It appears that the Twitter module does not pass an oauth_callback parameter when creating connections (authorising accounts).
This is an issue on multi-domain sites that share the same code base and database.
Twitter allows multiple domains to be authorised for callbacks, however, unless a client actually passes oauth_callback these are clearly not used and the default callback will be. Say these sites share the same code and database:
exampleone.com
egtwo.com
A developer picks exampleone.com as the default callback on the twitter config (http://exampleone.com/twitter/oauth) but also authorises egtwo.com.
When a user on egtwo.com links their account, oauth_callback should be sent to Twitter to have it return the user to http://egtwo.com/twitter/oauth but this is not done. The user actually ends up on http://exampleone.com/twitter/oauth which sees an invalid request and the account link is not finalised.
At the very least it would be nice if the module checked a config variable that one could set in their multi-site settings.php which would only be used if present.
The only other workaround would be to create many Twitter aps - one for each multi-site domain which isn't nice.
| Comment | File | Size | Author |
|---|---|---|---|
| #35 | twitter-n940060-35-7.x-5.x.patch | 2.98 KB | damienmckenna |
| #34 | twitter-n940060-34-7.x-6.x.patch | 3.07 KB | damienmckenna |
| #33 | twitter-n940060-32-6.x-5.x.patch | 3.14 KB | damienmckenna |
Comments
Comment #1
skizzo commentedsubscribing.
Having similar problem with:
one.example.com
two.example.com
...
Comment #2
pedrospSubscribing
Comment #3
raintonr commented+1 for this.
We have a family of sites using the same codebase and database on different domains (standard Drupal multisite setup), but it would be annoying to have to create a twitter application for each site.
At the moment they cannot share the same Twitter application though and everyone has to login and authorise on one specific site in the family which is configured on dev.twitter.com.
This issue would solve that problem.
Comment #4
raintonr commentedSo... I had a quick look at this.
Reading the Twitter doco seems that if one wants to use the non-default callback it has to be setup in the initial token request.
That means a change to the function
get_request_tokenintwitter.lib.php.I did try quickly modifying this to pass an array of params (
array('oauth_callback' => 'example.com')) toauth_requestbut that didn't work.Any suggestions?
Comment #5
raintonr commentedLOL... my bad. Just had a thought about what I did and turns out constructed the array incorrectly in the code (was correct in the comment). Fixed that up and yes, it does work. Hurrah!
To make this change, simply edit
twitter.lib.phpand change line 291 from this:To this:
Comment #6
michaek commentedI'm surprised that specifying a different domain in the callback is allowed, as I would have thought Twitter would restrict that. However, I think it could be desirable to test this and get it into the module. Could you roll a patch against the current dev?
Comment #7
raintonr commentedPatch? For a one line change? :(
Comment #8
michaek commentedYes, that's what I was asking. There are a lot of open issues on this module, and I don't have a lot of time, so I'll generally try to encourage people to get issues as close to committable as possible. If rolling a patch is prohibitive for you, can you check that the line number hasn't changed in the current dev release?
Comment #9
jon pughPatch attached, $params is now optional for $twitter->get_request_token();
Comment #10
dabblela commented+1 for this change, but having trouble applying the patch:
Hunk #2 FAILED at 314.
Trying against 3.0beta2, but also tried against -dev.
Comment #11
univate commentedNot sure where the main focus is on this module, but assuming development focus is on Drupal 7 I can confirm the the patch in #9 applies and works as required on the current 7.x-3.x-dev
Comment #12
univate commentedJust re-rolling this patch in the correct git -p1 format
Comment #13
justindodge commentedHi guys - I think this is an excellent functional enhancement for the twitter connect feature as well.
I was simply wanting to have mydomain.com and www.mydomain.com work with the twitter_signin.module, so I added your logic to the token generation there, and it works like a charm.
Here's the patch from #12 but with the sign in bit added.
Comment #14
pedrospAny chance to have a similar patch for 6x ?
Thanks
Comment #15
Pedro Lozano commentedThe last patch works pretty well for me.
+1 to adding this functionality.
Comment #16
13rac1 commentedPatch needs updating for 7.x-5.x-dev. Does not apply anymore.
Comment #17
damienmckennaTriggering the testbot.
Comment #18
damienmckennaTriggering the testbot.
Comment #19
damienmckennaRerolled, though untested.
Comment #20
damienmckennaFixed a bug in twitter_oauth_callback_form_validate() with an undefined $token variable.
Comment #28
damienmckennaRerolled.
Comment #30
damienmckennaRerolled.
Comment #31
damienmckennaPorted to 7.x-6.x.
Comment #33
damienmckennaPorted to 6.x-5.x.
Comment #34
damienmckennaForgot that the callback URL was updated to be loaded from a variable. This is for 7.x-6.x.
Comment #35
damienmckennaPorted to 7.x-5.x.
Comment #38
damienmckennaCommitted. Thanks all!