Skip to content

Commit 2556f49

Browse files
admanesachinadmanesachin
committed
Merge branch 'AC-1344' of github.com:magento-cia/magento2ce into cia-bugfixes-2.4.4-develop-04112021
2 parents 517fad6 + e54ffe6 commit 2556f49

File tree

6 files changed

+62
-67
lines changed

6 files changed

+62
-67
lines changed

‎app/code/Magento/Integration/Test/Unit/Oauth/OauthTest.php‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -61,10 +61,19 @@ class OauthTest extends TestCase
6161
*/
6262
private $_loggerMock;
6363

64+
/**
65+
* @var string
66+
*/
6467
private $_oauthToken;
6568

69+
/**
70+
* @var string
71+
*/
6672
private $_oauthSecret;
6773

74+
/**
75+
* @var string
76+
*/
6877
private $_oauthVerifier;
6978

7079
const CONSUMER_ID = 1;
@@ -187,7 +196,7 @@ protected function _getRequestTokenParams($amendments = [])
187196
),
188197
'oauth_nonce' => '',
189198
'oauth_timestamp' => time(),
190-
'oauth_signature_method' => OauthInterface::SIGNATURE_SHA1,
199+
'oauth_signature_method' => OauthInterface::SIGNATURE_SHA256,
191200
'oauth_signature' => 'invalid_signature',
192201
];
193202

@@ -871,7 +880,7 @@ protected function _getAccessTokenRequiredParams($amendments = [])
871880
Oauth::LENGTH_CONSUMER_KEY
872881
),
873882
'oauth_signature' => '',
874-
'oauth_signature_method' => OauthInterface::SIGNATURE_SHA1,
883+
'oauth_signature_method' => OauthInterface::SIGNATURE_SHA256,
875884
'oauth_nonce' => '',
876885
'oauth_timestamp' => (string)time(),
877886
'oauth_token' => $this->_generateRandomString(Oauth::LENGTH_TOKEN),

‎dev/tests/api-functional/framework/Magento/TestFramework/Authentication/Rest/OauthClient.php‎

Lines changed: 24 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,13 @@ class OauthClient extends AbstractService
3232
/** @var string|null */
3333
protected $_oauthVerifier = null;
3434

35+
/**
36+
* @param Credentials $credentials
37+
* @param ClientInterface|null $httpClient
38+
* @param TokenStorageInterface|null $storage
39+
* @param SignatureInterface|null $signature
40+
* @param UriInterface|null $baseApiUri
41+
*/
3542
public function __construct(
3643
Credentials $credentials,
3744
ClientInterface $httpClient = null,
@@ -53,17 +60,15 @@ public function __construct(
5360
}
5461

5562
/**
56-
* @return UriInterface
63+
* @inheritDoc
5764
*/
5865
public function getRequestTokenEndpoint()
5966
{
6067
return new Uri(TESTS_BASE_URL . '/oauth/token/request');
6168
}
6269

6370
/**
64-
* Returns the authorization API endpoint.
65-
*
66-
* @return UriInterface
71+
* @inheritDoc
6772
*/
6873
public function getAuthorizationEndpoint()
6974
{
@@ -171,19 +176,22 @@ protected function _parseResponseBody($responseBody)
171176
*/
172177
public function getOauthVerifier()
173178
{
174-
if (!isset($this->_oauthVerifier) || isEmpty($this->_oauthVerifier)) {
179+
if (empty($this->_oauthVerifier)) {
175180
throw new TokenResponseException("oAuth verifier must be obtained during request token request.");
176181
}
177182
return $this->_oauthVerifier;
178183
}
179184

180185
/**
181-
* @override to fix since parent implementation from lib not sending the oauth_verifier when requesting access token
182-
* Builds the authorization header for an authenticated API request
186+
* Builds the authorization header for an authenticated API request.
187+
*
188+
* Fixing this method since parent implementation from lib not sending the oauth_verifier
189+
* when requesting access token.
190+
*
183191
* @param string $method
184192
* @param UriInterface $uri the uri the request is headed
185193
* @param \OAuth\OAuth1\Token\TokenInterface $token
186-
* @param $bodyParams array
194+
* @param array|null $bodyParams
187195
* @return string
188196
*/
189197
protected function buildAuthorizationHeaderForAPIRequest(
@@ -278,4 +286,12 @@ public function validateAccessToken($token, $method = 'GET')
278286

279287
return json_decode($responseBody);
280288
}
289+
290+
/**
291+
* @inheritDoc
292+
*/
293+
protected function getSignatureMethod()
294+
{
295+
return 'HMAC-SHA256';
296+
}
281297
}

