params=array())
	Invoke the Graph API. More...

	_oauthRequest ($url, $params)
	Make a OAuth Request. More...

	makeRequest ($url, $params, $ch=null)
	Makes an HTTP request. More...

	parseSignedRequest ($signed_request)
	Parses a signed_request and validates the signature. More...

	makeSignedRequest ($data)
	Makes a signed_request blob using the given data. More...

	getApiUrl ($method)
	Build the URL for api given parameters. More...

	getUrl ($name, $path='', $params=array())
	Build the URL for given domain alias, path and parameters. More...

	getHttpHost ()

	getHttpProtocol ()

	getBaseDomain ()
	Get the base domain used for the cookie. More...

	getCurrentUrl ()
	Returns the Current URL, stripping it of known FB parameters that should not persist. More...

	throwAPIException ($result)
	Analyzes the supplied result to see if it was thrown because the access token is no longer valid. More...

	getMetadataCookie ()
	Parses the metadata cookie that our Javascript API set. More...

	setPersistentData ($key, $value)
	Each of the following four methods should be overridden in a concrete subclass, as they are in the provided Facebook class. More...

	getPersistentData ($key, $default=false)
	Get the data for $key, persisted by BaseFacebook::setPersistentData() More...

	clearPersistentData ($key)
	Clear the data with $key from the persistent storage. More...

	clearAllPersistentData ()
	Clear all data from the persistent storage. More...

Static Protected Member Functions
static	errorLog ($msg)
	Prints to the error log if you aren't in command line mode. More...

static	base64UrlDecode ($input)
	Base64 encoding that doesn't need to be urlencode()ed. More...

static	base64UrlEncode ($input)
	Base64 encoding that doesn't need to be urlencode()ed. More...

static	isAllowedDomain ($big, $small)

static	endsWith ($big, $small)

Protected Attributes
	$appId

	$appSecret

	$user

	$signedRequest
	The data from the signed_request token. More...

	$state
	A CSRF state variable to assist in the defense against CSRF attacks. More...

	$accessToken = null

	$fileUploadSupport = false

	$trustForwarded = false

Detailed Description

Provides access to the Facebook Platform.

This class provides a majority of the functionality needed, but the class is abstract because it is designed to be sub-classed. The subclass must implement the four abstract methods listed at the bottom of the file.

Author: Naitik Shah naiti.nosp@m.k@fa.nosp@m.ceboo.nosp@m.k.co.nosp@m.m

Definition at line 118 of file base_facebook.php.

Constructor & Destructor Documentation

◆ __construct()

BaseFacebook::__construct ( $config )

Initialize a Facebook Application.

The configuration:

appId: the application ID
secret: the application secret
fileUpload: (optional) boolean indicating if file uploads are enabled

Parameters

array $config The application configuration

Definition at line 215 of file base_facebook.php.

References $config, and $state.

                                        {
     $this->setAppId($config['appId']);
     $this->setAppSecret($config['secret']);
     if (isset($config['fileUpload'])) {
       $this->setFileUploadSupport($config['fileUpload']);
     }
     if (isset($config['trustForwarded']) && $config['trustForwarded']) {
       $this->trustForwarded = true;
     }
     $state = $this->getPersistentData('state');
     if (!empty($state)) {
       $this->state = $state;
     }
   }

Member Function Documentation

◆ _graph()

BaseFacebook::_graph	(	$path,
		$method = `'GET'`,
		$params = `array()`
	)

protected

Invoke the Graph API.

Parameters

string	$path	The path (required)
string	$method	The http method (default 'GET')
array	$params	The query/post data

Returns: mixed The decoded response object

Exceptions

FacebookApiException

Definition at line 852 of file base_facebook.php.

References PHPMailer\PHPMailer\$params, $path, and FacebookApiException\$result.

                                                                        {
     if (is_array($method) && empty($params)) {
       $params = $method;
       $method = 'GET';
     }
     $params['method'] = $method; // method override as we always do a POST
 
     if ($this->isVideoPost($path, $method)) {
       $domainKey = 'graph_video';
     } else {
       $domainKey = 'graph';
     }
 
     $result = json_decode($this->_oauthRequest(
       $this->getUrl($domainKey, $path),
       $params
     ), true);
 
     // results are returned, errors are thrown
     if (is_array($result) && isset($result['error'])) {
       $this->throwAPIException($result);
       // @codeCoverageIgnoreStart
     }
     // @codeCoverageIgnoreEnd
 
     return $result;
   }

◆ _oauthRequest()

BaseFacebook::_oauthRequest	(	$url,
		$params
	)

protected

Make a OAuth Request.

Parameters

string	$url	The path (required)
array	$params	The query/post data

Returns: string The decoded response object

Exceptions

FacebookApiException

Definition at line 889 of file base_facebook.php.

References $key, PHPMailer\PHPMailer\$params, and $url.

                                                   {
     if (!isset($params['access_token'])) {
       $params['access_token'] = $this->getAccessToken();
     }
 
     // json_encode all params values that are not strings
     foreach ($params as $key => $value) {
       if (!is_string($value)) {
         $params[$key] = json_encode($value);
       }
     }
 
     return $this->makeRequest($url, $params);
   }

◆ _restserver()

BaseFacebook::_restserver ( $params )

protected

Invoke the old restserver.php endpoint.

Parameters

array $params Method call object

Returns: mixed The decoded response object

Exceptions

FacebookApiException

Definition at line 801 of file base_facebook.php.

References PHPMailer\PHPMailer\$params, and FacebookApiException\$result.

                                           {
     // generic application level parameters
     $params['api_key'] = $this->getAppId();
     $params['format'] = 'json-strings';
 
     $result = json_decode($this->_oauthRequest(
       $this->getApiUrl($params['method']),
       $params
     ), true);
 
     // results are returned, errors are thrown
     if (is_array($result) && isset($result['error_code'])) {
       $this->throwAPIException($result);
       // @codeCoverageIgnoreStart
     }
     // @codeCoverageIgnoreEnd
 
     $method = strtolower($params['method']);
     if ($method === 'auth.expiresession' ||
         $method === 'auth.revokeauthorization') {
       $this->destroySession();
     }
 
     return $result;
   }

◆ api()

BaseFacebook::api ( )

Make an API call.

