icon changes, feed security improvements

1 files changed, 195 insertions, 186 deletions

diff --git a/include/poller.php b/include/poller.php
index d54c88e05..fd02e0198 100644
--- a/include/poller.php
+++ b/include/poller.php
@@ -2,18 +2,18 @@
 require_once("boot.php");
 
 function poller_run($argv, $argc){
-  global $a, $db;
+	global $a, $db;
 
-  if(is_null($a)){
-    $a = new App;
-  }
+	if(is_null($a)) {
+		$a = new App;
+	}
   
-  if(is_null($db)){
-    @include(".htconfig.php");
-    require_once("dba.php");
-    $db = new dba($db_host, $db_user, $db_pass, $db_data);
-    unset($db_host, $db_user, $db_pass, $db_data);
-  };
+	if(is_null($db)) {
+	    @include(".htconfig.php");
+    	require_once("dba.php");
+	    $db = new dba($db_host, $db_user, $db_pass, $db_data);
+    	unset($db_host, $db_user, $db_pass, $db_data);
+  	};
 
 	require_once('session.php');
 	require_once('datetime.php');
@@ -30,7 +30,7 @@ function poller_run($argv, $argc){
 	proc_run('php',"include/queue.php");
 	
 	// clear old cache
-	q("DELETE FROM `cache` WHERE `updated`<'%s'",
+	q("DELETE FROM `cache` WHERE `updated` < '%s'",
 		dbesc(datetime_convert('UTC','UTC',"now - 30 days")));
 
 	$manual_id  = 0;
@@ -47,245 +47,254 @@ function poller_run($argv, $argc){
 
 	$sql_extra = (($manual_id) ? " AND `id` = $manual_id " : "");
 
-	// 'stat' clause is a temporary measure until we have federation subscriptions working both directions
-	$contacts = q("SELECT * FROM `contact` 
-		WHERE ( ( `network` = 'dfrn' AND ( `dfrn-id` != '' OR (`issued-id` != '' AND `duplex` = 1)))
-		OR ( `network` IN ( 'stat', 'feed' ) AND `poll` != '' ))
+	$contacts = q("SELECT `id` FROM `contact` 
+		WHERE ( `rel` = %d OR `rel` = %d ) AND `poll` != ''
 		$sql_extra 
-		AND `self` = 0 AND `blocked` = 0 AND `readonly` = 0 ORDER BY RAND()");
+		AND `self` = 0 AND `blocked` = 0 AND `readonly` = 0 ORDER BY RAND()",
+		intval(REL_FAN),
+		intval(REL_BUD)
+	);
 
-	if(! count($contacts)){
+	if(! count($contacts)) {
 		return;
 	}
 
-	foreach($contacts as $contact) {
+	foreach($contacts as $c) {
 
-		if($manual_id)
-			$contact['last-update'] = '0000-00-00 00:00:00';
+		$res = q("SELECT * FROM `contact` WHERE `id` = %d LIMIT 1",
+			intval($c['id'])
+		);
 
-		if($contact['priority'] || $contact['subhub']) {
+		if(! count($res))
+			continue;
 
-			$hub_update = true;
-			$update     = false;
+		foreach($res as $contact) {
+			if($manual_id)
+				$contact['last-update'] = '0000-00-00 00:00:00';
 
-			$t = $contact['last-update'];
+			if($contact['priority'] || $contact['subhub']) {
 
-			// We should be getting everything via a hub. But just to be sure, let's check once a day.
-			// (You can make this more or less frequent if desired by setting 'pushpoll_frequency' appropriately)
-			// This also lets us update our subscription to the hub, and add or replace hubs in case it
-			// changed. We will only update hubs once a day, regardless of 'pushpoll_frequency'. 
+				$hub_update = true;
+				$update     = false;
 
+				$t = $contact['last-update'];
 
-			if($contact['subhub']) {
-				$interval = get_config('system','pushpoll_frequency');
-				$contact['priority'] = (($interval !== false) ? intval($interval) : 3);
-				$hub_update = false;
+				// We should be getting everything via a hub. But just to be sure, let's check once a day.
+				// (You can make this more or less frequent if desired by setting 'pushpoll_frequency' appropriately)
+				// This also lets us update our subscription to the hub, and add or replace hubs in case it
+				// changed. We will only update hubs once a day, regardless of 'pushpoll_frequency'. 
 
