<?php

[0] Fix | Delete

[1] Fix | Delete

/**

[2] Fix | Delete

* Abstract OAuth consumer

[3] Fix | Delete

* @author Ben Tadiar <ben@handcraftedbyben.co.uk>

[4] Fix | Delete

* @link https://github.com/benthedesigner/dropbox

[5] Fix | Delete

* @package Dropbox\OAuth

[6] Fix | Delete

* @subpackage Consumer

[7] Fix | Delete

*/

[8] Fix | Delete

[9] Fix | Delete

abstract class Dropbox_ConsumerAbstract

[10] Fix | Delete

{

[11] Fix | Delete

// Dropbox web endpoint. v2 API has just dropped the 1/ suffix to the below.

[12] Fix | Delete

const WEB_URL = 'https://www.dropbox.com/';

[13] Fix | Delete

[14] Fix | Delete

// OAuth flow methods

[15] Fix | Delete

const AUTHORISE_METHOD = 'oauth2/authorize';

[16] Fix | Delete

// Beware - the documentation in one place says oauth2/token/revoke, but that appears to be wrong

[17] Fix | Delete

const DEAUTHORISE_METHOD = '2/auth/token/revoke';

[18] Fix | Delete

const ACCESS_TOKEN_METHOD = 'oauth2/token';

[19] Fix | Delete

// The next endpoint only exists with APIv1

[20] Fix | Delete

const OAUTH_UPGRADE = 'oauth2/token_from_oauth1';

[21] Fix | Delete

[22] Fix | Delete

private $scopes = array(

[23] Fix | Delete

'account_info.read',

[24] Fix | Delete

'files.content.write',

[25] Fix | Delete

'files.content.read',

[26] Fix | Delete

'files.metadata.read',

[27] Fix | Delete

);

[28] Fix | Delete

[29] Fix | Delete

/**

[30] Fix | Delete

* Signature method, either PLAINTEXT or HMAC-SHA1

[31] Fix | Delete

* @var string

[32] Fix | Delete

*/

[33] Fix | Delete

private $sigMethod = 'PLAINTEXT';

[34] Fix | Delete

[35] Fix | Delete

/**

[36] Fix | Delete

* Output file handle

[37] Fix | Delete

* @var null|resource

[38] Fix | Delete

*/

[39] Fix | Delete

protected $outFile = null;

[40] Fix | Delete

[41] Fix | Delete

/**

[42] Fix | Delete

* Input file handle

[43] Fix | Delete

* @var null|resource

[44] Fix | Delete

*/

[45] Fix | Delete

protected $inFile = null;

[46] Fix | Delete

[47] Fix | Delete

/**

[48] Fix | Delete

* Authenticate using 3-legged OAuth flow, firstly

[49] Fix | Delete

* checking we don't already have tokens to use

[50] Fix | Delete

* @return void

[51] Fix | Delete

*/

[52] Fix | Delete

protected function authenticate()

[53] Fix | Delete

{

[54] Fix | Delete

global $updraftplus;

[55] Fix | Delete

[56] Fix | Delete

$access_token = $this->storage->get('access_token');

[57] Fix | Delete

//Check if the new token type is set if not they need to be upgraded to OAuth2

[58] Fix | Delete

if (!empty($access_token) && isset($access_token->oauth_token) && !isset($access_token->token_type)) {

[59] Fix | Delete

$updraftplus->log('OAuth v1 token found: upgrading to v2');

[60] Fix | Delete

$this->upgradeOAuth();

[61] Fix | Delete

$updraftplus->log('OAuth token upgrade successful');

[62] Fix | Delete

}

[63] Fix | Delete

[64] Fix | Delete

if (!empty($access_token) && isset($access_token->refresh_token) && isset($access_token->expires_in)) {

[65] Fix | Delete

if ($access_token->expires_in < time()) $this->refreshAccessToken();

[66] Fix | Delete

}

[67] Fix | Delete

[68] Fix | Delete

if (empty($access_token) || !isset($access_token->oauth_token)) {

[69] Fix | Delete

try {

[70] Fix | Delete

$this->getAccessToken();

[71] Fix | Delete

} catch(Exception $e) {

[72] Fix | Delete

$excep_class = get_class($e);

[73] Fix | Delete

// 04-Sep-2015 - Dropbox started throwing a 400, which caused a Dropbox_BadRequestException which previously wasn't being caught

