Merge branch 'dev' of https://github.com/redmatrix/hubzilla into dev_merge

5 files changed, 128 insertions, 14 deletions

diff --git a/Zotlabs/Module/Display.php b/Zotlabs/Module/Display.php
index 11c75219d..0ea55102e 100644
--- a/Zotlabs/Module/Display.php
+++ b/Zotlabs/Module/Display.php
@@ -133,7 +133,14 @@ class Display extends \Zotlabs\Web\Controller {
 		if((! $update) && (! $load)) {
 
 			$static  = ((local_channel()) ? channel_manual_conv_update(local_channel()) : 1);
-	
+
+			//if the target item is not a post (eg a like) we want to address its thread parent
+			$mid = ((($target_item['verb'] == ACTIVITY_LIKE) || ($target_item['verb'] == ACTIVITY_DISLIKE)) ? $target_item['thr_parent'] : $target_item['mid']);
+
+			//if we got a decoded hash we must encode it again before handing to javascript 
+			if($decoded)
+				$mid = 'b64.' . base64url_encode($mid);
+
 			$o .= '<div id="live-display"></div>' . "\r\n";
 			$o .= "<script> var profile_uid = " . ((intval(local_channel())) ? local_channel() : (-1))
 				. "; var netargs = '?f='; var profile_page = " . \App::$pager['page'] . "; </script>\r\n";
@@ -165,8 +172,7 @@ class Display extends \Zotlabs\Web\Controller {
 				'$dend' => '',
 				'$dbegin' => '',
 				'$verb' => '',
-				//if the target item is not a post (eg a like) want to address its thread parent
-				'$mid' => (($target_item['verb'] == ACTIVITY_POST) ? $item_hash : $target_item['thr_parent'])
+				'$mid' => $mid
 			));
 
 			head_add_link([ 
@@ -323,6 +329,7 @@ class Display extends \Zotlabs\Web\Controller {
 			$r = q("SELECT id, item_deleted FROM item WHERE mid = '%s' LIMIT 1",
 				dbesc($item_hash)
 			);
+
 			if($r) {
 				if(intval($r[0]['item_deleted'])) {
 					notice( t('Item has been removed.') . EOL );
diff --git a/Zotlabs/Module/Magic.php b/Zotlabs/Module/Magic.php
index bf3198067..d1550ec89 100644
--- a/Zotlabs/Module/Magic.php
+++ b/Zotlabs/Module/Magic.php
@@ -17,6 +17,7 @@ class Magic extends \Zotlabs\Web\Controller {
 		$dest = ((x($_REQUEST,'dest')) ? $_REQUEST['dest'] : '');
 		$test = ((x($_REQUEST,'test')) ? intval($_REQUEST['test']) : 0);
 		$rev  = ((x($_REQUEST,'rev'))  ? intval($_REQUEST['rev'])  : 0);
+		$owa  = ((x($_REQUEST,'owa'))  ? intval($_REQUEST['owa'])  : 0);
 		$delegate = ((x($_REQUEST,'delegate')) ? $_REQUEST['delegate']  : '');
 	
 		$parsed = parse_url($dest);
@@ -132,12 +133,31 @@ class Magic extends \Zotlabs\Web\Controller {
 		if(local_channel()) {
 			$channel = \App::get_channel();
 	