-				if((datetime_convert('UTC','UTC', 'now') > datetime_convert('UTC','UTC', $t . " + 1 day")) || $force)
-						$hub_update = true;
-			}
 
+				if($contact['subhub']) {
+					$interval = get_config('system','pushpoll_frequency');
+					$contact['priority'] = (($interval !== false) ? intval($interval) : 3);
+					$hub_update = false;
+	
+					if((datetime_convert('UTC','UTC', 'now') > datetime_convert('UTC','UTC', $t . " + 1 day")) || $force)
+							$hub_update = true;
+				}
 
-			/**
-			 * Based on $contact['priority'], should we poll this site now? Or later?
-			 */			
-
-			switch ($contact['priority']) {
-				case 5:
-					if(datetime_convert('UTC','UTC', 'now') > datetime_convert('UTC','UTC', $t . " + 1 month"))
-						$update = true;
-					break;					
-				case 4:
-					if(datetime_convert('UTC','UTC', 'now') > datetime_convert('UTC','UTC', $t . " + 1 week"))
-						$update = true;
-					break;
-				case 3:
-					if(datetime_convert('UTC','UTC', 'now') > datetime_convert('UTC','UTC', $t . " + 1 day"))
-						$update = true;
-					break;
-				case 2:
-					if(datetime_convert('UTC','UTC', 'now') > datetime_convert('UTC','UTC', $t . " + 12 hour"))
-						$update = true;
-					break;
-				case 1:
-				default:
-					if(datetime_convert('UTC','UTC', 'now') > datetime_convert('UTC','UTC', $t . " + 1 hour"))
-						$update = true;
-					break;
+				/**
+				 * Based on $contact['priority'], should we poll this site now? Or later?
+				 */			
+
+				switch ($contact['priority']) {
+					case 5:
+						if(datetime_convert('UTC','UTC', 'now') > datetime_convert('UTC','UTC', $t . " + 1 month"))
+							$update = true;
+						break;					
+					case 4:
+						if(datetime_convert('UTC','UTC', 'now') > datetime_convert('UTC','UTC', $t . " + 1 week"))
+							$update = true;
+						break;
+					case 3:
+						if(datetime_convert('UTC','UTC', 'now') > datetime_convert('UTC','UTC', $t . " + 1 day"))
+							$update = true;
+						break;
+					case 2:
+						if(datetime_convert('UTC','UTC', 'now') > datetime_convert('UTC','UTC', $t . " + 12 hour"))
+							$update = true;
+						break;
+					case 1:
+					default:
+						if(datetime_convert('UTC','UTC', 'now') > datetime_convert('UTC','UTC', $t . " + 1 hour"))
+							$update = true;
+						break;
+				}
+				if((! $update) && (! $force))
+					continue;
 			}
-			if((! $update) && (! $force))
+
+			$importer_uid = $contact['uid'];
+		
+			$r = q("SELECT * FROM `contact` WHERE `uid` = %d AND `self` = 1 LIMIT 1",
+				intval($importer_uid)
+			);
+			if(! count($r))
 				continue;
-		}
 
-		$importer_uid = $contact['uid'];
+			$importer = $r[0];
 
-		$r = q("SELECT * FROM `contact` WHERE `uid` = %d AND `self` = 1 LIMIT 1",
-			intval($importer_uid)
-		);
-		if(! count($r))
-			continue;
+			logger("poller: poll: IMPORTER: {$importer['name']}, CONTACT: {$contact['name']}");
 