[74] Fix | Delete

if ('Dropbox_BadRequestException' == $excep_class || 'Dropbox_Exception' == $excep_class) {

[75] Fix | Delete

global $updraftplus;

[76] Fix | Delete

$updraftplus->log($e->getMessage().' - need to reauthenticate this site with Dropbox (if this fails, then you can also try wiping your settings from the Expert Settings section)');

[77] Fix | Delete

//$this->getRequestToken();

[78] Fix | Delete

$this->authorise();

[79] Fix | Delete

} else {

[80] Fix | Delete

throw $e;

[81] Fix | Delete

}

[82] Fix | Delete

}

[83] Fix | Delete

}

[84] Fix | Delete

}

[85] Fix | Delete

[86] Fix | Delete

/**

[87] Fix | Delete

* Upgrade the user's OAuth1 token to a OAuth2 token

[88] Fix | Delete

* @return void

[89] Fix | Delete

*/

[90] Fix | Delete

private function upgradeOAuth()

[91] Fix | Delete

{

[92] Fix | Delete

// N.B. This call only exists under API v1 - i.e. there is no APIv2 equivalent. Hence the APIv1 endpoint (API_URL) is used, and not the v2 (API_URL_V2)

[93] Fix | Delete

$url = 'https://api.dropbox.com/1/' . self::OAUTH_UPGRADE;

[94] Fix | Delete

$response = $this->fetch('POST', $url, '');

[95] Fix | Delete

$token = new stdClass();

[96] Fix | Delete

/*

[97] Fix | Delete

oauth token secret and oauth token were needed by oauth1

[98] Fix | Delete

these are replaced in oauth2 with an access token

[99] Fix | Delete

currently they are still there just in case a method somewhere is expecting them to both be set

[100] Fix | Delete

as far as I can tell only the oauth token is used

[101] Fix | Delete

after more testing token secret can be removed.

[102] Fix | Delete

*/

[103] Fix | Delete

[104] Fix | Delete

$token->oauth_token_secret = $response['body']->access_token;

[105] Fix | Delete

$token->oauth_token = $response['body']->access_token;

[106] Fix | Delete

$token->token_type = $response['body']->token_type;

[107] Fix | Delete

$this->storage->set($token, 'access_token');

[108] Fix | Delete

$this->storage->set('true','upgraded');

[109] Fix | Delete

$this->storage->do_unset('request_token');

[110] Fix | Delete

}

[111] Fix | Delete

[112] Fix | Delete

/**

[113] Fix | Delete

* Obtain user authorisation

[114] Fix | Delete

* The user will be redirected to Dropbox' web endpoint

[115] Fix | Delete

* @link http://tools.ietf.org/html/rfc5849#section-2.2

[116] Fix | Delete

* @return void

[117] Fix | Delete

*/

[118] Fix | Delete

private function authorise()

[119] Fix | Delete

{

[120] Fix | Delete

// Only redirect if not using CLI

[121] Fix | Delete

if (PHP_SAPI !== 'cli' && (!defined('DOING_CRON') || !DOING_CRON) && (!defined('DOING_AJAX') || !DOING_AJAX)) {

[122] Fix | Delete

$url = $this->getAuthoriseUrl();

[123] Fix | Delete

if (!headers_sent()) {

[124] Fix | Delete

header('Location: ' . $url);

[125] Fix | Delete

exit;

[126] Fix | Delete

} else {

[127] Fix | Delete

throw new Dropbox_Exception(sprintf(__('The %s authentication could not go ahead, because something else on your site is breaking it. Try disabling your other plugins and switching to a default theme. (Specifically, you are looking for the component that sends output (most likely PHP warnings/errors) before the page begins. Turning off any debugging settings may also help).', 'updraftplus'), 'Dropbox'));

[128] Fix | Delete

}

[129] Fix | Delete

?><?php

[130] Fix | Delete

return false;

[131] Fix | Delete

}

[132] Fix | Delete

global $updraftplus;

[133] Fix | Delete

$updraftplus->log('Dropbox reauthorisation needed; but we are running from cron, AJAX or the CLI, so this is not possible');

[134] Fix | Delete

$this->storage->do_unset('access_token');

