jenkins-bot has submitted this change and it was merged. Change subject: Vendorize OAuth library ......................................................................
Vendorize OAuth library Depends on Iae6d7742cd7ae4c32c5f5a319edeaa01f29b5cfa. Change-Id: I70a9849a81558b292a7f3545e9f29a09669c0b12 --- D src/OAuth/Client.php D src/OAuth/ClientConfig.php D src/OAuth/Consumer.php D src/OAuth/Exception.php D src/OAuth/Request.php D src/OAuth/SignatureMethod.php D src/OAuth/SignatureMethod/HmacSha1.php D src/OAuth/SignatureMethod/Plaintext.php D src/OAuth/SignatureMethod/RsaSha1.php D src/OAuth/Token.php D src/OAuth/Util.php D tests/OAuth/ConsumerTest.php D tests/OAuth/RequestTest.php D tests/OAuth/SignatureMethod/HmacSha1Test.php D tests/OAuth/SignatureMethod/PlaintextTest.php D tests/OAuth/SignatureMethod/RsaSha1Test.php D tests/OAuth/TokenTest.php 17 files changed, 0 insertions(+), 2,514 deletions(-) Approvals: BryanDavis: Looks good to me, approved jenkins-bot: Verified diff --git a/src/OAuth/Client.php b/src/OAuth/Client.php deleted file mode 100644 index 133bfbe..0000000 --- a/src/OAuth/Client.php +++ /dev/null @@ -1,358 +0,0 @@ -<?php -/** - * @section LICENSE - * This file is part of Wikimedia Slim application library - * - * Wikimedia Slim application library is free software: you can - * redistribute it and/or modify it under the terms of the GNU General Public - * License as published by the Free Software Foundation, either version 3 of - * the License, or (at your option) any later version. - * - * Wikimedia Slim application library is distributed in the hope that it - * will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty - * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * General Public License for more details. - * - * You should have received a copy of the GNU General Public License along - * with Wikimedia Grants Review application. If not, see - * <http://www.gnu.org/licenses/>. - * - * @file - * @copyright © 2015 Chris Steipp, Wikimedia Foundation and contributors. - */ - -namespace Wikimedia\Slimapp\OAuth; - -use Psr\Log\LoggerAwareInterface; -use Psr\Log\LoggerInterface; -use Psr\Log\NullLogger; -use Wikimedia\Slimapp\OAuth\SignatureMethod\HmacSha1; -use Exception; - -/** - * MediaWiki OAuth client. - */ -class Client implements LoggerAwareInterface { - - /** - * @var LoggerInterface $logger - */ - protected $logger; - - /** - * @var ClientConfig $config - */ - private $config; - - /** - * Any extra params in the call that need to be signed - * @var array $extraParams - */ - private $extraParams = array(); - - /** - * url, defaults to oob - * @var string $callbackUrl - */ - private $callbackUrl = 'oob'; - - /** - * Track the last random nonce generated by the OAuth lib, used to verify - * /identity response isn't a replay - * @var string $lastNonce - */ - private $lastNonce; - - /** - * @param ClientConfig $config - * @param LoggerInterface $logger - */ - function __construct( - ClientConfig $config, - LoggerInterface $logger = null - ) { - $this->config = $config; - $this->logger = $logger ?: new NullLogger(); - } - - /** - * @param LoggerInterface $logger - */ - public function setLogger( LoggerInterface $logger ) { - $this->logger = $logger; - } - - /** - * @param string $url - * @param string $key - * @param string $secret - * @return MediaWiki - */ - public static function newFromKeyAndSecret( $url, $key, $secret ) { - $config = new ClientConfig( $url, true, true ); - $config->setConsumer( new Consumer( $key, $secret ) ); - return new static( $config ); - } - - /** - * @param string $key - * @param string $value - */ - public function setExtraParam( $key, $value ) { - $this->extraParams[$key] = $value; - } - - /** - * @param array $params - */ - public function setExtraParams( array $params ) { - $this->extraParams = $params; - } - - /** - * @param string $url - */ - public function setCallback( $url ) { - $this->callbackUrl = $url; - } - - /** - * First part of 3-legged OAuth, get the request Token. - * Redirect your authorizing users to the redirect url, and keep - * track of the request token since you need to pass it into complete() - * - * @return array (redirect, request/temp token) - */ - public function initiate() { - $initUrl = $this->config->endpointURL . - '/initiate&format=json&oauth_callback=' . - urlencode( $this->callbackUrl ); - $data = $this->makeOAuthCall( null, $initUrl ); - $return = json_decode( $data ); - if ( $return->oauth_callback_confirmed !== 'true' ) { - throw new Exception( "Callback wasn't confirmed" ); - } - $requestToken = new Token( $return->key, $return->secret ); - $url = $this->config->redirURL ?: - $this->config->endpointURL . "/authorize&"; - $url .= "oauth_token={$requestToken->key}&oauth_consumer_key={$this->config->consumer->key}"; - return array( $url, $requestToken ); - } - - /** - * The final leg of the OAuth handshake. Exchange the request Token from - * initiate() and the verification code that the user submitted back to you - * for an access token, which you'll use for all API calls. - * - * @param Token $requestToken Authorization code sent to the callback url - * @param string Temp/request token obtained from initiate, or null if this - * object was used and the token is already set. - * @return Token The access token - */ - public function complete( Token $requestToken, $verifyCode ) { - $tokenUrl = $this->config->endpointURL . '/token&format=json'; - $this->setExtraParam( 'oauth_verifier', $verifyCode ); - $data = $this->makeOAuthCall( $requestToken, $tokenUrl ); - $return = json_decode( $data ); - $accessToken = new Token( $return->key, $return->secret ); - // Cleanup after ourselves - $this->setExtraParams = array(); - return $accessToken; - } - - /** - * Optional step. This call the MediaWiki specific /identify method, which - * returns a signed statement of the authorizing user's identity. Use this - * if you are authenticating users in your application, and you need to - * know their username, groups, rights, etc in MediaWiki. - * - * @param Token $accessToken Access token from complete() - * @return object containing attributes of the user - */ - public function identify( Token $accessToken ) { - $identifyUrl = $this->config->endpointURL . '/identify'; - $data = $this->makeOAuthCall( $accessToken, $identifyUrl ); - $identity = $this->decodeJWT( $data, $this->config->consumer->secret ); - if ( !$this->validateJWT( - $identity, - $this->config->consumer->key, - $this->config->canonicalServerUrl, - $this->lastNonce - ) ) { - throw new Exception( "JWT didn't validate" ); - } - return $identity; - } - - /** - * Make a signed request to MediaWiki - * - * @param Token $token additional token to use in signature, besides - * the consumer token. In most cases, this will be the access token you - * got from complete(), but we set it to the request token when - * finishing the handshake. - * @param string $url URL to call - * @param bool $isPost true if this should be a POST request - * @param array $postFields POST parameters, only if $isPost is also true - * @return string Body from the curl request - */ - public function makeOAuthCall( - /*Token*/ $token, $url, $isPost = false, array $postFields = null - ) { - $params = array(); - // Get any params from the url - if ( strpos( $url, '?' ) ) { - $parsed = parse_url( $url ); - parse_str( $parsed['query'], $params ); - } - $params += $this->extraParams; - if ( $isPost && $postFields ) { - $params += $postFields; - } - $method = $isPost ? 'POST' : 'GET'; - $req = Request::fromConsumerAndToken( - $this->config->consumer, - $token, - $method, - $url, - $params - ); - $req->signRequest( - new HmacSha1(), - $this->config->consumer, - $token - ); - $this->lastNonce = $req->getParameter( 'oauth_nonce' ); - return $this->makeCurlCall( - $url, - $req->toHeader(), - $isPost, - $postFields, - $this->config - ); - } - - /** - * @param string $url - * @param array $headers - * @param bool $isPost - * @param array $postFields - * @return string - */ - private function makeCurlCall( - $url, $headers, $isPost, array $postFields = null - ) { - $ch = curl_init(); - curl_setopt( $ch, CURLOPT_URL, (string) $url ); - curl_setopt( $ch, CURLOPT_HEADER, 0 ); - curl_setopt( $ch, CURLOPT_RETURNTRANSFER, 1 ); - curl_setopt( $ch, CURLOPT_HTTPHEADER, array( $headers ) ); - if ( $isPost ) { - curl_setopt( $ch, CURLOPT_POST, true ); - curl_setopt( $ch, CURLOPT_POSTFIELDS, http_build_query( $postFields ) ); - } - if ( $this->config->useSSL ) { - curl_setopt( $ch, CURLOPT_PORT, 443 ); - } - if ( $this->config->verifySSL ) { - curl_setopt( $ch, CURLOPT_SSL_VERIFYPEER, true ); - curl_setopt( $ch, CURLOPT_SSL_VERIFYHOST, 2 ); - } else { - curl_setopt( $ch, CURLOPT_SSL_VERIFYPEER, false ); - curl_setopt( $ch, CURLOPT_SSL_VERIFYHOST, 0 ); - } - $data = curl_exec( $ch ); - if ( !$data ) { - throw new Exception( 'Curl error: ' . curl_error( $ch ) ); - } - return $data; - } - - /** - * @param string $JWT Json web token - * @param string $secret - * @return object - */ - private function decodeJWT( $JWT, $secret ) { - list( $headb64, $bodyb64, $sigb64 ) = explode( '.', $JWT ); - $header = json_decode( $this->urlsafeB64Decode( $headb64 ) ); - $payload = json_decode( $this->urlsafeB64Decode( $bodyb64 ) ); - $sig = $this->urlsafeB64Decode( $sigb64 ); - // MediaWiki will only use sha256 hmac (HS256) for now. This check - // makes sure an attacker doesn't return a JWT with 'none' signature - // type. - $expectSig = hash_hmac( - 'sha256', "{$headb64}.{$bodyb64}", $secret, true - ); - if ( $header->alg !== 'HS256' || !$this->compareHash( $sig, $expectSig ) ) { - throw new Exception( "Invalid JWT signature from /identify." ); - } - return $payload; - } - - /** - * @param object $identity - * @param string $consumerKey - * @param string $expectedConnonicalServer - * @param string $nonce - */ - protected function validateJWT( - $identity, $consumerKey, $expectedConnonicalServer, $nonce - ) { - // Verify the issuer is who we expect (server sends $wgCanonicalServer) - if ( $identity->iss !== $expectedConnonicalServer ) { - $this->logger->info( - "Invalid issuer '{$identity->iss}': expected '{$expectedConnonicalServer}'" ); - return false; - } - // Verify we are the intended audience - if ( $identity->aud !