2012-03-19 153 views
2

我如何才能將我的應用程序的manage_pages權限設置爲僅限特定頁面。現在我的應用程序獲得管理fb用戶的所有頁面的權限..我如何限制此功能並僅獲得訪問特定頁面的權限?如何將manage_pages權限設置爲特定的Facebook頁面?

我正在使用一種簡單的身份驗證方法。

$app_id  = 'xxxxxxxxxxxxx'; 
$app_secret = 'xxxxxxxxxxxxxxxx'; 
$my_url  = 'http://xxxxxxxxxxx.com/xxxx/facebook?client=params'; 

$code  = $_REQUEST["code"]; 

//auth user 
if(empty($code)) { 
$dialog_url = 'https://www.facebook.com/dialog/oauth?client_id=' 
       . $app_id . '&redirect_uri=' . urlencode($my_url).'&scope=offline_access,read_stream,publish_stream,manage_pages'; 
       echo("<script>top.location.href='" . $dialog_url . "'</script>"); 
      } 

//get user access_token 
$token_url = 'https://graph.facebook.com/oauth/access_token?client_id=' 
      . $app_id . '&redirect_uri=' . urlencode($my_url) 
      . '&client_secret=' . $app_secret 
      . '&code=' . $code; 
$access_token = file_get_contents($token_url); 


am using the above code for authentication. when i try to print the $_REQUEST params, i couldnt find any variable names 'signed_request'. is any other method can we use with the above code..?? 

回答

2

不幸的是,這是不可能的。非常惱人,但好..它是Facebook,所以沒有別的東西可以期待。

0

你應該從你身邊這樣做。 Facebook將送你的頁面ID的signed_request以便您可以驗證的頁面,並顯示/禁用內容:

<?php 
if(!empty($_REQUEST["signed_request"])) { 
    $app_secret = "APP_SECRET"; 
    $data = parse_signed_request($_REQUEST["signed_request"], $app_secret); 

    if (isset($data["page"])) { 
     echo $data["page"]["id"]; 
    } else { 
     echo "Not in a page"; 
    } 
} 

function parse_signed_request($signed_request, $secret) { 
    list($encoded_sig, $payload) = explode('.', $signed_request, 2); 

    // decode the data 
    $sig = base64_url_decode($encoded_sig); 
    $data = json_decode(base64_url_decode($payload), true); 

    if (strtoupper($data['algorithm']) !== 'HMAC-SHA256') { 
     error_log('Unknown algorithm. Expected HMAC-SHA256'); 
     return null; 
    } 

    // check sig 
    $expected_sig = hash_hmac('sha256', $payload, $secret, $raw = true); 
    if ($sig !== $expected_sig) { 
     error_log('Bad Signed JSON signature!'); 
     return null; 
    } 

    return $data; 
} 

function base64_url_decode($input) { 
    return base64_decode(strtr($input, '-_', '+/')); 
} 

此代碼是從this答案服用。只需檢查$data["page"]["id"]針對你想要的。