Version 4.3.0

system/Login/Handler/OAuth1/OAuth1.php

@@ -0,0 +1,456 @@
+<?php
+/**
+ * @brief		Abstract OAuth1 Login Handler
+ * @author		<a href='http://www.invisionpower.com'>Invision Power Services, Inc.</a>
+ * @copyright	(c) 2001 - 2016 Invision Power Services, Inc.
+ * @license		http://www.invisionpower.com/legal/standards/
+ * @package		IPS Community Suite
+ * @since		31 May 2017
+ * @version		SVN_VERSION_NUMBER
+ */
+
+namespace IPS\Login\Handler;
+
+/* To prevent PHP errors (extending class does not exist) revealing path */
+if ( !defined( '\IPS\SUITE_UNIQUE_KEY' ) )
+{
+	header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
+	exit;
+}
+
+/**
+ * Abstract OAuth1 Login Handler
+ */
+abstract class _OAuth1 extends \IPS\Login\Handler
+{
+	/* !Login Handler: Basics */
+		
+	/**
+	 * ACP Settings Form
+	 *
+	 * @param	string	$url	URL to redirect user to after successful submission
+	 * @return	array	List of settings to save - settings will be stored to core_login_methods.login_settings DB field
+	 * @code
+	 	return array( 'savekey'	=> new \IPS\Helpers\Form\[Type]( ... ), ... );
+	 * @endcode
+	 */
+	public function acpForm()
+	{		
+		$return = array(
+			array( 'login_handler_oauth_settings', static::getTitle() . '_info' ),
+			'consumer_key'		=> new \IPS\Helpers\Form\Text( 'oauth_consumer_key', ( isset( $this->settings['consumer_key'] ) ) ? $this->settings['consumer_key'] : '', TRUE ),
+			'consumer_secret'	=> new \IPS\Helpers\Form\Text( 'oauth_consumer_secret', ( isset( $this->settings['consumer_secret'] ) ) ? $this->settings['consumer_secret'] : '', TRUE ),
+		);	
+		
+		$return[] = 'account_management_settings';
+		$return['show_in_ucp'] = new \IPS\Helpers\Form\Radio( 'login_handler_show_in_ucp', isset( $this->settings['show_in_ucp'] ) ? $this->settings['show_in_ucp'] : 'always', FALSE, array(
+			'options' => array(
+				'always'		=> 'login_handler_show_in_ucp_always',
+				'loggedin'		=> 'login_handler_show_in_ucp_loggedin',
+			),
+		) );
+		$return['update_name_changes'] = new \IPS\Helpers\Form\Radio( 'login_update_name_changes', isset( $this->settings['update_name_changes'] ) ? $this->settings['update_name_changes'] : 'disabled', FALSE, array( 'options' => array(
+			'force'		=> 'login_update_changes_yes',
+			'optional'	=> 'login_update_changes_optional',
+			'disabled'	=> 'login_update_changes_no',
+		) ), NULL, NULL, NULL, 'login_update_name_changes_inc_optional' );
+		$return['update_email_changes'] = new \IPS\Helpers\Form\Radio( 'login_update_email_changes', isset( $this->settings['update_email_changes'] ) ? $this->settings['update_email_changes'] : 'optional', FALSE, array( 'options' => array(
+			'force'		=> 'login_update_changes_yes',
+			'optional'	=> 'login_update_changes_optional',
+			'disabled'	=> 'login_update_changes_no',
+		) ), NULL, NULL, NULL, 'login_update_email_changes_inc_optional' );
+		
+		return $return;
+	}
+		
+	/**
+	 * Test Settings
+	 *
+	 * @return	bool
+	 * @throws	\LogicException
+	 */
+	public function testSettings()
+	{
+		try
+		{
+			$response = $this->_sendRequest( 'get', $this->tokenRequestEndpoint() );
+		}
+		catch ( \Exception $e )
+		{
+			throw new \LogicException( \IPS\Member::loggedIn()->language()->addToStack( 'oauth1_setup_error', FALSE, array( 'sprintf' => array( $e->getMessage() ) ) ) );
+		}
+		
+		try
+		{
+			$response->decodeQueryString('oauth_token');
+		}
+		catch ( \Exception $e )
+		{
+			throw new \LogicException( \IPS\Member::loggedIn()->language()->addToStack( 'oauth1_setup_error', FALSE, array( 'sprintf' => array( (string) $response ) ) ) );
+		}
+	}
+	
+	/* !Authentication */
+	
+	use \IPS\Login\Handler\ButtonHandler;
+	
+	/**
+	 * Authenticate
+	 *
+	 * @param	\IPS\Login	$login	The login object
+	 * @return	\IPS\Member
+	 * @throws	\IPS\Login\Exception
+	 */
+	public function authenticateButton( \IPS\Login $login )
+	{
+		if ( isset( \IPS\Request::i()->denied ) )