== $consumerKey ) { - $this->logger->info( "Invalid audience '{$identity->aud}': expected '{$consumerKey}'" ); - return false; - } - // Verify we are within the time limits of the token. Issued at (iat) - // should be in the past, Expiration (exp) should be in the future. - $now = time(); - if ( $identity->iat > $now || $identity->exp < $now ) { - $this->logger->info( - "Invalid times issued='{$identity->iat}', " . - "expires='{$identity->exp}', now='{$now}'" - ); - return false; - } - // Verify we haven't seen this nonce before, which would indicate a replay attack - if ( $identity->nonce !== $nonce ) { - $this->logger->info( "Invalid nonce '{$identity->nonce}': expected '{$nonce}'" ); - return false; - } - return true; - } - - /** - * @param string $input - * @return string - */ - private function urlsafeB64Decode( $input ) { - $remainder = strlen( $input ) % 4; - if ( $remainder ) { - $padlen = 4 - $remainder; - $input .= str_repeat( '=', $padlen ); - } - return base64_decode( strtr( $input, '-_', '+/' ) ); - } - - /** - * Constant time comparison - * @param string $hash1 - * @param string $hash2 - * @return bool - */ - private function compareHash( $hash1, $hash2 ) { - $result = strlen( $hash1 ) ^ strlen( $hash2 ); - $len = min( strlen( $hash1 ), strlen( $hash2 ) ) - 1; - for ( $i = 0; $i < $len; $i++ ) { - $result |= ord( $hash1{$i} ) ^ ord( $hash2{$i} ); - } - return $result == 0; - } -} diff --git a/src/OAuth/ClientConfig.php b/src/OAuth/ClientConfig.php deleted file mode 100644 index f9f143a..0000000 --- a/src/OAuth/ClientConfig.php +++ /dev/null @@ -1,99 +0,0 @@ -<?php -/** - * @section LICENSE - * This file is part of Wikimedia Slim application library - * - * Wikimedia Slim application library is free software: you can - * redistribute it and/or modify it under the terms of the GNU General Public - * License as published by the Free Software Foundation, either version 3 of - * the License, or (at your option) any later version. - * - * Wikimedia Slim application library is distributed in the hope that it - * will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty - * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * General Public License for more details. - * - * You should have received a copy of the GNU General Public License along - * with Wikimedia Grants Review application. If not, see - * <http://www.gnu.org/licenses/>. - * - * @file - * @copyright © 2015 Chris Steipp, Wikimedia Foundation and contributors. - */ - -namespace Wikimedia\Slimapp\OAuth; - -/** - * MediaWiki OAuth client configuration - */ -class ClientConfig { - /** - * Url to the OAuth special page - * @var string $endpointURL - */ - public $endpointURL; - - /** - * Canonical server url, used to check /identify's iss. - * A default value will be created based on the provided $endpointURL. - * @var string $canonicalServerUrl - */ - public $canonicalServerUrl; - - /** - * Url that the user is sent to. Can be different from $endpointURL to - * play nice with MobileFrontend, etc. - * @var string|null $redirURL - */ - public $redirURL = null; - - /** - * Use https when calling the server. - * @var bool $useSSL - */ - public $useSSL; - - /** - * If you're testing against a server with self-signed certificates, you - * can turn this off but don't do this in production. - * @var bool $verifySSL - */ - public $verifySSL; - - /** - * @var Consumer|null $consumer - */ - public $consumer = null; - - /** - * @param string $url OAuth endpoint URL - * @param bool $verifySSL - */ - function __construct( $url, $verifySSL = true ) { - $this->endpointURL = $url; - $this->verifySSL = $verifySSL; - - $parts = parse_url( $url ); - $this->useSSL = $parts['scheme'] === 'https'; - $this->canonicalServerUrl = "{$parts['scheme']}://{$parts['host']}" . - ( isset( $parts['port'] ) ? ':' . $parts['port'] : '' ); - } - - /** - * @param string $redirURL - * @return ClientConfig Self, for method chaining - */ - public function setRedirUrl( $redirURL ) { - $this->redirURL = $redirURL; - return $this; - } - - /** - * @param Consumer $consumer - * @return ClientConfig Self, for method chaining - */ - public function setConsumer( Consumer $consumer ) { - $this->consumer = $consumer; - return $this; - } -} diff --git a/src/OAuth/Consumer.php b/src/OAuth/Consumer.php deleted file mode 100644 index 54310f5..0000000 --- a/src/OAuth/Consumer.php +++ /dev/null @@ -1,53 +0,0 @@ -<?php -/** - * @section LICENSE - * Copyright (c) 2007 Andy Smith - * - * Permission is hereby granted, free of charge, to any person obtaining - * a copy of this software and associated documentation files (the - * "Software"), to deal in the Software without restriction, including without - * limitation the rights to use, copy, modify, merge, publish, distribute, - * sublicense, and/or sell copies of the Software, and to permit persons to - * whom the Software is furnished to do so, subject to the following - * conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING - * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER - * DEALINGS IN THE SOFTWARE. - * - * @file - */ - -namespace Wikimedia\Slimapp\OAuth; - -/** - * Data type that represents the identity of the Consumer via its shared - * secret with the ServiceProvider. - */ -class Consumer { - /** - * @var string $key - */ - public $key; - - /** - * @var string $secret - */ - public $secret; - - function __construct( $key, $secret ) { - $this->key = $key; - $this->secret = $secret; - } - - function __toString() { - return __CLASS__ . "[key={$this->key},secret={$this->secret}]"; - } -} diff --git a/src/OAuth/Exception.php b/src/OAuth/Exception.php deleted file mode 100644 index bc09241..0000000 --- a/src/OAuth/Exception.php +++ /dev/null @@ -1,35 +0,0 @@ -<?php -/** - * @section LICENSE - * Copyright (c) 2007 Andy Smith - * - * Permission is hereby granted, free of charge, to any person obtaining - * a copy of this software and associated documentation files (the - * "Software"), to deal in the Software without restriction, including without - * limitation the rights to use, copy, modify, merge, publish, distribute, - * sublicense, and/or sell copies of the Software, and to permit persons to - * whom the Software is furnished to do so, subject to the following - * conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING - * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER - * DEALINGS IN THE SOFTWARE. - * - * @file - */ - -namespace Wikimedia\Slimapp\OAuth; - -/** - * Generic exception class - */ -class Exception extends \Exception { - // pass -} diff --git a/src/OAuth/Request.php b/src/OAuth/Request.php deleted file mode 100644 index 00e7a7a..0000000 --- a/src/OAuth/Request.php +++ /dev/null @@ -1,337 +0,0 @@ -<?php -/** - * @section LICENSE - * Copyright (c) 2007 Andy Smith - * - * Permission is hereby granted, free of charge, to any person obtaining - * a copy of this software and associated documentation files (the - * "Software"), to deal in the Software without restriction, including without - * limitation the rights to use, copy, modify, merge, publish, distribute, - * sublicense, and/or sell copies of the Software, and to permit persons to - * whom the Software is furnished to do so, subject to the following - * conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING - * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER - * DEALINGS IN THE SOFTWARE. - * - * @file - */ - -namespace Wikimedia\Slimapp\OAuth; - -/** - * An OAuth request - */ -class Request { - /** - * @var array $parameters - */ - protected $parameters; - - /** - * @var string $method - */ - protected $method; - - /** - * @var string $url - */ - protected $url; - - /** - * @var string $version - */ - public static $version = '1.0'; - - /** - * Used for tests. - * @var string $POST_INPUT - */ - public static $POST_INPUT = 'php://input'; - - /** - * @param string $method - * @param string $url - * @param array $parameters - */ - function __construct( $method, $url, $parameters = null ) { - $parameters = $parameters ?: array(); - $parameters = array_merge( - Util::parseParameters( parse_url( $url, PHP_URL_QUERY ) ), - $parameters - ); - $this->parameters = $parameters; - $this->method = $method; - $this->url = $url; - } - - - /** - * Attempt to build up a request from what was passed to the server - * - * @param string $method - * @param string $url - * @param array $params - * @return Request - */ - public static function fromRequest( - $method = null, - $url = null, - array $params = null - ) { - $scheme = ( !isset( $_SERVER['HTTPS'] ) || $_SERVER['HTTPS'] != 'on' ) ? - 'http' : 'https'; - $url = ( $url ?: $scheme ) . - '://' . $_SERVER['SERVER_NAME'] . - ':' . - $_SERVER['SERVER_PORT'] . - $_SERVER['REQUEST_URI']; - $method = $method ?: $_SERVER['REQUEST_METHOD']; - - // We weren't handed any params, so let's find the ones relevant - // to this request. If you run XML-RPC or similar you should use this - // to provide your own parsed parameter-list - if ( !