forked from cloudinary/cloudinary_php
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathAuthToken.php
More file actions
92 lines (84 loc) · 3.07 KB
/
Copy pathAuthToken.php
File metadata and controls
92 lines (84 loc) · 3.07 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
<?php
namespace Cloudinary;
/**
* Class AuthToken
* @package Cloudinary
*/
class AuthToken
{
const UNSAFE = '/([ "#%&\'\/:;<=>?@\[\]^`{\|}~\\\\])/';
/**
* Generate an authorization token.
* Options:
* string key - the secret key required to sign the token
* string ip - the IP address of the client
* number start_time - the start time of the token in seconds from epoch
* string expiration - the expiration time of the token in seconds from epoch
* string duration - the duration of the token (from start_time)
* string acl - the ACL for the token
* string url - the URL to authentication in case of a URL token
*
* @param array $options token configuration
*
* @return string the authorization token
* @throws Error if both expiration and duration were not provided
*/
public static function generate($options = array())
{
$key = \Cloudinary::option_get($options, "key");
if (!isset($key)) {
throw new \Cloudinary\Error("Missing authentication token key configuration");
}
$name = \Cloudinary::option_get($options, "token_name", "__cld_token__");
$start = \Cloudinary::option_get($options, "start_time");
$expiration = \Cloudinary::option_get($options, "expiration");
$ip = \Cloudinary::option_get($options, "ip");
$acl = \Cloudinary::option_get($options, "acl");
$url = \Cloudinary::option_get($options, "url");
$duration = \Cloudinary::option_get($options, "duration");
if (!strcasecmp($start, "now")) {
$start = time();
} elseif (is_numeric($start)) {
$start = 0 + $start;
}
if (!isset($expiration)) {
if (isset($duration)) {
$expiration = (isset($start) ? $start : time()) + $duration;
} else {
throw new \Cloudinary\Error("Must provide 'expiration' or 'duration'.");
}
}
$token = array();
if (isset($ip)) {
array_push($token, "ip=$ip");
}
if (isset($start)) {
array_push($token, "st=$start");
}
array_push($token, "exp=$expiration");
if (isset($acl)) {
array_push($token, "acl=" . self::escape_to_lower($acl));
}
$to_sign = $token;
if (isset($url) && !isset($acl)) {
array_push($to_sign, "url=" . self::escape_to_lower($url));
}
$auth = self::digest(join("~", $to_sign), $key);
array_push($token, "hmac=$auth");
return "$name=" . join("~", $token);
}
private static function digest($message, $key = null)
{
if (!isset($key)) {
$key = \Cloudinary::config_get("akamai_key");
}
$bin_key = pack("H*", $key);
return hash_hmac("sha256", $message, $bin_key);
}
private static function escape_to_lower($url)
{
return preg_replace_callback(self::UNSAFE, function ($match) {
return '%'.bin2hex($match[0]);
}, $url);
}
}