Returns: mixed The decoded response

Definition at line 639 of file base_facebook.php.

                          {
     $args = func_get_args();
     if (is_array($args[0])) {
       return $this->_restserver($args[0]);
     } else {
       return call_user_func_array(array($this, '_graph'), $args);
     }
   }

◆ base64UrlDecode()

static BaseFacebook::base64UrlDecode ( $input )

staticprotected

Base64 encoding that doesn't need to be urlencode()ed.

Exactly the same as base64_encode except it uses

instead of + _ instead of / No padded =

Parameters

string $input base64UrlEncoded string

Returns: string

Definition at line 1253 of file base_facebook.php.

References $input.

                                                     {
     return base64_decode(strtr($input, '-_', '+/'));
   }

◆ base64UrlEncode()

static BaseFacebook::base64UrlEncode ( $input )

staticprotected

Base64 encoding that doesn't need to be urlencode()ed.

Exactly the same as base64_encode except it uses

instead of + _ instead of /

Parameters

string $input string

Returns: string base64Url encoded string

Definition at line 1266 of file base_facebook.php.

References $input.

                                                     {
     $str = strtr(base64_encode($input), '+/', '-_');
     $str = str_replace('=', '', $str);
     return $str;
   }

◆ clearAllPersistentData()

BaseFacebook::clearAllPersistentData ( )

abstractprotected

Clear all data from the persistent storage.

Returns: void

◆ clearPersistentData()

BaseFacebook::clearPersistentData ( $key )

abstractprotected

Clear the data with $key from the persistent storage.

Parameters

string $key

Returns: void

◆ destroySession()

BaseFacebook::destroySession ( )

Destroy the current session.

Definition at line 1275 of file base_facebook.php.

References $_COOKIE, and user().

                                    {
     $this->accessToken = null;
     $this->signedRequest = null;
     $this->user = null;
     $this->clearAllPersistentData();
 
     // Javascript sets a cookie that will be used in getSignedRequest that we
     // need to clear if we can
     $cookie_name = $this->getSignedRequestCookieName();
     if (array_key_exists($cookie_name, $_COOKIE)) {
       unset($_COOKIE[$cookie_name]);
       if (!headers_sent()) {
         $base_domain = $this->getBaseDomain();
         setcookie($cookie_name, '', 1, '/', '.'.$base_domain);
       } else {
         // @codeCoverageIgnoreStart
         self::errorLog(
           'There exists a cookie that we wanted to clear that we couldn\'t '.
           'clear because headers was already sent. Make sure to do the first '.
           'API call before outputing anything.'
         );
         // @codeCoverageIgnoreEnd
       }
     }
   }

Here is the call graph for this function:

◆ endsWith()

static BaseFacebook::endsWith	(	$big,
		$small
	)

staticprotected

Definition at line 1339 of file base_facebook.php.

References $default, and $key.

                                                    {
     $len = strlen($small);
     if ($len === 0) {
       return true;
     }
     return substr($big, -$len) === $small;
   }

◆ errorLog()

static BaseFacebook::errorLog ( $msg )

staticprotected

Prints to the error log if you aren't in command line mode.

Parameters

string $msg Log message

Definition at line 1234 of file base_facebook.php.

References Monolog\Handler\error_log().

                                            {
     // disable error log if we are running in a CLI environment
     // @codeCoverageIgnoreStart
     if (php_sapi_name() != 'cli') {
       error_log($msg);
     }
     // @codeCoverageIgnoreEnd
   }

Here is the call graph for this function:

◆ establishCSRFTokenState()

BaseFacebook::establishCSRFTokenState ( )

protected

Lays down a CSRF state token for this process.

Returns: void

Definition at line 734 of file base_facebook.php.

                                                {
     if ($this->state === null) {
       $this->state = md5(uniqid(mt_rand(), true));
       $this->setPersistentData('state', $this->state);
     }
   }

◆ getAccessToken()

BaseFacebook::getAccessToken ( )

Determines the access token that should be used for API calls.

The first time this is called, $this->accessToken is set equal to either a valid user access token, or it's set to the application access token if a valid user access token wasn't available. Subsequent calls return whatever the first call returned.

Returns: string The access token

Definition at line 388 of file base_facebook.php.

                                    {
     if ($this->accessToken !== null) {
       // we've done this already and cached it.  Just return.
       return $this->accessToken;
     }
 
     // first establish access token to be the application
     // access token, in case we navigate to the /oauth/access_token
     // endpoint, where SOME access token is required
     $this->setAccessToken($this->getApplicationAccessToken());
     $user_access_token = $this->getUserAccessToken();
     if ($user_access_token) {
       $this->setAccessToken($user_access_token);
     }
 
     return $this->accessToken;
   }

◆ getAccessTokenFromCode()

BaseFacebook::getAccessTokenFromCode	(	$code,
		$redirect_uri = `null`
	)

protected

Retrieves an access token for the given authorization code (previously generated from www.facebook.com on behalf of a specific user).

The authorization code is sent to graph.facebook.com and a legitimate access token is generated provided the access token and the user for which it was generated all match, and the user is either logged in to Facebook or has granted an offline access permission.

Parameters

string $code An authorization code.

Returns: mixed An access token exchanged for the authorization code, or false if an access token could not be generated.

Definition at line 753 of file base_facebook.php.

References $code, and PHPMailer\PHPMailer\$params.

