Problems with phpSmug 3.5 and API 1.3

[asherber]

I have long used phpSmug with API 1.2 to serve some images on my website, but SmugMug recently turned that version off. So I'm updating to 1.3 and am having some problems. (I don't have composer available in my environment, so I can't move to phpSmug 4 and API 2.)

I've done the OAuth dance to get an access token, but now I'm getting a 400 Bad Request when I make a call. Here's sample code:

$sm = new phpSmug("APIKey=$key", "APIVer=1.3.0", "AppName=foobar", "OAuthSecret=$secret");
$sm->setToken("id=$accessToken_id", "Secret=$accessToken_secret");
$albums = $sm->albums_get();

Am I missing something obvious here?

[lildude]

Wow!! I've not looked at the old code in ages 😄

Your code looks good, but the problem isn't your code, it's with phpSmug - all the API urls are hardcoded to http and these have all been changed on the SmugMug side to redirect to https. Unfortunately, this results in invalid signatures etc and the old version of phpSmug doesn't handle this well.

The fix is to change all the URLs to use https:

diff --git a/phpSmug.php b/phpSmug.php
index 716d22a..d7d95e8 100644
--- a/phpSmug.php
+++ b/phpSmug.php
@@ -369,7 +369,7 @@ class phpSmug {
 		if ( ( strpos( $command, 'login.with' ) || strpos( $command, 'Token' ) ) || ( $this->oauth_signature_method == 'PLAINTEXT' ) || $this->secure ) {
 			$endpoint = "https://secure.smugmug.com/services/api/php/{$this->APIVer}/";
 		} else {
-			$endpoint = "http://api.smugmug.com/services/api/php/{$this->APIVer}/";
+			$endpoint = "https://api.smugmug.com/services/api/php/{$this->APIVer}/";
 			if ( ( isset( $this->SessionID ) && is_null( $this->SessionID ) ) && ( !strpos( $command, 'login.anonymously' ) ) && !$this->OAuthSecret ) {
 				throw new PhpSmugException( 'Not authenticated. No Session ID or OAuth Token.  Please login or provide an OAuth token.' );
 			}
@@ -655,7 +655,7 @@ class phpSmug {
 		if ( $this->loginType == 'authd' ) {
 			$upload_req->setHeader( 'X-Smug-SessionID', $this->SessionID );
 		} else {
-			$upload_req->setHeader( 'Authorization', 'OAuth realm="http://api.smugmug.com/",'
+			$upload_req->setHeader( 'Authorization', 'OAuth realm="https://api.smugmug.com/",'
 				.'oauth_consumer_key="'.$this->APIKey.'",'
 				.'oauth_token="'.$this->oauth_token.'",'
 				.'oauth_signature_method="'.$this->oauth_signature_method.'",'
@@ -678,7 +678,7 @@ class phpSmug {
 
 		//$proto = ( $this->oauth_signature_method == 'PLAINTEXT' || $this->secure ) ? 'https' : 'http';	// No secure uploads at this time.
 		//$upload_req->setURL( $proto . '://upload.smugmug.com/'.$args['FileName'] );
-		$upload_req->setURL( 'http://upload.smugmug.com/'.$args['FileName'] );
+		$upload_req->setURL( 'https://upload.smugmug.com/'.$args['FileName'] );
 		$upload_req->setBody( $data );
 
         //Send Requests
@@ -722,6 +722,7 @@ class phpSmug {
 
 		if ( $this->OAuthSecret ) {
 			$sig = $this->generate_signature( $method, $args );
+
 			$oauth_params = array (
 				'oauth_version'             => '1.0',
 				'oauth_nonce'               => $this->oauth_nonce,
@@ -825,9 +826,9 @@ class phpSmug {
 			} else if ( $apicall == 'Upload' ) {
 				//$proto = ( $this->oauth_signature_method == 'PLAINTEXT' || $this->secure ) ? 'https' : 'http';
 				//$endpoint = $proto . '://upload.smugmug.com/'.$apiargs['FileName'];	// No support for secure uploads yet
-				$endpoint = 'http://upload.smugmug.com/'.$apiargs['FileName'];
+				$endpoint = 'https://upload.smugmug.com/'.$apiargs['FileName'];
 			} else {
-				$endpoint = "http://api.smugmug.com/services/api/php/{$this->APIVer}/";
+				$endpoint = "https://api.smugmug.com/services/api/php/{$this->APIVer}/";
 			}
 
 			if ( is_null( $apicall ) ) {

[asherber]

Brilliant! Thanks so much for the quick response -- that's got things working.

I've made the changes locally, but do you think it might be worth an official release of 3.5.1?

[lildude]

I've made the changes locally, but do you think it might be worth an official release of 3.5.1?

I'm a bit reluctant to as the code is soooo old and ugly I'd really prefer peeps not use it TBH 😊

[asherber]

Understood, thanks. I guess this issue page will always be here, in case anyone else is in the same boat!