‎dev/tests/api-functional/framework/Magento/TestFramework/Authentication/Rest/OauthClient/Signature.php‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
class Signature extends \OAuth\OAuth1\Signature\Signature
1515
{
1616
/**
17-
* {@inheritdoc}
17+
* @inheritDoc
1818
*
1919
* In addition to the original method, allows array parameters for filters.
2020
*/
@@ -30,6 +30,7 @@ function ($carry, $item) {
3030
[]
3131
);
3232

33+
$signatureData = [];
3334
foreach (array_merge($queryStringData, $params) as $key => $value) {
3435
$signatureData[rawurlencode($key)] = rawurlencode($value);
3536
}
@@ -51,4 +52,17 @@ function ($carry, $item) {
5152

5253
return base64_encode($this->hash($baseString));
5354
}
55+
56+
/**
57+
* @inheritDoc
58+
*/
59+
protected function hash($data)
60+
{
61+
switch (strtoupper($this->algorithm)) {
62+
case 'HMAC-SHA256':
63+
return hash_hmac('sha256', $data, $this->getSigningKey(), true);
64+
default:
65+
return parent::hash($data);
66+
}
67+
}
5468
}

‎lib/internal/Magento/Framework/Oauth/Helper/Request.php‎

Lines changed: 1 addition & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -63,18 +63,7 @@ public function getRequestUrl($httpRequest)
6363
* @param string $contentTypeHeader
6464
* @param string $requestBodyString
6565
* @param string $requestUrl
66-
* @return array
67-
* merged array of oauth protocols and request parameters. eg :
68-
* <pre>
69-
* array (
70-
* 'oauth_version' => '1.0',
71-
* 'oauth_signature_method' => 'HMAC-SHA1',
72-
* 'oauth_nonce' => 'rI7PSWxTZRHWU3R',
73-
* 'oauth_timestamp' => '1377183099',
74-
* 'oauth_consumer_key' => 'a6aa81cc3e65e2960a4879392445e718',
75-
* 'oauth_signature' => 'VNg4mhFlXk7%2FvsxMqqUd5DWIj9s%3D'
76-
* )
77-
* </pre>
66+
* @return array Merged array of oauth protocols and request parameters.
7867
*/
7968
protected function _processRequest($authHeaderValue, $contentTypeHeader, $requestBodyString, $requestUrl)
8069
{

‎lib/internal/Magento/Framework/Oauth/Oauth.php‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88

99
use Magento\Framework\Encryption\Helper\Security;
1010
use Magento\Framework\Phrase;
11+
use Magento\Framework\Oauth\Exception as AuthException;
1112

1213
/**
1314
* Authorization service.
@@ -56,11 +57,11 @@ public function __construct(
5657
/**
5758
* Retrieve array of supported signature methods.
5859
*
59-
* @return string[] - Supported HMAC-SHA1 and HMAC-SHA256 signature methods.
60+
* @return string[]
6061
*/
6162
public static function getSupportedSignatureMethods()
6263
{
63-
return [self::SIGNATURE_SHA1, self::SIGNATURE_SHA256];
64+
return [self::SIGNATURE_SHA256];
6465
}
6566

6667
/**
@@ -141,7 +142,7 @@ public function validateAccessToken($accessToken)
141142
public function buildAuthorizationHeader(
142143
$params,
143144
$requestUrl,
144-
$signatureMethod = self::SIGNATURE_SHA1,
145+
$signatureMethod = self::SIGNATURE_SHA256,
145146
$httpMethod = 'POST'
146147
) {
147148
$required = ["oauth_consumer_key", "oauth_consumer_secret", "oauth_token", "oauth_token_secret"];
@@ -202,7 +203,7 @@ protected function _validateSignature($params, $consumerSecret, $httpMethod, $re
202203
);
203204

204205
if (!Security::compareStrings($calculatedSign, $params['oauth_signature'])) {
205-
throw new Exception(new Phrase('The signature is invalid. Verify and try again.'));
206+
throw new AuthException(new Phrase('The signature is invalid. Verify and try again.'));
206207
}
207208
}
208209

‎lib/internal/Magento/Framework/Oauth/OauthInterface.php‎

Lines changed: 6 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,10 @@ interface OauthInterface
5959
/**#@+
6060
* Signature Methods
6161
*/
62+
/**
63+
* @deprecated SHA1 is deprecated
64+
* @see SIGNATURE_SHA256
65+
*/
6266
const SIGNATURE_SHA1 = 'HMAC-SHA1';
6367