$params ) { - // Find request headers - $headers = Util::getHeaders(); - - // Parse the query-string to find GET params - $params = Util::parseParameters( $_SERVER['QUERY_STRING'] ); - - // It's a POST request of the proper content-type, so parse POST - // params and add those overriding any duplicates from GET - if ( $method === 'POST' && - isset( $headers['Content-Type'] ) && - strstr( $headers['Content-Type'], - 'application/x-www-form-urlencoded' - ) - ) { - $post_data = Util::parseParameters( - file_get_contents( self::$POST_INPUT ) - ); - $params = array_merge( $params, $post_data ); - } - - // We have a Authorization-header with OAuth data. Parse the header - // and add those overriding any duplicates from GET or POST - if ( isset( $headers['Authorization'] ) && - substr( $headers['Authorization'], 0, 6 ) === 'OAuth ' - ) { - $header_params = Util::splitHeader( $headers['Authorization'] ); - $params = array_merge( $params, $header_params ); - } - } - - return new Request( $method, $url, $params ); - } - - /** - * @param Consumer $consumer - * @param Token|null $token - * @param string $method - * @param string $url - * @param array $parameters - * @return Request - */ - public static function fromConsumerAndToken( - Consumer $consumer, - /*Token*/ $token = null, - $method, - $url, - array $parameters = null - ) { - $parameters = $parameters ?: array(); - $defaults = array( - 'oauth_version' => static::$version, - 'oauth_nonce' => md5( microtime() . mt_rand() ), - 'oauth_timestamp' => time(), - 'oauth_consumer_key' => $consumer->key, - ); - if ( $token ) { - $defaults['oauth_token'] = $token->key; - } - $parameters = array_merge( $defaults, $parameters ); - - return new self( $method, $url, $parameters ); - } - - public function setParameter( $name, $value, $allow_duplicates = true ) { - if ( $allow_duplicates && isset( $this->parameters[$name] ) ) { - // We have already added parameter(s) with this name, so add to - // the list - if ( is_scalar( $this->parameters[$name] ) ) { - // This is the first duplicate, so transform scalar (string) - // into an array so we can add the duplicates - $this->parameters[$name] = array( $this->parameters[$name] ); - } - - $this->parameters[$name][] = $value; - } else { - $this->parameters[$name] = $value; - } - } - - /** - * @param string $name - * @return mixed - */ - public function getParameter( $name ) { - return isset( $this->parameters[$name] ) ? - $this->parameters[$name] : null; - } - - /** - * @return array - */ - public function getParameters() { - return $this->parameters; - } - - /** - * @param string $name - */ - public function unsetParameter( $name ) { - unset( $this->parameters[$name] ); - } - - /** - * The request parameters, sorted and concatenated into a normalized string. - * @return string - */ - public function getSignableParameters() { - // Grab all parameters - $params = $this->parameters; - - // Remove oauth_signature if present - // Ref: Spec: 9.1.1 ("The oauth_signature parameter MUST be excluded.") - if ( isset( $params['oauth_signature'] ) ) { - unset( $params['oauth_signature'] ); - } - - return Util::buildHttpQuery( $params ); - } - - /** - * Returns the base string of this request - * - * The base string defined as the method, the url - * and the parameters (normalized), each urlencoded - * and the concated with &. - */ - public function getSignatureBaseString() { - $parts = array( - $this->getNormalizedMethod(), - $this->getNormalizedUrl(), - $this->getSignableParameters() - ); - - $parts = Util::urlencode( $parts ); - - return implode( '&', $parts ); - } - - /** - * @return string - */ - public function getNormalizedMethod() { - return strtoupper( $this->method ); - } - - /** - * Parses the url and rebuilds it to be scheme://host/path - * @return string - */ - public function getNormalizedUrl() { - $parts = parse_url( $this->url ); - - $scheme = isset( $parts['scheme'] ) ? $parts['scheme'] : 'http'; - $port = isset( $parts['port'] ) ? - $parts['port'] : ( $scheme === 'https' ? '443' : '80' ); - $host = isset( $parts['host'] ) ? strtolower( $parts['host'] ) : ''; - $path = isset( $parts['path'] ) ? $parts['path'] : ''; - - if ( ( $scheme === 'https' && $port != '443' ) || - ( $scheme === 'http' && $port != '80' ) - ) { - $host = "{$host}:{$port}"; - } - return "{$scheme}://{$host}{$path}"; - } - - /** - * Builds a url usable for a GET request - */ - public function toUrl() { - $post_data = $this->toPostData(); - $out = $this->getNormalizedUrl(); - if ( $post_data ) { - $out .= '?' . $post_data; - } - return $out; - } - - /** - * Builds the data one would send in a POST request - */ - public function toPostData() { - return Util::buildHttpQuery( $this->parameters ); - } - - /** - * Builds the Authorization: header - */ - public function toHeader( $realm = null ) { - $first = true; - if ( $realm ) { - $out = 'Authorization: OAuth realm="' . - Util::urlencode( $realm ) . '"'; - $first = false; - } else { - $out = 'Authorization: OAuth'; - } - - foreach ( $this->parameters as $k => $v ) { - if ( substr( $k, 0, 5 ) !== 'oauth' ) { - continue; - } - if ( is_array( $v ) ) { - throw new Exception( 'Arrays not supported in headers' ); - } - $out .= ( $first ) ? ' ' : ','; - $out .= Util::urlencode( $k ) . '="' . Util::urlencode( $v ) . '"'; - $first = false; - } - return $out; - } - - public function __toString() { - return $this->toUrl(); - } - - public function signRequest( $signature_method, $consumer, $token ) { - $this->setParameter( - 'oauth_signature_method', - $signature_method->getName(), - false - ); - $signature = $this->buildSignature( - $signature_method, $consumer, $token - ); - $this->setParameter( 'oauth_signature', $signature, false ); - } - - public function buildSignature( $signature_method, $consumer, $token ) { - $signature = $signature_method->buildSignature( - $this, $consumer, $token - ); - return $signature; - } -} diff --git a/src/OAuth/SignatureMethod.php b/src/OAuth/SignatureMethod.php deleted file mode 100644 index 1717f91..0000000 --- a/src/OAuth/SignatureMethod.php +++ /dev/null @@ -1,91 +0,0 @@ -<?php -/** - * @section LICENSE - * Copyright (c) 2007 Andy Smith - * - * Permission is hereby granted, free of charge, to any person obtaining - * a copy of this software and associated documentation files (the - * "Software"), to deal in the Software without restriction, including without - * limitation the rights to use, copy, modify, merge, publish, distribute, - * sublicense, and/or sell copies of the Software, and to permit persons to - * whom the Software is furnished to do so, subject to the following - * conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING - * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER - * DEALINGS IN THE SOFTWARE. - * - * @file - */ - -namespace Wikimedia\Slimapp\OAuth; - -/** - * A class for implementing a Signature Method - * See section 9 ("Signing Requests") in the spec - */ -abstract class SignatureMethod { - /** - * Needs to return the name of the Signature Method (ie HMAC-SHA1) - * @return string - */ - abstract public function getName(); - - /** - * Build up the signature - * NOTE: The output of this function MUST NOT be urlencoded. - * the encoding is handled in OAuthRequest when the final - * request is serialized - * @param Request $request - * @param Consumer $consumer - * @param Token $token - * @return string - */ - abstract public function buildSignature( - Request $request, - Consumer $consumer, - Token $token = null - ); - - /** - * Verifies that a given signature is correct - * @param Request $request - * @param Consumer $consumer - * @param Token|null $token - * @param string $signature - * @return bool - */ - public function checkSignature( - Request $request, - Consumer $consumer, - /*Token*/ $token, - $signature - ) { - $built = $this->buildSignature( $request, $consumer, $token ); - - // Check for zero length, although unlikely here - if ( strlen( $built ) === 0 || strlen( $signature ) === 0 ) { - return false; - } - - if ( strlen( $built ) !== strlen( $signature ) ) { - return false; - } - - // Avoid a timing leak with a (hopefully) time insensitive compare - $result = 0; - $len = strlen( $signature ); - for ( $i = 0; $i < $len; $i++ ) { - $result |= ord( $built[$i] ) ^ ord( $signature[$i] ); - } - - return $result == 0; - } -} diff --git a/src/OAuth/SignatureMethod/HmacSha1.php b/src/OAuth/SignatureMethod/HmacSha1.php deleted file mode 100644 index 43bc0e6..0000000 --- a/src/OAuth/SignatureMethod/HmacSha1.php +++ /dev/null @@ -1,67 +0,0 @@ -<?php -/** - * @section LICENSE - * Copyright (c) 2007 Andy Smith - * - * Permission is hereby granted, free of charge, to any person obtaining - * a copy of this software and associated documentation files (the - * "Software"), to deal in the Software without restriction, including without - * limitation the rights to use, copy, modify, merge, publish, distribute, - * sublicense, and/or sell copies of the Software, and to permit persons to - * whom the Software is furnished to do so, subject to the following - * conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING - * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER - * DEALINGS IN THE SOFTWARE. - * - * @file - */ - -namespace Wikimedia\Slimapp\OAuth\SignatureMethod; - -use Wikimedia\Slimapp\OAuth\Consumer; -use Wikimedia\Slimapp\OAuth\Request; -use Wikimedia\Slimapp\OAuth\SignatureMethod; -use Wikimedia\Slimapp\OAuth\Token; -use Wikimedia\Slimapp\OAuth\Util; - -/** - * The HMAC-SHA1 signature method uses the HMAC-SHA1 signature algorithm as - * defined in [RFC2104] where the Signature Base String is the text and the - * key is the concatenated values (each first encoded per Parameter Encoding) - * of the Consumer Secret and Token Secret, separated by an '&' character - * (ASCII code 38) even if empty. - * - Chapter 9.2 ("HMAC-SHA1") - */ -class HmacSha1 extends SignatureMethod { - function getName() { - return 'HMAC-SHA1'; - } - - public function buildSignature( - Request $request, - Consumer $consumer, - Token $token = null - ) { - $base_string = $request->getSignatureBaseString(); - $request->base_string = $base_string; - - $key_parts = array( - $consumer->secret, - $token ? $token->secret : '' - ); - - $key_parts = Util::urlencode( $key_parts ); - $key = implode( '&', $key_parts ); - - return base64_encode( hash_hmac( 'sha1', $base_string, $key, true ) ); - } -} diff --git a/src/OAuth/SignatureMethod/Plaintext.php b/src/OAuth/SignatureMethod/Plaintext.php deleted file mode 100644 index 580aa28..0000000 --- a/src/OAuth/SignatureMethod/Plaintext.php +++ /dev/null @@ -1,72 +0,0 @@ -<?php -/** - * @section LICENSE - * Copyright (c) 2007 Andy Smith - * - * Permission is hereby granted, free of charge, to any person obtaining - * a copy of this software and associated documentation files (the - * "Software"), to deal in the Software without restriction, including without - * limitation the rights to use, copy, modify, merge, publish, distribute, - * sublicense, and/or sell copies of the Software, and to permit persons to - * whom the Software is furnished to do so, subject to the following - * conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING - * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER - * DEALINGS IN THE SOFTWARE. - * - * @file - */ - -namespace Wikimedia\Slimapp\OAuth\SignatureMethod; - -use Wikimedia\Slimapp\OAuth\Consumer; -use Wikimedia\Slimapp\OAuth\Request; -use Wikimedia\Slimapp\OAuth\SignatureMethod; -use Wikimedia\Slimapp\OAuth\Token; -use Wikimedia\Slimapp\OAuth\Util; - -/** - * The PLAINTEXT method does not provide any security protection and SHOULD - * only be used over a secure channel such as HTTPS. It does not use the - * Signature Base String. - * - Chapter 9.4 ("PLAINTEXT") - */ -class Plaintext extends SignatureMethod { - public function getName() { - return 'PLAINTEXT'; - } - - /** - * oauth_signature is set to the concatenated encoded values of the Consumer - * Secret and Token Secret, separated by a '&' character (ASCII code 38), - * even if either secret is empty. The result MUST be encoded again. - * - Chapter 9.4.1 ("Generating Signatures") - * - * Please note that the second encoding MUST NOT happen in the - * SignatureMethod, as Request handles this! - */ - public function buildSignature( - Request $request, - Consumer $consumer, - Token $token = null - ) { - $key_parts = array( - $consumer->secret, - $token ? $token->secret : '' - ); - - $key_parts = Util::urlencode( $key_parts ); - $key = implode( '&', $key_parts ); - $request->base_string = $key; - - return $key; - } -} diff --git a/src/OAuth/SignatureMethod/RsaSha1.php b/src/OAuth/SignatureMethod/RsaSha1.php deleted file mode 100644 index 03fdfae..0000000 --- a/src/OAuth/SignatureMethod/RsaSha1.php +++ /dev/null @@ -1,108 +0,0 @@ -<?php -/** - * @section LICENSE - * Copyright (c) 2007 Andy Smith - * - * Permission is hereby granted, free of charge, to any person obtaining - * a copy of this software and associated documentation files (the - * "Software"), to deal in the Software without restriction, including without - * limitation the rights to use, copy, modify, merge, publish, distribute, - * sublicense, and/or sell copies of the Software, and to permit persons to - * whom the Software is furnished to do so, subject to the following - * conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING - * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER - * DEALINGS IN THE SOFTWARE. - * - * @file - */ -namespace Wikimedia\Slimapp\OAuth\SignatureMethod; - -use Wikimedia\Slimapp\OAuth\Consumer; -use Wikimedia\Slimapp\OAuth\Request; -use Wikimedia\Slimapp\OAuth\SignatureMethod; -use Wikimedia\Slimapp\OAuth\Token; -use Wikimedia\Slimapp\OAuth\Util; - -/** - * The RSA-SHA1 signature method uses the RSASSA-PKCS1-v1_5 signature - * algorithm as defined in [RFC3447] section 8.2 (more simply known as - * PKCS#1), using SHA-1 as the hash function for EMSA-PKCS1-v1_5. It is - * assumed that the Consumer has provided its RSA public key in a verified way - * to the Service Provider, in a manner which is beyond the scope of this - * specification. - * - Chapter 9.3 ("RSA-SHA1") - */ -abstract class RsaSha1 extends SignatureMethod { - public function getName() { - return "RSA-SHA1"; - } - - // Up to the SP to implement this lookup of keys. Possible ideas are: - // (1) do a lookup in a table of trusted certs keyed off of consumer - // (2) fetch via http using a url provided by the requester - // (3) some sort of specific discovery code based on request - // Either way should return a string representation of the certificate - abstract protected function fetchPublicCert( Request $request ); - - // Up to the SP to implement this lookup of keys. Possible ideas are: - // (1) do a lookup in a table of trusted certs keyed off of consumer - // Either way should return a string representation of the certificate - abstract protected function fetchPrivateCert( Request $request ); - - public function buildSignature( - Request $request, - Consumer $consumer, - Token $token = null - ) { - $base_string = $request->getSignatureBaseString(); - $request->base_string = $base_string; - - // Fetch the private key cert based on the request - $cert = $this->fetchPrivateCert( $request ); - - // Pull the private key ID from the certificate - $privatekeyid = openssl_get_privatekey( $cert ); - - // Sign using the key - $ok = openssl_sign( $base_string, $signature, $privatekeyid ); - - // Release the key resource - openssl_free_key( $privatekeyid ); - - return base64_encode( $signature ); - } - - public function checkSignature( - Request $request, - Consumer $consumer, - /*Token*/ $token, - $signature - ) { - $decoded_sig = base64_decode( $signature ); - - $base_string = $request->getSignatureBaseString(); - - // Fetch the public key cert based on the request - $cert = $this->fetchPublicCert( $request ); - - // Pull the public key ID from the certificate - $publickeyid = openssl_get_publickey( $cert ); - - // Check the computed signature against the one passed in the query - $ok = openssl_verify( $base_string, $decoded_sig, $publickeyid ); - - // Release the key resource - openssl_free_key( $publickeyid ); - - return $ok == 1; - } -} diff --git a/src/OAuth/Token.php b/src/OAuth/Token.php deleted file mode 100644 index 438955d..0000000 --- a/src/OAuth/Token.php +++ /dev/null @@ -1,68 +0,0 @@ -<?php -/** - * @section LICENSE - * Copyright (c) 2007 Andy Smith - * - * Permission is hereby granted, free of charge, to any person obtaining - * a copy of this software and associated documentation files (the - * "Software"), to deal in the Software without restriction, including without - * limitation the rights to use, copy, modify, merge, publish, distribute, - * sublicense, and/or sell copies of the Software, and to permit persons to - * whom the Software is furnished to do so, subject to the following - * conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING - * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER - * DEALINGS IN THE SOFTWARE. - * - * @file - */ - -namespace Wikimedia\Slimapp\OAuth; - -/** - * Data type that represents an End User via either and access or requst - * token. - */ -class Token { - /** - * @var string $key - */ - public $key; - - /** - * @var string $secret - */ - public $secret; - - /** - * @param string key The token - * @param string secret The token secret - */ - function __construct( $key, $secret ) { - $this->key = $key; - $this->secret = $secret; - } - - /** - * Generate the basic string serialization of a token that a server - * would respond to request_token and access_token calls with - * - * @return string - */ - function toString() { - return 'oauth_token=' . Util::urlencode( $this->key ) . - '&oauth_token_secret=' . Util::urlencode( $this->secret ); - } - - function __toString() { - return $this->toString(); - } -} diff --git a/src/OAuth/Util.php b/src/OAuth/Util.php deleted file mode 100644 index f8047a8..0000000 --- a/src/OAuth/Util.php +++ /dev/null @@ -1,215 +0,0 @@ -<?php -/** - * @section LICENSE - * Copyright (c) 2007 Andy Smith - * - * Permission is hereby granted, free of charge, to any person obtaining - * a copy of this software and associated documentation files (the - * "Software"), to deal in the Software without restriction, including without - * limitation the rights to use, copy, modify, merge, publish, distribute, - * sublicense, and/or sell copies of the Software, and to permit persons to - * whom the Software is furnished to do so, subject to the following - * conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING - * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER - * DEALINGS IN THE SOFTWARE. - * - * @file - */ - -namespace Wikimedia\Slimapp\OAuth; - -class Util { - - /** - * @param string $input - * @return string - */ - public static function urlencode( $input ) { - if ( is_array( $input ) ) { - return array_map( __METHOD__, $input ); - - } elseif ( is_scalar( $input ) ) { - return rawurlencode( $input ); - - } else { - return ''; - } - } - - /** - * @param string $string - * @return string - */ - public static function urldecode( $string ) { - return urldecode( $string ); - } - - /** - * Utility function for turning the Authorization: header into parameters, - * has to do some unescaping Can filter out any non-oauth parameters if - * needed (default behaviour) - * - * @param string $header - * @param bool $oauthOnly - * @return array - */ - public static function splitHeader( $header, $oauthOnly = true ) { - $re = '/(' . ( $oauthOnly ? 'oauth_' : '' ) . - '[a-z_-]*)=(:?"([^"]*)"|([^,]*))/'; - $params = array(); - if ( preg_match_all( $re, $header, $m ) ) { - foreach ( $m[1] as $i => $h ) { - $params[$h] = static::urldecode( - empty( $m[3][$i] ) ? $m[4][$i] : $m[3][$i] - ); - } - if ( isset( $params['realm'] ) ) { - unset( $params['realm'] ); - } - } - return $params; - } - - /** - * @return array - */ - public static function getHeaders() { - if ( function_exists( 'apache_request_headers' ) ) { - // we need this to get the actual Authorization: header - // because apache tends to tell us it doesn't exist - $headers = apache_request_headers(); - - // sanitize the output of apache_request_headers because - // we always want the keys to be Cased-Like-This and arh() - // returns the headers in the same case as they are in the - // request - $out = array(); - foreach ( $headers as $key => $value ) { - $key = str_replace( - ' ', '-', - ucwords( strtolower( str_replace( '-', ' ', $key ) ) ) - ); - $out[$key] = $value; - } - } else { - // otherwise we don't have apache and are just going to have to - // hope that $_SERVER actually contains what we need - $out = array(); - if ( isset( $_SERVER['CONTENT_TYPE'] ) ) { - $out['Content-Type'] = $_SERVER['CONTENT_TYPE']; - } - if ( isset( $_ENV['CONTENT_TYPE'] ) ) { - $out['Content-Type'] = $_ENV['CONTENT_TYPE']; - } - - foreach ( $_SERVER as $key => $value ) { - if ( substr( $key, 0, 5 ) == 'HTTP_' ) { - // this is chaos, basically it is just there to capitalize - // the first letter of every word that is not an initial - // HTTP and strip HTTP_ prefix - // Code from przemek - $key = str_replace( - ' ', '-', - ucwords( strtolower( - str_replace( '_', ' ', substr( $key, 5 ) ) - ) ) - ); - $out[$key] = $value; - } - } - } - return $out; - } - - /** - * This function takes a input like a=b&a=c&d=e and returns the parsed - * parameters like this array('a' => array('b','c'), 'd' => 'e') - * - * @param string $input - * @return array - */ - public static function parseParameters( $input ) { - if ( !isset( $input ) || !