11if (!class_exists(
'OAuthException')) {
 
   14    class OAuthException 
extends Exception
 
   29        $this->callback_url = $callback_url;
 
   34        return "OAuthConsumer[key=$this->key,secret=$this->secret]";
 
   60        return "oauth_token=" .
 
   62           "&oauth_token_secret=" .
 
   76        $built = $this->build_signature($request, $consumer, 
$token);
 
   77        return $built == $signature;
 
   93        $base_string = $request->get_signature_base_string();
 
   94        $request->base_string = $base_string;
 
  102        $key = implode(
'&', $key_parts);
 
  104        $computed_signature = base64_encode(hash_hmac(
'sha1', $base_string, $key, 
true));
 
  106        return $computed_signature;
 
  126            array_push($sig, 
'');
 
  129        $raw = implode(
"&", $sig);
 
  131        $request->base_string = $raw;
 
  152        throw Exception(
"fetch_public_cert not implemented");
 
  161        throw Exception(
"fetch_private_cert not implemented");
 
  166        $base_string = $request->get_signature_base_string();
 
  167        $request->base_string = $base_string;
 
  173        $privatekeyid = openssl_get_privatekey($cert);
 
  176        $ok = openssl_sign($base_string, $signature, $privatekeyid);
 
  179        openssl_free_key($privatekeyid);
 
  181        return base64_encode($signature);
 
  186        $decoded_sig = base64_decode($signature);
 
  188        $base_string = $request->get_signature_base_string();
 
  194        $publickeyid = openssl_get_publickey($cert);
 
  197        $ok = openssl_verify($base_string, $decoded_sig, $publickeyid);
 
  200        openssl_free_key($publickeyid);
 
  235        strpos(
':', 
$_SERVER[
'HTTP_HOST']) < 0) {
 
  236            $port = 
':' . 
$_SERVER[
'SERVER_PORT'] ;
 
  258            if (get_magic_quotes_gpc()) {
 
  260                foreach (
$_POST as $k => $v) {
 
  261                    $v = stripslashes($v);
 
  270            if (@substr($request_headers[
'Authorization'], 0, 6) == 
"OAuth ") {
 
  272                    $request_headers[
'Authorization']
 
  290                      "oauth_consumer_key" => $consumer->key);
 
  292            $defaults[
'oauth_token'] = 
$token->key;
 
  299        if ($parts[
'query']) {
 
  310        if ($allow_duplicates && isset($this->parameters[
$name])) {
 
  312            if (is_scalar($this->parameters[
$name])) {
 
  315                $this->parameters[
$name] = array($this->parameters[
$name]);
 
  318            $this->parameters[
$name][] = $value;
 
  320            $this->parameters[
$name] = $value;
 
  326        return isset($this->parameters[
$name]) ? $this->parameters[
$name] : 
null;
 
  336        unset($this->parameters[
$name]);
 
  350        if (isset($params[
'oauth_signature'])) {
 
  351            unset($params[
'oauth_signature']);
 
  374        return implode(
'&', $parts);
 
  382        return strtoupper($this->http_method);
 
  391        $parts = parse_url($this->http_url);
 
  393        $port = @$parts[
'port'];
 
  394        $scheme = $parts[
'scheme'];
 
  395        $host = $parts[
'host'];
 
  396        $path = @$parts[
'path'];
 
  398        $port or $port = ($scheme == 
'https') ? 
'443' : 
'80';
 
  400        if (($scheme == 
'https' && $port != 
'443')
 
  401        || ($scheme == 
'http' && $port != 
'80')) {
 
  402            $host = 
"$host:$port";
 
  404        return "$scheme://$host$path";
 
  415            $out .= 
'?' . $post_data;
 
  433        $out = 
'Authorization: OAuth realm=""';
 
  435        foreach ($this->parameters as $k => $v) {
 
  436            if (substr($k, 0, 5) != 
"oauth") {
 
  440                throw new OAuthException(
'Arrays not supported in headers');
 
