OAuthSignatureMethod.php

<?php
 
namespace ceLTIc\LTI\OAuth;
 
abstract class OAuthSignatureMethod
{
 
    abstract public function get_name();
 
    abstract public function build_signature($request, $consumer, $token);
 
    public function check_signature($request, $consumer, $token, $signature)
    {
        $built = $this->build_signature($request, $consumer, $token);
 
        // Check for zero length, although unlikely here
        if (strlen($built) == 0 || strlen($signature) == 0) {
            return false;
        }
 
        if (strlen($built) != strlen($signature)) {
            return false;
        }
 
        // Avoid a timing leak with a (hopefully) time insensitive compare
        $result = 0;
        for ($i = 0; $i < strlen($signature); $i++) {
            $result |= ord($built[$i]) ^ ord($signature[$i]);
        }
 
        return $result == 0;
    }
 
}