-		$importer = $r[0];
+			$last_update = (($contact['last-update'] === '0000-00-00 00:00:00') 
+				? datetime_convert('UTC','UTC','now - 30 days', ATOM_TIME)
+				: datetime_convert('UTC','UTC',$contact['last-update'], ATOM_TIME)
+			);
 
-		logger("poller: poll: IMPORTER: {$importer['name']}, CONTACT: {$contact['name']}");
+			if($contact['network'] === 'dfrn') {
 
-		$last_update = (($contact['last-update'] === '0000-00-00 00:00:00') 
-			? datetime_convert('UTC','UTC','now - 30 days', ATOM_TIME)
-			: datetime_convert('UTC','UTC',$contact['last-update'], ATOM_TIME)
-		);
+				$idtosend = $orig_id = (($contact['dfrn-id']) ? $contact['dfrn-id'] : $contact['issued-id']);
 
-		if($contact['network'] === 'dfrn') {
+				if(intval($contact['duplex']) && $contact['dfrn-id'])
+					$idtosend = '0:' . $orig_id;
+				if(intval($contact['duplex']) && $contact['issued-id'])
+					$idtosend = '1:' . $orig_id;		
 
-			$idtosend = $orig_id = (($contact['dfrn-id']) ? $contact['dfrn-id'] : $contact['issued-id']);
+				$url = $contact['poll'] . '?dfrn_id=' . $idtosend 
+					. '&dfrn_version=' . DFRN_PROTOCOL_VERSION 
+					. '&type=data&last_update=' . $last_update ;
+	
+				$xml = fetch_url($url);
 
-			if(intval($contact['duplex']) && $contact['dfrn-id'])
-				$idtosend = '0:' . $orig_id;
-			if(intval($contact['duplex']) && $contact['issued-id'])
-				$idtosend = '1:' . $orig_id;		
+				logger('poller: handshake with url ' . $url . ' returns xml: ' . $xml, LOGGER_DATA);
 
-			$url = $contact['poll'] . '?dfrn_id=' . $idtosend 
-				. '&dfrn_version=' . DFRN_PROTOCOL_VERSION 
-				. '&type=data&last_update=' . $last_update ;
-	
-			$xml = fetch_url($url);
 
-			logger('poller: handshake with url ' . $url . ' returns xml: ' . $xml, LOGGER_DATA);
+				if(! $xml) {
+					logger("poller: $url appears to be dead - marking for death ");
+					// dead connection - might be a transient event, or this might
+					// mean the software was uninstalled or the domain expired. 
+					// Will keep trying for one month.
+					mark_for_death($contact);
 
+					// set the last-update so we don't keep polling
 
-			if(! $xml) {
-				logger("poller: $url appears to be dead - marking for death ");
-				// dead connection - might be a transient event, or this might
-				// mean the software was uninstalled or the domain expired. 
-				// Will keep trying for one month.
-				mark_for_death($contact);
+					$r = q("UPDATE `contact` SET `last-update` = '%s' WHERE `id` = %d LIMIT 1",
+						dbesc(datetime_convert()),
+						intval($contact['id'])
+					);
 
-				// set the last-update so we don't keep polling
+					continue;
+				}
 
-				$r = q("UPDATE `contact` SET `last-update` = '%s' WHERE `id` = %d LIMIT 1",
-					dbesc(datetime_convert()),
-					intval($contact['id'])
-				);
+				if(! strstr($xml,'<?xml')) {
+					logger('poller: response from ' . $url . ' did not contain XML.');
+					$r = q("UPDATE `contact` SET `last-update` = '%s' WHERE `id` = %d LIMIT 1",
+						dbesc(datetime_convert()),
+						intval($contact['id'])
+					);
+					continue;
+				}
 
-				continue;
-			}
 
-			if(! strstr($xml,'<?xml')) {
-				logger('poller: response from ' . $url . ' did not contain XML.');
-				$r = q("UPDATE `contact` SET `last-update` = '%s' WHERE `id` = %d LIMIT 1",
-					dbesc(datetime_convert()),
-					intval($contact['id'])
-				);
-				continue;
-			}
+				$res = simplexml_load_string($xml);
+	
+				if(intval($res->status) == 1) {
+					logger("poller: $url replied status 1 - marking for death ");
 
