Merge branch 'dev' of https://framagit.org/hubzilla/core into xdev_merge

8 files changed, 142 insertions, 50 deletions

diff --git a/Zotlabs/Daemon/Cron.php b/Zotlabs/Daemon/Cron.php
index 25e49b817..8b6b42c8a 100644
--- a/Zotlabs/Daemon/Cron.php
+++ b/Zotlabs/Daemon/Cron.php
@@ -94,6 +94,29 @@ class Cron {
 					@time_sleep_until(microtime(true) + (float) $interval);
 			}
 		}
+		
+		// Clean expired photos from cache
+		
+		$age = get_config('system','active_expire_days', '30');
+		$r = q("SELECT DISTINCT xchan, content FROM photo WHERE photo_usage = %d AND expires < %s - INTERVAL %s",
+			intval(PHOTO_CACHE),
+			db_utcnow(), 
+			db_quoteinterval($age . ' DAY')
+		);
+		if($r) {
+			foreach($r as $rr) {
+				$file = dbunescbin($rr['content']);
+				if(is_file($file)) {
+					@unlink($file);
+					logger('info: deleted cached photo file ' . $file, LOGGER_DEBUG);
+				}
+			}
+		}
+		q("DELETE FROM photo WHERE photo_usage = %d AND expires < %s - INTERVAL %s",
+			intval(PHOTO_CACHE),
+			db_utcnow(), 
+			db_quoteinterval($age . ' DAY')
+		);		
 
 		// publish any applicable items that were set to be published in the future
 		// (time travel posts). Restrict to items that have come of age in the last
diff --git a/Zotlabs/Lib/Enotify.php b/Zotlabs/Lib/Enotify.php
index 523ccf93a..5e5798cac 100644
--- a/Zotlabs/Lib/Enotify.php
+++ b/Zotlabs/Lib/Enotify.php
@@ -828,7 +828,7 @@ class Enotify {
 		$x = array(
 			'notify_link' => $item['llink'],
 			'name' => $item['author']['xchan_name'],
-			'addr' => $item['author']['xchan_addr'],
+			'addr' => (($item['author']['xchan_addr']) ? $item['author']['xchan_addr'] : $item['author']['xchan_url']),
 			'url' => $item['author']['xchan_url'],
 			'photo' => $item['author']['xchan_photo_s'],
 			'when' => relative_date(($edit)? $item['edited'] : $item['created']), 
diff --git a/Zotlabs/Module/Pconfig.php b/Zotlabs/Module/Pconfig.php
index 44fe5d9a9..f31d5fdf6 100644
--- a/Zotlabs/Module/Pconfig.php
+++ b/Zotlabs/Module/Pconfig.php
@@ -22,6 +22,11 @@ class Pconfig extends \Zotlabs\Web\Controller {
 		$k = trim(escape_tags($_POST['k']));
 		$v = trim($_POST['v']);
 		$aj = intval($_POST['aj']);
+
+		// Do not store "serialized" data received in the $_POST
+		if (preg_match('|^a:[0-9]+:{.*}$|s',$v) || preg_match('O:8:"stdClass":[0-9]+:{.*}$|s',$v)) {
+			return;
+		}
 	
 		if(in_array(argv(2),$this->disallowed_pconfig())) {
 			notice( t('This setting requires special processing and editing has been blocked.') . EOL);
diff --git a/Zotlabs/Module/Photo.php b/Zotlabs/Module/Photo.php
index 30e8340e2..d85db7307 100644
--- a/Zotlabs/Module/Photo.php
+++ b/Zotlabs/Module/Photo.php
@@ -1,19 +1,20 @@
 <?php
+
+
 namespace Zotlabs\Module;
 
 require_once('include/security.php');
 require_once('include/attach.php');
 require_once('include/photo/photo_driver.php');
 
-
 class Photo extends \Zotlabs\Web\Controller {
 
 	function init() {
 
-		$prvcachecontrol = false;
 		$streaming = null;
 		$channel = null;
 		$person = 0;
+		$renew = false;
 
 		switch(argc()) {
 			case 4:
@@ -29,7 +30,15 @@ class Photo extends \Zotlabs\Web\Controller {
 				killme();
 				// NOTREACHED
 		}
-	
+
+		$cache_mode = array(
+			'on' => get_config('system','photo_cache_enable', 0),
+			'age' => 86400,
+			'exp' => true,
+			'leak' => false
+		);
+		call_hooks('cache_mode_hook', $cache_mode);
+		
 		$observer_xchan = get_observer_hash();
 		$ismodified = $_SERVER['HTTP_IF_MODIFIED_SINCE'];
 