[135] Fix | Delete

throw new Dropbox_Exception(sprintf(__('You need to re-authenticate with %s, as your existing credentials are not working.', 'updraftplus'), 'Dropbox'));

[136] Fix | Delete

#$updraftplus->log(sprintf(__('You need to re-authenticate with %s, as your existing credentials are not working.', 'updraftplus'), 'Dropbox'), 'error');

[137] Fix | Delete

return false;

[138] Fix | Delete

}

[139] Fix | Delete

[140] Fix | Delete

/**

[141] Fix | Delete

* Build the user authorisation URL

[142] Fix | Delete

* @return string

[143] Fix | Delete

*/

[144] Fix | Delete

public function getAuthoriseUrl()

[145] Fix | Delete

{

[146] Fix | Delete

/*

[147] Fix | Delete

Generate a random key to be passed to Dropbox and stored in session to be checked to prevent CSRF

[148] Fix | Delete

Uses OpenSSL or Mcrypt or defaults to pure PHP implementaion if neither are available.

[149] Fix | Delete

*/

[150] Fix | Delete

[151] Fix | Delete

global $updraftplus;

[152] Fix | Delete

if (!function_exists('crypt_random_string')) $updraftplus->ensure_phpseclib('Crypt_Random');

[153] Fix | Delete

[154] Fix | Delete

$CSRF = base64_encode(crypt_random_string(16));

[155] Fix | Delete

$this->storage->set($CSRF,'CSRF');

[156] Fix | Delete

// Prepare request parameters

[157] Fix | Delete

/*

[158] Fix | Delete

For OAuth v2 Dropbox needs to use a authorisation url that matches one that is set inside the

[159] Fix | Delete

Dropbox developer console. In order to check this it needs the client ID for the OAuth v2 app

[160] Fix | Delete

This will use the default one unless the user is using their own Dropbox App

[161] Fix | Delete

[162] Fix | Delete

For users that use their own Dropbox App there is also no need to provide the callbackhome as

[163] Fix | Delete

part of the CSRF as there is no need to go to auth.updraftplus.com also the redirect uri can

[164] Fix | Delete

then be set to the home as default

[165] Fix | Delete

[166] Fix | Delete

Check if the key has dropbox: if so then remove it to stop the request from being invalid

[167] Fix | Delete

*/

[168] Fix | Delete

$appkey = $this->storage->get('appkey');

[169] Fix | Delete

[170] Fix | Delete

if (!empty($appkey) && 'dropbox:' == substr($appkey, 0, 8)) {

[171] Fix | Delete

$key = substr($appkey, 8);

[172] Fix | Delete

} else if (!empty($appkey)) {

[173] Fix | Delete

$key = $appkey;

[174] Fix | Delete

}

[175] Fix | Delete

[176] Fix | Delete

if ('' != $this->instance_id) $this->instance_id = ':'.$this->instance_id;

[177] Fix | Delete

[178] Fix | Delete

$params = array(

[179] Fix | Delete

'client_id' => empty($key) ? $this->oauth2_id : $key,

[180] Fix | Delete

'response_type' => 'code',

[181] Fix | Delete

'redirect_uri' => empty($key) ? $this->callback : $this->callbackhome,

[182] Fix | Delete

'state' => empty($key) ? "POST:".$CSRF.$this->instance_id.$this->callbackhome : $CSRF.$this->instance_id,

[183] Fix | Delete

'scope' => implode(' ', $this->scopes),

[184] Fix | Delete

'token_access_type' => 'offline'

[185] Fix | Delete

);

[186] Fix | Delete

[187] Fix | Delete

// Build the URL and redirect the user

[188] Fix | Delete

$query = '?' . http_build_query($params, '', '&');

[189] Fix | Delete

$url = self::WEB_URL . self::AUTHORISE_METHOD . $query;

[190] Fix | Delete

return $url;

[191] Fix | Delete

}

[192] Fix | Delete

[193] Fix | Delete

protected function deauthenticate()

[194] Fix | Delete

{

[195] Fix | Delete

$url = UpdraftPlus_Dropbox_API::API_URL_V2 . self::DEAUTHORISE_METHOD;

[196] Fix | Delete

$response = $this->fetch('POST', $url, '', array('api_v2' => true));

[197] Fix | Delete

$this->storage->delete();

[198] Fix | Delete

}

[199] Fix | Delete

[200] Fix | Delete

/**

[201] Fix | Delete

* Acquire an access token

[202] Fix | Delete

* Tokens acquired at this point should be stored to

[203] Fix | Delete

* prevent having to request new tokens for each API call

[204] Fix | Delete

* @link http://tools.ietf.org/html/rfc5849#section-2.3

[205] Fix | Delete

*/

[206] Fix | Delete

public function getAccessToken()

[207] Fix | Delete

{

[208] Fix | Delete

[209] Fix | Delete

// If this is non-empty, then we just received a code. It is stored in 'code' - our next job is to put it into the proper place.

