Merge branch 'dev' of https://github.com/redmatrix/hubzilla into dev_merge

9 files changed, 51 insertions, 10 deletions

diff --git a/Zotlabs/Lib/ThreadItem.php b/Zotlabs/Lib/ThreadItem.php
index d33f3c183..d916ce2c1 100644
--- a/Zotlabs/Lib/ThreadItem.php
+++ b/Zotlabs/Lib/ThreadItem.php
@@ -313,7 +313,8 @@ class ThreadItem {
 
 		$tmp_item = array(
 			'template' => $this->get_template(),
-			'mode' => $mode,			
+			'mode' => $mode,
+			'item_type' => intval($item['item_type']),			
 			'type' => implode("",array_slice(explode("/",$item['verb']),-1)),
 			'body' => $body['html'],
 			'tags' => $body['tags'],
diff --git a/Zotlabs/Module/Attach.php b/Zotlabs/Module/Attach.php
index 94f46978a..490d5edd0 100644
--- a/Zotlabs/Module/Attach.php
+++ b/Zotlabs/Module/Attach.php
@@ -31,7 +31,7 @@ class Attach extends \Zotlabs\Web\Controller {
 	
 		$unsafe_types = array('text/html','text/css','application/javascript');
 	
-		if(in_array($r['data']['filetype'],$unsafe_types)) {
+		if(in_array($r['data']['filetype'],$unsafe_types) && (! channel_codeallowed($r['data']['uid']))) {
 				header('Content-type: text/plain');
 		}
 		else {
diff --git a/Zotlabs/Module/Getfile.php b/Zotlabs/Module/Getfile.php
index 0b05d78a4..413a68e0c 100644
--- a/Zotlabs/Module/Getfile.php
+++ b/Zotlabs/Module/Getfile.php
@@ -108,7 +108,7 @@ class Getfile extends \Zotlabs\Web\Controller {
 			
 		$unsafe_types = array('text/html','text/css','application/javascript');
 	
-		if(in_array($r['data']['filetype'],$unsafe_types)) {
+		if(in_array($r['data']['filetype'],$unsafe_types) && (! channel_codeallowed($channel['channel_id']))) {
 				header('Content-type: text/plain');
 		}
 		else {
diff --git a/Zotlabs/Module/Like.php b/Zotlabs/Module/Like.php
index c995079ce..b104a5f5f 100644
--- a/Zotlabs/Module/Like.php
+++ b/Zotlabs/Module/Like.php
@@ -255,7 +255,7 @@ class Like extends \Zotlabs\Web\Controller {
 			// get the item. Allow linked photos (which are normally hidden) to be liked
 	
 			$r = q("SELECT * FROM item WHERE id = %d 
-				and item_type = 0 and item_deleted = 0 and item_unpublished = 0 
+				and (item_type = 0 or item_type = 6) and item_deleted = 0 and item_unpublished = 0 
 				and item_delayed = 0 and item_pending_remove = 0 and item_blocked = 0 LIMIT 1",
 				intval($item_id)
 			);
diff --git a/Zotlabs/Module/Oep.php b/Zotlabs/Module/Oep.php
index 9a1317142..5e06d3540 100644
--- a/Zotlabs/Module/Oep.php
+++ b/Zotlabs/Module/Oep.php
@@ -172,7 +172,7 @@ class Oep extends \Zotlabs\Web\Controller {
 		if(! perm_is_allowed($channel['channel_id'],get_observer_hash(),'view_pages'))
 			return $ret;
 
-		$sql_extra = items_permissions_sql($channel['channel_id'],get_observer_hash());
+		$sql_extra = item_permissions_sql($channel['channel_id'],get_observer_hash());
 