+		{
+			return NULL;
+		}
+		elseif ( isset( \IPS\Request::i()->oauth_token ) )
+		{
+			return $this->_handleAuthorizationResponse( $login );
+		}
+		else
+		{		
+			$this->_redirectToAuthorizationEndpoint( $login );
+		}
+	}
+	
+	/**
+	 * Redirect to Resource Owner Authorization Endpoint
+	 *
+	 * @param	\IPS\Login	$login	The login object
+	 * @return	void
+	 */
+	protected function _redirectToAuthorizationEndpoint( \IPS\Login $login )
+	{
+		$callback = $login->url->setQueryString( '_processLogin', $this->id )->csrf();
+		if ( isset( \IPS\Request::i()->ref ) )
+		{
+			$callback = $callback->setQueryString( 'ref', \IPS\Request::i()->ref );
+		}
+		
+		try
+		{
+			$response = $this->_sendRequest( 'get', $this->tokenRequestEndpoint(), array( 'oauth_callback' => (string) $callback ) )->decodeQueryString('oauth_token');
+		}
+		catch ( \Exception $e )
+		{
+			\IPS\Log::i( $e, 'twitter' );
+			throw new \IPS\Login\Exception( 'generic_error', \IPS\Login\Exception::INTERNAL_ERROR );
+		}
+		
+		\IPS\Output::i()->redirect( $this->authorizationEndpoint( $login )->setQueryString( 'oauth_token', $response['oauth_token'] ) );
+	}
+	
+	/**
+	 * Handle authorization response
+	 *
+	 * @param	\IPS\Login	$login	The login object
+	 * @return	\IPS\Member
+	 * @throws	\IPS\Login\Exception
+	 */
+	protected function _handleAuthorizationResponse( \IPS\Login $login )
+	{		
+		/* Authenticate */
+		try
+		{
+			$response = $this->_sendRequest( 'post', $this->accessTokenEndpoint(), array( 'oauth_verifier' => \IPS\Request::i()->oauth_verifier ), \IPS\Request::i()->oauth_token )->decodeQueryString('oauth_token');
+		}
+		catch ( \Exception $e )
+		{
+			\IPS\Log::i( $e, 'twitter' );
+			throw new \IPS\Login\Exception( 'generic_error', \IPS\Login\Exception::INTERNAL_ERROR );
+		}
+						
+		/* Get user id */
+		try
+		{
+			$userId = $this->authenticatedUserId( $response['oauth_token'], $response['oauth_token_secret'] );
+		}
+		catch ( \Exception $e )
+		{
+			\IPS\Log::log( $e, 'oauth' );
+			throw new \IPS\Login\Exception( 'generic_error', \IPS\Login\Exception::INTERNAL_ERROR );
+		}
+						
+		/* Has this user signed in with this service before? */
+		try
+		{
+			$oauthAccess = \IPS\Db::i()->select( '*', 'core_login_links', array( 'token_login_method=? AND token_identifier=?', $this->id, $userId ) )->first();
+			$member = \IPS\Member::load( $oauthAccess['token_member'] );
+			
+			/* If the user never finished the linking process, or the account has been deleted, discard this access token */
+			if ( !$oauthAccess['token_linked'] or !$member->member_id )
+			{
+				\IPS\Db::i()->delete( 'core_login_links', array( 'token_login_method=? AND token_member=?', $this->id, $oauthAccess['token_member'] ) );
+				throw new \UnderflowException;
+			}
+			
+			/* Otherwise, update our token... */
+			\IPS\Db::i()->update( 'core_login_links', array(
+				'token_access_token'	=> $response['oauth_token'],
+				'token_secret'			=> $response['oauth_token_secret'],
+			), array( 'token_login_method=? AND token_member=?', $this->id, $oauthAccess['token_member'] ) );
+			
+			/* ... and return the member object */
+			return $member;
+		}
+		/* No, create or link the account */
+		catch ( \UnderflowException $e )
+		{
+			/* Get the username + email */
+			$name = NULL;
+			try
+			{
+				$name = $this->authenticatedUserName( $response['oauth_token'], $response['oauth_token_secret'] );
+			}
+			catch ( \Exception $e ) {}
+			$email = NULL;
+			try
+			{
+				$email = $this->authenticatedEmail( $response['oauth_token'], $response['oauth_token_secret'] );
+			}
+			catch ( \Exception $e ) {}
+			
+			try
+			{
+				if ( $login->type === \IPS\Login::LOGIN_UCP )
+				{
+					$exception = new \IPS\Login\Exception( 'generic_error', \IPS\Login\Exception::MERGE_SOCIAL_ACCOUNT );
+					$exception->handler = $this;
+					$exception->member = $login->reauthenticateAs;