[210] Fix | Delete

$code = $this->storage->get('code');

[211] Fix | Delete

/*

[212] Fix | Delete

Checks to see if the user is using their own Dropbox App if so then they need to get

[213] Fix | Delete

a request token. If they are using our App then we just need to save these details

[214] Fix | Delete

*/

[215] Fix | Delete

if (!empty($code)){

[216] Fix | Delete

$appkey = $this->storage->get('appkey');

[217] Fix | Delete

if (!empty($appkey)){

[218] Fix | Delete

// Get the signed request URL

[219] Fix | Delete

$url = UpdraftPlus_Dropbox_API::API_URL_V2 . self::ACCESS_TOKEN_METHOD;

[220] Fix | Delete

$params = array(

[221] Fix | Delete

'code' => $code,

[222] Fix | Delete

'grant_type' => 'authorization_code',

[223] Fix | Delete

'redirect_uri' => $this->callbackhome,

[224] Fix | Delete

'client_id' => $this->consumerKey,

[225] Fix | Delete

'client_secret' => $this->consumerSecret,

[226] Fix | Delete

);

[227] Fix | Delete

$response = $this->fetch('POST', $url, '' , $params);

[228] Fix | Delete

[229] Fix | Delete

$code = json_decode(json_encode($response['body']),true);

[230] Fix | Delete

[231] Fix | Delete

} else {

[232] Fix | Delete

$code = base64_decode($code);

[233] Fix | Delete

$code = json_decode($code, true);

[234] Fix | Delete

}

[235] Fix | Delete

[236] Fix | Delete

/*

[237] Fix | Delete

Again oauth token secret and oauth token were needed by oauth1

[238] Fix | Delete

these are replaced in oauth2 with an access token

[239] Fix | Delete

currently they are still there just in case a method somewhere is expecting them to both be set

[240] Fix | Delete

as far as I can tell only the oauth token is used

[241] Fix | Delete

after more testing token secret can be removed.

[242] Fix | Delete

*/

[243] Fix | Delete

$token = new stdClass();

[244] Fix | Delete

$token->oauth_token_secret = $code['access_token'];

[245] Fix | Delete

$token->oauth_token = $code['access_token'];

[246] Fix | Delete

$token->account_id = $code['account_id'];

[247] Fix | Delete

$token->token_type = $code['token_type'];

[248] Fix | Delete

$token->uid = $code['uid'];

[249] Fix | Delete

$token->refresh_token = $code['refresh_token'];

[250] Fix | Delete

$token->expires_in = time() + $code['expires_in'] - 30;

[251] Fix | Delete

$this->storage->set($token, 'access_token');

[252] Fix | Delete

$this->storage->do_unset('upgraded');

[253] Fix | Delete

[254] Fix | Delete

//reset code

[255] Fix | Delete

$this->storage->do_unset('code');

[256] Fix | Delete

} else {

[257] Fix | Delete

throw new Dropbox_BadRequestException("No Dropbox Code found, will try to get one now", 400);

[258] Fix | Delete

}

[259] Fix | Delete

}

[260] Fix | Delete

[261] Fix | Delete

/**

[262] Fix | Delete

* This function will make a request to the auth server sending the users refresh token to get a new access token

[263] Fix | Delete

*

[264] Fix | Delete

* @return void

[265] Fix | Delete

*/

[266] Fix | Delete

public function refreshAccessToken() {

[267] Fix | Delete

global $updraftplus;

[268] Fix | Delete

[269] Fix | Delete

$access_token = $this->storage->get('access_token');