 		$r = q("select * from iconfig where iconfig.cat = 'system' and iconfig.k = 'CARD' and iconfig.v = '%s' limit 1",
 			dbesc($res)
@@ -183,7 +183,7 @@ class Oep extends \Zotlabs\Web\Controller {
 		else {
 			return $ret;
 		}
-				
+
 		$r = q("select * from item 
 			where item.uid = %d and item_type = %d 
 			$sql_extra order by item.created desc",
diff --git a/Zotlabs/Module/Rpost.php b/Zotlabs/Module/Rpost.php
index 56f4f23f6..e716d1330 100644
--- a/Zotlabs/Module/Rpost.php
+++ b/Zotlabs/Module/Rpost.php
@@ -20,6 +20,7 @@ require_once('include/zot.php');
  * body= Body of post
  * url= URL which will be parsed and the results appended to the body
  * source= Source application
+ * post_id= post_id of post to 'share' (local use only) 
  * remote_return= absolute URL to return after posting is finished
  * type= choices are 'html' or 'bbcode', default is 'bbcode'
  *
@@ -108,6 +109,46 @@ class Rpost extends \Zotlabs\Web\Controller {
 			if($x['success'])
 				$_REQUEST['body'] = $_REQUEST['body'] . $x['body'];
 		}
+
+		if($_REQUEST['post_id']) {
+			$r = q("SELECT * from item WHERE id = %d  LIMIT 1",
+				intval($_REQUEST['post_id'])
+			);
+			if(($r) && (! intval($r[0]['item_private']))) {
+				$sql_extra = item_permissions_sql($r[0]['uid']);
+	
+				$r = q("select * from item where id = %d $sql_extra",
+					intval($_REQUEST['post_id'])
+				);
+				if($r && $r[0]['mimetype'] === 'text/bbcode') {
+	
+					xchan_query($r);
+	
+					$is_photo = (($r[0]['obj_type'] === ACTIVITY_OBJ_PHOTO) ? true : false);
+					if($is_photo) {
+						$object = json_decode($r[0]['obj'],true);
+						$photo_bb = $object['body'];
+					}
+	
+					if (strpos($r[0]['body'], "[/share]") !== false) {
+						$pos = strpos($r[0]['body'], "[share");
+						$i = substr($r[0]['body'], $pos);
+					} else {
+						$i = "[share author='".urlencode($r[0]['author']['xchan_name']).
+							"' profile='".$r[0]['author']['xchan_url'] .
+							"' avatar='".$r[0]['author']['xchan_photo_s'].
+							"' link='".$r[0]['plink'].
+							"' posted='".$r[0]['created'].
+							"' message_id='".$r[0]['mid']."']";
+						if($r[0]['title'])
+							$i .= '[b]'.$r[0]['title'].'[/b]'."\r\n";
+						$i .= (($is_photo) ? $photo_bb . "\r\n" . $r[0]['body'] : $r[0]['body']);
+						$i .= "[/share]";
+					}
+				}
+			}	
+			$_REQUEST['body'] = $_REQUEST['body'] . $i;
+		}
 	
 		$x = array(
 			'is_owner'            => true,
diff --git a/Zotlabs/Storage/File.php b/Zotlabs/Storage/File.php
index 7a102134f..332bf6896 100644
--- a/Zotlabs/Storage/File.php
+++ b/Zotlabs/Storage/File.php
@@ -254,7 +254,7 @@ class File extends DAV\Node implements DAV\IFile {
 			// @todo this should be a global definition
 			$unsafe_types = array('text/html', 'text/css', 'application/javascript');
 
-			if (in_array($r[0]['filetype'], $unsafe_types)) {
+			if (in_array($r[0]['filetype'], $unsafe_types) && (! channel_codeallowed($this->data['uid']))) {
 				header('Content-disposition: attachment; filename="' . $r[0]['filename'] . '"');
 				header('Content-type: text/plain');
 			}
@@ -300,7 +300,7 @@ class File extends DAV\Node implements DAV\IFile {
 	public function getContentType() {
 		// @todo this should be a global definition.
 		$unsafe_types = array('text/html', 'text/css', 'application/javascript');
-		if (in_array($this->data['filetype'], $unsafe_types)) {
+		if (in_array($this->data['filetype'], $unsafe_types) && (! channel_codeallowed($this->data['uid']))) {
 			return 'text/plain';
 		}
 		return $this->data['filetype'];
diff --git a/Zotlabs/Zot/Auth.php b/Zotlabs/Zot/Auth.php
index 44f01174e..8d198f506 100644
--- a/Zotlabs/Zot/Auth.php
+++ b/Zotlabs/Zot/Auth.php
@@ -167,7 +167,6 @@ class Auth {
 			dbesc($hubloc['hubloc_url'])
 		);
 
-		// needs a nonce!!!!
 		$p = zot_build_packet($channel,$type = 'auth_check', 
 			array(array('guid' => $hubloc['hubloc_guid'],'guid_sig' => $hubloc['hubloc_guid_sig'])), 
 			$hubloc['hubloc_sitekey'], (($x) ? $x[0]['site_crypto'] : ''), $this->sec);
diff --git a/Zotlabs/Zot/Finger.php b/Zotlabs/Zot/Finger.php
index e205b136f..dab7d9e01 100644
--- a/Zotlabs/Zot/Finger.php
+++ b/Zotlabs/Zot/Finger.php
@@ -122,7 +122,7 @@ class Finger {
 
 		$x = json_decode($result['body'], true);
 
-		$verify = \Zotlabs\Web\HTTPSig::verify($result,(($x) ? $x['key'] : '');
+		$verify = \Zotlabs\Web\HTTPSig::verify($result,(($x) ? $x['key'] : ''));
 		
 		if($x && (! $verify['header_valid'])) {
 			$signed_token = ((is_array($x) && array_key_exists('signed_token', $x)) ? $x['signed_token'] : null);