                                                                          {
     if (empty($code)) {
       return false;
     }
 
     if ($redirect_uri === null) {
       $redirect_uri = $this->getCurrentUrl();
     }
 
     try {
       // need to circumvent json_decode by calling _oauthRequest
       // directly, since response isn't JSON format
       $access_token_response =
         $this->_oauthRequest(
           $this->getUrl('graph', '/oauth/access_token'),
           $params = array('client_id' => $this->getAppId(),
                           'client_secret' => $this->getAppSecret(),
                           'redirect_uri' => $redirect_uri,
                           'code' => $code));
     } catch (FacebookApiException $e) {
       // most likely that user very recently revoked authorization.
       // In any event, we don't have an access token, so say so.
       self::errorLog($e->getMessage());      
       return false;
     }
 
     if (empty($access_token_response)) {
       self::errorlog('No access token response');
       return false;
     }
 
     $response_params = json_decode($access_token_response, true);
     if (!isset($response_params['access_token'])) {
       self::errorlog('No access token in response. ' . $access_token_response);
       return false;
     }
 
     return $response_params['access_token'];
   }

◆ getApiSecret()

BaseFacebook::getApiSecret ( )

Get the App Secret.

Returns: string the App Secret

Deprecated:

Definition at line 279 of file base_facebook.php.

                                  {
     return $this->getAppSecret();
   }

◆ getApiUrl()

BaseFacebook::getApiUrl ( $method )

protected

Build the URL for api given parameters.

Parameters

$method String the method name.

Returns: string The URL for the given parameters

Definition at line 1039 of file base_facebook.php.

References $name.

                                         {
     static $READ_ONLY_CALLS =
       array('admin.getallocation' => 1,
             'admin.getappproperties' => 1,
             'admin.getbannedusers' => 1,
             'admin.getlivestreamvialink' => 1,
             'admin.getmetrics' => 1,
             'admin.getrestrictioninfo' => 1,
             'application.getpublicinfo' => 1,
             'auth.getapppublickey' => 1,
             'auth.getsession' => 1,
             'auth.getsignedpublicsessiondata' => 1,
             'comments.get' => 1,
             'connect.getunconnectedfriendscount' => 1,
             'dashboard.getactivity' => 1,
             'dashboard.getcount' => 1,
             'dashboard.getglobalnews' => 1,
             'dashboard.getnews' => 1,
             'dashboard.multigetcount' => 1,
             'dashboard.multigetnews' => 1,
             'data.getcookies' => 1,
             'events.get' => 1,
             'events.getmembers' => 1,
             'fbml.getcustomtags' => 1,
             'feed.getappfriendstories' => 1,
             'feed.getregisteredtemplatebundlebyid' => 1,
             'feed.getregisteredtemplatebundles' => 1,
             'fql.multiquery' => 1,
             'fql.query' => 1,
             'friends.arefriends' => 1,
             'friends.get' => 1,
             'friends.getappusers' => 1,
             'friends.getlists' => 1,
             'friends.getmutualfriends' => 1,
             'gifts.get' => 1,
             'groups.get' => 1,
             'groups.getmembers' => 1,
             'intl.gettranslations' => 1,
             'links.get' => 1,
             'notes.get' => 1,
             'notifications.get' => 1,
             'pages.getinfo' => 1,
             'pages.isadmin' => 1,
             'pages.isappadded' => 1,
             'pages.isfan' => 1,
             'permissions.checkavailableapiaccess' => 1,
             'permissions.checkgrantedapiaccess' => 1,
             'photos.get' => 1,
             'photos.getalbums' => 1,
             'photos.gettags' => 1,
             'profile.getinfo' => 1,
             'profile.getinfooptions' => 1,
             'stream.get' => 1,
             'stream.getcomments' => 1,
             'stream.getfilters' => 1,
             'users.getinfo' => 1,
             'users.getloggedinuser' => 1,
             'users.getstandardinfo' => 1,
             'users.hasapppermission' => 1,
             'users.isappuser' => 1,
             'users.isverified' => 1,
             'video.getuploadlimits' => 1);
     $name = 'api';
     if (isset($READ_ONLY_CALLS[strtolower($method)])) {
       $name = 'api_read';
     } else if (strtolower($method) == 'video.upload') {
       $name = 'api_video';
     }
     return self::getUrl($name, 'restserver.php');
   }

◆ getAppId()

BaseFacebook::getAppId ( )

Get the Application ID.

Returns: string the Application ID

Definition at line 246 of file base_facebook.php.

Referenced by sspmod_authfacebook_Facebook\constructSessionVariableName(), and sspmod_authfacebook_Facebook\getSharedSessionCookieName().

                              {
     return $this->appId;
   }

Here is the caller graph for this function:

◆ getApplicationAccessToken()

BaseFacebook::getApplicationAccessToken ( )

protected

Returns the access token that should be used for logged out users when no authorization code is available.

Returns: string The application access token, useful for gathering public information about users and applications.

Definition at line 725 of file base_facebook.php.

                                                  {
     return $this->appId.'|'.$this->appSecret;
   }

◆ getAppSecret()

BaseFacebook::getAppSecret ( )

Get the App Secret.

Returns: string the App Secret

Definition at line 288 of file base_facebook.php.

                                  {
     return $this->appSecret;
   }

◆ getBaseDomain()

BaseFacebook::getBaseDomain ( )

protected

Get the base domain used for the cookie.

Definition at line 1164 of file base_facebook.php.

References $metadata.

Referenced by sspmod_authfacebook_Facebook\deleteSharedSessionCookie(), and sspmod_authfacebook_Facebook\initSharedSession().

                                      {
     // The base domain is stored in the metadata cookie if not we fallback
     // to the current hostname
     $metadata = $this->getMetadataCookie();
     if (array_key_exists('base_domain', $metadata) &&
         !empty($metadata['base_domain'])) {
       return trim($metadata['base_domain'], '.');
     }
     return $this->getHttpHost();
   }

Here is the caller graph for this function:

◆ getCode()

BaseFacebook::getCode ( )

protected

Get the authorization code from the query parameters, if it exists, and otherwise return false to signal no authorization code was discoverable.

