phpSmug 3.5 - PHP Wrapper for the SmugMug API
Written by Colin Seymour
Project Homepage: http://phpSmug.com/, (*1)
phpSmug is a PHP wrapper class for the SmugMug API and is based on work done by
Dan Coulter in phpFlickr ., (*2)
Released under GNU General Public License version 3, (*3)
Copyright (C) 2008 Colin Seymour, (*4)
This file is part of phpSmug.
phpSmug is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by the Free
Software Foundation, either version 3 of the License, or (at your option)
any later version.
phpSmug is distributed in the hope that it will be useful, but WITHOUT ANY
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
details.
You should have received a copy of the GNU General Public License along
with phpSmug. If not, see <http://www.gnu.org/licenses/>.
For more information about the class and upcoming tools and applications using
phpSmug, visit http://phpsmug.com/., (*5)
Please help support the maintenance and development of phpSmug by making a
donation., (*6)
What's New in phpSmug 3.5
phpSmug 3.5 introduces the ability for you to now embed images that are not marked
as externally linkable ("External links" is set to "No" within your SmugMug album
settings) into external websites by introducing a new method signResource()
., (*7)
See the Display Unlinkable Images section below for more details., (*8)
This README file is now in Markdown format instead of plaintext., (*9)
Requirements
phpSmug is written in PHP and utilises functionality supplied with PHP 5.2 and
later and optionally PEAR., (*10)
From a PHP perspective, the only requirement is PHP 5.2 compiled with GD and
optionally, curl support enabled., (*11)
If you wish to use a database for caching, you will also need the following
PEAR packages:, (*12)
Please consult the above links for details on installing the PEAR modules., (*13)
Installation
Copy the files from the installation package into a folder on your server.
They need to be readable by your web server. You can put them into an include
folder defined in your php.ini file, if you like, though it's not required., (*14)
Usage
To use phpSmug, all you have to do is include the file in your PHP scripts and
create an instance. For example:, (*15)
require_once("phpSmug/phpSmug.php");
$f = new phpSmug(... arguments go here ...);
The constructor takes up to five arguments depending on which SmugMug API
endpoint and authentication mechanism you wish to use:, (*16)
-
APIKey
- Required for ALL endpoints, (*17)
This is the API key you have obtained for your application from
http://www.smugmug.com/hack/apikeys., (*18)
-
OAuthSecret
- Required for OAuth authentication (1.2.2 endpoint ONLY)
Default: NULL, (*19)
This is the secret assigned to your API key and is displayed in the
Settings tab of the SmugMug Control Panel. If no secret is displayed,
select "change" next to the API key your application will use and click
"save". A secret will be generated for you., (*20)
If you are not using OAuth authentication, then you don't need to worry
about this argument., (*21)
-
AppName
- Optional
Default: NULL, (*22)
This is the name, version and URL of the application you have built using
the phpSmug. There is no required format, but something like:, (*23)
"My Cool App/1.0 (http://my.url.com)"
... would be very useful., (*24)
Whilst this isn't obligatory, it is recommended as it helps SmugMug
identify the application that is calling the API in the event one of your
users reporting a problem on the SmugMug forums., (*25)
-
APIVer
- Optional
Default: 1.2.0, (*26)
Use this to set the endpoint you wish to use. The default is 1.2.0 as
this is the latest "Stable" endpoint provided by SmugMug., (*27)
Arguments to all phpSmug methods must be provided as a series of strings or an
associative array. For example:, (*28)
-
Arguments as strings:, (*29)
$f = new phpSmug("APIKey=12345678",
"AppName=My Cool App/1.0 (http://app.com)",
"APIVer=1.2.2");
-
Arguments as an associative array:, (*30)
$f = new phpSmug(array("APIKey" => "12345678",
"AppName" => "My Cool App/1.0 (http://app.com)",
"APIVer" => "1.2.2")
);
Naturally, you can predefine the array before instantiating the object and just
pass the array variable., (*31)
phpSmug implements all methods and arguments as documented in the SmugMug API
documentation., (*32)
To call a method, remove the "smugmug." part of the name and replace any
fullstops with underscores. For example, instead of smugmug.images.get
, you
would call images_get()
., (*33)
Remember: ALL function names and arguments ARE case sensitive., (*34)
There is no need to pass the SessionID
or oauth_token*
arguments to the
various methods as phpSmug will automatically pass these, where applicable,
unless otherwise documented. The exception is when using phpSmug to go through
the OAuth authorization process detailed later., (*35)
images_upload()
does not use the API for uploading, but instead HTTP PUT as
recommended by SmugMug at http://wiki.smugmug.net/display/SmugMug/Uploading, (*36)
HTTP PUT has been chosen as it's quicker, easier to use and more reliable than
the other methods., (*37)
Authentication
You must authenticate with SmugMug in order to use the API., (*38)
With the release of version 1.2.2 of the SmugMug API, there are now two methods
to authenticate with SmugMug: standard email/password or userid/hash or OAuth.