[270] Fix | Delete

[271] Fix | Delete

$params = array(

[272] Fix | Delete

'code' => 'ud_dropbox_code',

[273] Fix | Delete

'refresh_token' => $access_token->refresh_token,

[274] Fix | Delete

'headers' => apply_filters('updraftplus_auth_headers', ''),

[275] Fix | Delete

);

[276] Fix | Delete

[277] Fix | Delete

$response = $this->fetch('POST', $this->callback, '' , $params);

[278] Fix | Delete

[279] Fix | Delete

if ("200" != $response['code']) {

[280] Fix | Delete

$updraftplus->log('Failed to refresh access token error code: '.$response['code']);

[281] Fix | Delete

return;

[282] Fix | Delete

}

[283] Fix | Delete

[284] Fix | Delete

if (empty($response['body'])) {

[285] Fix | Delete

$updraftplus->log('Failed to refresh access token empty response body');

[286] Fix | Delete

return;

[287] Fix | Delete

}

[288] Fix | Delete

[289] Fix | Delete

$body = json_decode(base64_decode($response['body']));

[290] Fix | Delete

[291] Fix | Delete

if (isset($body->access_token) && isset($body->expires_in)) {

[292] Fix | Delete

$access_token->oauth_token_secret = $body->access_token;

[293] Fix | Delete

$access_token->oauth_token = $body->access_token;

[294] Fix | Delete

$access_token->expires_in = time() + $body->expires_in - 30;

[295] Fix | Delete

$this->storage->set($access_token, 'access_token');

[296] Fix | Delete

$updraftplus->log('Successfully updated and refreshed the access token');

[297] Fix | Delete

} else {

[298] Fix | Delete

$updraftplus->log('Failed to refresh access token missing token and expiry: '.json_encode($body));

[299] Fix | Delete

return;

[300] Fix | Delete

}

[301] Fix | Delete

}

[302] Fix | Delete

[303] Fix | Delete

/**

[304] Fix | Delete

* Get the request/access token

[305] Fix | Delete

* This will return the access/request token depending on

[306] Fix | Delete

* which stage we are at in the OAuth flow, or a dummy object

[307] Fix | Delete

* if we have not yet started the authentication process

[308] Fix | Delete

* @return object stdClass

[309] Fix | Delete

*/

[310] Fix | Delete

private function getToken()

[311] Fix | Delete

{

[312] Fix | Delete

if (!$token = $this->storage->get('access_token')) {

[313] Fix | Delete

if (!$token = $this->storage->get('request_token')) {

[314] Fix | Delete

$token = new stdClass();

[315] Fix | Delete

$token->oauth_token = null;

[316] Fix | Delete

$token->oauth_token_secret = null;

[317] Fix | Delete

}

[318] Fix | Delete

}

[319] Fix | Delete

return $token;

[320] Fix | Delete

}

[321] Fix | Delete

[322] Fix | Delete

/**

[323] Fix | Delete

* Generate signed request URL

[324] Fix | Delete

* See inline comments for description

[325] Fix | Delete

* @link http://tools.ietf.org/html/rfc5849#section-3.4

[326] Fix | Delete

* @param string $method HTTP request method

[327] Fix | Delete

* @param string $url API endpoint to send the request to

[328] Fix | Delete

* @param string $call API call to send

[329] Fix | Delete

* @param array $additional Additional parameters as an associative array

[330] Fix | Delete

* @return array

[331] Fix | Delete

*/

[332] Fix | Delete

protected function getSignedRequest($method, $url, $call, array $additional = array())

[333] Fix | Delete

{

[334] Fix | Delete

// Get the request/access token

[335] Fix | Delete

$token = $this->getToken();

[336] Fix | Delete

[337] Fix | Delete

// Prepare the standard request parameters differently for OAuth1 and OAuth2; we still need OAuth1 to make the request to the upgrade token endpoint

[338] Fix | Delete

if (isset($token->token_type)) {

[339] Fix | Delete

$params = array(

[340] Fix | Delete

'access_token' => $token->oauth_token,

[341] Fix | Delete

);

[342] Fix | Delete

[343] Fix | Delete

/*

[344] Fix | Delete

To keep this API backwards compatible with the API v1 endpoints all v2 endpoints will also send to this method a api_v2 parameter this will then return just the access token as the signed request is not needed for any calls.