Returns: mixed The authorization code, or false if the authorization code could not be determined.

Definition at line 680 of file base_facebook.php.

                                {
     if (isset($_REQUEST['code'])) {
       if ($this->state !== null &&
           isset($_REQUEST['state']) &&
           $this->state === $_REQUEST['state']) {
 
         // CSRF state has done its job, so clear it
         $this->state = null;
         $this->clearPersistentData('state');
         return $_REQUEST['code'];
       } else {
         self::errorLog('CSRF state token does not match one provided. ' . $this->state . '!=' . $_REQUEST['state']);
         return false;
       }
     }
 
     return false;
   }

◆ getCurrentUrl()

BaseFacebook::getCurrentUrl ( )

protected

Returns the Current URL, stripping it of known FB parameters that should not persist.

Returns: string The current URL

Definition at line 1181 of file base_facebook.php.

References GuzzleHttp\Psr7\$protocol.

                                      {
     $protocol = $this->getHttpProtocol() . '://';
     $host = $this->getHttpHost();
     $currentUrl = $protocol.$host.$_SERVER['REQUEST_URI'];
     $parts = parse_url($currentUrl);
 
     // use port if non default
     $port =
       isset($parts['port']) &&
       (($protocol === 'http://' && $parts['port'] !== 80) ||
        ($protocol === 'https://' && $parts['port'] !== 443))
       ? ':' . $parts['port'] : '';
 
     // rebuild
     return $protocol . $parts['host'] . $port . $parts['path'];
   }

◆ getFileUploadSupport()

BaseFacebook::getFileUploadSupport ( )

Get the file upload support status.

Returns: boolean true if and only if the server supports file upload.

Definition at line 308 of file base_facebook.php.

                                          {
     return $this->fileUploadSupport;
   }

◆ getHttpHost()

BaseFacebook::getHttpHost ( )

protected

Definition at line 1134 of file base_facebook.php.

References $_SERVER.

Referenced by sspmod_authfacebook_Facebook\initSharedSession().

                                    {
     if ($this->trustForwarded && isset($_SERVER['HTTP_X_FORWARDED_HOST'])) {
       return $_SERVER['HTTP_X_FORWARDED_HOST'];
     }
     return $_SERVER['HTTP_HOST'];
   }

Here is the caller graph for this function:

◆ getHttpProtocol()

BaseFacebook::getHttpProtocol ( )

protected

Definition at line 1141 of file base_facebook.php.

References $_SERVER.

                                        {
     if ($this->trustForwarded && isset($_SERVER['HTTP_X_FORWARDED_PROTO'])) {
       if ($_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') {
         return 'https';
       }
       return 'http';
     }
     /*apache + variants specific way of checking for https*/
     if (isset($_SERVER['HTTPS']) &&
         ($_SERVER['HTTPS'] === 'on' || $_SERVER['HTTPS'] == 1)) {
       return 'https';
     }
     /*nginx way of checking for https*/
     if (isset($_SERVER['SERVER_PORT']) &&
         ($_SERVER['SERVER_PORT'] === '443')) {
       return 'https';
     }
     return 'http';
   }

◆ getLoginStatusUrl()

BaseFacebook::getLoginStatusUrl ( $params = array() )

Get a login status URL to fetch the status from Facebook.

The parameters:

ok_session: the URL to go to if a session is found
no_session: the URL to go to if the user is not connected
no_user: the URL to go to if the user is not signed into facebook

Parameters

array $params Provide custom parameters

Returns: string The URL for the logout flow

Definition at line 620 of file base_facebook.php.

References PHPMailer\PHPMailer\$params.

                                                      {
     return $this->getUrl(
       'www',
       'extern/login_status.php',
       array_merge(array(
         'api_key' => $this->getAppId(),
         'no_session' => $this->getCurrentUrl(),
         'no_user' => $this->getCurrentUrl(),
         'ok_session' => $this->getCurrentUrl(),
         'session_version' => 3,
       ), $params)
     );
   }

◆ getLoginUrl()

BaseFacebook::getLoginUrl ( $params = array() )

Get a Login URL for use with redirects.

By default, full page redirect is assumed. If you are using the generated URL with a window.open() call in JavaScript, you can pass in display=popup as part of the $params.

The parameters:

redirect_uri: the URL to go to after a successful login
scope: comma separated list of requested extended perms

Parameters

array $params Provide custom parameters

Returns: string The URL for the login flow

Definition at line 569 of file base_facebook.php.

References PHPMailer\PHPMailer\$params.

                                                {
     $this->establishCSRFTokenState();
     $currentUrl = $this->getCurrentUrl();
 
     // if 'scope' is passed as an array, convert to comma separated list
     $scopeParams = isset($params['scope']) ? $params['scope'] : null;
     if ($scopeParams && is_array($scopeParams)) {
       $params['scope'] = implode(',', $scopeParams);
     }
 
     return $this->getUrl(
       'www',
       'dialog/oauth',
       array_merge(array(
                     'client_id' => $this->getAppId(),
                     'redirect_uri' => $currentUrl, // possibly overwritten
                     'state' => $this->state),
                   $params));
   }

◆ getLogoutUrl()

BaseFacebook::getLogoutUrl ( $params = array() )

Get a Logout URL suitable for use with redirects.

The parameters:

next: the URL to go to after a successful logout

Parameters

array $params Provide custom parameters

Returns: string The URL for the logout flow

Definition at line 598 of file base_facebook.php.

References PHPMailer\PHPMailer\$params.

                                                 {
     return $this->getUrl(
       'www',
       'logout.php',
       array_merge(array(
         'next' => $this->getCurrentUrl(),
         'access_token' => $this->getUserAccessToken(),
       ), $params)
     );
   }

◆ getMetadataCookie()

BaseFacebook::getMetadataCookie ( )

protected

Parses the metadata cookie that our Javascript API set.