+					throw $exception;
+				}
+				
+				$member = $this->createAccount( $name, $email );
+				
+				\IPS\Db::i()->insert( 'core_login_links', array(
+					'token_login_method'	=> $this->id,
+					'token_member'			=> $member->member_id,
+					'token_identifier'		=> $userId,
+					'token_linked'			=> 1,
+					'token_access_token'	=> $response['oauth_token'],
+					'token_secret'			=> $response['oauth_token_secret'],
+				) );
+				
+				$member->logHistory( 'core', 'social_account', array(
+					'service'		=> static::getTitle(),
+					'handler'		=> $this->id,
+					'account_id'	=> $this->userId( $member ),
+					'account_name'	=> $this->userProfileName( $member ),
+					'linked'		=> TRUE,
+					'registered'	=> TRUE
+				) );
+				
+				if ( $syncOptions = $this->syncOptions( $member, TRUE ) )
+				{
+					$profileSync = array();
+					foreach ( $syncOptions as $option )
+					{
+						$profileSync[ $option ] = array( 'handler' => $this->id, 'ref' => NULL, 'error' => NULL );
+					}
+					$member->profilesync = $profileSync;
+					$member->save();
+				}
+				
+				return $member;
+			}
+			catch ( \IPS\Login\Exception $exception )
+			{
+				if ( $exception->getCode() === \IPS\Login\Exception::MERGE_SOCIAL_ACCOUNT )
+				{
+					\IPS\Db::i()->insert( 'core_login_links', array(
+						'token_login_method'	=> $this->id,
+						'token_member'			=> $exception->member->member_id,
+						'token_identifier'		=> $userId,
+						'token_linked'			=> 0,
+						'token_access_token'	=> $response['oauth_token'],
+						'token_secret'			=> $response['oauth_token_secret'],
+					) );
+				}
+				
+				throw $exception;
+			}
+		}
+	}
+	
+	/**
+	 * Authorization Endpoint
+	 *
+	 * @param	\IPS\Login	$login	The login object
+	 * @return	\IPS\Http\Url
+	 */
+	abstract protected function authorizationEndpoint( \IPS\Login $login );
+	
+	/**
+	 * Token Request Endpoint
+	 *
+	 * @return	\IPS\Http\Url
+	 */
+	abstract protected function tokenRequestEndpoint();
+	
+	/**
+	 * Access Token Endpoint
+	 *
+	 * @return	\IPS\Http\Url
+	 */
+	abstract protected function accessTokenEndpoint();
+	
+	/**
+	 * Send Request
+	 *
+	 * @param	string			  $method			HTTP Method
+	 * @param	\IPS\Http\Url	  $url				URL
+	 * @param	array|string|NULL $params			Parameters
+	 * @param	string			  $token			OAuth Token
+	 * @param	array			  $otherParams		Other params to send obvs
+	 * @param	string			  $mimeBoundary		Mime data to send (boundary => data )
+	 * @return	\IPS\Http\Response
+	 * @throws	\IPS\Http\Request\Exception
+	 */
+	protected function _sendRequest( $method, $url, $params=array(), $token='', $secret='', $otherParams=array(), $mimeBoundary=array() )
+	{		
+		/* Generate the OAUTH Authorization Header */
+		$OAuthAuthorization = array_merge( array(
+			'oauth_consumer_key'	=> $this->settings['consumer_key'],
+			'oauth_nonce'			=> md5( \IPS\Login::generateRandomString() ),
+			'oauth_signature_method'=> 'HMAC-SHA1',
+			'oauth_timestamp'		=> time(),
+			'oauth_token'			=> $token,
+			'oauth_version'			=> '1.0'
+		) );
+		
+		$queryStringParams = array();
+		foreach ( $params as $k => $v )
+		{
+			if ( mb_substr( $k, 0, 6 ) === 'oauth_' )
+			{
+				$OAuthAuthorization = array_merge( array( $k => $v ), $OAuthAuthorization );
+				unset( $params[ $k ] );
+			}
+			elseif ( $method === 'get' )
+			{
+				$queryStringParams[ $k ] = $v;
+			}
+		}
+		
+		/* All keys sent in the signature must be in alphabetical order, that includes oAuth keys and user sent params */
+		$allKeys = array_merge( $OAuthAuthorization, $params );
+		ksort( $allKeys );
+		
+		$signatureBaseString = mb_strtoupper( $method ) . '&' . rawurlencode( (string) $url ) . '&' . rawurlencode( http_build_query( $allKeys, NULL, '&', PHP_QUERY_RFC3986 ) );	
+		$signingKey = rawurlencode( $this->settings['consumer_secret'] ) . '&' . rawurlencode( $secret ?: $token );			
+		$OAuthAuthorizationEncoded = array();
