OAuthSignatureMethod.php 1.4 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455
  1. <?php
  2. /**
  3. * A class for implementing a Signature Method
  4. * See section 9 ("Signing Requests") in the spec
  5. */
  6. abstract class OAuthSignatureMethod {
  7. /**
  8. * Needs to return the name of the Signature Method (ie HMAC-SHA1)
  9. * @return string
  10. */
  11. abstract public function get_name();
  12. /**
  13. * Build up the signature
  14. * NOTE: The output of this function MUST NOT be urlencoded.
  15. * the encoding is handled in OAuthRequest when the final
  16. * request is serialized
  17. * @param OAuthRequest $request
  18. * @param OAuthConsumer $consumer
  19. * @param OAuthToken $token
  20. * @return string
  21. */
  22. abstract public function build_signature($request, $consumer, $token);
  23. /**
  24. * Verifies that a given signature is correct
  25. * @param OAuthRequest $request
  26. * @param OAuthConsumer $consumer
  27. * @param OAuthToken $token
  28. * @param string $signature
  29. * @return bool
  30. */
  31. public function check_signature($request, $consumer, $token, $signature) {
  32. $built = $this->build_signature($request, $consumer, $token);
  33. // Check for zero length, although unlikely here
  34. if (strlen($built) == 0 || strlen($signature) == 0) {
  35. return false;
  36. }
  37. if (strlen($built) != strlen($signature)) {
  38. return false;
  39. }
  40. // Avoid a timing leak with a (hopefully) time insensitive compare
  41. $result = 0;
  42. for ($i = 0; $i < strlen($signature); $i++) {
  43. $result |= ord($built{$i}) ^ ord($signature{$i});
  44. }
  45. return $result == 0;
  46. }
  47. }