[345] Fix | Delete

*/

[346] Fix | Delete

[347] Fix | Delete

if (isset($additional['api_v2']) && $additional['api_v2'] == true) {

[348] Fix | Delete

unset($additional['api_v2']);

[349] Fix | Delete

if (isset($additional['timeout'])) unset($additional['timeout']);

[350] Fix | Delete

if (isset($additional['content_download']) && $additional['content_download'] == true) {

[351] Fix | Delete

unset($additional['content_download']);

[352] Fix | Delete

$extra_headers = array();

[353] Fix | Delete

if (isset($additional['headers'])) {

[354] Fix | Delete

foreach ($additional['headers'] as $key => $header) {

[355] Fix | Delete

$extra_headers[] = $header;

[356] Fix | Delete

}

[357] Fix | Delete

unset($additional['headers']);

[358] Fix | Delete

}

[359] Fix | Delete

$headers = array(

[360] Fix | Delete

'Authorization: Bearer '.$params['access_token'],

[361] Fix | Delete

'Content-Type:',

[362] Fix | Delete

'Dropbox-API-Arg: '.json_encode($additional),

[363] Fix | Delete

);

[364] Fix | Delete

[365] Fix | Delete

$headers = array_merge($headers, $extra_headers);

[366] Fix | Delete

$additional = '';

[367] Fix | Delete

} else if (isset($additional['content_upload']) && $additional['content_upload'] == true) {

[368] Fix | Delete

unset($additional['content_upload']);

[369] Fix | Delete

$headers = array(

[370] Fix | Delete

'Authorization: Bearer '.$params['access_token'],

[371] Fix | Delete

'Content-Type: application/octet-stream',

[372] Fix | Delete

'Dropbox-API-Arg: '.json_encode($additional),

[373] Fix | Delete

);

[374] Fix | Delete

$additional = '';

[375] Fix | Delete

} else {

[376] Fix | Delete

$headers = array(

[377] Fix | Delete

'Authorization: Bearer '.$params['access_token'],

[378] Fix | Delete

'Content-Type: application/json',

[379] Fix | Delete

);

[380] Fix | Delete

}

[381] Fix | Delete

return array(

[382] Fix | Delete

'url' => $url . $call,

[383] Fix | Delete

'postfields' => $additional,

[384] Fix | Delete

'headers' => $headers,

[385] Fix | Delete

);

[386] Fix | Delete

} elseif (isset($additional['code']) && isset($additional['refresh_token'])) {

[387] Fix | Delete

$extra_headers = array();

[388] Fix | Delete

if (isset($additional['headers']) && !empty($additional['headers'])) {

[389] Fix | Delete

foreach ($additional['headers'] as $key => $header) {

[390] Fix | Delete

$extra_headers[] = $key.': '.$header;

[391] Fix | Delete

}

[392] Fix | Delete

unset($additional['headers']);

[393] Fix | Delete

}

[394] Fix | Delete

$headers = array();

[395] Fix | Delete

$headers = array_merge($headers, $extra_headers);

[396] Fix | Delete

[397] Fix | Delete

return array(

[398] Fix | Delete

'url' => $url . $call,

[399] Fix | Delete

'postfields' => $additional,

[400] Fix | Delete

'headers' => $headers,

[401] Fix | Delete

);

[402] Fix | Delete

}

[403] Fix | Delete

} else {

[404] Fix | Delete

// Generate a random string for the request

[405] Fix | Delete

$nonce = md5(microtime(true) . uniqid('', true));

[406] Fix | Delete

$params = array(

[407] Fix | Delete

'oauth_consumer_key' => $this->consumerKey,

[408] Fix | Delete

'oauth_token' => $token->oauth_token,

[409] Fix | Delete

'oauth_signature_method' => $this->sigMethod,

[410] Fix | Delete

'oauth_version' => '1.0',

[411] Fix | Delete

// Generate nonce and timestamp if signature method is HMAC-SHA1

[412] Fix | Delete

'oauth_timestamp' => ($this->sigMethod == 'HMAC-SHA1') ? time() : null,

[413] Fix | Delete

'oauth_nonce' => ($this->sigMethod == 'HMAC-SHA1') ? $nonce : null,

[414] Fix | Delete

);

[415] Fix | Delete

}

[416] Fix | Delete

[417] Fix | Delete

// Merge with the additional request parameters

[418] Fix | Delete

$params = array_merge($params, $additional);

