Merge branch 'master' into movejs

Conflicts:
	version.inc

4 files changed, 340 insertions, 35 deletions

diff --git a/include/attach.php b/include/attach.php
index 3eb7a9366..cd211f2a2 100644
--- a/include/attach.php
+++ b/include/attach.php
@@ -526,11 +526,14 @@ function attach_mkdir($channel,$observer_hash,$arr = null) {
 	$sql_options = '';
 
 	$basepath = 'store/' . $channel['channel_address'];
+
+	logger('attach_mkdir: basepath: ' . $basepath);
+
 	if(! is_dir($basepath))
-		@mkdir($basepath,STORAGE_DEFAULT_PERMISSIONS,true);
+		mkdir($basepath,STORAGE_DEFAULT_PERMISSIONS,true);
 
 
-	if(! perm_is_allowed($channel_id, get_observer_hash(),'write_storage')) {
+	if(! perm_is_allowed($channel_id, $observer_hash,'write_storage')) {
 		$ret['message'] = t('Permission denied.');
 		return $ret;
 	}
@@ -607,10 +610,10 @@ function attach_mkdir($channel,$observer_hash,$arr = null) {
 		dbesc(''),
 		dbesc($created),
 		dbesc($created),
-		dbesc(($arr && array_key_exists('allow_cid',$arr)) ? $arr['allow_cid'] : ''),
-		dbesc(($arr && array_key_exists('allow_gid',$arr)) ? $arr['allow_gid'] : ''),
-		dbesc(($arr && array_key_exists('deny_cid',$arr))  ? $arr['deny_cid']  : ''),
-		dbesc(($arr && array_key_exists('deny_gid',$arr))  ? $arr['deny_gid']  : '')
+		dbesc(($arr && array_key_exists('allow_cid',$arr)) ? $arr['allow_cid'] : $channel['channel_allow_cid']),
+		dbesc(($arr && array_key_exists('allow_gid',$arr)) ? $arr['allow_gid'] : $channel['channel_allow_gid']),
+		dbesc(($arr && array_key_exists('deny_cid',$arr))  ? $arr['deny_cid']  : $channel['channel_deny_cid']),
+		dbesc(($arr && array_key_exists('deny_gid',$arr))  ? $arr['deny_gid']  : $channel['channel_deny_gid'])
 	);
 
 	if($r) {
diff --git a/include/items.php b/include/items.php
index 9824d2434..781956882 100755
--- a/include/items.php
+++ b/include/items.php
@@ -3935,3 +3935,52 @@ function items_fetch($arr,$channel = null,$observer_hash = null,$client_mode = C
 
 	return $items;
 }
+
+
+function update_remote_id($channel,$post_id,$webpage,$pagetitle,$namespace,$remote_id,$mid) {
+
+	$page_type = '';
+
+	if($webpage & ITEM_WEBPAGE)
+		$page_type = 'WEBPAGE';
+	elseif($webpage & ITEM_BUILDBLOCK)
+		$page_type = 'BUILDBLOCK';
+	elseif($webpage & ITEM_PDL)
+		$page_type = 'PDL';
+	elseif($namespace && $remote_id) {
+		$page_type = $namespace;
+		$pagetitle = $remote_id;
+	}
+
+	if($page_type) {	
+
+		// store page info as an alternate message_id so we can access it via 
+		//    https://sitename/page/$channelname/$pagetitle
+		// if no pagetitle was given or it couldn't be transliterated into a url, use the first 
+		// sixteen bytes of the mid - which makes the link portable and not quite as daunting
+		// as the entire mid. If it were the post_id the link would be less portable.
+
+		$r = q("select * from item_id where iid = %d and uid = %d and service = '%s' limit 1",
+			intval($post_id),
+			intval($channel['channel_id']),
+			dbesc($page_type)
+		);
+		if($r) {
+			q("update item_id set sid = '%s' where id = %d limit 1",
+				dbesc(($pagetitle) ? $pagetitle : substr($mid,0,16)),
+				intval($r[0]['id'])
+			);
+		}
+		else {
+			q("insert into item_id ( iid, uid, sid, service ) values ( %d, %d, '%s','%s' )",
+				intval($post_id),
+				intval($channel['channel_id']),
+				dbesc(($pagetitle) ? $pagetitle : substr($mid,0,16)),
+				dbesc($page_type)
+			);
+		}
+	}
+
+}
+
+
diff --git a/include/reddav.php b/include/reddav.php
index 79c68a000..17bca790d 100644
--- a/include/reddav.php
+++ b/include/reddav.php
@@ -75,12 +75,12 @@ class RedInode implements DAV\INode {
 class RedDirectory extends DAV\Node implements DAV\ICollection {
 
 	private $red_path;
+	private $folder_hash;
 	private $ext_path;
 	private $root_dir = '';
 	private $auth;
 