$input ) { - return array(); - } - - $pairs = explode( '&', $input ); - - $parsed = array(); - foreach ( $pairs as $pair ) { - $split = explode( '=', $pair, 2 ); - $parameter = static::urldecode( $split[0] ); - $value = isset( $split[1] ) ? static::urldecode( $split[1] ) : ''; - - if ( isset( $parsed[$parameter] ) ) { - // We have already recieved parameter(s) with this name, so - // add to the list of parameters with this name - - if ( is_scalar( $parsed[$parameter] ) ) { - // This is the first duplicate, so transform scalar - // (string) into an array so we can add the duplicates - $parsed[$parameter] = array( $parsed[$parameter] ); - } - - $parsed[$parameter][] = $value; - } else { - $parsed[$parameter] = $value; - } - } - return $parsed; - } - - /** - * @param array $params - * @return string - */ - public static function buildHttpQuery( array $params ) { - if ( !$params ) { - return ''; - } - - // Urlencode both keys and values - $keys = static::urlencode( array_keys( $params ) ); - $values = static::urlencode( array_values( $params ) ); - $params = array_combine( $keys, $values ); - - // Parameters are sorted by name, using lexicographical byte value - // ordering. Ref: Spec: 9.1.1 (1) - uksort( $params, 'strcmp' ); - - $pairs = array(); - foreach ( $params as $parameter => $value ) { - if ( is_array( $value ) ) { - // If two or more parameters share the same name, they are - // sorted by their value - // Ref: Spec: 9.1.1 (1) - sort( $value, SORT_STRING ); - foreach ( $value as $duplicate_value ) { - $pairs[] = "{$parameter}={$duplicate_value}"; - } - } else { - $pairs[] = "{$parameter}={$value}"; - } - } - // For each parameter, the name is separated from the corresponding - // value by an '=' character (ASCII code 61) - // Each name-value pair is separated by an '&' character (ASCII code 38) - return implode( '&', $pairs ); - } - - /** - * Disallow construction of utility class. - */ - private function __construct() { - // no-op - } -} diff --git a/tests/OAuth/ConsumerTest.php b/tests/OAuth/ConsumerTest.php deleted file mode 100644 index 8e6c0f8..0000000 --- a/tests/OAuth/ConsumerTest.php +++ /dev/null @@ -1,41 +0,0 @@ -<?php -/** - * @section LICENSE - * Copyright (c) 2007 Andy Smith - * - * Permission is hereby granted, free of charge, to any person obtaining - * a copy of this software and associated documentation files (the - * "Software"), to deal in the Software without restriction, including without - * limitation the rights to use, copy, modify, merge, publish, distribute, - * sublicense, and/or sell copies of the Software, and to permit persons to - * whom the Software is furnished to do so, subject to the following - * conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING - * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER - * DEALINGS IN THE SOFTWARE. - * - * @file - */ - -namespace Wikimedia\Slimapp\OAuth; - -/** - * @coversDefaultClass \Wikimedia\Slimapp\OAuth\Consumer - */ -class ConsumerTest extends \PHPUnit_Framework_TestCase { - public function testConvertToString() { - $consumer = new Consumer( 'key', 'secret' ); - $this->assertEquals( - 'Wikimedia\Slimapp\OAuth\Consumer[key=key,secret=secret]', - (string) $consumer - ); - } -} diff --git a/tests/OAuth/RequestTest.php b/tests/OAuth/RequestTest.php deleted file mode 100644 index 144ccd6..0000000 --- a/tests/OAuth/RequestTest.php +++ /dev/null @@ -1,524 +0,0 @@ -<?php -/** - * @section LICENSE - * Copyright (c) 2007 Andy Smith - * - * Permission is hereby granted, free of charge, to any person obtaining - * a copy of this software and associated documentation files (the - * "Software"), to deal in the Software without restriction, including without - * limitation the rights to use, copy, modify, merge, publish, distribute, - * sublicense, and/or sell copies of the Software, and to permit persons to - * whom the Software is furnished to do so, subject to the following - * conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING - * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER - * DEALINGS IN THE SOFTWARE. - * - * @file - */ - -namespace Wikimedia\Slimapp\OAuth; - -use Wikimedia\Slimapp\OAuth\SignatureMethod\HmacSha1; -use Wikimedia\Slimapp\OAuth\SignatureMethod\Plaintext; - -/** - * @coversDefaultClass \Wikimedia\Slimapp\OAuth\Request - */ -class RequestTest extends \PHPUnit_Framework_TestCase { - - public function testCanGetSingleParameter() { - $request = new Request( '', '', array( 'test'=>'foo' ) ); - $this->assertEquals( 'foo', $request->getParameter( 'test' ), - 'Failed to read back parameter' - ); - - $request = new Request( - '', '', array( 'test' => array( 'foo', 'bar' ) ) - ); - $this->assertEquals( array( 'foo', 'bar' ), - $request->getParameter( 'test' ), 'Failed to read back parameter' ); - - $request = new Request( - '', '', array( 'test' => 'foo', 'bar' => 'baz' ) - ); - $this->assertEquals( 'foo', $request->getParameter( 'test' ), - 'Failed to read back parameter' - ); - $this->assertEquals( 'baz', $request->getParameter( 'bar' ), - 'Failed to read back parameter' - ); - } - - public function testGetAllParameters() { - // Yes, a awesomely boring test.. But if this doesn't work, the other - // tests is unreliable - $request = new Request( '', '', array( 'test' => 'foo' ) ); - $this->assertEquals( array( 'test'=>'foo' ), $request->getParameters(), - 'Failed to read back parameters' - ); - - $request = new Request( - '', '', array( 'test' => 'foo', 'bar' => 'baz' ) - ); - $this->assertEquals( array( 'test' => 'foo', 'bar' => 'baz' ), - $request->getParameters(), 'Failed to read back parameters' ); - - $request = new Request( - '', '', array( 'test' => array( 'foo', 'bar' ) ) - ); - $this->assertEquals( array( 'test' => array( 'foo', 'bar' ) ), - $request->getParameters(), 'Failed to read back parameters' ); - } - - public function testSetParameters() { - $request = new Request( '', '' ); - $this->assertEquals( null, $request->getParameter( 'test' ), - 'Failed to assert that non-existing parameter is null' ); - - $request->setParameter( 'test', 'foo' ); - $this->assertEquals( 'foo', $request->getParameter( 'test' ), - 'Failed to set single-entry parameter' ); - - $request->setParameter( 'test', 'bar' ); - $this->assertEquals( array( 'foo', 'bar' ), - $request->getParameter( 'test' ), - 'Failed to set single-entry parameter' - ); - - $request->setParameter( 'test', 'bar', false ); - $this->assertEquals( 'bar', $request->getParameter( 'test' ), - 'Failed to set single-entry parameter' - ); - } - - public function testUnsetParameter() { - $request = new Request( '', '' ); - $this->assertEquals( null, $request->getParameter( 'test' ) ); - - $request->setParameter( 'test', 'foo' ); - $this->assertEquals( 'foo', $request->getParameter( 'test' ) ); - - $request->unsetParameter( 'test' ); - $this->assertEquals( null, $request->getParameter( 'test' ), - 'Failed to unset parameter' - ); - } - - public function testCreateRequestFromConsumerAndToken() { - $cons = new Consumer( 'key', 'kd94hf93k423kf44' ); - $token = new Token( 'token', 'pfkkdhi9sl3r4s00' ); - - $request = Request::fromConsumerAndToken( - $cons, $token, 'POST', 'http://example.com' - ); - $this->assertEquals( 'POST', $request->getNormalizedMethod() ); - $this->assertEquals( 'http://example.com', $request->getNormalizedUrl() ); - $this->assertEquals( '1.0', $request->getParameter( 'oauth_version' ) ); - $this->assertEquals( $cons->key, $request->getParameter( 'oauth_consumer_key' ) ); - $this->assertEquals( $token->key, $request->getParameter( 'oauth_token' ) ); - $this->assertEquals( time(), $request->getParameter( 'oauth_timestamp' ) ); - $this->assertRegExp( '/[0-9a-f]{32}/', $request->getParameter( 'oauth_nonce' ) ); - // We don't know what the nonce will be, except it'll be md5 and hence - // 32 hexa digits - - $request = Request::fromConsumerAndToken( $cons, $token, 'POST', - 'http://example.com', array( 'oauth_nonce'=>'foo' ) ); - $this->assertEquals( 'foo', $request->getParameter( 'oauth_nonce' ) ); - - $request = Request::fromConsumerAndToken( $cons, null, 'POST', - 'http://example.com', array( 'oauth_nonce'=>'foo' ) ); - $this->assertNull( $request->getParameter( 'oauth_token' ) ); - - // Test that parameters given in the $http_url instead of in the - // $parameters-parameter will still be picked up - $request = Request::fromConsumerAndToken( $cons, $token, 'POST', - 'http://example.com/?foo=bar' ); - $this->assertEquals( 'http://example.com/', $request->getNormalizedUrl() ); - $this->assertEquals( 'bar', $request->getParameter( 'foo' ) ); - } - - public function testBuildRequestFromPost() { - static::buildRequest( - 'POST', 'http://testbed/test', 'foo=bar&baz=blargh' ); - $this->assertEquals( array( 'foo'=>'bar','baz'=>'blargh' ), - Request::fromRequest()->getParameters(), - 'Failed to parse POST parameters' ); - } - - public function testBuildRequestFromGet() { - static::buildRequest( 'GET', 'http://testbed/test?foo=bar&baz=blargh' ); - $this->assertEquals( array( 'foo'=>'bar','baz'=>'blargh' ), - Request::fromRequest()->getParameters(), - 'Failed to parse GET parameters' ); - } - - public function testBuildRequestFromHeader() { - $test_header = 'OAuth realm="",oauth_foo=bar,oauth_baz="bla,rgh"'; - static::buildRequest( 'POST', 'http://testbed/test', '', $test_header ); - $this->assertEquals( - array( 'oauth_foo'=>'bar','oauth_baz'=>'bla,rgh' ), - Request::fromRequest()->getParameters(), - 'Failed to split auth-header correctly' ); - } - - public function testHasProperParameterPriority() { - $test_header = 'OAuth realm="",oauth_foo=header'; - static::buildRequest( 'POST', 'http://testbed/test?oauth_foo=get', - 'oauth_foo=post', $test_header ); - $this->assertEquals( 'header', - Request::fromRequest()->getParameter( 'oauth_foo' ), - 'Loaded parameters in with the wrong priorities' ); - - static::buildRequest( 'POST', 'http://testbed/test?oauth_foo=get', - 'oauth_foo=post' ); - $this->assertEquals( 