phpSmug allows you to implement either method in your application., (*39)
Note: The 1.3.0 API endpoint only supports OAuth authentication., (*40)
-
Method 1: EmailAddress/Password or UserID/Hash:, (*41)
This sets up your session ID required for interaction with the API using
this authentication method., (*42)
login()
without any arguments will log you in anonymously and will allow
you to access any public gallery, image or sharegroup., (*43)
If you wish to access private albums and images, upload or change
settings, you will need to login by providing either an
EmailAddress/Password or UserID/Hash combination to login., (*44)
For example, to login using an email address and password:, (*45)
$f->login("EmailAddress=you@domain.com", "Password=secretpassword");
To login using a UserID and password hash (obtained from a previous
Email/Password login):, (*46)
$f->login("UserID=<value>", "PasswordHash=<value>");
Both methods will use HTTPS/SSL to ensure your username and password
information is encrypted., (*47)
Using a UserID and hash is probably the most secure method as your email
and password can not be determined from the hash. However, in order to
obtain the hash and UserID, you need to login at least once using
login()
with the EmailAddress/Password combination., (*48)
-
Method 2: OAuth:, (*49)
This is the most secure of all the methods as your username and password
are only ever entered on the SmugMug website. If you've used Flickr's
API, this very similar to the authorisation functionality Flickr uses., (*50)
Authenticating using OAuth is a 3 step process., (*51)
-
First, you need to request an unauthorised request token:, (*52)
$resp = $f->auth_getRequestToken();
Once you've obtained the token, you need to use it to direct the user to
SmugMug to authorise your application. You can do this in a variety of
ways. It's up to you as the application developer to choose which method
suits you. Ultimately, you need to direct the user to
http://api.smugmug.com/services/oauth/authorize.mg with the required
"Access", "Permissions" and the "oauth_token" arguments., (*53)
phpSmug provides a simple method that generates a link you can use for
redirection or for the user to click (it also takes care of passing the
OAuth token too):, (*54)
echo '<a href="'.$f->authorize("Access=[Public|Full]", "Permissions=[Read|Add|Modify]").'">Authorize</a>';
"Public" and "Read" are the default options for Access and Permissions
respectively, so you can leave them out if you only need these permissions., (*55)
-
Once the user has authorized your application, you will need to request
the access token and access token secret (once again phpSmug takes care of
passing the relevant OAuth token):, (*56)
$token = $f->auth_getAccessToken();
You will need to save the token and token secret returned by the
auth_getAccessToken()
call in your own location for later use., (*57)
-
Once you've saved the token and token secret, you will no longer need to
use any of the authentication methods above. Simply call
setToken("id=<value>", "Secret=<value>")
and pass the token ID and token
secret immediately after instantiating your object instance., (*58)
For example:, (*59)
$f = new phpSmug(array("APIKey" => "12345678",
"AppName" => "My Cool App/1.0 (http://app.com)",
"APIVer" => "1.2.2")
);
$f->setToken("id=<value>", "Secret=<value>");
By default, phpSmug uses the HMAC-SHA1 signature method. This is the most
secure signature method. If you wish to use PLAINTEXT, simply set the
oauth_signature_method
class variable to PLAINTEXT
., (*60)
$f->oauth_signature_method = 'PLAINTEXT';
Caching
Caching can be very important to a project as it can drastically improve the
performance of your application., (*61)
phpSmug has caching functionality that can cache data to a database or files,
you just need to enable it., (*62)
It is recommended that caching is enabled immediately after a new phpSmug
instance is created, and before any other phpSmug methods are called., (*63)
To enable caching, use the enableCache()
function., (*64)
The enableCache()
function takes 4 arguments:, (*65)
-
type
- Required
This is "db" for database or "fs" for filesystem., (*66)