@@ -106,13 +115,14 @@ class Photo extends \Zotlabs\Web\Controller {
 			   License link: http://creativecommons.org/licenses/by/3.0/
 			*/
 
+			// @FIXME It seems this part doesn't work because we are not setting such cookie
 			$cookie_value = false;
 			if (isset($_COOKIE['devicePixelRatio'])) {
 			  $cookie_value = intval($_COOKIE['devicePixelRatio']);
 			}
 			else {
 			  // Force revalidation of cache on next request
-			  $cache_directive = 'no-cache';
+			  // $prvcachecontrol = 'no-cache';
 			  $status = 'no cookie';
 			}
 	
@@ -129,27 +139,43 @@ class Photo extends \Zotlabs\Web\Controller {
 				    $resolution = 1;
 			}
 			
-			$r = q("SELECT uid, photo_usage FROM photo WHERE resource_id = '%s' AND imgscale = %d LIMIT 1",
+			$r = q("SELECT uid, photo_usage, expires, display_path FROM photo WHERE resource_id = '%s' AND imgscale = %d LIMIT 1",
 				dbesc($photo),
 				intval($resolution)
 			);
 			if($r) {
-
 				$allowed = (-1);
 
-				if(intval($r[0]['photo_usage'])) {
+				$u = intval($r[0]['photo_usage']);
+				if($u) {
 					$allowed = 1;
-					if(intval($r[0]['photo_usage']) === PHOTO_COVER) 
+					if($u === PHOTO_COVER) 
 						if($resolution < PHOTO_RES_COVER_1200)
 							$allowed = (-1);
-					if(intval($r[0]['photo_usage']) === PHOTO_PROFILE)
+					if($u === PHOTO_PROFILE)
 						if(! in_array($resolution,[4,5,6]))
 							$allowed = (-1);
+					if($u === PHOTO_CACHE) {
+						// Cached image leak protection
+						if(! (local_channel() || $cache_mode['leak'])) {
+							header("Location: " . $r[0]['display_path']);
+							killme();
+						}
+						// Revalidate cache
+						if($cache_mode['on'] && strtotime($r[0]['expires']) - 60 < time()) {
+							$cache = array(
+								'url' => $r[0]['display_path'],
+								'uid' => $r[0]['uid']
+							);
+							call_hooks('cache_url_hook', $cache);
+							if(! $cache['status'])
+								http_status_exit(404,'not found');
+						}
+					}
 				}
 
-				if($allowed === (-1)) {
+				if($allowed === (-1))
 					$allowed = attach_can_view($r[0]['uid'],$observer_xchan,$photo);
-				}
 
 				$channel = channelx_by_n($r[0]['uid']);
 
@@ -160,16 +186,19 @@ class Photo extends \Zotlabs\Web\Controller {
 				);
 
 				$exists = (($e) ? true : false);
-
+			
 				if($exists && $allowed) {
+					$expires = strtotime($e[0]['expires'] . 'Z');
 					$data = dbunescbin($e[0]['content']);
 					$filesize = $e[0]['filesize'];
 					$mimetype = $e[0]['mimetype'];
 					$modified = strtotime($e[0]['edited'] . 'Z');
-					if(intval($e[0]['os_storage']))
+
+					if(intval($e[0]['os_storage'])) {
 						$streaming = $data;
+					}
 					if($e[0]['allow_cid'] != '' || $e[0]['allow_gid'] != '' || $e[0]['deny_gid'] != '' || $e[0]['deny_gid'] != '')
-						$prvcachecontrol = true;
+						$prvcachecontrol = 'no-store, no-cache, must-revalidate';
 				}
 				else {
 					if(! $allowed) {
@@ -180,9 +209,9 @@ class Photo extends \Zotlabs\Web\Controller {
 					}
 
 				}
-			} else {
+			} 
+			else
 				http_status_exit(404,'not found');
-			}
 		}
 
 		header_remove('Pragma');
@@ -225,24 +254,14 @@ class Photo extends \Zotlabs\Web\Controller {
 				$mimetype = $ph->getType();
 			}
 		}
-	
-		// @FIXME Seems never invoked
-		// Writing in cachefile
-		if (isset($cachefile) && $cachefile != '') {
-			file_put_contents($cachefile, $data);
-			$modified = filemtime($cachefile);
-		}
-
 
