From 2aa06ec0a3b614f4ea1894beb4c704e03cabbdd9 Mon Sep 17 00:00:00 2001 From: Jean Paul Galea Date: Tue, 21 Jul 2015 20:36:56 +0000 Subject: [PATCH] Refactor sign function. - this commit might affect LOG_DEBUG message, since now we log utf8_encode($qs) not $qs. - this is probably what we want though, since we run hash_hmac on the latter. --- ykval-common.php | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/ykval-common.php b/ykval-common.php index b36d907..b2340e9 100644 --- a/ykval-common.php +++ b/ykval-common.php @@ -82,19 +82,22 @@ function log_format() { // Sign a http query string in the array of key-value pairs // return b64 encoded hmac hash -function sign($a, $apiKey, $logger) { +function sign($a, $apiKey, $logger) +{ ksort($a); - $qs = urldecode(http_build_query($a)); - // the TRUE at the end states we want the raw value, not hexadecimal form - $hmac = hash_hmac('sha1', utf8_encode($qs), $apiKey, true); + $qs = http_build_query($a); + $qs = urldecode($qs); + $qs = utf8_encode($qs); + + // base64 encoded binary digest + $hmac = hash_hmac('sha1', $qs, $apiKey, TRUE); $hmac = base64_encode($hmac); - $logger->log(LOG_DEBUG, 'SIGN: ' . $qs . ' H=' . $hmac); + $logger->log(LOG_DEBUG, "SIGN: $qs H=$hmac"); return $hmac; - -} // sign an array of query string +} function curl_settings($logger, $ident, $handle, $url, $timeout, $curlopts) {