+		foreach ( $OAuthAuthorization as $k => $v )
+		{
+			$OAuthAuthorizationEncoded[] = rawurlencode( $k ) . '="' . rawurlencode( $v ) . '"';
+			
+			if ( $k === 'oauth_nonce' )
+			{
+				$signature = base64_encode( hash_hmac( 'sha1', $signatureBaseString, $signingKey, TRUE ) );
+				$OAuthAuthorizationEncoded[] = rawurlencode( 'oauth_signature' ) . '="' . rawurlencode( $signature ) . '"';
+			}
+		}
+		$OAuthAuthorizationHeader = 'OAuth ' . implode( ', ', $OAuthAuthorizationEncoded );
+		
+		$headers = array( 'Authorization' => $OAuthAuthorizationHeader );
+		
+		/* Send the request */
+		if ( ! count( $mimeBoundary ) )
+		{
+			if ( $method === 'get' )
+			{
+				return $url->setQueryString( $queryStringParams )->request()->setHeaders( $headers )->get();
+			}
+			else
+			{
+				return $url->setQueryString( $queryStringParams )->request()->setHeaders( $headers )->$method( $params );
+			}
+		}
+		else
+		{
+			$headers['Content-Type'] = 'multipart/form-data; boundary=' . $mimeBoundary[0];
+			
+			return $url->setQueryString( $queryStringParams )->request()->setHeaders( $headers )->$method( $mimeBoundary[1] );
+		}
+	}
+	
+	/**
+	 * Get user's identifier (may not be a number)
+	 * May return NULL if server doesn't support this
+	 *
+	 * @param	\IPS\Member	$member	Member
+	 * @return	string|NULL
+	 * @throws	\IPS\Login\Exception	The token is invalid and the user needs to reauthenticate
+	 * @throws	\DomainException		General error where it is safe to show a message to the user
+	 * @throws	\RuntimeException		Unexpected error from service
+	 */
+	public function userId( \IPS\Member $member )
+	{
+		if ( !( $link = $this->_link( $member ) ) )
+		{
+			throw new \IPS\Login\Exception( $error['message'], \IPS\Login\Exception::INTERNAL_ERROR );
+		}
+		
+		return $this->authenticatedUserId( $link['token_access_token'], $link['token_secret'] );
+	}
+	
+	/**
+	 * Get user's profile name
+	 * May return NULL if server doesn't support this
+	 *
+	 * @param	\IPS\Member	$member	Member
+	 * @return	string|NULL
+	 * @throws	\IPS\Login\Exception	The token is invalid and the user needs to reauthenticate
+	 * @throws	\DomainException		General error where it is safe to show a message to the user
+	 * @throws	\RuntimeException		Unexpected error from service
+	 */
+	public function userProfileName( \IPS\Member $member )
+	{
+		if ( !( $link = $this->_link( $member ) ) )
+		{
+			throw new \IPS\Login\Exception( NULL, \IPS\Login\Exception::INTERNAL_ERROR );
+		}
+		
+		return $this->authenticatedUserName( $link['token_access_token'], $link['token_secret'] );
+	}
+	
+	/**
+	 * Get user's email address
+	 * May return NULL if server doesn't support this
+	 *
+	 * @param	\IPS\Member	$member	Member
+	 * @return	string|NULL
+	 * @throws	\IPS\Login\Exception	The token is invalid and the user needs to reauthenticate
+	 * @throws	\DomainException		General error where it is safe to show a message to the user
+	 * @throws	\RuntimeException		Unexpected error from service
+	 */
+	public function userEmail( \IPS\Member $member )
+	{
+		if ( !( $link = $this->_link( $member ) ) )
+		{
+			throw new \IPS\Login\Exception( $error['message'], \IPS\Login\Exception::INTERNAL_ERROR );
+		}
+		
+		return $this->authenticatedEmail( $link['token_access_token'], $link['token_secret'] );
+	}
+	
+	/* !UCP */
+	
+	/**
+	 * Show in Account Settings?
+	 *
+	 * @param	\IPS\Member|NULL	$member	The member, or NULL for if it should show generally
+	 * @return	bool
+	 */
+	public function showInUcp( \IPS\Member $member = NULL )
+	{
+		if ( !isset( $this->settings['show_in_ucp'] ) )
+		{
+			return TRUE; // Default to showing
+		}
+		return parent::showInUcp( $member );
+	}
+}

system/Login/Handler/OAuth1/Twitter.php

@@ -0,0 +1,504 @@
+<?php
+/**
+ * @brief		Twitter Login Handler
+ * @author		<a href='https://www.invisioncommunity.com'>Invision Power Services, Inc.</a>
+ * @copyright	(c) Invision Power Services, Inc.