Returns: an array mapping key to value

Definition at line 1306 of file base_facebook.php.

References $_COOKIE, and $metadata.

                                          {
     $cookie_name = $this->getMetadataCookieName();
     if (!array_key_exists($cookie_name, $_COOKIE)) {
       return array();
     }
 
     // The cookie value can be wrapped in "-characters so remove them
     $cookie_value = trim($_COOKIE[$cookie_name], '"');
 
     if (empty($cookie_value)) {
       return array();
     }
 
     $parts = explode('&', $cookie_value);
     $metadata = array();
     foreach ($parts as $part) {
       $pair = explode('=', $part, 2);
       if (!empty($pair[0])) {
         $metadata[urldecode($pair[0])] =
           (count($pair) > 1) ? urldecode($pair[1]) : '';
       }
     }
 
     return $metadata;
   }

◆ getMetadataCookieName()

BaseFacebook::getMetadataCookieName ( )

protected

Constructs and returns the name of the coookie that potentially contain metadata.

The cookie is not set by the BaseFacebook class, but it may be set by the JavaScript SDK.

Returns: string the name of the cookie that would house metadata.

Definition at line 668 of file base_facebook.php.

                                              {
     return 'fbm_'.$this->getAppId();
   }

◆ getPersistentData()

BaseFacebook::getPersistentData	(	$key,
		$default = `false`
	)

abstractprotected

Get the data for $key, persisted by BaseFacebook::setPersistentData()

Parameters

string	$key	The key of the data to retrieve
boolean	$default	The default value to return if $key is not found

Returns: mixed

◆ getSignedRequest()

BaseFacebook::getSignedRequest ( )

Retrieve the signed request, either from a request parameter or, if not present, from a cookie.

Returns: string the signed request, if available, or null otherwise.

Definition at line 479 of file base_facebook.php.

References $_COOKIE.

                                      {
     if (!$this->signedRequest) {
       if (!empty($_REQUEST['signed_request'])) {
         $this->signedRequest = $this->parseSignedRequest(
           $_REQUEST['signed_request']);
       } else if (!empty($_COOKIE[$this->getSignedRequestCookieName()])) {
         $this->signedRequest = $this->parseSignedRequest(
           $_COOKIE[$this->getSignedRequestCookieName()]);
       }
     }
     return $this->signedRequest;
   }

◆ getSignedRequestCookieName()

BaseFacebook::getSignedRequestCookieName ( )

protected

Constructs and returns the name of the cookie that potentially houses the signed request for the app user.

The cookie is not set by the BaseFacebook class, but it may be set by the JavaScript SDK.

Returns: string the name of the cookie that would house the signed request value.

Definition at line 657 of file base_facebook.php.

                                                   {
     return 'fbsr_'.$this->getAppId();
   }

◆ getUrl()

BaseFacebook::getUrl	(	$name,
		$path = `''`,
		$params = `array()`
	)

protected

Build the URL for given domain alias, path and parameters.

Parameters

$name	string The name of the domain
$path	string Optional path (without a leading slash)
$params	array Optional query parameters

Returns: string The URL for the given parameters

Definition at line 1119 of file base_facebook.php.

References $name, PHPMailer\PHPMailer\$params, $path, and $url.

                                                               {
     $url = self::$DOMAIN_MAP[$name];
     if ($path) {
       if ($path[0] === '/') {
         $path = substr($path, 1);
       }
       $url .= $path;
     }
     if ($params) {
       $url .= '?' . http_build_query($params, null, '&');
     }
 
     return $url;
   }

◆ getUser()

BaseFacebook::getUser ( )

Get the UID of the connected user, or 0 if the Facebook user is not connected.

Returns: string the UID if available.

Definition at line 498 of file base_facebook.php.

References $user, and user().

                             {
     if ($this->user !== null) {
       // we've already determined this and cached the value
       return $this->user;
     }
 
     return $this->user = $this->getUserFromAvailableData();
   }

Here is the call graph for this function:

◆ getUserAccessToken()

BaseFacebook::getUserAccessToken ( )

protected

Determines and returns the user access token, first using the signed request if present, and then falling back on the authorization code if present.

The intent is to return a valid user access token, or false if one is determined to not be available.

Returns: string A valid user access token, or false if one could not be determined.

Definition at line 416 of file base_facebook.php.

References $code.

                                           {
     // first, consider a signed request if it's supplied
     // if there is a signed request, then it alone determines
     // the access token
     $signed_request = $this->getSignedRequest();
     if ($signed_request) {
       // apps.facebook.com hands the access_token in the signed_request
       if (array_key_exists('oauth_token', $signed_request)) {
         $access_token = $signed_request['oauth_token'];
         $this->setPersistentData('access_token', $access_token);
         return $access_token;
       }
 
       // the JS SDK puts a code in with the redirect_uri of ''
       if (array_key_exists('code', $signed_request)) {
         $code = $signed_request['code'];
         if ($code && $code == $this->getPersistentData('code')) {
           // short-circuit if the code we have is the same as the one presented
           return $this->getPersistentData('access_token');
         }
 
         $access_token = $this->getAccessTokenFromCode($code, '');
         if ($access_token) {
           $this->setPersistentData('code', $code);
           $this->setPersistentData('access_token', $access_token);
           return $access_token;
         }
       }
 
       // signed request states there's no access token, so anything
       // stored should be cleared
       $this->clearAllPersistentData();
       return false; // respect the signed request's data, even
                     // if there's an authorization code or something else
     }
 
     $code = $this->getCode();
     if ($code && $code != $this->getPersistentData('code')) {
       $access_token = $this->getAccessTokenFromCode($code);
       if ($access_token) {
         $this->setPersistentData('code', $code);
         $this->setPersistentData('access_token', $access_token);
         return $access_token;
       }
 
       // code was bogus, so everything based on it should be invalidated
       $this->clearAllPersistentData();
       return false;
     }
 
     // as a fallback, just return whatever is in the persistent
     // store, knowing nothing explicit (signed request, authorization
     // code, etc.) was present to shadow it (or we saw a code in $_REQUEST,
     // but it's the same as what's in the persistent store)
     return $this->getPersistentData('access_token');
   }

◆ getUserFromAccessToken()

BaseFacebook::getUserFromAccessToken ( )

protected

Retrieves the UID with the understanding that $this->accessToken has already been set and is seemingly legitimate.