'post', - Request::fromRequest()->getParameter( 'oauth_foo' ), - 'Loaded parameters in with the wrong priorities' ); - - static::buildRequest( 'POST', 'http://testbed/test?oauth_foo=get' ); - $this->assertEquals( 'get', - Request::fromRequest()->getParameter( 'oauth_foo' ), - 'Loaded parameters in with the wrong priorities' ); - } - - public function testNormalizeHttpMethod() { - static::buildRequest( 'POST', 'http://testbed/test' ); - $this->assertEquals( 'POST', - Request::fromRequest()->getNormalizedMethod(), - 'Failed to normalize HTTP method: POST' ); - - static::buildRequest( 'post', 'http://testbed/test' ); - $this->assertEquals( 'POST', - Request::fromRequest()->getNormalizedMethod(), - 'Failed to normalize HTTP method: post' ); - - static::buildRequest( 'GET', 'http://testbed/test' ); - $this->assertEquals( 'GET', - Request::fromRequest()->getNormalizedMethod(), - 'Failed to normalize HTTP method: GET' ); - - static::buildRequest( 'PUT', 'http://testbed/test' ); - $this->assertEquals( 'PUT', - Request::fromRequest()->getNormalizedMethod(), - 'Failed to normalize HTTP method: PUT' ); - } - - public function testNormalizeParameters() { - // This is mostly repeats of OAuthUtilTest::testParseParameters - // & OAuthUtilTest::TestBuildHttpQuery - - // Tests taken from - // http://wiki.oauth.net/TestCases ( "Normalize Request Parameters" ) - static::buildRequest( 'POST', 'http://testbed/test', 'name' ); - $this->assertEquals( 'name=', - Request::fromRequest()->getSignableParameters() ); - - static::buildRequest( 'POST', 'http://testbed/test', 'a=b' ); - $this->assertEquals( 'a=b', - Request::fromRequest()->getSignableParameters() ); - - static::buildRequest( 'POST', 'http://testbed/test', 'a=b&c=d' ); - $this->assertEquals( 'a=b&c=d', - Request::fromRequest()->getSignableParameters() ); - - static::buildRequest( 'POST', 'http://testbed/test', 'a=x%21y&a=x+y' ); - $this->assertEquals( 'a=x%20y&a=x%21y', - Request::fromRequest()->getSignableParameters() ); - - static::buildRequest( 'POST', 'http://testbed/test', 'x%21y=a&x=a' ); - $this->assertEquals( 'x=a&x%21y=a', - Request::fromRequest()->getSignableParameters() ); - - static::buildRequest( 'POST', - 'http://testbed/test', 'a=1&c=hi there&f=25&f=50&f=a&z=p&z=t' ); - $this->assertEquals( 'a=1&c=hi%20there&f=25&f=50&f=a&z=p&z=t', - Request::fromRequest()->getSignableParameters() ); - } - - public function testNormalizeHttpUrl() { - static::buildRequest( 'POST', 'http://example.com' ); - $this->assertEquals( 'http://example.com', - Request::fromRequest()->getNormalizedUrl() ); - - static::buildRequest( 'POST', 'https://example.com' ); - $this->assertEquals( 'https://example.com', - Request::fromRequest()->getNormalizedUrl() ); - - // Tests that http on !80 and https on !443 keeps the port - static::buildRequest( 'POST', 'http://example.com:8080' ); - $this->assertEquals( 'http://example.com:8080', - Request::fromRequest()->getNormalizedUrl() ); - - static::buildRequest( 'POST', 'https://example.com:80' ); - $this->assertEquals( 'https://example.com:80', - Request::fromRequest()->getNormalizedUrl() ); - - static::buildRequest( 'POST', 'http://example.com:443' ); - $this->assertEquals( 'http://example.com:443', - Request::fromRequest()->getNormalizedUrl() ); - - static::buildRequest( 'POST', 'http://Example.COM' ); - $this->assertEquals( 'http://example.com', - Request::fromRequest()->getNormalizedUrl() ); - - // Emulate silly behavior by some clients, where there Host header - // includes the port - static::buildRequest( 'POST', 'http://example.com' ); - $_SERVER['HTTP_HOST'] = $_SERVER['HTTP_HOST'] . ':' . - $_SERVER['SERVER_PORT']; - $this->assertEquals( 'http://example.com', - Request::fromRequest()->getNormalizedUrl() ); - } - - public function testBuildPostData() { - static::buildRequest( 'POST', 'http://example.com' ); - $this->assertEquals( '', Request::fromRequest()->toPostData() ); - - static::buildRequest( 'POST', 'http://example.com', 'foo=bar' ); - $this->assertEquals( 'foo=bar', Request::fromRequest()->toPostData() ); - - static::buildRequest( 'GET', 'http://example.com?foo=bar' ); - $this->assertEquals( 'foo=bar', Request::fromRequest()->toPostData() ); - } - - public function testBuildUrl() { - static::buildRequest( 'POST', 'http://example.com' ); - $this->assertEquals( 'http://example.com', - Request::fromRequest()->toUrl() ); - - static::buildRequest( 'POST', 'http://example.com', 'foo=bar' ); - $this->assertEquals( 'http://example.com?foo=bar', - Request::fromRequest()->toUrl() ); - - static::buildRequest( 'GET', 'http://example.com?foo=bar' ); - $this->assertEquals( 'http://example.com?foo=bar', - Request::fromRequest()->toUrl() ); - } - - public function testConvertToString() { - static::buildRequest( 'POST', 'http://example.com' ); - $this->assertEquals( 'http://example.com', - (string)Request::fromRequest() ); - - static::buildRequest( 'POST', 'http://example.com', 'foo=bar' ); - $this->assertEquals( 'http://example.com?foo=bar', - (string)Request::fromRequest() ); - - static::buildRequest( 'GET', 'http://example.com?foo=bar' ); - $this->assertEquals( 'http://example.com?foo=bar', - (string)Request::fromRequest() ); - } - - public function testBuildHeader() { - static::buildRequest( 'POST', 'http://example.com' ); - $this->assertEquals( 'Authorization: OAuth', - Request::fromRequest()->toHeader() ); - $this->assertEquals( 'Authorization: OAuth realm="test"', - Request::fromRequest()->toHeader( 'test' ) ); - - static::buildRequest( 'POST', 'http://example.com', 'foo=bar' ); - $this->assertEquals( 'Authorization: OAuth', - Request::fromRequest()->toHeader() ); - $this->assertEquals( 'Authorization: OAuth realm="test"', - Request::fromRequest()->toHeader( 'test' ) ); - - static::buildRequest( 'POST', 'http://example.com', 'oauth_test=foo' ); - $this->assertEquals( 'Authorization: OAuth oauth_test="foo"', - Request::fromRequest()->toHeader() ); - $this->assertEquals( - 'Authorization: OAuth realm="test",oauth_test="foo"', - Request::fromRequest()->toHeader( 'test' ) ); - - // Is headers supposted to be Urlencoded. More to the point: - // Should it be baz = bla,rgh or baz = bla%2Crgh ?? - // - morten.fangel - static::buildRequest( 'POST', 'http://example.com', - '', 'OAuth realm="",oauth_foo=bar,oauth_baz="bla,rgh"' ); - $this->assertEquals( - 'Authorization: OAuth oauth_foo="bar",oauth_baz="bla%2Crgh"', - Request::fromRequest()->toHeader() ); - $this->assertEquals( - 'Authorization: OAuth realm="test",oauth_foo="bar",oauth_baz="bla%2Crgh"', - Request::fromRequest()->toHeader( 'test' ) ); - } - - public function testWontBuildHeaderWithArrayInput() { - $this->setExpectedException( 'Wikimedia\Slimapp\OAuth\Exception' ); - static::buildRequest( 'POST', 'http://example.com', - 'oauth_foo=bar&oauth_foo=baz' ); - Request::fromRequest()->toHeader(); - } - - public function testBuildBaseString() { - static::buildRequest( 'POST', 'http://testbed/test', 'n=v' ); - $this->assertEquals( - 'POST&http%3A%2F%2Ftestbed%2Ftest&n%3Dv', - Request::fromRequest()->getSignatureBaseString() - ); - - static::buildRequest( 'POST', 'http://testbed/test', 'n=v&n=v2' ); - $this->assertEquals( 'POST&http%3A%2F%2Ftestbed%2Ftest&n%3Dv%26n%3Dv2', - Request::fromRequest()->getSignatureBaseString() ); - - static::buildRequest( 'GET', 'http://example.com?n=v' ); - $this->assertEquals( 'GET&http%3A%2F%2Fexample.com&n%3Dv', - Request::fromRequest()->getSignatureBaseString() ); - - $params = 'oauth_version=1.0&oauth_consumer_key=dpf43f3p2l4k3l03' - . '&oauth_timestamp=1191242090' - . '&oauth_nonce=hsu94j3884jdopsl' - . '&oauth_signature_method=PLAINTEXT&oauth_signature=ignored'; - static::buildRequest( 'POST', 'https://photos.example.net/request_token', $params ); - $this->assertEquals( - 'POST&https%3A%2F%2Fphotos.example.net%2Frequest_token&oauth_' - . 'consumer_key%3Ddpf43f3p2l4k3l03%26oauth_nonce%3Dhsu94j3884j' - . 'dopsl%26oauth_signature_method%3DPLAINTEXT%26oauth_timestam' - . 'p%3D1191242090%26oauth_version%3D1.0', - Request::fromRequest()->getSignatureBaseString() ); - - $params = 'file=vacation.jpg&size=original&oauth_version=1.0'; - $params .= '&oauth_consumer_key=dpf43f3p2l4k3l03'; - $params .= '&oauth_token=nnch734d00sl2jdk&oauth_timestamp=1191242096'; - $params .= '&oauth_nonce=kllo9940pd9333jh'; - $params .= '&oauth_signature=ignored&oauth_signature_method=HMAC-SHA1'; - static::buildRequest( 'GET', 'http://photos.example.net/photos?'.$params ); - $this->assertEquals( - 'GET&http%3A%2F%2Fphotos.example.net%2Fphotos&file%3Dvacation' - . '.jpg%26oauth_consumer_key%3Ddpf43f3p2l4k3l03%26oauth_nonce%' - . '3Dkllo9940pd9333jh%26oauth_signature_method%3DHMAC-SHA1%26o' - . 'auth_timestamp%3D1191242096%26oauth_token%3Dnnch734d00sl2jd' - . 'k%26oauth_version%3D1.0%26size%3Doriginal', - Request::fromRequest()->getSignatureBaseString() ); - } - - public function testBuildSignature() { - $params = 'file=vacation.jpg&size=original&oauth_version=1.0' - . '&oauth_consumer_key=dpf43f3p2l4k3l03' - . '&oauth_token=nnch734d00sl2jdk' - . '&oauth_timestamp=1191242096&oauth_nonce=kllo9940pd9333jh' - . '&oauth_signature=ignored&oauth_signature_method=HMAC-SHA1'; - static::buildRequest( 'GET', 'http://photos.example.net/photos?'.$params ); - $r = Request::fromRequest(); - - $cons = new Consumer( 'key', 'kd94hf93k423kf44' ); - $token = new Token( 'token', 'pfkkdhi9sl3r4s00' ); - - $hmac = new HmacSha1(); - $plaintext = new Plaintext(); - - $this->assertEquals( 'tR3+Ty81lMeYAr/Fid0kMTYa/WM=', - $r->buildSignature( $hmac, $cons, $token ) ); - - $this->assertEquals( 'kd94hf93k423kf44&pfkkdhi9sl3r4s00', - $r->buildSignature( $plaintext, $cons, $token ) ); - } - - public function testSign() { - $params = 'file=vacation.jpg&size=original&oauth_version=1.0' - . '&oauth_consumer_key=dpf43f3p2l4k3l03' - . '&oauth_token=nnch734d00sl2jdk' - . '&oauth_timestamp=1191242096&oauth_nonce=kllo9940pd9333jh' - . '&oauth_signature=__ignored__&oauth_signature_method=HMAC-SHA1'; - static::buildRequest( 'GET', - 'http://photos.example.net/photos?'.