  460            "oauth_signature_method",
 
  461            $signature_method->get_name(),
 
  470        $signature = $signature_method->build_signature($this, $consumer, 
$token);
 
  490        return md5($mt . $rand); 
 
  509        $this->signature_methods[$signature_method->get_name()] =
 
  530        $new_token = $this->data_store->new_request_token($consumer);
 
  551        $new_token = $this->data_store->new_access_token(
$token, $consumer);
 
  567        return array($consumer, 
$token);
 
  576        $version = $request->get_parameter(
"oauth_version");
 
  581            throw new OAuthException(
"OAuth version '$version' not supported");
 
  592        @$request->get_parameter(
"oauth_signature_method");
 
  593        if (!$signature_method) {
 
  594            $signature_method = 
"PLAINTEXT";
 
  598            array_keys($this->signature_methods)
 
  600            throw new OAuthException(
 
  601                "Signature method '$signature_method' not supported " .
 
  602        "try one of the following: " .
 
  603        implode(
", ", array_keys($this->signature_methods))
 
  606        return $this->signature_methods[$signature_method];
 
  614        $consumer_key = @$request->get_parameter(
"oauth_consumer_key");
 
  615        if (!$consumer_key) {
 
  616            throw new OAuthException(
"Invalid consumer key");
 
  619        $consumer = $this->data_store->lookup_consumer($consumer_key);
 
  621            throw new OAuthException(
"Invalid consumer");
 
  630    private function get_token(&$request, $consumer, $token_type = 
"access")
 
  632        $token_field = @$request->get_parameter(
'oauth_token');
 
  636        $token = $this->data_store->lookup_token(
 
  642            throw new OAuthException(
"Invalid $token_type token: $token_field");
 
  657        $timestamp = @$request->get_parameter(
'oauth_timestamp');
 
  658        $nonce = @$request->get_parameter(
'oauth_nonce');
 
  665        $signature = $request->get_parameter(
'oauth_signature');
 
  666        $valid_sig = $signature_method->check_signature(
 
  674            $ex_text = 
"Invalid signature";
 
  676                $ex_text = $ex_text . 
" ours= $OAuth_last_computed_signature yours=$signature";
 
  678            throw new OAuthException($ex_text);
 
  689        if ($now - 
$timestamp > $this->timestamp_threshold) {
 
  690            throw new OAuthException(
 
  691                "Expired timestamp, yours $timestamp, ours $now" 
  702        $found = $this->data_store->lookup_nonce(
 
  709            throw new OAuthException(
"Nonce already used: $nonce");
 
  749        if (is_array($input)) {
 
  750            return array_map(array(
'OAuthUtil', 
'urlencode_rfc3986'), $input);
 
  751        } elseif (is_scalar($input)) {
 
  755                str_replace(
'%7E', 
'~', rawurlencode($input))
 
  768        return urldecode($string);
 
  774    public static function split_header($header, $only_allow_oauth_parameters = 
true)
 
  776        $pattern = 
'/(([-_a-z]*)=("([^"]*)"|([^,]*)),?)/';
 
  779        while (preg_match($pattern, $header, $matches, PREG_OFFSET_CAPTURE, $offset) > 0) {
 
  780            $match = $matches[0];
 
  781            $header_name = $matches[2][0];
 
  782            $header_content = (isset($matches[5])) ? $matches[5][0] : $matches[4][0];
 
  783            if (preg_match(
'/^oauth_/', $header_name) || !$only_allow_oauth_parameters) {
 
  786            $offset = $match[1] + strlen($match[0]);
 
  789        if (isset($params[
'realm'])) {
 
  790            unset($params[
'realm']);
 
  799        if (function_exists(
'apache_request_headers')) {
 
  802            return apache_request_headers();
 
  807        foreach (
$_SERVER as $key => $value) {
 
  808            if (substr($key, 0, 5) == 
"HTTP_") {
 
  815                    ucwords(strtolower(str_replace(
"_", 
" ", substr($key, 5))))
 
