$bin = '';

for($i = 0; $i < strlen($hex); $i += 2)

$bin .= chr(hexdec($hex{$i+1}) + hexdec($hex{$i}) * 16);

return base64_encode($bin);

extends HTTP_Request

{

/**

* Oauth realm

* @var string

*/

var $_realm;

/**

* Oauth consumer key

* @var string

*/

var $_consumer_key;

/**

* OAuth consumer secret

* @var string

*/

var $_consumer_secret;

/**

* Oauth token

* @var string

*/

var $_token;

/**

* Oauth token secret

* @var string

*/

var $_token_secret;

/**

* Constructor

*

* Sets up the object

* @param string The url to fetch/access

* @param array Associative array of parameters which can have the following keys:

* <ul>

* <li>consumer_key - Oauth consumer key (string)</li>

* <li>consumer_secret - Oauth consumer secret (string)</li>

* <li>signature_method - TBD</li>

* <li>token - Oauth session token or frob (string)</li>

* <li>token_secret - Oauth session secret (string)</li>

* <li>realm - Oauth realm (string)</li>

* <li>method - Method to use, GET, POST etc (string)</li>

* <li>http - HTTP Version to use, 1.0 or 1.1 (string)</li>

* <li>user - Basic Auth username (string)</li>

* <li>pass - Basic Auth password (string)</li>

* <li>proxy_host - Proxy server host (string)</li>

* <li>proxy_port - Proxy server port (integer)</li>

* <li>proxy_user - Proxy auth username (string)</li>

* <li>proxy_pass - Proxy auth password (string)</li>

* <li>timeout - Connection timeout in seconds (float)</li>

* <li>allowRedirects - Whether to follow redirects or not (bool)</li>

* <li>maxRedirects - Max number of redirects to follow (integer)</li>

* <li>useBrackets - Whether to append [] to array variable names (bool)</li>

* <li>saveBody - Whether to save response body in response object property (bool)</li>

* <li>readTimeout - Timeout for reading / writing data over the socket (array (seconds, microseconds))</li>

* <li>socketOptions - Options to pass to Net_Socket object (array)</li>

* </ul>

* @access public

*/

function HTTP_Request_OAuth($url = '', $params = array())

{

$this->_realm = null;

$this->_token = null;

$this->_token_secret = null;

$this->_consumer_key = null;

$this->_consumer_secret = null;

$this->signature_method = $params['signature_method'];

HTTP_Request::HTTP_Request($url, $params);

$this->addHeader('User-Agent', 'PHP HTTP_Request_OAuth class');

}

/**

* Signs the request, then sends it

*

* @access public

* @param bool Whether to store response body in Response object property,

* set this to false if downloading a LARGE file and using a Listener

* @return mixed PEAR error on error, true otherwise

*/

function sendRequest($saveBody=true, $authHeader=false)

{

$this->sign($authHeader);

$r = HTTP_Request::sendRequest($saveBody);

return $r;

}

/**

* @return array Various oauth_* parameters, as defined in the spec.

* Includes: oauth_token, oauth_consumer_key,

* oauth_signature_method, oauth_signature,

* oauth_timestamp, oauth_nonce, oauth_version.

*/

function oauth_parameters()

{

// e.g.: https://photos.example.net/request_token?oauth_consumer_key=dpf43f3p2l4k3l03&oauth_signature_method=PLAINTEXT&oauth_signature=kd94hf93k423kf44%26&oauth_timestamp=1191242090&oauth_nonce=hsu94j3884jdopsl&oauth_version=1.0

return array('oauth_token' => $this->_token,

'oauth_consumer_key' => $this->_consumer_key,

'oauth_signature_method' => $this->signature_method,

'oauth_signature' => null,

'oauth_timestamp' => time(),

'oauth_nonce' => uniqid(''),

'oauth_version' => '1.0');

}

/**

* @param array $params Associative array of parameters to normalize for signing.

* Note that values are expected to be urlencoded!

*

* @return string CGI query parameter string for signing.

*/

function oauth_parametersToString($params)

{

$param_keys = array_keys($params);

$param_values = array_values($params);

// sort by name, then by value

array_multisort($param_keys, SORT_ASC, $param_values, SORT_ASC);

// pack parameters into a normalized string

$normalized_keyvalues = array();

for($i = 0; $i < count($param_keys); $i += 1) {

$key = $param_keys[$i];

$value = $param_values[$i];

// don't urlencode the values - they are probably already urlencoded

// ?? ^ WTF? "Probably"?

if($key != 'oauth_signature')

if($key != 'oauth_token' || $value) {

$value = rawurlencode(urldecode($value));

$normalized_keyvalues[] = urlencode($key).'='.$value;

}

}

return join('&', $normalized_keyvalues);

}

/**

* @return string Request URL as defined in the spec,

* i.e. everything up to the query string.

