sort out the rest of the nasty stuff in the attachment/file api - time to move on to something else

4 files changed, 38 insertions, 31 deletions

diff --git a/include/items.php b/include/items.php
index 6618fe876..5afb0816d 100755
--- a/include/items.php
+++ b/include/items.php
@@ -496,7 +496,7 @@ function get_item_elements($x) {
 	$arr['object']       = activity_sanitise($x['object']);
 	$arr['target']       = activity_sanitise($x['target']);
 
-	$arr['attach']       = implode(',',activity_sanitise($x['attach']));
+	$arr['attach']       = activity_sanitise($x['attach']);
 	$arr['term']         = decode_tags($x['tags']);
 
 	$arr['item_private'] = ((array_key_exists('flags',$x) && is_array($x['flags']) && in_array('private',$x['flags'])) ? 1 : 0);
@@ -588,7 +588,7 @@ function encode_item($item) {
 	if($item['target'])
 		$x['target']     = json_decode($item['target'],true);
 	if($item['attach'])
-		$x['attach']     = explode(',', $item['attach']);
+		$x['attach']     = json_decode($item['attach'],true);
 	if($y = encode_item_flags($item))
 		$x['flags']      = $y;
 	if($item['term'])
@@ -1260,6 +1260,11 @@ function item_store($arr,$force_parent = false) {
 		$arr['target'] = json_encode($arr['target']);
 	}
 
+	if((x($arr,'attach')) && is_array($arr['attach'])) {
+		activity_sanitise($arr['attach']);
+		$arr['attach'] = json_encode($arr['attach']);
+	}
+
 	$arr['aid']           = ((x($arr,'aid'))           ? intval($arr['aid'])                 : 0);
 	$arr['uri']           = ((x($arr,'uri'))           ? notags(trim($arr['uri']))           : random_string());
 	$arr['author_xchan']  = ((x($arr,'author_xchan'))  ? notags(trim($arr['author_xchan']))  : '');
diff --git a/include/text.php b/include/text.php
index 90cd86a5f..cb68fcc86 100644
--- a/include/text.php
+++ b/include/text.php
@@ -947,37 +947,33 @@ function prepare_body($item,$attach = false) {
 		return $s;
 	}
 
-	$arr = explode(',',$item['attach']);
+	$arr = json_decode($item['attach'],true);
 	if(count($arr)) {
 		$s .= '<div class="body-attach">';
 		foreach($arr as $r) {
 			$matches = false;
 			$icon = '';
-			$cnt = preg_match_all('|\[attach\]href=\"(.*?)\" length=\"(.*?)\" type=\"(.*?)\" title=\"(.*?)\"\[\/attach\]|',$r,$matches, PREG_SET_ORDER);
-			if($cnt) {
-				foreach($matches as $mtch) {
-					$icontype = strtolower(substr($mtch[3],0,strpos($mtch[3],'/')));
-					switch($icontype) {
-						case 'video':
-						case 'audio':
-						case 'image':
-						case 'text':
-							$icon = '<div class="attachtype icon s22 type-' . $icontype . '"></div>';
-							break;
-						default:
-							$icon = '<div class="attachtype icon s22 type-unkn"></div>';
-							break;
-					}
-					$title = ((strlen(trim($mtch[4]))) ? escape_tags(trim($mtch[4])) : escape_tags($mtch[1]));
-					$title .= ' ' . $mtch[2] . ' ' . t('bytes');
-					if((local_user() == $item['uid']) && ($item['contact-id'] != $a->contact['id']) && ($item['network'] == NETWORK_DFRN))
-						$the_url = $a->get_baseurl() . '/redir/' . $item['contact-id'] . '?f=1&url=' . $mtch[1];
-					else
-						$the_url = $mtch[1];
-
-					$s .= '<a href="' . strip_tags($the_url) . '" title="' . $title . '" class="attachlink"  >' . $icon . '</a>';
-				}
+			$icontype = substr($r['type'],0,strpos($r['type'],'/'));
+
+			switch($icontype) {
+				case 'video':
+				case 'audio':
+				case 'image':
+				case 'text':
+					$icon = '<div class="attachtype icon s22 type-' . $icontype . '"></div>';
+					break;
+				default:
+					$icon = '<div class="attachtype icon s22 type-unkn"></div>';
+					break;
 			}
+
+			$title = htmlentities($r['title'], ENT_COMPAT,'UTF-8');
+			if(! $title)
+				$title = t('unknown.???');
+			$title .= ' ' . $r['length'] . ' ' . t('bytes');
+
+			$url = $a->get_baseurl() . '/magic?f=&hash=' . $item['author_xchan'] . '&dest=' . $r['href'] . '/' . $r['revision'];
+			$s .= '<a href="' . $url . '" title="' . $title . '" class="attachlink"  >' . $icon . '</a>';
 		}
 		$s .= '<div class="clear"></div></div>';
 	}
diff --git a/mod/item.php b/mod/item.php
index c482f3ea9..8d01a12f8 100644
--- a/mod/item.php
+++ b/mod/item.php
@@ -471,14 +471,19 @@ function item_post(&$a) {
 	$match = false;
 
 	if(preg_match_all('/(\[attachment\](.*?)\[\/attachment\])/',$body,$match)) {
+		$attachments = array();
 		foreach($match[2] as $mtch) {
 			$hash = substr($mtch,0,strpos($mtch,','));
 			$rev = intval(substr($mtch,strpos($mtch,',')));
 			$r = attach_by_hash_nodata($hash,$rev);
 			if($r['success']) {
-				if(strlen($attachments))
-					$attachments .= ',';
-				$attachments .= '[attach]href="' . $a->get_baseurl() . '/attach/' . $r['data']['hash'] . '" length="' . $r['data']['filesize'] . '" type="' . $r['data']['filetype'] . '" title="' . urlencode($r['data']['filename']) . '" revision="' . $r['data']['revision'] . '"[/attach]'; 
+				$attachments[] = array(
+					'href'     => $a->get_baseurl() . '/attach/' . $r['data']['hash'],
+					'length'   =>  $r['data']['filesize'],
+					'type'     => $r['data']['filetype'],
+					'title'    => urlencode($r['data']['filename']),
+					'revision' => $r['data']['revision']
+				);
 			}
 			$body = str_replace($match[1],'',$body);
 		}
diff --git a/mod/magic.php b/mod/magic.php
index d7a6674ee..408619b7e 100644
--- a/mod/magic.php
+++ b/mod/magic.php
@@ -10,7 +10,8 @@ function magic_init(&$a) {
 
 	if($hash) {
 		$x = q("select xchan.xchan_url, hubloc.* from xchan left join hubloc on xchan_hash = hubloc_hash
-			where hublock_hash = '%s' and (hubloc_flags & %d) limit 1",
+			where hubloc_hash = '%s' and (hubloc_flags & %d) limit 1",
+			dbesc($hash),
 			intval(HUBLOC_FLAGS_PRIMARY)
 		);
 	}