+			// OpenWebAuth
+
+			if($owa) {
+
+				$headers = [];
+				$headers['Accept'] = 'application/x-zot+json' ;
+				$headers['X-Open-Web-Auth'] = random_string();
+				$headers = \Zotlabs\Web\HTTPSig::create_sig('',$headers,$channel['channel_prvkey'],
+					'acct:' . $channel['channel_address'] . '@' . \App::get_hostname(),false,true,'sha512');
+				$x = z_fetch_url($basepath . '/owa',false,$redirects,[ 'headers' => $headers ]);
+
+				if($x['success']) {
+					$j = json_decode($x['body'],true);
+					if($j['success'] && $j['token']) {
+						$x = strpbrk($dest,'?&');
+						$args = (($x) ? '&owt=' . $j['token'] : '?f=&owt=' . $j['token']) . (($delegate) ? '&delegate=1' : '');
+						goaway($dest . $args);
+					}
+				}
+				goaway($dest);
+			}
+
+
 			$token = random_string();
-//			$token_sig = base64url_encode(rsa_sign($token,$channel['channel_prvkey']));
-	 
-//			$channel['token'] = $token;
-//			$channel['token_sig'] = $token_sig;
-	
+
 			\Zotlabs\Zot\Verify::create('auth',$channel['channel_id'],$token,$x[0]['hubloc_url']);
 	
 			$target_url = $x[0]['hubloc_callback'] . '/?f=&auth=' . urlencode(channel_reddress($channel))
diff --git a/Zotlabs/Module/Owa.php b/Zotlabs/Module/Owa.php
new file mode 100644
index 000000000..4b0d855c5
--- /dev/null
+++ b/Zotlabs/Module/Owa.php
@@ -0,0 +1,53 @@
+<?php
+
+namespace Zotlabs\Module;
+
+/**
+ * OpenWebAuth verifier and token generator
+ * See https://macgirvin.com/wiki/mike/OpenWebAuth/Home
+ * Requests to this endpoint should be signed using HTTP Signatures
+ * using the 'Authorization: Signature' authentication method
+ * If the signature verifies a token is returned. 
+ *
+ * This token may be exchanged for an authenticated cookie. 
+ */
+
+class Owa extends \Zotlabs\Web\Controller {
+
+	function init() {
+
+		$ret = [ 'success' => false ];
+
+		foreach([ 'REDIRECT_REMOTE_USER', 'HTTP_AUTHORIZATION' ] as $head) {
+			if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,9) === 'Signature') {
+				if($head !== 'HTTP_AUTHORIZATION') {
+					$_SERVER['HTTP_AUTHORIZATION'] = $_SERVER[$head];
+					continue;
+				}
+
+				$sigblock = \Zotlabs\Web\HTTPSig::parse_sigheader($_SERVER[$head]);
+				if($sigblock) {
+					$keyId = $sigblock['keyId'];
+
+					if($keyId) {
+						$r = q("select * from hubloc left join xchan on hubloc_hash = xchan_hash 
+							where hubloc_addr = '%s' limit 1",
+							dbesc(str_replace('acct:','',$keyId))
+						);
+						if($r) {
+							$hubloc = $r[0];
+							$verified = \Zotlabs\Web\HTTPSig::verify('',$hubloc['xchan_pubkey']);	
+							if($verified && $verified['header_signed'] && $verified['header_valid']) {
+								$ret['success'] = true;
+								$token = random_string(32);
+								\Zotlabs\Zot\Verify::create('owt',0,$token,$r[0]['hubloc_addr']);
+								$ret['token'] = $token;
+							}
+						}
+					}
+				}
+			}
+		}
+		json_return_and_die($ret,'application/x-zot+json');
+	}
+}
diff --git a/Zotlabs/Module/Rmagic.php b/Zotlabs/Module/Rmagic.php
index 9fcc72441..0c4eb9ae4 100644
--- a/Zotlabs/Module/Rmagic.php
+++ b/Zotlabs/Module/Rmagic.php
@@ -18,7 +18,7 @@ class Rmagic extends \Zotlabs\Web\Controller {
 				if($r[0]['hubloc_url'] === z_root())
 					goaway(z_root() . '/login');
 				$dest = z_root() . '/' . str_replace('zid=','zid_=',\App::$query_string);
-				goaway($r[0]['hubloc_url'] . '/magic' . '?f=&dest=' . $dest);
+				goaway($r[0]['hubloc_url'] . '/magic' . '?f=&owa=1&dest=' . $dest);
 			}
 		}
 	}
@@ -63,7 +63,7 @@ class Rmagic extends \Zotlabs\Web\Controller {
 				else
 					$dest = urlencode(z_root() . '/' . str_replace('zid=','zid_=',\App::$query_string));
 	