+ * @license		https://www.invisioncommunity.com/legal/standards/
+ * @package		Invision Community
+ * @since		1 June 2017
+ */
+
+namespace IPS\Login\Handler\OAuth1;
+
+/* To prevent PHP errors (extending class does not exist) revealing path */
+if ( !defined( '\IPS\SUITE_UNIQUE_KEY' ) )
+{
+	header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
+	exit;
+}
+
+/**
+ * Twitter Login Handler
+ */
+class _Twitter extends \IPS\Login\Handler\OAuth1
+{	
+	/**
+	 * @brief	Share Service
+	 */
+	public static $shareService = 'Twitter';
+	
+	/**
+	 * Get title
+	 *
+	 * @return	string
+	 */
+	public static function getTitle()
+	{
+		return 'login_handler_Twitter';
+	}
+	
+	/**
+	 * ACP Settings Form
+	 *
+	 * @param	string	$url	URL to redirect user to after successful submission
+	 * @return	array	List of settings to save - settings will be stored to core_login_methods.login_settings DB field
+	 * @code
+	 	return array( 'savekey'	=> new \IPS\Helpers\Form\[Type]( ... ), ... );
+	 * @endcode
+	 */
+	public function acpForm()
+	{
+		\IPS\Member::loggedIn()->language()->words['login_acp_desc'] = \IPS\Member::loggedIn()->language()->addToStack('login_acp_will_reauth');
+		
+		return array_merge(
+			array(
+				'name'				=> new \IPS\Helpers\Form\Radio( 'login_real_name', ( isset( $this->settings['name'] ) ) ? $this->settings['name'] : 'any', TRUE, array(
+					'options' => array(
+						'real'		=> 'login_twitter_name_real',
+						'screen'	=> 'login_twitter_name_screen',
+						'any'		=> 'login_real_name_disabled',
+					),
+					'toggles' => array(
+						'real'		=> array( 'login_update_name_changes_inc_optional' ),
+						'screen'	=> array( 'login_update_name_changes_inc_optional' ),
+					)
+				), NULL, NULL, NULL, 'login_real_name' ),
+			),
+			parent::acpForm(),
+			array(
+				'allow_status_import' => new \IPS\Helpers\Form\YesNo( 'login_generic_allow_status_import', ( isset( $this->settings['allow_status_import'] ) ) ? $this->settings['allow_status_import'] : FALSE, FALSE )
+			)
+		);
+	}
+	
+	/**
+	 * Get the button color
+	 *
+	 * @return	string
+	 */
+	public function buttonColor()
+	{
+		return '#00abf0';
+	}
+	
+	/**
+	 * Get the button icon
+	 *
+	 * @return	string
+	 */
+	public function buttonIcon()
+	{
+		return 'twitter';
+	}
+	
+	/**
+	 * Get button text
+	 *
+	 * @return	string
+	 */
+	public function buttonText()
+	{
+		return 'login_twitter';
+	}
+
+	/**
+	 * Get button class
+	 *
+	 * @return	string
+	 */
+	public function buttonClass()
+	{
+		return 'ipsSocial_twitter';
+	}
+	
+	/**
+	 * Get logo to display in information about logins with this method
+	 * Returns NULL for methods where it is not necessary to indicate the method, e..g Standard
+	 *
+	 * @return	\IPS\Http\Url
+	 */
+	public function logoForDeviceInformation()
+	{
+		return \IPS\Theme::i()->resource( 'logos/login/Twitter.png', 'core', 'interface' );
+	}
+	
+	/**
+	 * Authorization Endpoint
+	 *
+	 * @param	\IPS\Login	$login	The login object
+	 * @return	\IPS\Http\Url
+	 */
+	protected function authorizationEndpoint( \IPS\Login $login )
+	{
+		$return = \IPS\Http\Url::external('https://api.twitter.com/oauth/authenticate');
+		
+		if ( $login->type === \IPS\Login::LOGIN_ACP or $login->type === \IPS\Login::LOGIN_REAUTHENTICATE )
+		{
+			$return = $return->setQueryString( 'force_login', 'true' );
+		}
+		
+		if ( $login->type === \IPS\Login::LOGIN_REAUTHENTICATE )
+		{
+			try
+			{
+				$token = \IPS\Db::i()->select( array( 'token_access_token', 'token_secret' ), 'core_login_links', array( 'token_login_method=? AND token_member=?', $this->id, $login->reauthenticateAs->member_id ) )->first();
+				$userDetails = $this->_userData( $token['token_access_token'], $token['token_secret'] );
+				if ( isset( $userDetails['screen_name'] ) )
+				{
+					$return = $return->setQueryString( 'screen_name', $userDetails['screen_name'] );
+				}
+			}
+			catch ( \Exception $e ) { }
+		}
+		
+		return $return;
+	}
+	
+	/**
