FacebookSignedRequestFromInputHelper.php 3.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166
  1. <?php
  2. /**
  3. * Copyright 2014 Facebook, Inc.
  4. *
  5. * You are hereby granted a non-exclusive, worldwide, royalty-free license to
  6. * use, copy, modify, and distribute this software in source code or binary
  7. * form for use in connection with the web services and APIs provided by
  8. * Facebook.
  9. *
  10. * As with any software that integrates with the Facebook platform, your use
  11. * of this software is subject to the Facebook Developer Principles and
  12. * Policies [http://developers.facebook.com/policy/]. This copyright notice
  13. * shall be included in all copies or substantial portions of the software.
  14. *
  15. * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  16. * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  17. * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  18. * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  19. * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
  20. * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
  21. * DEALINGS IN THE SOFTWARE.
  22. *
  23. */
  24. namespace Facebook;
  25. use Facebook\Entities\SignedRequest;
  26. /**
  27. * Class FacebookSignedRequestFromInputHelper
  28. * @package Facebook
  29. */
  30. abstract class FacebookSignedRequestFromInputHelper
  31. {
  32. /**
  33. * @var \Facebook\Entities\SignedRequest|null
  34. */
  35. protected $signedRequest;
  36. /**
  37. * @var string the app id
  38. */
  39. protected $appId;
  40. /**
  41. * @var string the app secret
  42. */
  43. protected $appSecret;
  44. /**
  45. * @var string|null Random string to prevent CSRF.
  46. */
  47. public $state = null;
  48. /**
  49. * Initialize the helper and process available signed request data.
  50. *
  51. * @param string|null $appId
  52. * @param string|null $appSecret
  53. */
  54. public function __construct($appId = null, $appSecret = null)
  55. {
  56. $this->appId = FacebookSession::_getTargetAppId($appId);
  57. $this->appSecret = FacebookSession::_getTargetAppSecret($appSecret);
  58. $this->instantiateSignedRequest();
  59. }
  60. /**
  61. * Instantiates a new SignedRequest entity.
  62. *
  63. * @param string|null
  64. */
  65. public function instantiateSignedRequest($rawSignedRequest = null)
  66. {
  67. $rawSignedRequest = $rawSignedRequest ?: $this->getRawSignedRequest();
  68. if (!$rawSignedRequest) {
  69. return;
  70. }
  71. $this->signedRequest = new SignedRequest($rawSignedRequest, $this->state, $this->appSecret);
  72. }
  73. /**
  74. * Instantiates a FacebookSession from the signed request from input.
  75. *
  76. * @return FacebookSession|null
  77. */
  78. public function getSession()
  79. {
  80. if ($this->signedRequest && $this->signedRequest->hasOAuthData()) {
  81. return FacebookSession::newSessionFromSignedRequest($this->signedRequest);
  82. }
  83. return null;
  84. }
  85. /**
  86. * Returns the SignedRequest entity.
  87. *
  88. * @return \Facebook\Entities\SignedRequest|null
  89. */
  90. public function getSignedRequest()
  91. {
  92. return $this->signedRequest;
  93. }
  94. /**
  95. * Returns the user_id if available.
  96. *
  97. * @return string|null
  98. */
  99. public function getUserId()
  100. {
  101. return $this->signedRequest ? $this->signedRequest->getUserId() : null;
  102. }
  103. /**
  104. * Get raw signed request from input.
  105. *
  106. * @return string|null
  107. */
  108. abstract public function getRawSignedRequest();
  109. /**
  110. * Get raw signed request from GET input.
  111. *
  112. * @return string|null
  113. */
  114. public function getRawSignedRequestFromGet()
  115. {
  116. if (isset($_GET['signed_request'])) {
  117. return $_GET['signed_request'];
  118. }
  119. return null;
  120. }
  121. /**
  122. * Get raw signed request from POST input.
  123. *
  124. * @return string|null
  125. */
  126. public function getRawSignedRequestFromPost()
  127. {
  128. if (isset($_POST['signed_request'])) {
  129. return $_POST['signed_request'];
  130. }
  131. return null;
  132. }
  133. /**
  134. * Get raw signed request from cookie set from the Javascript SDK.
  135. *
  136. * @return string|null
  137. */
  138. public function getRawSignedRequestFromCookie()
  139. {
  140. if (isset($_COOKIE['fbsr_' . $this->appId])) {
  141. return $_COOKIE['fbsr_' . $this->appId];
  142. }
  143. return null;
  144. }
  145. }