Try to fix issue #10; work around bug https://bugs.php.net/bug.php?id=68168

[grauphel.git] / lib / oauth.php

diff --git a/lib/oauth.php b/lib/oauth.php
index e2eb651d4b54d53cfc9ad0f575c949639e2cc9d7..41af3490953d078fec47a13c5e6af0382b87c339 100644 (file)
--- a/lib/oauth.php
+++ b/lib/oauth.php
@@ -98,7 +98,25 @@ class OAuth
 
     public function accessTokenHandler(\OAuthProvider $provider)
     {
-        $token = $this->tokens->load('access', $provider->token);
+        if ($provider->token == '') {
+            //conboy sends empty token when not authed yet
+            return OAUTH_PARAMETER_ABSENT;
+        }
+
+        try {
+            $token = $this->tokens->load('access', $provider->token);
+        } catch (OAuthException $e) {
+            if ($e->getCode() == OAUTH_TOKEN_REJECTED) {
+                return OAUTH_TOKEN_REJECTED;
+            }
+            throw $e;
+        }
+
+        if (time() - $token->lastuse > 60) {
+            //time to update lastuse after at least a minute
+            $this->tokens->updateLastUse($token->tokenKey);
+        }
+
         $provider->token_secret = $token->secret;
         return OAUTH_OK;
     }
@@ -135,12 +153,43 @@ class OAuth
     /**
      * Get a new oauth provider instance.
      * Used to work around the fastcgi bug in oauthprovider.
-     * 
+     *
      * @return \OAuthProvider
      */
     public static function getProvider()
     {
-        return new \OAuthProvider();
+        //$_SERVER['REDIRECT_HTTP_AUTHORIZATION'] = $_SERVER['HTTP_AUTHORIZATION'];
+        //unset($_SERVER['HTTP_AUTHORIZATION']);
+        if ((isset($_SERVER['HTTP_AUTHORIZATION'])
+                && strtolower(substr($_SERVER['HTTP_AUTHORIZATION'], 0, 5)) != 'oauth')
+            || (isset($_SERVER['REDIRECT_HTTP_AUTHORIZATION'])
+                && strtolower(substr($_SERVER['REDIRECT_HTTP_AUTHORIZATION'], 0, 5)) != 'oauth')
+        ) {
+            //work around bug https://bugs.php.net/bug.php?id=68168
+            //#68168: HTTP Basic auth reported as "signature_method_rejected"
+            throw new \OAuthException(
+                'No oauth auth header', OAUTH_PARAMETER_ABSENT
+            );
+        }
+
+        $params = array();
+        if (!isset($_SERVER['HTTP_AUTHORIZATION'])
+            && isset($_SERVER['REDIRECT_HTTP_AUTHORIZATION'])
+        ) {
+            //FastCgi puts the headers in REDIRECT_HTTP_AUTHORIZATION,
+            // but the oauth extension does not read that.
+            // we have to parse the parameters manually
+            $regex = "/(oauth_[a-z_-]*)=(?:\"([^\"]*)\"|([^,]*))/";
+            preg_match_all(
+                $regex, $_SERVER['REDIRECT_HTTP_AUTHORIZATION'], $matches
+            );
+
+            foreach ($matches[1] as $key => $paramName) {
+                $params[$paramName] = urldecode($matches[2][$key]);
+            }
+        }
+
+        return new \OAuthProvider($params);
     }
 }
 ?>