+	 * Token Request Endpoint
+	 *
+	 * @return	\IPS\Http\Url
+	 */
+	protected function tokenRequestEndpoint()
+	{
+		return \IPS\Http\Url::external('https://api.twitter.com/oauth/request_token');
+	}
+	
+	/**
+	 * Access Token Endpoint
+	 *
+	 * @return	\IPS\Http\Url
+	 */
+	protected function accessTokenEndpoint()
+	{
+		return \IPS\Http\Url::external('https://api.twitter.com/oauth/access_token');
+	}
+	
+	/**
+	 * Get authenticated user's identifier (may not be a number)
+	 *
+	 * @param	string	$accessToken		Access Token
+	 * @param	string	$accessTokenSecret	Access Token Secret
+	 * @return	string
+	 */
+	protected function authenticatedUserId( $accessToken, $accessTokenSecret )
+	{
+		return $this->_userData( $accessToken, $accessTokenSecret )['id'];
+	}
+	
+	/**
+	 * Get authenticated user's username
+	 * May return NULL if server doesn't support this
+	 *
+	 * @param	string	$accessToken		Access Token
+	 * @param	string	$accessTokenSecret	Access Token Secret
+	 * @return	string|NULL
+	 */
+	protected function authenticatedUserName( $accessToken, $accessTokenSecret )
+	{
+		if ( $this->settings['name'] == 'screen' )
+		{
+			return $this->_userData( $accessToken, $accessTokenSecret )['screen_name'];
+		}
+		elseif ( $this->settings['name'] == 'real' )
+		{
+			return $this->_userData( $accessToken, $accessTokenSecret )['name'];
+		}
+		return NULL;
+	}
+	
+	/**
+	 * Get authenticated user's email address
+	 * May return NULL if server doesn't support this
+	 *
+	 * @param	string	$accessToken		Access Token
+	 * @param	string	$accessTokenSecret	Access Token Secret
+	 * @return	string|NULL
+	 */
+	protected function authenticatedEmail( $accessToken, $accessTokenSecret )
+	{
+		return $this->_userData( $accessToken, $accessTokenSecret )['email'];
+	}
+	
+	/**
+	 * Get user's profile photo
+	 * May return NULL if server doesn't support this
+	 *
+	 * @param	\IPS\Member	$member	Member
+	 * @return	\IPS\Http\Url|NULL
+	 * @throws	\IPS\Login\Exception	The token is invalid and the user needs to reauthenticate
+	 * @throws	\DomainException		General error where it is safe to show a message to the user
+	 * @throws	\RuntimeException		Unexpected error from service
+	 */
+	public function userProfilePhoto( \IPS\Member $member )
+	{
+		if ( !( $link = $this->_link( $member ) ) )
+		{
+			throw new \IPS\Login\Exception( NULL, \IPS\Login\Exception::INTERNAL_ERROR );
+		}
+				
+		$userData = $this->_userData( $link['token_access_token'], $link['token_secret'] );
+		if ( !$userData['default_profile_image'] )
+		{
+			return \IPS\Http\Url::external( str_replace( '_normal', '', $userData['profile_image_url_https'] ?: $userData['profile_image_url'] ) );
+		}
+		return NULL;
+	}
+		
+	/**
+	 * Get user's cover photo
+	 * May return NULL if server doesn't support this
+	 *
+	 * @param	\IPS\Member	$member	Member
+	 * @return	\IPS\Http\Url|NULL
+	 * @throws	\IPS\Login\Exception	The token is invalid and the user needs to reauthenticate
+	 * @throws	\DomainException		General error where it is safe to show a message to the user
+	 * @throws	\RuntimeException		Unexpected error from service
+	 */
+	public function userCoverPhoto( \IPS\Member $member )
+	{
+		if ( !( $link = $this->_link( $member ) ) )
+		{
+			throw new \IPS\Login\Exception( NULL, \IPS\Login\Exception::INTERNAL_ERROR );
+		}
+				
+		$userData = $this->_userData( $link['token_access_token'], $link['token_secret'] );		
+		if ( isset( $userData['profile_banner_url'] ) and $userData['profile_banner_url'] )
+		{
+			return \IPS\Http\Url::external( $userData['profile_banner_url'] );
+		}
+		
+		return NULL;
+	}
+	
+	/**
+	 * Get user's statuses since a particular date
+	 *
+	 * @param	\IPS\Member			$member	Member
+	 * @param	\IPS\DateTime|NULL	$since	Date/Time to get statuses since then, or NULL to get the latest one
+	 * @return	array
+	 * @throws	\IPS\Login\Exception	The token is invalid and the user needs to reauthenticate