-		header("Content-type: " . $mimetype);
-	
-		if($prvcachecontrol) {
+		if(isset($prvcachecontrol)) {
 	
 			// it is a private photo that they have no permission to view.
 			// tell the browser not to cache it, in case they authenticate
 			// and subsequently have permission to see it
 	
-			header("Cache-Control: no-store, no-cache, must-revalidate");
+			header("Cache-Control: " . $prvcachecontrol);
 	
 		}
 		else {
@@ -255,18 +274,23 @@ class Photo extends \Zotlabs\Web\Controller {
 			// This has performance considerations but we highly recommend you 
 			// leave it alone. 
 	
-			$cache = get_config('system','photo_cache_time', 86400);    // 1 day by default
+			$maxage = $cache_mode['age'];
 
-		 	header("Expires: " . gmdate("D, d M Y H:i:s", time() + $cache) . " GMT");
-			header("Cache-Control: max-age=" . $cache);
+			if($cache_mode['exp'] || (! isset($expires)) || (isset($expires) && $expires - 60 < time()))
+				$expires = time() + $maxage;
+			else
+				$maxage = $expires - time();
+			
+		 	header("Expires: " . gmdate("D, d M Y H:i:s", $expires) . " GMT");
+			header("Cache-Control: max-age=" . $maxage);
 	
 		}
 
+		header("Content-type: " . $mimetype);
 		header("Last-Modified: " . gmdate("D, d M Y H:i:s", $modified) . " GMT");
 		header("Content-Length: " . (isset($filesize) ? $filesize : strlen($data)));
 
 		// If it's a file resource, stream it. 
-
 		if($streaming && $channel) {
 			if(strpos($streaming,'store') !== false)
 				$istream = fopen($streaming,'rb');
diff --git a/Zotlabs/Module/Photos.php b/Zotlabs/Module/Photos.php
index 03fd8a53d..21f6293ef 100644
--- a/Zotlabs/Module/Photos.php
+++ b/Zotlabs/Module/Photos.php
@@ -264,7 +264,7 @@ class Photos extends \Zotlabs\Web\Controller {
 						}
 	
 						$x = q("update photo set edited = '%s', content = '%s', filesize = %d, height = %d, width = %d where resource_id = '%s' and uid = %d and imgscale = 0",
-						    dbesc(datetime_convert()),
+							dbesc(datetime_convert()),
 							dbescbin($data),
 							intval($fsize),
 							intval($height),
@@ -278,10 +278,13 @@ class Photos extends \Zotlabs\Web\Controller {
 	
 						$width  = $ph->getWidth();
 						$height = $ph->getHeight();
+						$data = $ph->imageString();
+						$fsize = strlen($data);
 	
-						$x = q("update photo set edited = '%s', content = '%s', height = %d, width = %d where resource_id = '%s' and uid = %d and imgscale = 1",
-						    dbesc(datetime_convert()),
-							dbescbin($ph->imageString()),
+						$x = q("update photo set edited = '%s', content = '%s', filesize = %d, height = %d, width = %d where resource_id = '%s' and uid = %d and imgscale = 1",
+							dbesc(datetime_convert()),
+							dbescbin($data),
+							intval($fsize),
 							intval($height),
 							intval($width),
 							dbesc($resource_id),
@@ -294,10 +297,13 @@ class Photos extends \Zotlabs\Web\Controller {
 	
 						$width  = $ph->getWidth();
 						$height = $ph->getHeight();
+						$data = $ph->imageString();
+						$fsize = strlen($data);
 	
-						$x = q("update photo set edited = '%s', content = '%s', height = %d, width = %d where resource_id = '%s' and uid = %d and imgscale = 2",
-						    dbesc(datetime_convert()),
-							dbescbin($ph->imageString()),
+						$x = q("update photo set edited = '%s', content = '%s', filesize = %d, height = %d, width = %d where resource_id = '%s' and uid = %d and imgscale = 2",
+							dbesc(datetime_convert()),
+							dbescbin($data),
+							intval($fsize),
 							intval($height),
 							intval($width),
 							dbesc($resource_id),
@@ -310,10 +316,13 @@ class Photos extends \Zotlabs\Web\Controller {
 	
