L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-59645 oauth1: Pass oauth_callback only to obtain the request token

Browse Source 
As per the oauth1 spec, the oauth_callback is supposed to be passed only
when obtaining the initial request token. The client used to append it
automatically to all requests which broke the request signature.
This commit is contained in:
David Mudrák
2017-09-19 14:44:41 +02:00
parent 91cbdda6af
commit f2252e9501
1 changed files with 11 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/oauthlib.php
+11 -12
View File
@@ -184,9 +184,6 @@ class oauth_helper {
$oauth_params['oauth_nonce'] = $this->get_nonce();
$oauth_params['oauth_timestamp'] = $this->get_timestamp();
$oauth_params['oauth_consumer_key'] = $this->consumer_key;
if (!empty($this->oauth_callback)) {
$oauth_params['oauth_callback'] = $this->oauth_callback->out(false);
}
$oauth_params['oauth_signature_method'] = 'HMAC-SHA1';
$oauth_params['oauth_signature'] = $this->sign($http_method, $url, $oauth_params, $this->sign_secret);
return $oauth_params;
@@ -221,7 +218,14 @@ class oauth_helper {
*/
public function request_token() {
$this->sign_secret = $this->consumer_secret.'&';
$params = $this->prepare_oauth_parameters($this->request_token_api, array(), 'GET');
if (empty($this->oauth_callback)) {
$params = [];
} else {
$params = ['oauth_callback' => $this->oauth_callback->out(false)];
}
$params = $this->prepare_oauth_parameters($this->request_token_api, $params, 'GET');
$content = $this->http->get($this->request_token_api, $params, $this->http_options);
// Including:
// oauth_token
@@ -230,14 +234,9 @@ class oauth_helper {
if (empty($result['oauth_token'])) {
throw new moodle_exception('Error while requesting an oauth token');
}
// build oauth authrize url
if (!empty($this->oauth_callback)) {
// url must be rawurlencode
$result['authorize_url'] = $this->authorize_url . '?oauth_token='.$result['oauth_token'].'&oauth_callback='.rawurlencode($this->oauth_callback->out(false));
} else {
// no callback
$result['authorize_url'] = $this->authorize_url . '?oauth_token='.$result['oauth_token'];
}
// Build oauth authorize url.
$result['authorize_url'] = $this->authorize_url . '?oauth_token='.$result['oauth_token'];
return $result;
}