+	 * @throws	\DomainException		General error where it is safe to show a message to the user
+	 * @throws	\RuntimeException		Unexpected error from service
+	 */
+	public function userStatuses( \IPS\Member $member, \IPS\DateTime $since = NULL )
+	{
+		if ( !( $link = $this->_link( $member ) ) )
+		{
+			throw new \IPS\Login\Exception( NULL, \IPS\Login\Exception::INTERNAL_ERROR );
+		}
+						
+		$return = array();
+		$response = $this->_sendRequest( 'get', \IPS\Http\Url::external('https://api.twitter.com/1.1/statuses/user_timeline.json'), $since ? array() : array( 'count' => 1 ), $link['token_access_token'], $link['token_secret'] )->decodeJson();
+		foreach ( $response as $statusData )
+		{
+			if ( $since and strtotime( $statusData['created_at'] ) < $since->getTimestamp() )
+			{
+				break;
+			}
+			
+			$status = \IPS\core\Statuses\Status::createItem( $member, $member->ip_address, new \IPS\DateTime( $statusData['created_at'] ) );
+			$status->content = $this->_parseStatusText( $member, nl2br( $statusData['text'], FALSE ) );
+					
+			$return[] = $status;
+		}
+		
+		return $return;
+	}
+	
+	/**
+	 * Get link to user's remote profile
+	 * May return NULL if server doesn't support this
+	 *
+	 * @param	string	$identifier	The ID Nnumber/string from remote service
+	 * @param	string	$username	The username from remote service
+	 * @return	\IPS\Http\Url|NULL
+	 * @throws	\IPS\Login\Exception	The token is invalid and the user needs to reauthenticate
+	 * @throws	\DomainException		General error where it is safe to show a message to the user
+	 * @throws	\RuntimeException		Unexpected error from service
+	 */
+	public function userLink( $identifier, $username )
+	{
+		return \IPS\Http\Url::external( "https://twitter.com/" )->setPath( $username );
+	}
+	
+	/**
+	 * Syncing Options
+	 *
+	 * @param	\IPS\Member	$member			The member we're asking for (can be used to not show certain options iof the user didn't grant those scopes)
+	 * @param	bool		$defaultOnly	If TRUE, only returns which options should be enabled by default for a new account
+	 * @return	array
+	 */
+	public function syncOptions( \IPS\Member $member, $defaultOnly = FALSE )
+	{
+		$return = array();
+		
+		if ( !isset( $this->settings['update_email_changes'] ) or $this->settings['update_email_changes'] === 'optional' )
+		{
+			$return[] = 'email';
+		}
+		
+		if ( isset( $this->settings['update_name_changes'] ) and $this->settings['update_name_changes'] === 'optional' and isset( $this->settings['name'] ) and $this->settings['name'] != 'any' )
+		{
+			$return[] = 'name';
+		}
+		
+		$return[] = 'photo';
+		$return[] = 'cover';
+		
+		if ( \IPS\Settings::i()->profile_comments and isset( $this->settings['allow_status_import'] ) and $this->settings['allow_status_import'] )
+		{
+			$return[] = 'status';
+		}
+		
+		return $return;
+	}
+	
+	/**
+	 * @brief	Cached user data
+	 */
+	protected $_cachedUserData = array();
+	
+	/**
+	 * Get user data
+	 *
+	 * @param	string	$accessToken		Access Token
+	 * @param	string	$accessTokenSecret	Access Token Secret
+	 * @return	array
+	 * @throws	\IPS\Login\Exception	The token is invalid and the user needs to reauthenticate
+	 * @throws	\RuntimeException		Unexpected error from service
+	 */
+	protected function _userData( $accessToken, $accessTokenSecret )
+	{
+		if ( !isset( $this->_cachedUserData[ $accessToken ] ) )
+		{
+			$response = $this->_sendRequest( 'get', \IPS\Http\Url::external('https://api.twitter.com/1.1/account/verify_credentials.json'), array( 'include_email' => 'true' ), $accessToken, $accessTokenSecret )->decodeJson();
+			if ( isset( $response['errors'] ) )
+			{
+				throw new \IPS\Login\Exception( $response['errors'][0]['message'], \IPS\Login\Exception::INTERNAL_ERROR );
+			}
+			
+			$this->_cachedUserData[ $accessToken ] = $response;
+		}
+		return $this->_cachedUserData[ $accessToken ];
+	}
+	
+	/**
+	 * Post something to Twitter
+	 *
+	 * @param	\IPS\Member			$member		Member posting
+	 * @param	string				$content	Content to post