+					// we may not be friends anymore. Will keep trying for one month.
+					// set the last-update so we don't keep polling
 
-			$res = simplexml_load_string($xml);
+					$r = q("UPDATE `contact` SET `last-update` = '%s' WHERE `id` = %d LIMIT 1",
+						dbesc(datetime_convert()),
+						intval($contact['id'])
+					);
 
-			if(intval($res->status) == 1) {
-				logger("poller: $url replied status 1 - marking for death ");
+					mark_for_death($contact);
+				}
+				else {
+					if($contact['term-date'] != '0000-00-00 00:00:00') {
+						logger("poller: $url back from the dead - removing mark for death");
+						unmark_for_death($contact);
+					}
+				}
 
-				// we may not be friends anymore. Will keep trying for one month.
-				// set the last-update so we don't keep polling
+				if((intval($res->status) != 0) || (! strlen($res->challenge)) || (! strlen($res->dfrn_id)))
+					continue;
 
-				$r = q("UPDATE `contact` SET `last-update` = '%s' WHERE `id` = %d LIMIT 1",
-					dbesc(datetime_convert()),
-					intval($contact['id'])
-				);
+				$postvars = array();
 
-				mark_for_death($contact);
-			}
-			else {
-				if($contact['term-date'] != '0000-00-00 00:00:00') {
-					logger("poller: $url back from the dead - removing mark for death");
-					unmark_for_death($contact);
+				$sent_dfrn_id = hex2bin((string) $res->dfrn_id);
+				$challenge    = hex2bin((string) $res->challenge);
+
+				$final_dfrn_id = '';
+
+				if(($contact['duplex']) && strlen($contact['prvkey'])) {
+					openssl_private_decrypt($sent_dfrn_id,$final_dfrn_id,$contact['prvkey']);
+					openssl_private_decrypt($challenge,$postvars['challenge'],$contact['prvkey']);
+				}
+				else {
+					openssl_public_decrypt($sent_dfrn_id,$final_dfrn_id,$contact['pubkey']);
+					openssl_public_decrypt($challenge,$postvars['challenge'],$contact['pubkey']);
 				}
-			}
 
-			if((intval($res->status) != 0) || (! strlen($res->challenge)) || (! strlen($res->dfrn_id)))
-				continue;
+				$final_dfrn_id = substr($final_dfrn_id, 0, strpos($final_dfrn_id, '.'));
 
-			$postvars = array();
+				if(strpos($final_dfrn_id,':') == 1)
+					$final_dfrn_id = substr($final_dfrn_id,2);
 
-			$sent_dfrn_id = hex2bin((string) $res->dfrn_id);
-			$challenge    = hex2bin((string) $res->challenge);
+				if($final_dfrn_id != $orig_id) {
+	
+					// did not decode properly - cannot trust this site 
+					continue;
+				}
 
-			$final_dfrn_id = '';
+				$postvars['dfrn_id'] = $idtosend;
+				$postvars['dfrn_version'] = DFRN_PROTOCOL_VERSION;
 
-			if(($contact['duplex']) && strlen($contact['prvkey'])) {
-				openssl_private_decrypt($sent_dfrn_id,$final_dfrn_id,$contact['prvkey']);
-				openssl_private_decrypt($challenge,$postvars['challenge'],$contact['prvkey']);
+				$xml = post_url($contact['poll'],$postvars);
 			}
 			else {
-				openssl_public_decrypt($sent_dfrn_id,$final_dfrn_id,$contact['pubkey']);
-				openssl_public_decrypt($challenge,$postvars['challenge'],$contact['pubkey']);
-			}
 
-			$final_dfrn_id = substr($final_dfrn_id, 0, strpos($final_dfrn_id, '.'));
+				// $contact['network'] !== 'dfrn'
 