It relies on Facebook's Graph API to retrieve user information and then extract the user ID.

Returns: integer Returns the UID of the Facebook user, or 0 if the Facebook user could not be determined.

Definition at line 709 of file base_facebook.php.

                                               {
     try {
       $user_info = $this->api('/me');
       return $user_info['id'];
     } catch (FacebookApiException $e) {
       return 0;
     }
   }

◆ getUserFromAvailableData()

BaseFacebook::getUserFromAvailableData ( )

protected

Determines the connected user by first examining any signed requests, then considering an authorization code, and then falling back to any persistent store storing the user.

Returns: integer The id of the connected Facebook user, or 0 if no such user exists.

Definition at line 515 of file base_facebook.php.

References $default, and $user.

                                                 {
     // if a signed request is supplied, then it solely determines
     // who the user is
     $signed_request = $this->getSignedRequest();
     if ($signed_request) {
       if (array_key_exists('user_id', $signed_request)) {
         $user = $signed_request['user_id'];
 
         if($user != $this->getPersistentData('user_id')){
           $this->clearAllPersistentData();
         }
 
         $this->setPersistentData('user_id', $signed_request['user_id']);
         return $user;
       }
 
       // if the signed request didn't present a user id, then invalidate
       // all entries in any persistent store
       $this->clearAllPersistentData();
       return 0;
     }
 
     $user = $this->getPersistentData('user_id', $default = 0);
     $persisted_access_token = $this->getPersistentData('access_token');
 
     // use access_token to fetch user id if we have a user access_token, or if
     // the cached access token has changed
     $access_token = $this->getAccessToken();
     if ($access_token &&
         $access_token != $this->getApplicationAccessToken() &&
         !($user && $persisted_access_token == $access_token)) {
       $user = $this->getUserFromAccessToken();
       if ($user) {
         $this->setPersistentData('user_id', $user);
       } else {
         $this->clearAllPersistentData();
       }
     }
 
     return $user;
   }

◆ isAllowedDomain()

static BaseFacebook::isAllowedDomain	(	$big,
		$small
	)

staticprotected

Definition at line 1332 of file base_facebook.php.

                                                           {
     if ($big === $small) {
       return true;
     }
     return self::endsWith($big, '.'.$small);
   }

◆ isVideoPost()

BaseFacebook::isVideoPost	(	$path,
		$method = `'GET'`
	)

protected

Return true if this is video post.

Parameters

string	$path	The path
string	$method	The http method (default 'GET')

Returns: boolean true if this is video post

Definition at line 835 of file base_facebook.php.

References $path.

                                                          {
     if ($method == 'POST' && preg_match("/^(\/)(.+)(\/)(videos)$/", $path)) {
       return true;
     }
     return false;
   }

◆ makeRequest()

BaseFacebook::makeRequest	(	$url,
		$params,
		$ch = `null`
	)

protected

Makes an HTTP request.

This method can be overridden by subclasses if developers want to do fancier things or use something other than curl to make the request.

Parameters

string	$url	The URL to make the request to
array	$params	The parameters to use for the POST body
CurlHandler	$ch	Initialized curl handle

Returns: string The response text

Definition at line 915 of file base_facebook.php.

References PHPMailer\PHPMailer\$params, FacebookApiException\$result, and $url.

                                                           {
     if (!$ch) {
       $ch = curl_init();
     }
 
     $opts = self::$CURL_OPTS;
     if ($this->getFileUploadSupport()) {
       $opts[CURLOPT_POSTFIELDS] = $params;
     } else {
       $opts[CURLOPT_POSTFIELDS] = http_build_query($params, null, '&');
     }
     $opts[CURLOPT_URL] = $url;
 
     // disable the 'Expect: 100-continue' behaviour. This causes CURL to wait
     // for 2 seconds if the server does not support this header
     if (isset($opts[CURLOPT_HTTPHEADER])) {
       $existing_headers = $opts[CURLOPT_HTTPHEADER];
       $existing_headers[] = 'Expect:';
       $opts[CURLOPT_HTTPHEADER] = $existing_headers;
     } else {
       $opts[CURLOPT_HTTPHEADER] = array('Expect:');
     }
 
     curl_setopt_array($ch, $opts);
     $result = curl_exec($ch);
 
     if (curl_errno($ch) == 60) { // CURLE_SSL_CACERT
       self::errorLog('Invalid or no certificate authority found, '.
                      'using bundled information');
       curl_setopt($ch, CURLOPT_CAINFO,
                   dirname(__FILE__) . '/fb_ca_chain_bundle.crt');
       $result = curl_exec($ch);
     }
 
     // With dual stacked DNS responses, it's possible for a server to
     // have IPv6 enabled but not have IPv6 connectivity.  If this is
     // the case, curl will try IPv4 first and if that fails, then it will
     // fall back to IPv6 and the error EHOSTUNREACH is returned by the
     // operating system
     if ($result === false && empty($opts[CURLOPT_IPRESOLVE])) {
         $matches = array();
         $regex = '/Failed to connect to ([^:].*): Network is unreachable/';
         if (preg_match($regex, curl_error($ch), $matches)) {
           if (strlen(@inet_pton($matches[1])) === 16) {
             self::errorLog('Invalid IPv6 configuration on server, '.
                            'Please disable or get native IPv6 on your server.');
             self::$CURL_OPTS[CURLOPT_IPRESOLVE] = CURL_IPRESOLVE_V4;
             curl_setopt($ch, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V4);
             $result = curl_exec($ch);
           }
         }
     }
 
     if ($result === false) {
       $e = new FacebookApiException(array(
         'error_code' => curl_errno($ch),
         'error' => array(
         'message' => curl_error($ch),
         'type' => 'CurlException',
         ),
       ));
       curl_close($ch);
       throw $e;
     }
     curl_close($ch);
     return $result;
   }

◆ makeSignedRequest()

BaseFacebook::makeSignedRequest ( $data )

protected

Makes a signed_request blob using the given data.