6468
const SIGNATURE_SHA256 = 'HMAC-SHA256';
@@ -69,16 +73,6 @@ interface OauthInterface
6973
* Issue a pre-authorization request token to the caller.
7074
*
7175
* @param array $params - Array containing parameters necessary for requesting Request Token.
72-
* <pre>
73-
* array (
74-
* 'oauth_version' => '1.0',
75-
* 'oauth_signature_method' => 'HMAC-SHA1',
76-
* 'oauth_nonce' => 'rI7PSWxTZRHWU3R',
77-
* 'oauth_timestamp' => '1377183099',
78-
* 'oauth_consumer_key' => 'a6aa81cc3e65e2960a4879392445e718',
79-
* 'oauth_signature' => 'VNg4mhFlXk7%2FvsxMqqUd5DWIj9s%3D'
80-
* )
81-
* </pre>
8276
* @param string $requestUrl - The request Url.
8377
* @param string $httpMethod - (default: 'POST')
8478
* @return array - The request token/secret pair.
@@ -96,18 +90,6 @@ public function getRequestToken($params, $requestUrl, $httpMethod = 'POST');
9690
* Get access token for a pre-authorized request token.
9791
*
9892
* @param array $params - Array containing parameters necessary for requesting Access Token.
99-
* <pre>
100-
* array (
101-
* 'oauth_version' => '1.0',
102-
* 'oauth_signature_method' => 'HMAC-SHA1',
103-
* 'oauth_token' => 'a6aa81cc3e65e2960a487939244sssss',
104-
* 'oauth_nonce' => 'rI7PSWxTZRHWU3R',
105-
* 'oauth_timestamp' => '1377183099',
106-
* 'oauth_consumer_key' => 'a6aa81cc3e65e2960a4879392445e718',
107-
* 'oauth_signature' => 'VNg4mhFlXk7%2FvsxMqqUd5DWIj9s%3D',
108-
* 'oauth_verifier' => 'a6aa81cc3e65e2960a487939244vvvvv'
109-
* )
110-
* </pre>
11193
* @param string $requestUrl - The request Url.
11294
* @param string $httpMethod - (default: 'POST')
11395
* @return array - The access token/secret pair.
@@ -125,17 +107,6 @@ public function getAccessToken($params, $requestUrl, $httpMethod = 'POST');
125107
* Validate an access token request.
126108
*
127109
* @param array $params - Array containing parameters necessary for validating Access Token.
128-
* <pre>
129-
* array (
130-
* 'oauth_version' => '1.0',
131-
* 'oauth_signature_method' => 'HMAC-SHA1',
132-
* 'oauth_token' => 'a6aa81cc3e65e2960a487939244sssss',
133-
* 'oauth_nonce' => 'rI7PSWxTZRHWU3R',
134-
* 'oauth_timestamp' => '1377183099',
135-
* 'oauth_consumer_key' => 'a6aa81cc3e65e2960a4879392445e718',
136-
* 'oauth_signature' => 'VNg4mhFlXk7%2FvsxMqqUd5DWIj9s%3D'
137-
* )
138-
* </pre>
139110
* @param string $requestUrl - The request Url.
140111
* @param string $httpMethod - (default: 'POST')
141112
* @return int Consumer ID.
@@ -167,20 +138,15 @@ public function validateAccessToken($accessToken);
167138
* );
168139
* </pre>
169140
* @param string $requestUrl e.g 'http://www.example.com/endpoint'
170-
* @param string $signatureMethod (default: 'HMAC-SHA1')
141+
* @param string $signatureMethod (default: 'HMAC-SHA256')
171142
* @param string $httpMethod (default: 'POST')
172143
* @return string
173-
* <pre>
174-
* OAuth oauth_version="1.0", oauth_signature_method="HMAC-SHA1", oauth_nonce="5X1aWR2qzf2uFm1",
175-
* oauth_timestamp="1381930661", oauth_consumer_key="34edf957ef88492f0a32eb7e1731e85d",
176-
* oauth_token="7c0709f789e1f38a17aa4b9a28e1b06c", oauth_signature="agVxK0epXOOeQK4%2Bc7UAqUXoAok%3D"
177-
* <pre>
178144
* @throws \Magento\Framework\Oauth\Exception
179145
*/
180146
public function buildAuthorizationHeader(
181147
$params,
182148
$requestUrl,
183-
$signatureMethod = self::SIGNATURE_SHA1,
149+
$signatureMethod = self::SIGNATURE_SHA256,
184150
$httpMethod = 'POST'
185151
);
186152
}

0 commit comments

Comments
 (0)