woothemes/woocommerce — pull request #5270 by maxrice (2014-04-03 21:02:41+00:00)
Title: Normalize both key and value before generating OAuth signature

The existing OAuth code uses `array_walk` to normalize parameters (URL decode/encode) prior to generating the OAuth signature, but doesn't appear to properly normalize the parameter key which is likely due to this:

>Only the values of the array may potentially be changed; its structure cannot be altered, i.e., the programmer cannot add, unset or reorder elements. If the callback does not respect this requirement, the behavior of this function is undefined, and unpredictable.

see [`array_walk`](http://us2.php.net/array_walk)

Because the OAuth 1.0a spec indicates that the full query string should be normalized prior to generating the signature, our implementation is not correct.

This pull fixes that by properly normalizing both the parameter key and value properly (URL decoding, then re-encoding, and double-encoding %) which ensures the implementation conforms to the spec. This is particularly important for clients using 3rd party libraries (say, Ruby or iOS OAuth libs) that match the spec.

This can potentially break some integrations that are coded against this bug, but I think it's better to fix it now rather than wait.

cc @kloon - wanted to get your input on this as you'll need to update the PHP client library to match this :)