Parameters

array The data array.

Returns: string The signed request.

Definition at line 1019 of file base_facebook.php.

References $data.

Referenced by sspmod_authfacebook_Facebook\initSharedSession().

                                               {
     if (!is_array($data)) {
       throw new InvalidArgumentException(
         'makeSignedRequest expects an array. Got: ' . print_r($data, true));
     }
     $data['algorithm'] = self::SIGNED_REQUEST_ALGORITHM;
     $data['issued_at'] = time();
     $json = json_encode($data);
     $b64 = self::base64UrlEncode($json);
     $raw_sig = hash_hmac('sha256', $b64, $this->getAppSecret(), $raw = true);
     $sig = self::base64UrlEncode($raw_sig);
     return $sig.'.'.$b64;
   }

Here is the caller graph for this function:

◆ parseSignedRequest()

BaseFacebook::parseSignedRequest ( $signed_request )

protected

Parses a signed_request and validates the signature.

Parameters

string $signed_request A signed token

Returns: array The payload inside it or null if the sig is wrong

Definition at line 989 of file base_facebook.php.

References $data.

Referenced by sspmod_authfacebook_Facebook\initSharedSession().

                                                          {
     list($encoded_sig, $payload) = explode('.', $signed_request, 2);
 
     // decode the data
     $sig = self::base64UrlDecode($encoded_sig);
     $data = json_decode(self::base64UrlDecode($payload), true);
 
     if (strtoupper($data['algorithm']) !== self::SIGNED_REQUEST_ALGORITHM) {
       self::errorLog(
         'Unknown algorithm. Expected ' . self::SIGNED_REQUEST_ALGORITHM);
       return null;
     }
 
     // check sig
     $expected_sig = hash_hmac('sha256', $payload,
                               $this->getAppSecret(), $raw = true);
     if ($sig !== $expected_sig) {
       self::errorLog('Bad Signed JSON signature!');
       return null;
     }
 
     return $data;
   }

Here is the caller graph for this function:

◆ setAccessToken()

BaseFacebook::setAccessToken ( $access_token )

Sets the access token for api calls.

Use this if you get your access token by other means and just want the SDK to use it.

Parameters

string $access_token an access token.

Returns: BaseFacebook

Definition at line 331 of file base_facebook.php.

                                                 {
     $this->accessToken = $access_token;
     return $this;
   }

◆ setApiSecret()

BaseFacebook::setApiSecret ( $apiSecret )

Set the App Secret.

Parameters

string $apiSecret The App Secret

Returns: BaseFacebook

Deprecated:

Definition at line 257 of file base_facebook.php.

                                            {
     $this->setAppSecret($apiSecret);
     return $this;
   }

◆ setAppId()

BaseFacebook::setAppId ( $appId )

Set the Application ID.

Parameters

string $appId The Application ID

Returns: BaseFacebook

Definition at line 236 of file base_facebook.php.

                                    {
     $this->appId = $appId;
     return $this;
   }

◆ setAppSecret()

BaseFacebook::setAppSecret ( $appSecret )

Set the App Secret.

Parameters

string $appSecret The App Secret

Returns: BaseFacebook

Definition at line 268 of file base_facebook.php.

                                            {
     $this->appSecret = $appSecret;
     return $this;
   }

◆ setExtendedAccessToken()

BaseFacebook::setExtendedAccessToken ( )

Extend an access token, while removing the short-lived token that might have been generated via client-side flow.

Thanks to http://bit.ly/b0Pt0H for the workaround.

Definition at line 341 of file base_facebook.php.

References PHPMailer\PHPMailer\$params.

                                            {
     try {
       // need to circumvent json_decode by calling _oauthRequest
       // directly, since response isn't JSON format
       $access_token_response = $this->_oauthRequest(
         $this->getUrl('graph', '/oauth/access_token'),
         $params = array(
           'client_id' => $this->getAppId(),
           'client_secret' => $this->getAppSecret(),
           'grant_type' => 'fb_exchange_token',
           'fb_exchange_token' => $this->getAccessToken(),
         )
       );
     }
     catch (FacebookApiException $e) {
       // most likely that user very recently revoked authorization
       // In any event, we don't have an access token, so say so
       return false;
     }
 
     if (empty($access_token_response)) {
       return false;
     }
 
     $response_params = array();
     parse_str($access_token_response, $response_params);
 
     if (!isset($response_params['access_token'])) {
       return false;
     }
 
     $this->destroySession();
 
     $this->setPersistentData(
       'access_token', $response_params['access_token']
     );
   }

◆ setFileUploadSupport()

BaseFacebook::setFileUploadSupport ( $fileUploadSupport )

Set the file upload support status.

Parameters

boolean $fileUploadSupport The file upload support status.

Returns: BaseFacebook

Definition at line 298 of file base_facebook.php.

                                                            {
     $this->fileUploadSupport = $fileUploadSupport;
     return $this;
   }

◆ setPersistentData()

BaseFacebook::setPersistentData	(	$key,
		$value
	)

abstractprotected

Each of the following four methods should be overridden in a concrete subclass, as they are in the provided Facebook class.

The Facebook class uses PHP sessions to provide a primitive persistent store, but another subclass–one that you implement– might use a database, memcache, or an in-memory cache.

See also: Facebook Stores the given ($key, $value) pair, so that future calls to getPersistentData($key) return $value. This call may be in another request.