-				goaway($url . '/magic' . '?f=&dest=' . $dest);
+				goaway($url . '/magic' . '?f=&owa=1&dest=' . $dest);
 			}
 		}
 	}
diff --git a/Zotlabs/Module/Wfinger.php b/Zotlabs/Module/Wfinger.php
index 07a7b7735..d0c4d73d2 100644
--- a/Zotlabs/Module/Wfinger.php
+++ b/Zotlabs/Module/Wfinger.php
@@ -30,9 +30,15 @@ class Wfinger extends \Zotlabs\Web\Controller {
 		$resource = $_REQUEST['resource'];
 		logger('webfinger: ' . $resource,LOGGER_DEBUG);
 	
+
+		$root_resource  = false;
+
+		if(strcasecmp(rtrim($resource,'/'),z_root()) === 0)
+			$root_resource = true;
+
 		$r = null;
 	
-		if($resource) {
+		if(($resource) && (! $root_resource)) {
 	
 			if(strpos($resource,'acct:') === 0) {
 				$channel = str_replace('acct:','',$resource);
@@ -60,7 +66,25 @@ class Wfinger extends \Zotlabs\Web\Controller {
 	
 		header('Access-Control-Allow-Origin: *');
 	
+
+		if($root_resource) {
+			$result['subject'] = $resource;
+			$result['properties'] = [
+					'https://w3id.org/security/v1#publicKeyPem' => get_config('system','pubkey')
+			];
+			$result['links'] = [
+				[
+					'rel'  => 'http://purl.org/openwebauth/v1',
+					'type' => 'application/x-zot+json',
+					'href' => z_root() . '/owa',
+				],
+			];
+
+
+
 	
+		}
+
 		if($resource && $r) {
 	
 			$h = q("select hubloc_addr from hubloc where hubloc_hash = '%s' and hubloc_deleted = 0",
@@ -84,7 +108,8 @@ class Wfinger extends \Zotlabs\Web\Controller {
 	
 			$result['properties'] = [
 					'http://webfinger.net/ns/name'   => $r[0]['channel_name'],
-					'http://xmlns.com/foaf/0.1/name' => $r[0]['channel_name']
+					'http://xmlns.com/foaf/0.1/name' => $r[0]['channel_name'],
+					'https://w3id.org/security/v1#publicKeyPem' => $r[0]['xchan_pubkey']
 			];
 	
 			foreach($aliases as $alias) 
@@ -124,6 +149,13 @@ class Wfinger extends \Zotlabs\Web\Controller {
 					'rel'  => 'http://purl.org/zot/protocol',
 					'href' => z_root() . '/.well-known/zot-info' . '?address=' . $r[0]['xchan_addr'],
 				],
+
+				[
+					'rel'  => 'http://purl.org/openwebauth/v1',
+					'type' => 'application/x-zot+json',
+					'href' => z_root() . '/owa',
+				],
+
 	
 				[
 					'rel'  => 'magic-public-key',
@@ -136,14 +168,16 @@ class Wfinger extends \Zotlabs\Web\Controller {
 				$result['zot'] = zotinfo( [ 'address' => $r[0]['xchan_addr'] ]);
 			}
 		}
-		else {
+
+		if(! $result) {
 			header($_SERVER["SERVER_PROTOCOL"] . ' ' . 400 . ' ' . 'Bad Request');
 			killme();
 		}
 	
 		$arr = [ 'channel' => $r[0], 'request' => $_REQUEST, 'result' => $result ];
 		call_hooks('webfinger',$arr);
-	
+
+
 		json_return_and_die($arr['result'],'application/jrd+json');
 	
 	}