-
dsn
- Required for type=db
This a PEAR::MDB2 DSN connection string, for example:, (*67)
mysql://user:password@server/database
phpSmug uses the MDB2 PEAR module to interact with the database if you use
database based caching. phpSmug does NOT supply the necessary PEAR
modules. If you with to use a database for caching, you will need to
download and install PEAR, the MDB2 PEAR module and the corresponding
database driver yourself. See MDB2 Manual for details., (*68)
-
cache_dir
- Required for type=fs, (*69)
This is the folder/directory that the web server has write access to. This
directory must already exist., (*70)
Use absolute paths for best results as relative paths may have unexpected
behaviour. They'll usually work, you'll just want to test them., (*71)
You may not want to allow the world to view the files that are created
during caching. If you want to hide this information, either make sure
that your permissions are set correctly, or prevent the webserver from
displaying *.cache files., (*72)
In Apache, you can specify this in the configuration files or in a
.htaccess file with the following directives:, (*73)
<FilesMatch "\.cache$">
Deny from all
</FilesMatch>
Alternatively, you can specify a directory that is outside of the web
server's document root., (*74)
-
cache_expire
- Optional
Default: 3600, (*75)
This is the maximum age of each cache entry in seconds., (*76)
-
table
- Optional
Default: smugmug_cache, (*77)
This is the database table name that will be used for storing the cached
data. This is only applicable for database (db) caching and will be
ignored if included for filesystem (fs) caching., (*78)
If the table does not exist, phpSmug will attempt to create it., (*79)
Each of the caching methods can be enabled as follows:, (*80)
Filesystem based cache:, (*81)
$f->enableCache("type=fs", "cache_dir=/tmp", "cache_expire=86400" );
Database based cache:, (*82)
$f->enableCache("type=db", "dsn=mysql://USERNAME:PASSWORD_database", "cache_expire=86400");
If you have caching enabled, and you make changes, it's a good idea to call
clearCache()
to refresh the cache so your changes are reflected immediately., (*83)
Display Unlinkable Images
Note: This option is only available if you are using OAuth authentication., (*84)
By default, when you create a new gallery within SmugMug, you will be able to
display/embed the images from within this gallery on external websites. If you
change the gallery settings and set "External links" to "No", you will no longer
be able to do that., (*85)
If you are using OAuth authentication, you can however sign your image URLs with
your OAuth credentials using signResource()
and display those images on an
external site., (*86)
For example, you can display your "unlinkable" images using:, (*87)
<img src=" . $f->signResource( $img['TinyURL'] ) . " />
See the example-external-links.php
for a complete implementation example., (*88)
Keep in mind, these links are time based so you will need to regenerate the links every
time the page is loaded. This may affect the rendering performance of the page
containing these "signed" images., (*89)
As these links are time based, you won't be able to cache the HTML output, but you
can still use the caching mechanisms supplied with phpSmug to cache the raw API
data., (*90)
Uploading
Uploading is very easy. You can either upload an image from your local system,
or from a location on the web., (*91)
In order to upload, you will need to have logged into SmugMug and have the
album ID of the album you wish to upload to., (*92)
Then it's just a matter of calling the method with the various optional
parameters., (*93)
For example, upload a local file using:, (*94)
$f->images_upload("AlbumID=123456", "File=/path/to/image.jpg");
... or from a remote site using:, (*95)
$f->images_uploadFromURL("AlbumID=123456", "URL=http://my.site.com/image.jpg");
If you want the file to have a specific name on SmugMug, then add the optional
"FileName" argument. If you don't specify a filename, the source filename will
be used., (*96)
You can find a list of optional parameters, like caption and keywords on the
API documentation page., (*97)