$params ); - $r = Request::fromRequest(); - - $cons = new Consumer( 'key', 'kd94hf93k423kf44' ); - $token = new Token( 'token', 'pfkkdhi9sl3r4s00' ); - - $hmac = new HmacSha1(); - $plaintext = new Plaintext(); - - // We need to test both what the parameter is, and how the serialized - // request is.. - - $r->signRequest( $hmac, $cons, $token ); - $this->assertEquals( 'HMAC-SHA1', - $r->getParameter( 'oauth_signature_method' ) ); - $this->assertEquals( 'tR3+Ty81lMeYAr/Fid0kMTYa/WM=', - $r->getParameter( 'oauth_signature' ) ); - $expectedPostdata = 'file=vacation.jpg' - . '&oauth_consumer_key=dpf43f3p2l4k3l03' - . '&oauth_nonce=kllo9940pd9333jh' - . '&oauth_signature=tR3%2BTy81lMeYAr%2FFid0kMTYa%2FWM%3D' - . '&oauth_signature_method=HMAC-SHA1' - . '&oauth_timestamp=1191242096&oauth_token=nnch734d00sl2jdk' - . '&oauth_version=1.0&size=original'; - $this->assertEquals( $expectedPostdata, $r->toPostData() ); - - $r->signRequest( $plaintext, $cons, $token ); - $this->assertEquals( 'PLAINTEXT', - $r->getParameter( 'oauth_signature_method' ) ); - $this->assertEquals( 'kd94hf93k423kf44&pfkkdhi9sl3r4s00', - $r->getParameter( 'oauth_signature' ) ); - $expectedPostdata = 'file=vacation.jpg' - . '&oauth_consumer_key=dpf43f3p2l4k3l03' - . '&oauth_nonce=kllo9940pd9333jh&' - . 'oauth_signature=kd94hf93k423kf44%26pfkkdhi9sl3r4s00' - . '&oauth_signature_method=PLAINTEXT' - . '&oauth_timestamp=1191242096&oauth_token=nnch734d00sl2jdk' - . '&oauth_version=1.0&size=original'; - $this->assertEquals( $expectedPostdata, $r->toPostData() ); - - } - - /** - * Populates $_{SERVER,GET,POST} and whatever environment-variables needed - * to test everything. - * - * @param string $method GET or POST - * @param string $uri What URI is the request to ( eg http://example.com/foo?bar=baz ) - * @param string $post_data What should the post-data be - * @param string $auth_header What to set the Authorization header to - */ - public static function buildRequest( - $method, $uri, $post_data = '', $auth_header = '' - ) { - $_SERVER = array(); - $_POST = array(); - $_GET = array(); - - $method = strtoupper( $method ); - - $parts = parse_url( $uri ); - - $scheme = $parts['scheme']; - $port = isset( $parts['port'] ) && $parts['port'] ? - $parts['port'] : ( $scheme === 'https' ? '443' : '80' ); - $host = $parts['host']; - $path = isset( $parts['path'] ) ? $parts['path'] : null; - $query = isset( $parts['query'] ) ? $parts['query'] : null; - - if ( $scheme == 'https' ) { - $_SERVER['HTTPS'] = 'on'; - } - - $_SERVER['REQUEST_METHOD'] = $method; - $_SERVER['HTTP_HOST'] = $host; - $_SERVER['SERVER_NAME'] = $host; - $_SERVER['SERVER_PORT'] = $port; - $_SERVER['SCRIPT_NAME'] = $path; - $_SERVER['REQUEST_URI'] = $path . '?' . $query; - $_SERVER['QUERY_STRING'] = $query . ''; - parse_str( $query, $_GET ); - - if ( $method == 'POST' ) { - $_SERVER['HTTP_CONTENT_TYPE'] = 'application/x-www-form-urlencoded'; - $_POST = parse_str( $post_data ); - Request::$POST_INPUT = 'data:application/x-www-form-urlencoded,'.$post_data; - } - - if ( $auth_header != '' ) { - $_SERVER['HTTP_AUTHORIZATION'] = $auth_header; - } - } -} diff --git a/tests/OAuth/SignatureMethod/HmacSha1Test.php b/tests/OAuth/SignatureMethod/HmacSha1Test.php deleted file mode 100644 index a9e9f22..0000000 --- a/tests/OAuth/SignatureMethod/HmacSha1Test.php +++ /dev/null @@ -1,116 +0,0 @@ -<?php -/** - * @section LICENSE - * Copyright (c) 2007 Andy Smith - * - * Permission is hereby granted, free of charge, to any person obtaining - * a copy of this software and associated documentation files (the - * "Software"), to deal in the Software without restriction, including without - * limitation the rights to use, copy, modify, merge, publish, distribute, - * sublicense, and/or sell copies of the Software, and to permit persons to - * whom the Software is furnished to do so, subject to the following - * conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING - * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER - * DEALINGS IN THE SOFTWARE. - * - * @file - */ - -namespace Wikimedia\Slimapp\OAuth\SignatureMethod; - -use Wikimedia\Slimapp\OAuth\Consumer; -use Wikimedia\Slimapp\OAuth\Request; -use Wikimedia\Slimapp\OAuth\Token; - -/** - * @coversDefaultClass \Wikimedia\Slimapp\OAuth\SignatureMethod\HmacSha1 - */ -class HmacSha1Test extends \PHPUnit_Framework_TestCase { - private $method; - - public function setUp() { - $this->method = new HmacSha1(); - } - - public function testIdentifyAsHmacSha1() { - $this->assertEquals( 'HMAC-SHA1', $this->method->getName() ); - } - - public function testBuildSignature() { - // Tests taken from http://wiki.oauth.net/TestCases section 9.2 ( "HMAC-SHA1" ) - $request = $this->mockRequest( 'bs' ); - $consumer = new Consumer( '__unused__', 'cs' ); - $token = null; - $this->assertEquals( 'egQqG5AJep5sJ7anhXju1unge2I=', - $this->method->buildSignature( $request, $consumer, $token ) ); - - $request = $this->mockRequest( 'bs' ); - $consumer = new Consumer( '__unused__', 'cs' ); - $token = new Token( '__unused__', 'ts' ); - $this->assertEquals( 'VZVjXceV7JgPq/dOTnNmEfO0Fv8=', - $this->method->buildSignature( $request, $consumer, $token ) ); - - $request = $this->mockRequest( - 'GET&http%3A%2F%2Fphotos.example.net%2Fphotos&file%3Dvacation.jpg%26' - . 'oauth_consumer_key%3Ddpf43f3p2l4k3l03%26' - . 'oauth_nonce%3Dkllo9940pd9333jh%26' - . 'oauth_signature_method%3DHMAC-SHA1%26' - . 'oauth_timestamp%3D1191242096%26' - . 'oauth_token%3Dnnch734d00sl2jdk%26' - . 'oauth_version%3D1.0%26size%3Doriginal' ); - $consumer = new Consumer( '__unused__', 'kd94hf93k423kf44' ); - $token = new Token( '__unused__', 'pfkkdhi9sl3r4s00' ); - $this->assertEquals( 'tR3+Ty81lMeYAr/Fid0kMTYa/WM=', - $this->method->buildSignature( $request, $consumer, $token ) ); - } - - public function testVerifySignature() { - // Tests taken from http://wiki.oauth.net/TestCases section 9.2 - // ( "HMAC-SHA1" ) - $request = $this->mockRequest( 'bs' ); - $consumer = new Consumer( '__unused__', 'cs' ); - $token = null; - $signature = 'egQqG5AJep5sJ7anhXju1unge2I='; - $this->assertTrue( $this->method->checkSignature( - $request, $consumer, $token, $signature ) ); - - $request = $this->mockRequest( 'bs' ); - $consumer = new Consumer( '__unused__', 'cs' ); - $token = new Token( '__unused__', 'ts' ); - $signature = 'VZVjXceV7JgPq/dOTnNmEfO0Fv8='; - $this->assertTrue( $this->method->checkSignature( - $request, $consumer, $token, $signature ) ); - - $request = $this->mockRequest( - 'GET&http%3A%2F%2Fphotos.example.net%2Fphotos&file%3Dvacation.jpg%26' - . 'oauth_consumer_key%3Ddpf43f3p2l4k3l03%26' - . 'oauth_nonce%3Dkllo9940pd9333jh%26' - . 'oauth_signature_method%3DHMAC-SHA1%26' - . 'oauth_timestamp%3D1191242096%26' - . 'oauth_token%3Dnnch734d00sl2jdk%26' - . 'oauth_version%3D1.0%26size%3Doriginal' ); - $consumer = new Consumer( '__unused__', 'kd94hf93k423kf44' ); - $token = new Token( '__unused__', 'pfkkdhi9sl3r4s00' ); - $signature = 'tR3+Ty81lMeYAr/Fid0kMTYa/WM='; - $this->assertTrue( $this->method->checkSignature( - $request, $consumer, $token, $signature ) ); - } - - protected function mockRequest( $baseStr ) { - $stub = $this->getMockBuilder( 'Wikimedia\Slimapp\OAuth\request' ) - ->disableOriginalConstructor() - ->getMock(); - $stub->method( 'getSignatureBaseString' ) - ->willReturn( $baseStr ); - return $stub; - } -} diff --git a/tests/OAuth/SignatureMethod/PlaintextTest.php b/tests/OAuth/SignatureMethod/PlaintextTest.php deleted file mode 100644 index 137b6a7..0000000 --- a/tests/OAuth/SignatureMethod/PlaintextTest.php +++ /dev/null @@ -1,128 +0,0 @@ -<?php -/** - * @section LICENSE - * Copyright (c) 2007 Andy Smith - * - * Permission is hereby granted, free of charge, to any person obtaining - * a copy of this software and associated documentation files (the - * "Software"), to deal in the Software without restriction, including without - * limitation the rights to use, copy, modify, merge, publish, distribute, - * sublicense, and/or sell copies of the Software, and to permit persons to - * whom the Software is furnished to do so, subject to the following - * conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING - * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER - * DEALINGS IN THE SOFTWARE. - * - * @file - */ - -namespace Wikimedia\Slimapp\OAuth\SignatureMethod; - -use Wikimedia\Slimapp\OAuth\Consumer; -use Wikimedia\Slimapp\OAuth\Request; -use Wikimedia\Slimapp\OAuth\Token; - -/** - * @coversDefaultClass \Wikimedia\Slimapp\OAuth\SignatureMethod\Plaintext - */ -class PlaintextTest extends \PHPUnit_Framework_TestCase { - private $method; - - public function setUp() { - $this->method = new Plaintext(); - } - - public function testIdentifyAsPlaintext() { - $this->assertEquals( 'PLAINTEXT', $this->method->getName() ); - } - - public function testBuildSignature() { - // Tests based on from http://wiki.oauth.net/TestCases section 9.2 ( "HMAC-SHA1" ) - $request = $this->mockRequest( '__unused__' ); - $consumer = new Consumer( '__unused__', 'cs' ); - $token = null; - $this->assertEquals( 'cs&', $this->method->buildSignature( $request, $consumer, $token ) ); - - $request = $this->mockRequest( '__unused__' ); - $consumer = new Consumer( '__unused__', 'cs' ); - $token = new Token( '__unused__', 'ts' ); - $this->assertEquals( 'cs&ts', $this->method->buildSignature( $request, $consumer, $token ) ); - - $request = $this->mockRequest( '__unused__' ); - $consumer = new Consumer( '__unused__', 'kd94hf93k423kf44' ); - $token = new Token( '__unused__', 'pfkkdhi9sl3r4s00' ); - $this->assertEquals( 'kd94hf93k423kf44&pfkkdhi9sl3r4s00', - $this->method->buildSignature( $request, $consumer, $token ) ); - - // Tests taken from Chapter 9.4.1 ( "Generating Signature" ) from the spec - $request = $this->mockRequest( '__unused__' ); - $consumer = new Consumer( '__unused__', 'djr9rjt0jd78jf88' ); - $token = new Token( '__unused__', 'jjd999tj88uiths3' ); - $this->assertEquals( 'djr9rjt0jd78jf88&jjd999tj88uiths3', - $this->method->buildSignature( $request, $consumer, $token ) ); - - $request = $this->mockRequest( '__unused__' ); - $consumer = new Consumer( '__unused__', 'djr9rjt0jd78jf88' ); - $token = new Token( '__unused__', 'jjd99$tj88uiths3' ); - $this->assertEquals( 'djr9rjt0jd78jf88&jjd99%24tj88uiths3', - $this->method->buildSignature( $request, $consumer, $token ) ); - } - - public function testVerifySignature() { - // Tests based on from http://wiki.oauth.net/TestCases section 9.2 ( "HMAC-SHA1" ) - $request = $this->mockRequest( '__unused__' ); - $consumer = new Consumer( '__unused__', 'cs' ); - $token = null; - $signature = 'cs&'; - $this->assertTrue( $this->method->checkSignature( - $request, $consumer, $token, $signature ) ); - - $request = $this->mockRequest( '__unused__' ); - $consumer = new Consumer( '__unused__', 'cs' ); - $token = new Token( '__unused__', 'ts' ); - $signature = 'cs&ts'; - $this->assertTrue( $this->method->checkSignature( - $request, $consumer, $token, $signature ) ); - - $request = $this->mockRequest( '__unused__' ); - $consumer = new Consumer( '__unused__', 'kd94hf93k423kf44' ); - $token = new Token( '__unused__', 'pfkkdhi9sl3r4s00' ); - $signature = 'kd94hf93k423kf44&pfkkdhi9sl3r4s00'; - $this->assertTrue( $this->method->checkSignature( - $request, $consumer, $token, $signature ) ); - - // Tests taken from Chapter 9.4.1 ( "Generating Signature" ) from the - // spec - $request = $this->mockRequest( '__unused__' ); - $consumer = new Consumer( '__unused__', 'djr9rjt0jd78jf88' ); - $token = new Token( '__unused__', 'jjd999tj88uiths3' ); - $signature = 'djr9rjt0jd78jf88&jjd999tj88uiths3'; - $this->assertTrue( $this->method->checkSignature( - $request, $consumer, $token, $signature ) ); - - $request = $this->mockRequest( '__unused__' ); - $consumer = new Consumer( '__unused__', 'djr9rjt0jd78jf88' ); - $token = new Token( '__unused__', 'jjd99$tj88uiths3' ); - $signature = 'djr9rjt0jd78jf88&jjd99%24tj88uiths3'; - $this->assertTrue( $this->method->checkSignature( - $request, $consumer, $token, $signature ) ); - } - - protected function mockRequest( $baseStr ) { - $stub = $this->getMockBuilder( 'Wikimedia\Slimapp\OAuth\request' ) - ->disableOriginalConstructor() - ->getMock(); - $stub->method( 'getSignatureBaseString' ) - ->willReturn( $baseStr ); - return $stub; - } -} diff --git a/tests/OAuth/SignatureMethod/RsaSha1Test.php b/tests/OAuth/SignatureMethod/RsaSha1Test.php deleted file mode 100644 index c1da1ba..0000000 --- a/tests/OAuth/SignatureMethod/RsaSha1Test.php +++ /dev/null @@ -1,144 +0,0 @@ -<?php -/** - * @section LICENSE - * Copyright (c) 2007 Andy Smith - * - * Permission is hereby granted, free of charge, to any person obtaining - * a copy of this software and associated documentation files (the - * "Software"), to deal in the Software without restriction, including without - * limitation the rights to use, copy, modify, merge, publish, distribute, - * sublicense, and/or sell copies of the Software, and to permit persons to - * whom the Software is furnished to do so, subject to the following - * conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING - * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER - * DEALINGS IN THE SOFTWARE. - * - * @file - */ - -namespace Wikimedia\Slimapp\OAuth\SignatureMethod; - -use Wikimedia\Slimapp\OAuth\Consumer; -use Wikimedia\Slimapp\OAuth\Request; -use Wikimedia\Slimapp\OAuth\Token; - -/** - * @coversDefaultClass \Wikimedia\Slimapp\OAuth\SignatureMethod\RsaSha1 - */ -class RsaSha1Test extends \PHPUnit_Framework_TestCase { - private $method; - - public function setUp() { - $cert = <<<EOD ------BEGIN PRIVATE KEY----- -MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBALRiMLAh9iimur8V -A7qVvdqxevEuUkW4K+2KdMXmnQbG9Aa7k7eBjK1S+0LYmVjPKlJGNXHDGuy5Fw/d -7rjVJ0BLB+ubPK8iA/Tw3hLQgXMRRGRXXCn8ikfuQfjUS1uZSatdLB81mydBETlJ -hI6GH4twrbDJCR2Bwy/XWXgqgGRzAgMBAAECgYBYWVtleUzavkbrPjy0T5FMou8H -X9u2AC2ry8vD/l7cqedtwMPp9k7TubgNFo+NGvKsl2ynyprOZR1xjQ7WgrgVB+mm -uScOM/5HVceFuGRDhYTCObE+y1kxRloNYXnx3ei1zbeYLPCHdhxRYW7T0qcynNmw -rn05/KO2RLjgQNalsQJBANeA3Q4Nugqy4QBUCEC09SqylT2K9FrrItqL2QKc9v0Z -zO2uwllCbg0dwpVuYPYXYvikNHHg+aCWF+VXsb9rpPsCQQDWR9TT4ORdzoj+Nccn -qkMsDmzt0EfNaAOwHOmVJ2RVBspPcxt5iN4HI7HNeG6U5YsFBb+/GZbgfBT3kpNG -WPTpAkBI+gFhjfJvRw38n3g/+UeAkwMI2TJQS4n8+hid0uus3/zOjDySH3XHCUno -cn1xOJAyZODBo47E+67R4jV1/gzbAkEAklJaspRPXP877NssM5nAZMU0/O/NGCZ+ -3jPgDUno6WbJn5cqm8MqWhW1xGkImgRk+fkDBquiq4gPiT898jusgQJAd5Zrr6Q8 -AO/0isr/3aa6O6NLQxISLKcPDk2NOccAfS/xOtfOz4sJYM3+Bs4Io9+dZGSDCA54 -Lw03eHTNQghS0A== ------END PRIVATE KEY----- -EOD; - $pubcert = <<<EOD ------BEGIN CERTIFICATE----- -MIIBpjCCAQ+gAwIBAgIBATANBgkqhkiG9w0BAQUFADAZMRcwFQYDVQQDDA5UZXN0 -IFByaW5jaXBhbDAeFw03MDAxMDEwODAwMDBaFw0zODEyMzEwODAwMDBaMBkxFzAV -BgNVBAMMDlRlc3QgUHJpbmNpcGFsMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB -gQC0YjCwIfYoprq/FQO6lb3asXrxLlJFuCvtinTF5p0GxvQGu5O3gYytUvtC2JlY -zypSRjVxwxrsuRcP3e641SdASwfrmzyvIgP08N4S0IFzEURkV1wp/IpH7kH41Etb -mUmrXSwfNZsnQRE5SYSOhh+LcK2wyQkdgcMv11l4KoBkcwIDAQABMA0GCSqGSIb3 -DQEBBQUAA4GBAGZLPEuJ5SiJ2ryq+CmEGOXfvlTtEL2nuGtr9PewxkgnOjZpUy+d -4TvuXJbNQc8f4AMWL/tO9w0Fk80rWKp9ea8/df4qMq5qlFWlx6yOLQxumNOmECKb -WpkUQDIDJEoFUzKMVuJf4KO/FJ345+BNLGgbJ6WujreoM1X/gYfdnJ/J ------END CERTIFICATE----- -EOD; - - $this->method = $this->getMockBuilder( - 'Wikimedia\Slimapp\OAuth\SignatureMethod\RsaSha1' ) - ->setMethods( array( 'fetchPrivateCert', 'fetchPublicCert' ) ) - ->getMock(); - - $this->method->method( 'fetchPrivateCert' ) - ->willReturn( $cert ); - $this->method->method( 'fetchPublicCert' ) - ->willReturn( $pubcert ); - } - - public function testIdentifyAsRsaSha1() { - $this->assertEquals( 'RSA-SHA1', $this->method->getName() ); - } - - public function testBuildSignature() { - if ( !function_exists( 'openssl_get_privatekey' ) ) { - $this->markTestSkipped( - 'OpenSSL not available, can\'t test RSA-SHA1 functionality' - ); - } - - // Tests taken from http://wiki.oauth.net/TestCases section 9.3 - // ("RSA-SHA1") - $request = $this->mockRequest( - // @codingStandardsIgnoreStart Line exceeds 100 characters - 'GET&http%3A%2F%2Fphotos.example.net%2Fphotos&file%3Dvacaction.jpg%26oauth_consumer_key%3Ddpf43f3p2l4k3l03%26oauth_nonce%3D13917289812797014437%26oauth_signature_method%3DRSA-SHA1%26oauth_timestamp%3D1196666512%26oauth_version%3D1.0%26size%3Doriginal' - // @codingStandardsIgnoreEnd - ); - $consumer = new Consumer( 'dpf43f3p2l4k3l03', '__unused__' ); - $token = null; - // @codingStandardsIgnoreStart Line exceeds 100 characters - $signature = 'jvTp/wX1TYtByB1m+Pbyo0lnCOLIsyGCH7wke8AUs3BpnwZJtAuEJkvQL2/9n4s5wUmUl4aCI4BwpraNx4RtEXMe5qg5T1LVTGliMRpKasKsW//e+RinhejgCuzoH26dyF8iY2ZZ/5D1ilgeijhV/vBka5twt399mXwaYdCwFYE='; - // @codingStandardsIgnoreEnd - $this->assertEquals( $signature, - $this->method->buildSignature( $request, $consumer, $token ) - ); - } - - public function testVerifySignature() { - if ( !function_exists( 'openssl_get_privatekey' ) ) { - $this->markTestSkipped( - 'OpenSSL not available, can\'t test RSA-SHA1 functionality' - ); - } - - // Tests taken from http://wiki.oauth.net/TestCases section 9.3 - // ("RSA-SHA1") - $request = $this->mockRequest( - // @codingStandardsIgnoreStart Line exceeds 100 characters - 'GET&http%3A%2F%2Fphotos.example.net%2Fphotos&file%3Dvacaction.jpg%26oauth_consumer_key%3Ddpf43f3p2l4k3l03%26oauth_nonce%3D13917289812797014437%26oauth_signature_method%3DRSA-SHA1%26oauth_timestamp%3D1196666512%26oauth_version%3D1.0%26size%3Doriginal' - // @codingStandardsIgnoreEnd - ); - $consumer = new Consumer( 'dpf43f3p2l4k3l03', '__unused__' ); - $token = null; - // @codingStandardsIgnoreStart Line exceeds 100 characters - $signature = 'jvTp/wX1TYtByB1m+Pbyo0lnCOLIsyGCH7wke8AUs3BpnwZJtAuEJkvQL2/9n4s5wUmUl4aCI4BwpraNx4RtEXMe5qg5T1LVTGliMRpKasKsW//e+RinhejgCuzoH26dyF8iY2ZZ/5D1ilgeijhV/vBka5twt399mXwaYdCwFYE='; - // @codingStandardsIgnoreEnd - $this->assertTrue( $this->method->checkSignature( - $request, $consumer, $token, $signature - ) ); - } - - protected function mockRequest( $baseStr ) { - $stub = $this->getMockBuilder( 'Wikimedia\Slimapp\OAuth\request' ) - ->disableOriginalConstructor() - ->getMock(); - $stub->method( 'getSignatureBaseString' ) - ->willReturn( $baseStr ); - return $stub; - } -} diff --git a/tests/OAuth/TokenTest.php b/tests/OAuth/TokenTest.php deleted file mode 100644 index eecde55..0000000 --- a/tests/OAuth/TokenTest.php +++ /dev/null @@ -1,58 +0,0 @@ -<?php -/** - * @section LICENSE - * Copyright (c) 2007 Andy Smith - * - * Permission is hereby granted, free of charge, to any person obtaining - * a copy of this software and associated documentation files (the - * "Software"), to deal in the Software without restriction, including without - * limitation the rights to use, copy, modify, merge, publish, distribute, - * sublicense, and/or sell copies of the Software, and to permit persons to - * whom the Software is furnished to do so, subject to the following - * conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING - * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER - * DEALINGS IN THE SOFTWARE. - * - * @file - */ - -namespace Wikimedia\Slimapp\OAuth; - -/** - * @coversDefaultClass \Wikimedia\Slimapp\OAuth\Token - */ -class TokenTest extends \PHPUnit_Framework_TestCase { - public function testSerialize() { - $token = new Token( 'token', 'secret' ); - $this->assertEquals( - 'oauth_token=token&oauth_token_secret=secret', $token->toString() - ); - - $token = new Token( 'token&', 'secret%' ); - $this->assertEquals( - 'oauth_token=token%26&oauth_token_secret=secret%25', - $token->toString() - ); - } - public function testConvertToString() { - $token = new Token( 'token', 'secret' ); - $this->assertEquals( - 'oauth_token=token&oauth_token_secret=secret', (string)$token - ); - - $token = new Token( 'token&', 'secret%' ); - $this->assertEquals( - 'oauth_token=token%26&oauth_token_secret=secret%25', - (string)$token - ); - } -} -- To view, visit https://gerrit.wikimedia.org/r/248567 To unsubscribe, visit https://gerrit.wikimedia.org/r/settings Gerrit-MessageType: merged Gerrit-Change-Id: I70a9849a81558b292a7f3545e9f29a09669c0b12 Gerrit-PatchSet: 2 Gerrit-Project: wikimedia/slimapp Gerrit-Branch: master Gerrit-Owner: Gergő Tisza <[email protected]> Gerrit-Reviewer: BryanDavis <[email protected]> Gerrit-Reviewer: Legoktm <[email protected]> Gerrit-Reviewer: jenkins-bot <> _______________________________________________ MediaWiki-commits mailing list [email protected] https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