Parameters

string	$key
array	$value

Returns: void

◆ throwAPIException()

BaseFacebook::throwAPIException ( $result )

protected

Analyzes the supplied result to see if it was thrown because the access token is no longer valid.

If that is the case, then we destroy the session.

Parameters

$result array A record storing the error message returned by a failed API call.

Definition at line 1206 of file base_facebook.php.

References $message, and FacebookApiException\$result.

                                                 {
     $e = new FacebookApiException($result);
     switch ($e->getType()) {
       // OAuth 2.0 Draft 00 style
       case 'OAuthException':
         // OAuth 2.0 Draft 10 style
       case 'invalid_token':
         // REST server errors are just Exceptions
       case 'Exception':
         $message = $e->getMessage();
         if ((strpos($message, 'Error validating access token') !== false) ||
             (strpos($message, 'Invalid OAuth access token') !== false) ||
             (strpos($message, 'An active access token must be used') !== false)
         ) {
           $this->destroySession();
         }
         break;
     }
 
     throw $e;
   }

◆ useFileUploadSupport()

BaseFacebook::useFileUploadSupport ( )

DEPRECATED! Please use getFileUploadSupport instead.

Get the file upload support status.

Returns: boolean true if and only if the server supports file upload.

Definition at line 319 of file base_facebook.php.

                                          {
     return $this->getFileUploadSupport();
   }

Field Documentation

◆ $accessToken

BaseFacebook::$accessToken = null

protected

Definition at line 189 of file base_facebook.php.

◆ $appId

BaseFacebook::$appId

protected

Definition at line 157 of file base_facebook.php.

◆ $appSecret

BaseFacebook::$appSecret

protected

Definition at line 164 of file base_facebook.php.

◆ $CURL_OPTS

BaseFacebook::$CURL_OPTS

static

Initial value:

= array(
    CURLOPT_CONNECTTIMEOUT => 10,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT        => 60,
    CURLOPT_USERAGENT      => 'facebook-php-3.2',
  )

Default options for curl.

Definition at line 133 of file base_facebook.php.

◆ $DOMAIN_MAP

BaseFacebook::$DOMAIN_MAP

static

Initial value:

= array(
    'api'         => 'https://api.facebook.com/',
    'api_video'   => 'https://api-video.facebook.com/',
    'api_read'    => 'https://api-read.facebook.com/',
    'graph'       => 'https://graph.facebook.com/',
    'graph_video' => 'https://graph-video.facebook.com/',
    'www'         => 'https://www.facebook.com/',
  )

Maps aliases to Facebook domains.

Definition at line 143 of file base_facebook.php.

◆ $fileUploadSupport

BaseFacebook::$fileUploadSupport = false

protected

Definition at line 196 of file base_facebook.php.

◆ $signedRequest

BaseFacebook::$signedRequest

protected

The data from the signed_request token.

Definition at line 176 of file base_facebook.php.

◆ $state

BaseFacebook::$state

protected

A CSRF state variable to assist in the defense against CSRF attacks.

Definition at line 181 of file base_facebook.php.

◆ $trustForwarded

BaseFacebook::$trustForwarded = false

protected

Definition at line 203 of file base_facebook.php.

◆ $user

BaseFacebook::$user

protected

Definition at line 171 of file base_facebook.php.

◆ SIGNED_REQUEST_ALGORITHM

const BaseFacebook::SIGNED_REQUEST_ALGORITHM = 'HMAC-SHA256'

Signed Request Algorithm.

Definition at line 128 of file base_facebook.php.

◆ VERSION

const BaseFacebook::VERSION = '3.2.2'

Version.

Definition at line 123 of file base_facebook.php.

The documentation for this class was generated from the following file:

libs/composer/vendor/simplesamlphp/simplesamlphp/modules/authfacebook/extlibinc/base_facebook.php

Public Member Functions

Data Fields

Static Public Attributes

Protected Member Functions

Static Protected Member Functions

Protected Attributes

Detailed Description

Constructor & Destructor Documentation

◆ __construct()

Member Function Documentation

◆ _graph()

◆ _oauthRequest()

◆ _restserver()

◆ api()

◆ base64UrlDecode()

◆ base64UrlEncode()

◆ clearAllPersistentData()

◆ clearPersistentData()

◆ destroySession()

◆ endsWith()

◆ errorLog()

◆ establishCSRFTokenState()

◆ getAccessToken()

◆ getAccessTokenFromCode()

◆ getApiSecret()

◆ getApiUrl()

◆ getAppId()

◆ getApplicationAccessToken()

◆ getAppSecret()

◆ getBaseDomain()

◆ getCode()

◆ getCurrentUrl()

◆ getFileUploadSupport()

◆ getHttpHost()

◆ getHttpProtocol()

◆ getLoginStatusUrl()

◆ getLoginUrl()

◆ getLogoutUrl()

◆ getMetadataCookie()

◆ getMetadataCookieName()

◆ getPersistentData()

◆ getSignedRequest()

◆ getSignedRequestCookieName()

◆ getUrl()

◆ getUser()

◆ getUserAccessToken()

◆ getUserFromAccessToken()

◆ getUserFromAvailableData()

◆ isAllowedDomain()

◆ isVideoPost()

◆ makeRequest()

◆ makeSignedRequest()

◆ parseSignedRequest()

◆ setAccessToken()

◆ setApiSecret()

◆ setAppId()

◆ setAppSecret()

◆ setExtendedAccessToken()

◆ setFileUploadSupport()

◆ setPersistentData()

◆ throwAPIException()

◆ useFileUploadSupport()

Field Documentation

◆ $accessToken

◆ $appId

◆ $appSecret

◆ $CURL_OPTS

◆ $DOMAIN_MAP

◆ $fileUploadSupport

◆ $signedRequest

◆ $state

◆ $trustForwarded

◆ $user

◆ SIGNED_REQUEST_ALGORITHM

◆ VERSION