From f2252e9501d82b1d45de7920fd37afb7b603882c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?David=20Mudr=C3=A1k?= <david@moodle.com>
Date: Mon, 21 Aug 2017 19:14:53 +0200
Subject: [PATCH] MDL-59645 oauth1: Pass oauth_callback only to obtain the
 request token

As per the oauth1 spec, the oauth_callback is supposed to be passed only
when obtaining the initial request token. The client used to append it
automatically to all requests which broke the request signature.
---
 lib/oauthlib.php | 23 +++++++++++------------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/lib/oauthlib.php b/lib/oauthlib.php
index 87fd236d0ba..f80ad912a87 100644
--- a/lib/oauthlib.php
+++ b/lib/oauthlib.php
@@ -184,9 +184,6 @@ class oauth_helper {
         $oauth_params['oauth_nonce']	    = $this->get_nonce();
         $oauth_params['oauth_timestamp']    = $this->get_timestamp();
         $oauth_params['oauth_consumer_key'] = $this->consumer_key;
-        if (!empty($this->oauth_callback)) {
-            $oauth_params['oauth_callback'] = $this->oauth_callback->out(false);
-        }
         $oauth_params['oauth_signature_method']	= 'HMAC-SHA1';
         $oauth_params['oauth_signature']	= $this->sign($http_method, $url, $oauth_params, $this->sign_secret);
         return $oauth_params;
@@ -221,7 +218,14 @@ class oauth_helper {
      */
     public function request_token() {
         $this->sign_secret = $this->consumer_secret.'&';
-        $params = $this->prepare_oauth_parameters($this->request_token_api, array(), 'GET');
+
+        if (empty($this->oauth_callback)) {
+            $params = [];
+        } else {
+            $params = ['oauth_callback' => $this->oauth_callback->out(false)];
+        }
+
+        $params = $this->prepare_oauth_parameters($this->request_token_api, $params, 'GET');
         $content = $this->http->get($this->request_token_api, $params, $this->http_options);
         // Including:
         //     oauth_token
@@ -230,14 +234,9 @@ class oauth_helper {
         if (empty($result['oauth_token'])) {
             throw new moodle_exception('Error while requesting an oauth token');
         }
-        // build oauth authrize url
-        if (!empty($this->oauth_callback)) {
-            // url must be rawurlencode
-            $result['authorize_url'] = $this->authorize_url . '?oauth_token='.$result['oauth_token'].'&oauth_callback='.rawurlencode($this->oauth_callback->out(false));
-        } else {
-            // no callback
-            $result['authorize_url'] = $this->authorize_url . '?oauth_token='.$result['oauth_token'];
-        }
+        // Build oauth authorize url.
+        $result['authorize_url'] = $this->authorize_url . '?oauth_token='.$result['oauth_token'];
+
         return $result;
     }