rack-facebook-method-fix 0.2.0 → 0.3.0

data/README.rdoc

@@ -1,8 +1,22 @@
-= rack-facebook-method-fix
+= What?
 
-Description goes here.
+In early 2011 Facebook started to send all iframe application requests as POST. Because of this most REST based applications broke. This Rack::Facebook::MethodFix middleware looks for incoming POST requests. If the request contains _signed_request_ parameter it converts request to GET as originally intended. Optionally if you give Facebook application _secret_id_ in middleware settings it will also validate the contents of _signed_request_ parameter.
+  
+= Install
 
-== Contributing to rack-facebook-method-fix
+  gem install rack-facebook-method-fix
+
+= Usage
+
+  require "rack-facebook-method-fix"
+  use Rack::Facebook::MethodFix
+  
+or
+
+  require "rack-facebook-method-fix"
+  use Rack::Facebook::MethodFix, :secret_id => "c561df165eacdd6e32672c9eaee10318"  
+  
+== Contributing to Rack::Facebook::MethodFix
  
 * Check out the latest master to make sure the feature hasn't been implemented or the bug hasn't been fixed yet
 * Check out the issue tracker to make sure someone already hasn't requested it and/or contributed it
@@ -14,6 +28,6 @@ Description goes here.
 
 == Copyright
 
-Copyright (c) 2011 Mika Tuupola. See LICENSE.txt for
+Copyright (c) 2011 Mika Tuupola. See LICENSE for
 further details.
 

data/Rakefile

@@ -16,7 +16,7 @@ Jeweler::Tasks.new do |gem|
   gem.homepage = "http://github.com/tuupola/rack-facebook-method-fix"
   gem.license = "MIT"
   gem.summary = %Q{Fix RESTfull Facebook applications}
-  gem.description = %Q{In early 2011 Facebook started to send all application requests as POST. This gem converts POST requests back to GET when applicable.}
+  gem.description = %Q{In early 2011 Facebook started to send all application requests as POST. This Rack middleware converts POST requests back to GET when applicable.}
   gem.email = "tuupola@appelsiini.net"
   gem.authors = ["Mika Tuupola"]
   # Include your dependencies below. Runtime dependencies are required when using your gem,

data/VERSION

@@ -1 +1 @@
-0.2.0
+0.3.0

data/lib/rack/facebook/method-fix.rb

@@ -2,17 +2,51 @@ module Rack
   module Facebook
     class MethodFix
 
-      def initialize(app)
+      def initialize(app, settings={})
         @app = app
+        @settings = settings
       end
 
       def call(env)
         if env["REQUEST_METHOD"] == "POST"
-          req = Request.new(env)
-          env["REQUEST_METHOD"] = "GET" if req.params["signed_request"]
+          request = Request.new(env)
+          if @settings[:secret_id] && request.params["signed_request"]
+            env["REQUEST_METHOD"] = "GET" if signed_request_valid?(@settings[:secret_id], request)          
+          else
+            env["REQUEST_METHOD"] = "GET" if request.params["signed_request"]
+          end
         end
         @app.call(env)
       end
+      
+      # Code adapted from https://github.com/nsanta/fbgraph
+      def signed_request_valid?(secret_id, request)
+        encoded_signature, payload = request.params["signed_request"].split(".", 2)
+        signature = ""
+        valid = true
+        
+        url_decode_64(encoded_signature).each_byte do |byte|
+          signature << "%02x" % byte
+        end
+        
+        data = JSON.parse(url_decode_64(payload))
+        if data["algorithm"].to_s.upcase != "HMAC-SHA256"
+          valid = false
+        end
+        
+        expected_signature = OpenSSL::HMAC.hexdigest("sha256", secret_id, payload)
+        if expected_signature != signature
+          valid = false
+        end
+        
+        valid
+      end
+            
+      def url_decode_64(string)
+        encoded_string = string.gsub("-", "+").gsub("_", "/")
+        encoded_string += "=" while !(encoded_string.size % 4).zero?
+        Base64.decode64(encoded_string)
+      end
     
     end
   end

data/lib/rack-facebook-method-fix.rb

@@ -1 +1,2 @@
+require "json"
 require "rack/facebook/method-fix"

data/rack-facebook-method-fix.gemspec

@@ -5,22 +5,22 @@
 
 Gem::Specification.new do |s|
   s.name = %q{rack-facebook-method-fix}
-  s.version = "0.2.0"
+  s.version = "0.3.0"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Mika Tuupola"]
-  s.date = %q{2011-03-31}
-  s.description = %q{In early 2011 Facebook started to send all application requests as POST. This gem converts POST requests back to GET when applicable.}
+  s.date = %q{2011-04-13}
+  s.description = %q{In early 2011 Facebook started to send all application requests as POST. This Rack middleware converts POST requests back to GET when applicable.}
   s.email = %q{tuupola@appelsiini.net}
   s.extra_rdoc_files = [
-    "LICENSE.txt",
+    "LICENSE",
     "README.rdoc"
   ]
   s.files = [
     ".document",
     "Gemfile",
     "Gemfile.lock",
-    "LICENSE.txt",
+    "LICENSE",
     "README.rdoc",
     "Rakefile",
     "VERSION",

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: rack-facebook-method-fix
 version: !ruby/object:Gem::Version 
-  hash: 23
+  hash: 19
   prerelease: false
   segments: 
   - 0
-  - 2
+  - 3
   - 0
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors: 
 - Mika Tuupola
@@ -15,7 +15,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2011-03-31 00:00:00 +03:00
+date: 2011-04-13 00:00:00 +03:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
@@ -78,20 +78,20 @@ dependencies:
   name: rcov
   prerelease: false
   version_requirements: *id004
-description: In early 2011 Facebook started to send all application requests as POST. This gem converts POST requests back to GET when applicable.
+description: In early 2011 Facebook started to send all application requests as POST. This Rack middleware converts POST requests back to GET when applicable.
 email: tuupola@appelsiini.net
 executables: []
 
 extensions: []
 
 extra_rdoc_files: 
-- LICENSE.txt
+- LICENSE
 - README.rdoc
 files: 
 - .document
 - Gemfile
 - Gemfile.lock
-- LICENSE.txt
+- LICENSE
 - README.rdoc
 - Rakefile
 - VERSION