Replacing Photos
Replacing photos is identical to uploading. The only difference is you need to
specify the ImageID of the image you wish to replace., (*98)
Other Notes
-
By default, phpSmug will attempt to use Curl to communicate with the
SmugMug API endpoint if it's available. If not, it will revert to using
sockets based communication using fsockopen()
. If you wish to force the
use of sockets, you can do so using the phpSmug supplied `setAdapter()'
right after instantiating your instance:, (*99)
$f = new phpSmug("APIKey=<value>");
$f->setAdapter("socket");
Valid arguments are "curl" (default) and "socket"., (*100)
-
Some people will need to use phpSmug from behind a proxy server. You can
use the setProxy()
method to set the appropriate proxy settings., (*101)
For example:, (*102)
$f = new phpSmug("APIKey=<value>");
$f->setProxy("server=<proxy_server>", "port=<value>");
All your calls will then pass through the specified proxy on the specified
port., (*103)
If your proxy server requires a username and password, then add those
options to the setProxy()
method arguments too., (*104)
For example:, (*105)
$f = new phpSmug("APIKey=<value>");
$f->setProxy("server=<proxy_server>",
"port=<value>",
"username=<proxy_username>",
"password=<proxy_password>");
-
By default phpSmug only uses HTTPS for authentication related methods like
all the login*()
and *Token()
methods. You can however force the use
of HTTPS for ALL API calls, with the exception of uploads, by calling
setSecureOnly()
immediately after instantiating the object., (*106)
For example:, (*107)
$f = new phpSmug("APIKey=<value>");
$f->setSecureOnly();
NOTE: Forcing the use of HTTPS for ALL API communication may have an
impact on performance as HTTPS is inherently slower than HTTP., (*108)
-
If phpSmug encounters an error, or SmugMug returns a "Fail" response, an
exception will be thrown and your application will stop executing. If
there is a problem with communicating with the endpoint, a
HttpRequestException will be thrown. If an error is detected elsewhere, a
PhpSmugException will be thrown., (*109)
It is recommended that you configure your application to catch exceptions
from phpSmug., (*110)
-
SmugMug occasionally puts the SmugMug site into read-only mode in order to
carry out maintenance. SmugMug's mode is now stored in the mode object
variable (eg $f->mode
for easy checking of SmugMug's status. Note, this
is not set for login()
methods as the API doesn't return the mode for
logins because you can't login when SmugMug is in read-only mode. If
SmugMug is not in read-only mode, this variable is empty., (*111)
Examples
phpSmug comes with 3 examples to help get you on your way. All 3 examples
perform the same thing, just using differing authentication methods. They all
show thumbnails of the first album found for the respective authentication
methods:, (*112)
-
example-login.php
illustrates a username/password login., (*113)
-
example-anon.php
illustrates an anonymous login., (*114)
-
example-oauth.php
illustrates an OAuth login., (*115)
-
example-external-links.php
illustrates displaying unlinkable images., (*116)
You can see the anonymous and OAuth login examples in action at
http://phpsmug.com/examples., (*117)
And that's all folks., (*118)
Keep up to date on developments and enhancements to phpSmug on it's new
dedicated site at http://phpsmug.com/., (*119)
If you encounter any problems with phpSmug, please check the list of known
issues with phpSmug and the API itself at http://phpsmug.com/bugs., (*120)
If you are using phpSmug and wish to let the world know, drop me a line via the
contact form at http://phpsmug.com/about or Tweet using the #phpSmug hashtag
and I'll add a link and brief description to the sidebar on http://phpsmug.com/., (*121)
If you use and find phpSmug useful, please help support its maintenance and
development by making a donation., (*122)
This document is also available online at http://phpsmug.com/docs., (*123)
Change History
-
3.5 - 2 Mar '13', (*124)
- Added ability to sign an image URL with OAuth authentication parameters
to allow embedding of "non-external" images within external sites.
Fixes Ticket #16.