 						$width  = $ph->getWidth();
 						$height = $ph->getHeight();
+						$data = $ph->imageString();
+						$fsize = strlen($data);
 	
-						$x = q("update photo set edited = '%s', content = '%s', height = %d, width = %d where resource_id = '%s' and uid = %d and imgscale = 3",
-						    dbesc(datetime_convert()),
-							dbescbin($ph->imageString()),
+						$x = q("update photo set edited = '%s', content = '%s', filesize = %d, height = %d, width = %d where resource_id = '%s' and uid = %d and imgscale = 3",
+							dbesc(datetime_convert()),
+							dbescbin($data),
+							intval($fsize),
 							intval($height),
 							intval($width),
 							dbesc($resource_id),
diff --git a/Zotlabs/Update/_1228.php b/Zotlabs/Update/_1228.php
index b9ba1d86f..9e6bf8047 100644
--- a/Zotlabs/Update/_1228.php
+++ b/Zotlabs/Update/_1228.php
@@ -11,8 +11,8 @@ class _1228 {
 
 		if(ACTIVE_DBTYPE == DBTYPE_POSTGRES) {
 			$r1 = q("ALTER TABLE item ADD uuid text NOT NULL DEFAULT '' ");
- 			$r2 = q("create index \"uuid_idx\" on channel (\"uuid\")");
-			$r3 = q("ALTER TABLE item add summary TEXT NOT NULL");
+			$r2 = q("create index \"uuid_idx\" on item (\"uuid\")");
+			$r3 = q("ALTER TABLE item add summary TEXT NOT NULL DEFAULT ''");
 
 			$r = ($r1 && $r2 && $r3);
 		}
@@ -25,7 +25,6 @@ class _1228 {
 
 		if($r) {
 			q("COMMIT");
-			self::upgrade();
 			return UPDATE_SUCCESS;
 		}
 
diff --git a/Zotlabs/Update/_1229.php b/Zotlabs/Update/_1229.php
new file mode 100644
index 000000000..8e8711644
--- /dev/null
+++ b/Zotlabs/Update/_1229.php
@@ -0,0 +1,32 @@
+<?php
+
+namespace Zotlabs\Update;
+
+class _1229 {
+
+	function run() {
+	
+	    q("START TRANSACTION");
+
+		if(ACTIVE_DBTYPE == DBTYPE_POSTGRES) {
+			$r1 = q("ALTER TABLE photo ADD expires timestamp NOT NULL DEFAULT '0001-01-01 00:00:00' ");
+ 			$r2 = q("create index \"photo_expires_idx\" on photo (\"expires\")");
+
+			$r = ($r1 && $r2);
+		}
+		else {
+			$r = q("ALTER TABLE `photo` ADD `expires` datetime NOT NULL DEFAULT '0001-01-01 00:00:00' , 
+				ADD INDEX `expires` (`expires`)");
+		}
+
+		if($r) {
+			q("COMMIT");
+			return UPDATE_SUCCESS;
+		}
+
+		q("ROLLBACK");
+		return UPDATE_FAILED;
+
+	}
+
+}
diff --git a/Zotlabs/Widget/Notifications.php b/Zotlabs/Widget/Notifications.php
index 0f9f609e4..37d9139ec 100644
--- a/Zotlabs/Widget/Notifications.php
+++ b/Zotlabs/Widget/Notifications.php
@@ -24,7 +24,7 @@ class Notifications {
 				],
 				'filter' => [
 					'posts_label' => t('Show new posts only'),
-					'name_label' => t('Filter by name')
+					'name_label' => t('Filter by name or address')
 				]
 			];
 
@@ -43,7 +43,7 @@ class Notifications {
 				],
 				'filter' => [
 					'posts_label' => t('Show new posts only'),
-					'name_label' => t('Filter by name')
+					'name_label' => t('Filter by name or address')
 				]
 			];
 
@@ -119,7 +119,7 @@ class Notifications {
 				'label' => t('Forums'),
 				'title' => t('Forums'),
 				'filter' => [
-					'name_label' => t('Filter by name')
+					'name_label' => t('Filter by name or address')
 				]
 			];
 		}
@@ -150,7 +150,7 @@ class Notifications {
 				],
 				'filter' => [
 					'posts_label' => t('Show new posts only'),
-					'name_label' => t('Filter by name')
+					'name_label' => t('Filter by name or address')
 				]
 			];
 		}