/** * Implements section 6.3 of the OAuth spec. */ private function exchangeRequestToken(RemoteContentRequest $request) { try { $accessor = $this->accessorInfo->getAccessor(); $url = $accessor->consumer->callback_url->accessTokenURL; $msgParams = array(); $msgParams[ShindigOAuth::$OAUTH_TOKEN] = $accessor->requestToken; self::addIdentityParams($msgParams, $request->getToken()); $callbackUrl = $this->requestParams->getReceivedCallback(); if (strlen($callbackUrl) > 0) { $parsed_url = parse_url($callbackUrl); parse_str($parsed_url["query"], $url_params); if (strlen($url_params["oauth_token"]) > 0 && strlen($url_params["oauth_verifier"]) > 0 && $url_params["oauth_token"] == $accessor->requestToken) { $msgParams[ShindigOAuth::$OAUTH_VERIFIER] = $url_params["oauth_verifier"]; } else { throw new GadgetException("Invalid received callback URL: " . $callbackUrl); } } $request = $this->newRequestMessageParams($url->url, $msgParams); $reply = $this->sendOAuthMessage($request); $reply->requireParameters(array(ShindigOAuth::$OAUTH_TOKEN, ShindigOAuth::$OAUTH_TOKEN_SECRET)); $accessor->accessToken = $reply->get_parameter(ShindigOAuth::$OAUTH_TOKEN); $accessor->tokenSecret = $reply->get_parameter(ShindigOAuth::$OAUTH_TOKEN_SECRET); } catch (Exception $e) { // It's unfortunate the OAuth libraries throw a generic Exception. throw new GadgetException("INTERNAL SERVER ERROR: " . $e); } }
private function buildTokenKey() { $tokenKey = new TokenKey(); // need to URLDecode so when comparing with the ProviderKey it goes thought $tokenKey->setGadgetUri(urldecode($this->authToken->getAppUrl())); $tokenKey->setModuleId($this->authToken->getModuleId()); $tokenKey->setServiceName($this->requestParams->getServiceName()); $tokenKey->setTokenName($this->requestParams->getTokenName()); // At some point we might want to let gadgets specify whether to use OAuth // for the owner, the viewer, or someone else. For now always using the // owner identity seems reasonable. $tokenKey->setUserId($this->authToken->getOwnerId()); return $tokenKey; }
/** * * @param oauthCrypter used to encrypt transient information we store on the * client. * @param authToken user's gadget security token * @param params OAuth fetch parameters sent from makeRequest * @param tokenStore storage for long lived tokens. */ public function __construct($tokenStore, $oauthCrypter, $nextFetcher, $authToken, OAuthRequestParams $params) { parent::setNextFetcher($nextFetcher); $this->oauthCrypter = $oauthCrypter; $this->authToken = $authToken; $this->bypassSpecCache = $params->getBypassSpecCache(); $this->requestParams = $params; $this->newClientState = null; $this->aznUrl = null; $this->error = null; $this->errorText = null; $origClientState = $params->getOrigClientState(); if ($origClientState != null && strlen($origClientState) > 0) { try { $this->origClientState = $this->oauthCrypter->unwrap($origClientState, self::$CLIENT_STATE_MAX_AGE_SECS); } catch (BlobCrypterException $e) { // Probably too old, pretend we never saw it at all. } } if ($this->origClientState == null) { $this->origClientState = array(); } $this->tokenStore = $tokenStore; }