+	 * @param	\IPS\Http\Url|NULL	$url		Optional link
+	 * @return	void
+	 */
+	public function postToTwitter( \IPS\Member $member, $content, \IPS\Http\Url $url = NULL )
+	{
+		if ( !( $link = $this->_link( $member ) ) )
+		{
+			return FALSE;
+		}
+		
+		$data = array( 'status' => $content );
+		
+		if ( $url !== NULL )
+		{
+			if ( !isset( \IPS\Data\Store::i()->twitter_config ) or \IPS\Data\Store::i()->twitter_config['time'] > time() - 86400 )
+			{
+				$response = $this->_sendRequest( 'get', \IPS\Http\Url::external('https://api.twitter.com/1.1/help/configuration.json'), array(), $link['token_access_token'], $link['token_secret'] )->decodeJson();
+				\IPS\Data\Store::i()->twitter_config = array_merge( $response, array( 'time' => time() ) );
+			}
+			$maxUrlLen = \IPS\Data\Store::i()->twitter_config['short_url_length'];
+			$data['status'] = mb_substr( $data['status'], 0, ( 140 - ( $maxUrlLen + 1 ) ) ) . ' ' . $url;
+		}
+				
+		$response = $this->_sendRequest( 'post', \IPS\Http\Url::external('https://api.twitter.com/1.1/statuses/update.json'), $data, $link['token_access_token'], $link['token_secret'] )->decodeJson();
+
+		return isset( $response['id_str'] );
+	}
+	
+	/* ! Social Promotes */
+	
+	/**
+	 * Request a token
+	 *
+	 * @param	\IPS\Http\Url	$callback		Callback URK
+	 * @return	string
+	 */
+	public function requestToken( $callback )
+	{
+		return $this->_sendRequest( 'get', $this->tokenRequestEndpoint(), array( 'oauth_callback' => (string) $callback ) )->decodeQueryString('oauth_token');
+	}
+	
+	/**
+	 * Get authenticated user's identifier (may not be a number)
+	 *
+	 * @param	string	$verifier			Verifier
+	 * @param	string	$accessTokenSecret	Access Token
+	 * @return	array
+	 */
+	public function exchangeToken( $verifier, $accessToken )
+	{
+		return $this->_sendRequest( 'post', $this->accessTokenEndpoint(), array( 'oauth_verifier' => $verifier ), $accessToken )->decodeQueryString('user_id');
+	}
+	
+	/**
+	 * Can we publish to this twitter account?
+	 *
+	 * @param	string	$accessToken		Access Token
+	 * @param	string	$accessTokenSecret	Access Token Secret
+	 * @return	boolean
+	 */
+	public function hasWritePermissions( $accessToken, $accessTokenSecret )
+	{
+		try
+		{
+			$response = $this->_sendRequest( 'get', \IPS\Http\Url::external('https://api.twitter.com/1.1/account/verify_credentials.json'), array(), $accessToken, $accessTokenSecret );
+			
+			if ( $response->httpHeaders['x-access-level'] == 'read' )
+			{
+				return FALSE;
+			}
+			
+			$response->decodeJson();
+			
+			return TRUE;
+		}
+		catch ( \IPS\Http\Request\Exception $e ) { }
+		
+		return FALSE;
+	}
+	
+	/**
+	 * Send a status
+	 *
+	 * @param	array	$data				Post data to send
+	 * @param	string	$accessToken		Access Token
+	 * @param	string	$accessTokenSecret	Access Token Secret
+	 * @return	boolean
+	 */
+	public function sendStatus( $data, $accessToken, $accessTokenSecret )
+	{
+		return $this->_sendRequest( 'post', \IPS\Http\Url::external("https://api.twitter.com/1.1/statuses/update.json"), $data, $accessToken, $accessTokenSecret )->decodeJson();
+	}
+	
+	/**
+	 * Send media
+	 *
+	 * @param	array	$contents			Photo contents
+	 * @param	string	$accessToken		Access Token
+	 * @param	string	$accessTokenSecret	Access Token Secret
+	 * @return	boolean
+	 */
+	public function sendMedia( $contents, $accessToken, $accessTokenSecret )
+	{
+		$mimeBoundary = sha1( microtime() );
+		
+		$data = '--' . $mimeBoundary . "\r\n";
+        $data .= 'Content-Disposition: form-data; name="media";' . "\r\n";
+        $data .= 'Content-Type: application/octet-stream' . "\r\n" . "\r\n";
+        $data .= $contents . "\r\n";
+        $data .= '--' . $mimeBoundary . '--' . "\r\n" . "\r\n";
+	        
+		return $this->_sendRequest( 'post', \IPS\Http\Url::external('https://upload.twitter.com/1.1/media/upload.json'), array(), $accessToken, $accessTokenSecret, array(), array( $mimeBoundary, $data ) )->decodeJson();
+	}
+}