-			if(strpos($final_dfrn_id,':') == 1)
-				$final_dfrn_id = substr($final_dfrn_id,2);
+				$xml = fetch_url($contact['poll']);
+			}
 
-			if($final_dfrn_id != $orig_id) {
+			logger('poller: received xml : ' . $xml, LOGGER_DATA);
 
-				// did not decode properly - cannot trust this site 
+			if(! strstr($xml,'<?xml')) {
+				logger('poller: post_handshake: response from ' . $url . ' did not contain XML.');
+				$r = q("UPDATE `contact` SET `last-update` = '%s' WHERE `id` = %d LIMIT 1",
+					dbesc(datetime_convert()),
+					intval($contact['id'])
+				);
 				continue;
 			}
 
-			$postvars['dfrn_id'] = $idtosend;
-			$postvars['dfrn_version'] = DFRN_PROTOCOL_VERSION;
+			consume_feed($xml,$importer,$contact,$hub,1);
 
-			$xml = post_url($contact['poll'],$postvars);
-		}
-		else {
-
-			// $contact['network'] !== 'dfrn'
-
-			$xml = fetch_url($contact['poll']);
-		}
-
-		logger('poller: received xml : ' . $xml, LOGGER_DATA);
-
-		if(! strstr($xml,'<?xml')) {
-			logger('poller: post_handshake: response from ' . $url . ' did not contain XML.');
-			$r = q("UPDATE `contact` SET `last-update` = '%s' WHERE `id` = %d LIMIT 1",
-				dbesc(datetime_convert()),
-				intval($contact['id'])
-			);
-			continue;
-		}
-
-		consume_feed($xml,$importer,$contact,$hub,1);
-
-		// do it twice. Ensures that children of parents which may be later in the stream aren't tossed
+			// do it twice. Ensures that children of parents which may be later in the stream aren't tossed
 
-		consume_feed($xml,$importer,$contact,$hub,1);
+			consume_feed($xml,$importer,$contact,$hub,1);
 
 
-		if((strlen($hub)) && ($hub_update) 
-			&& (($contact['rel'] == REL_BUD) || (($contact['network'] === 'stat') && (! $contact['readonly'])))) {
-			logger('poller: subscribing to hub(s) : ' . $hub . ' contact name : ' . $contact['name'] . ' local user : ' . $importer['name']);
-			$hubs = explode(',', $hub);
-			if(count($hubs)) {
-				foreach($hubs as $h) {
-					$h = trim($h);
-					if(! strlen($h))
-						continue;
-					subscribe_to_hub($h,$importer,$contact);
+			if((strlen($hub)) && ($hub_update) 
+				&& (($contact['rel'] == REL_BUD) || (($contact['network'] === 'stat') && (! $contact['readonly'])))) {
+				logger('poller: subscribing to hub(s) : ' . $hub . ' contact name : ' . $contact['name'] . ' local user : ' . $importer['name']);
+				$hubs = explode(',', $hub);
+				if(count($hubs)) {
+					foreach($hubs as $h) {
+						$h = trim($h);
+						if(! strlen($h))
+							continue;
+						subscribe_to_hub($h,$importer,$contact);
+					}
 				}
 			}
-		}
 
 
-		$updated = datetime_convert();
+			$updated = datetime_convert();
 
-		$r = q("UPDATE `contact` SET `last-update` = '%s', `success_update` = '%s' WHERE `id` = %d LIMIT 1",
-			dbesc($updated),
-			dbesc($updated),
-			intval($contact['id'])
-		);
+			$r = q("UPDATE `contact` SET `last-update` = '%s', `success_update` = '%s' WHERE `id` = %d LIMIT 1",
+				dbesc($updated),
+				dbesc($updated),
+				intval($contact['id'])
+			);
 
-		// loop - next contact
-	}  
+			// loop - next contact
+		}
+	}
 		
 	return;
 }