[419] Fix | Delete

ksort($params);

[420] Fix | Delete

[421] Fix | Delete

// URL encode each parameter to RFC3986 for use in the base string

[422] Fix | Delete

$encoded = array();

[423] Fix | Delete

foreach($params as $param => $value) {

[424] Fix | Delete

if ($value !== null) {

[425] Fix | Delete

// If the value is a file upload (prefixed with @), replace it with

[426] Fix | Delete

// the destination filename, the file path will be sent in POSTFIELDS

[427] Fix | Delete

if (isset($value[0]) && $value[0] === '@') $value = $params['filename'];

[428] Fix | Delete

# Prevent spurious PHP warning by only doing non-arrays

[429] Fix | Delete

if (!is_array($value)) $encoded[] = $this->encode($param) . '=' . $this->encode($value);

[430] Fix | Delete

} else {

[431] Fix | Delete

unset($params[$param]);

[432] Fix | Delete

}

[433] Fix | Delete

}

[434] Fix | Delete

[435] Fix | Delete

// Build the first part of the string

[436] Fix | Delete

$base = $method . '&' . $this->encode($url . $call) . '&';

[437] Fix | Delete

[438] Fix | Delete

// Re-encode the encoded parameter string and append to $base

[439] Fix | Delete

$base .= $this->encode(implode('&', $encoded));

[440] Fix | Delete

[441] Fix | Delete

// Concatenate the secrets with an ampersand

[442] Fix | Delete

$key = $this->consumerSecret . '&' . $token->oauth_token_secret;

[443] Fix | Delete

[444] Fix | Delete

// Get the signature string based on signature method

[445] Fix | Delete

$signature = $this->getSignature($base, $key);

[446] Fix | Delete

$params['oauth_signature'] = $signature;

[447] Fix | Delete

[448] Fix | Delete

// Build the signed request URL

[449] Fix | Delete

$query = '?' . http_build_query($params, '', '&');

[450] Fix | Delete

[451] Fix | Delete

return array(

[452] Fix | Delete

'url' => $url . $call . $query,

[453] Fix | Delete

'postfields' => $params,

[454] Fix | Delete

);

[455] Fix | Delete

}

[456] Fix | Delete

[457] Fix | Delete

/**

[458] Fix | Delete

* Generate the oauth_signature for a request

[459] Fix | Delete

* @param string $base Signature base string, used by HMAC-SHA1

[460] Fix | Delete

* @param string $key Concatenated consumer and token secrets

[461] Fix | Delete

*/

[462] Fix | Delete

private function getSignature($base, $key)

[463] Fix | Delete

{

[464] Fix | Delete

switch ($this->sigMethod) {

[465] Fix | Delete

case 'PLAINTEXT':

[466] Fix | Delete

$signature = $key;

[467] Fix | Delete

break;

[468] Fix | Delete

case 'HMAC-SHA1':

[469] Fix | Delete

$signature = base64_encode(hash_hmac('sha1', $base, $key, true));

[470] Fix | Delete

break;

[471] Fix | Delete

}

[472] Fix | Delete

[473] Fix | Delete

return $signature;

[474] Fix | Delete

}

[475] Fix | Delete

[476] Fix | Delete

/**

[477] Fix | Delete

* Set the OAuth signature method

[478] Fix | Delete

* @param string $method Either PLAINTEXT or HMAC-SHA1

[479] Fix | Delete

* @return void

[480] Fix | Delete

*/

[481] Fix | Delete

public function setSignatureMethod($method)

[482] Fix | Delete

{

[483] Fix | Delete

$method = strtoupper($method);

[484] Fix | Delete

[485] Fix | Delete

switch ($method) {

[486] Fix | Delete

case 'PLAINTEXT':

[487] Fix | Delete

case 'HMAC-SHA1':

[488] Fix | Delete

$this->sigMethod = $method;

[489] Fix | Delete

break;

[490] Fix | Delete

default:

[491] Fix | Delete

throw new Dropbox_Exception('Unsupported signature method ' . $method);

[492] Fix | Delete

}

[493] Fix | Delete

}

[494] Fix | Delete

[495] Fix | Delete

/**

[496] Fix | Delete

* Set the output file

[497] Fix | Delete

* @param resource Resource to stream response data to

[498] Fix | Delete

* @return void

[499] Fix | Delete