  828        if (!isset($input) || !$input) {
 
  833        $pairs = explode(
'&', $input);
 
  835        $parsed_parameters = array();
 
  836        foreach ($pairs as $pair) {
 
  837            $split = explode(
'=', $pair, 2);
 
  842            if (isset($parsed_parameters[$parameter])) {
 
  846                if (is_scalar($parsed_parameters[$parameter])) {
 
  849                    $parsed_parameters[$parameter] = array($parsed_parameters[$parameter]);
 
  852                $parsed_parameters[$parameter][] = $value;
 
  854                $parsed_parameters[$parameter] = $value;
 
  857        return $parsed_parameters;
 
  869        $params = array_combine(
$keys, $values);
 
  873        uksort($params, 
'strcmp');
 
  876        foreach ($params as $parameter => $value) {
 
  877            if (is_array($value)) {
 
  881                foreach ($value as $duplicate_value) {
 
  882                    $pairs[] = $parameter . 
'=' . $duplicate_value;
 
  885                $pairs[] = $parameter . 
'=' . $value;
 
  890        return implode(
'&', $pairs);
 
$OAuth_last_computed_signature
http://oauth.googlecode.com/svn/code/php/
foreach($mandatory_scripts as $file) $timestamp
An exception for terminatinating execution or to throw for unit testing.
__construct($key, $secret, $callback_url=null)
lookup_consumer($consumer_key)
new_access_token($token, $consumer)
lookup_token($consumer, $token_type, $token)
new_request_token($consumer)
lookup_nonce($consumer, $token, $nonce, $timestamp)
static from_consumer_and_token($consumer, $token, $http_method, $http_url, $parameters=null)
pretty much a helper function to set up the request
__construct($http_method, $http_url, $parameters=null)
sign_request($signature_method, $consumer, $token)
get_normalized_http_method()
just uppercases the http method
to_postdata()
builds the data one would send in a POST request
get_normalized_http_url()
parses the url and rebuilds it to be scheme://host/path
to_url()
builds a url usable for a GET request
get_signable_parameters()
The request parameters, sorted and concatenated into a normalized string.
get_signature_base_string()
Returns the base string of this request.
static from_request($http_method=null, $http_url=null, $parameters=null)
attempt to build up a request from what was passed to the server
set_parameter($name, $value, $allow_duplicates=true)
static generate_timestamp()
util function: current timestamp
to_header()
builds the Authorization: header
build_signature($signature_method, $consumer, $token)
static generate_nonce()
util function: current nonce
add_signature_method($signature_method)
check_signature(&$request, $consumer, $token)
all-in-one function to check the signature on a request should guess the signature method appropriate...
check_nonce($consumer, $token, $nonce, $timestamp)
check that the nonce is not repeated
check_timestamp($timestamp)
check that the timestamp is new enough
fetch_access_token(&$request)
process an access_token request returns the access token on success
get_token(&$request, $consumer, $token_type="access")
try to find the token for the provided request's token key
fetch_request_token(&$request)
process a request_token request returns the request token on success
get_signature_method(&$request)
figure out the signature with some defaults
verify_request(&$request)
verify an api call, checks all the parameters
get_consumer(&$request)
try to find the consumer for the provided request's consumer key
get_version(&$request)
version 1
build_signature($request, $consumer, $token)
build_signature($request, $consumer, $token)
fetch_public_cert(&$request)
build_signature(&$request, $consumer, $token)
fetch_private_cert(&$request)
check_signature(&$request, $consumer, $token, $signature)
check_signature(&$request, $consumer, $token, $signature)
to_string()
generates the basic string serialization of a token that a server would respond to request_token and ...
__construct($key, $secret)
key = the token secret = the token secret
static split_header($header, $only_allow_oauth_parameters=true)
static urldecode_rfc3986($string)
static urlencode_rfc3986($input)
static parse_parameters($input)
static build_http_query($params)