*/

function oauth_requestURL()

{

return $this->_url->protocol . '://'

. $this->_url->user . (!empty($this->_url->pass) ? ':' : '')

. $this->_url->pass . (!empty($this->_url->user) ? '@' : '')

. $this->_url->host . ($this->_url->port == $this->_url->getStandardPort($this->_url->protocol) ? '' : ':' . $this->_url->port)

. $this->_url->path;

}

function _sha1($s, $consumer_secret, $token_secret) {

$key = $consumer_secret . '&' . $token_secret;

$digest_b64 = base64_encode(hash_hmac("sha1", $s, $key, TRUE));

return $digest_b64;

}

/**

* @return string Binary md5 digest, as distinct from PHP's built-in hexdigest.

*/

function _md5($s, $consumer_secret, $token_secret)

{

$s = join('&', array_map('urlencode',

array($s, $consumer_secret, $token_secret)));

$md5 = md5($s);

$bin = '';

for($i = 0; $i < strlen($md5); $i += 2)

$bin .= chr(hexdec($md5{$i+1}) + hexdec($md5{$i}) * 16);

return base64_encode($bin);

}

function addParam($key, $val, $preencoded = false) {

if ($this->_method == 'GET') {

$this->addQueryString($key, $val, $preencoded);

} else {

$this->addPostData($key, $val, $preencoded);

}

}

/**

* Sign this here request.

*

* @param boolean $authHeader Where to put the signature:

* true means Authorization HTTP header,

* false means CGI query params.

*/

function sign($authHeader=false)

{

$oauth_parameters = $this->oauth_parameters();

// get any and all existing oauth_* params out of POST, GET

foreach($oauth_parameters as $key => $value) {

$this->_url->removeQueryString($key);

unset($this->_postData[$key]);

}

// get a callback reference to the proper function for adding new oauth_* params

// function should accept two arguments: key, value

$parameter_adder = in_array($this->_requestHeaders['content-type'], array('application/x-www-form-urlencoded', 'multipart/form-data'))

? array(&$this, 'addPostData')

: array(&$this->_url, 'addQueryString');

// for later normalizing

$parameters_to_normalize = array();

// add new oauth_* parameters if they're not supposed to be in a header

foreach($oauth_parameters as $key => $value)

if($key != 'oauth_signature')

if($key != 'oauth_token' || $value) {

if(!$authHeader)

call_user_func($parameter_adder, $key, $value);

// these will later need to be normalized, and are expected to be urlencoded

$parameters_to_normalize[$key] = urlencode($value);

}

// the master list of parameters to normalize, order matters

$parameters_to_normalize = array_merge($this->_url->querystring,

$this->_postData,

$parameters_to_normalize);

$normalized_params_string = $this->oauth_parametersToString($parameters_to_normalize);

$signature_parts = array($this->_method,

$this->oauth_requestURL(),

$normalized_params_string);

$signed_string = join('&', array_map('urlencode', $signature_parts));

$oauth_parameters['oauth_signature'] =

$this->signature_method == 'md5' ?

HTTP_Request_OAuth::_md5($signed_string,

$this->_consumer_secret,

$this->_token_secret) :

$this->signature_method == 'HMAC-SHA1' ?

HTTP_Request_OAuth::_sha1($signed_string,

$this->_consumer_secret,

$this->_token_secret) :

die('unknown signature method');

if($authHeader) {

// oauth_* params go into the Authorization request header

$authorization_header = "OAuth ";

$i = 0;

if ($this->_realm) {

$authorization_header .= "realm=\"{$this->_realm}\"";

$i++;

}

foreach($oauth_parameters as $key => $value) {

# BLAH just want to join a list with ", "

if($key != 'oauth_token' || $value) {

if ($i++ > 0)

$authorization_header .= ", ";

$value = urlencode($value);

$authorization_header .= "{$key}=\"{$value}\"";

}

}

$this->addHeader('Authorization', $authorization_header);

} else {

// oauth_* params go into the request body or URL, see above

call_user_func($parameter_adder, 'oauth_signature', $oauth_parameters['oauth_signature']);

}

// for testing, or whatever - wildly insecure:

/*

$this->addHeader('X-Oauth-Params', $normalized_params_string);

$this->addHeader('X-Oauth-String', $signed_string);

$this->addHeader('X-Oauth-URL', $this->_url->getURL());

*/

}

/**

* @return array Token and secret, for requests that return such values.

*/

function getResponseTokenSecret()

{

if(preg_match('/\boauth_token=(\S+)\b/Uis', $this->getResponseBody(), $m))

$token = $m[1];

if(preg_match('/\boauth_token_secret=(\S+)\b/Uis', $this->getResponseBody(), $m))

$secret = $m[1];

return array($token, $secret);

}

}