- Added example-external-links.php example to demonstrate the above.
- Switched to using Markdown for the README file.
-
3.4 - 21 Jun '11, (*125)
- Added missing hidden header for image uploads that should be hidden.
Fixes Ticket #12.
-
3.3 - 3 Jun '11, (*126)
- Worked around bizarre behaviour in the way PHP's
implode()
and
http_build_query()
handle associative array keys with empty values.
Fixes Ticket #11.
-
3.2 - 30 May '11, (*127)
- Improved support for the 1.3.0 API endpoint (Ticket #10)
- Implemented the ability to force all API communication to occur
securely over HTTPS. OAuth Only. (Ticket #9)
- phpSmug now uses the documented secure.smugmug.com API endpoints
(Ticket #8)
- Updated OAuth example to use new Album URL and to remove its use of
the deprecated
session_unregister()
PHP function.
-
3.1 - 28 Mar '11, (*128)
- phpSmug now defaults to using the 1.2.2 API endpoint. All earlier
endpoints are still available, but technically deprecated by SmugMug.
- Removed erroneous re-instantiation of processor when setting adapter.
- Corrected check for safe_dir OR open_basedir so fails over to socket
connection correctly
- Improved connection settings
-
3.0 - 13 Nov '10, (*129)
- The
setProxy()
method now allows you to set a proxy username and
password.
- OAuth token setting now works correctly again (Ticket #7).
- phpSmug no longer depends on PEAR so no longer ships any PEAR modules.
- phpSmug is now 100% PHP 5 E_STRICT compliant (Ticket #2).
- phpSmug is now licensed under the GPLv3 license.
-
2.2 - 21 Jul '10, (*130)
- https is forced for all calls that use OAuth with the PLAINTEXT
signature method. WARNING: Uploads are however rejected by the API if
you use PLAINTEXT (which is NOT the default).
- Failed upload responses and smugmug.auth.* method responses are no
longer cached.
- Upload filenames are now encoded to ensure spaces and non-ascii
characters are correctly handled.
-
images_upload()
now honours any earlier setProxy()
calls so uploads
can occur through that proxy.
-
clearCache()
now takes a boolean argument to state whether you want
the cache location to be removed when the cache is cleared. Default
is FALSE, ie the cache location will NOT be removed
- Added methods to handle calling of the various login.* methods
offered by the API when using these instead of the single
login()
method offered by phpSmug. (Ticket #6)
- For my own benefit, I've now implemented a full PHPUnit test suite
that checks all functionality of phpSmug.
-
2.1 - 27 Sep '09, (*131)
- Changed image_upload method to upload to upload.smugmug.com instead
of api.smugmug.com. SmugMug made changes to enforce the use of
upload.smugmug.com as uploading to api.smugmug.com was causing
problems. (Ticket #5)
- Resolved issue with recaching of cached data (Ticket #4).
- SmugMug's mode (ie read-only etc) is now stored in $obj->mode for
easy checking of SmugMug's status.
- Corrected "login with hash" example in the README file.
-
2.0.2 - 22 Feb '09, (*132)
- Tidied up code so phpSmug.php is E_STRICT compliant and doesn't
report any notice messages.
- Force error log level to be lower than E_STRICT due to limitation of
PEAR modules (See notes in Ticket #2).
- Resolved over-zealous clearCache() function (Ticket #3).
-
2.0.1 - 7 Nov '08, (*133)
- Resolved issue where error code was not passed to Exception() line
350 (Ticket #1)
-
2.0 - 30 Oct '08, (*134)
- Removed
die_on_error
functionality in favour of exceptions
- Remove
getErrorCode()
and getErrorMsg()
functions as no longer
provide die_on_error
functionality. Error codes and msgs are passed
via Exception.
- Tidied up PEAR pkgs included to only include the bare minimum (these
are provided to ease implementation after all)
- Updated HTTP_Request to 1.4.3
- Added OAuth support for 1.2.2 endpoint. Defaults to using HMAC-SHA1
as it's the most secure with minimal perf issues.
- Initial phpSmug 2.0 - Obsoletes ALL previous versions of phpSmug.