 
-
 	function __construct($ext_path,&$auth_plugin) {
 		logger('RedDirectory::__construct() ' . $ext_path);
 		$this->ext_path = $ext_path;
@@ -89,7 +89,11 @@ class RedDirectory extends DAV\Node implements DAV\ICollection {
 			$this->red_path = '/';
 		$this->auth = $auth_plugin;
 		logger('Red_Directory: ' . print_r($this,true));
+		$this->folder_hash = '';
 
+		$this->getDir();
+		if($this->auth->browser)
+			$this->auth->browser->set_writeable();
 
 	}
 
@@ -102,13 +106,13 @@ class RedDirectory extends DAV\Node implements DAV\ICollection {
 			return;
 		}
 
-		if(! perm_is_allowed($this->auth->channel_id,$this->auth->observer,'view_storage')) {
+		if(($this->auth->owner_id) && (! perm_is_allowed($this->auth->owner_id,$this->auth->observer,'view_storage'))) {
 			throw new DAV\Exception\Forbidden('Permission denied.');
 			return;
 		}
 
-		return RedCollectionData($this->red_path,$this->auth);
-
+		$contents =  RedCollectionData($this->red_path,$this->auth);
+		return $contents;
 	}
 
 
@@ -123,7 +127,7 @@ class RedDirectory extends DAV\Node implements DAV\ICollection {
 			return;
 		}
  
-		if(! perm_is_allowed($this->auth->channel_id,$this->auth->observer,'view_storage')) {
+		if(($this->auth->owner_id) && (! perm_is_allowed($this->auth->owner_id,$this->auth->observer,'view_storage'))) {
 			throw new DAV\Exception\Forbidden('Permission denied.');
 			return;
 		}
@@ -154,10 +158,16 @@ class RedDirectory extends DAV\Node implements DAV\ICollection {
 		logger('RedDirectory::createFile : ' . $name);
 		logger('RedDirectory::createFile : ' . print_r($this,true));
 
-		logger('createFile():' . stream_get_contents($data));
+//		logger('createFile():' . stream_get_contents($data));
 
 
-		if(! perm_is_allowed($this->auth->channel_id,$this->auth->observer,'write_storage')) {
+		if(! $this->auth->owner_id) {
+			logger('createFile: permission denied');
+			throw new DAV\Exception\Forbidden('Permission denied.');
+			return;
+		}
+
+		if(! perm_is_allowed($this->auth->owner_id,$this->auth->observer,'write_storage')) {
 			logger('createFile: permission denied');
 			throw new DAV\Exception\Forbidden('Permission denied.');
 			return;
@@ -174,20 +184,25 @@ class RedDirectory extends DAV\Node implements DAV\ICollection {
 		$filesize = 0;
 		$hash = random_string();
 
-dbg(1);
-
-        $r = q("INSERT INTO attach ( aid, uid, hash, filename, filetype, filesize, revision, data, created, edited )
-            VALUES ( %d, %d, '%s', '%s', '%s', %d, %d, '%s', '%s', '%s' ) ",
+        $r = q("INSERT INTO attach ( aid, uid, hash, filename, folder, filetype, filesize, revision, data, created, edited, allow_cid, allow_gid, deny_cid, deny_gid )
+            VALUES ( %d, %d, '%s', '%s', '%s', '%s', %d, %d, '%s', '%s', '%s', '%s', '%s', '%s', '%s' ) ",
             intval($c[0]['channel_account_id']),
             intval($c[0]['channel_id']),
             dbesc($hash),
             dbesc($name),
+			dbesc($this->folder_hash),
             dbesc($mimetype),
             intval($filesize),
             intval(0),
             dbesc(stream_get_contents($data)),
             dbesc(datetime_convert()),
-            dbesc(datetime_convert())
+            dbesc(datetime_convert()),
+			dbesc($c[0]['channel_allow_cid']),
+			dbesc($c[0]['channel_allow_gid']),
+			dbesc($c[0]['channel_deny_cid']),
+			dbesc($c[0]['channel_deny_gid'])
+
+
 		);
 
 		$r = q("update attach set filesize = length(data) where hash = '%s' and uid = %d limit 1",
@@ -195,25 +210,58 @@ dbg(1);
 			intval($c[0]['channel_id'])
 		);
 
+		$r = q("select filesize from attach where hash = '%s' and uid = %d limit 1",
+			dbesc($hash),
+			intval($c[0]['channel_id'])
+		);
 
-dbg(0);
- 
-	}
+		// FIXME - delete attached file resource if using OS storage
 
+		$maxfilesize = get_config('system','maxfilesize');
 
-	function createDirectory($name) {
-		if(! perm_is_allowed($this->auth->channel_id,$this->auth->observer,'write_storage')) {
-			throw new DAV\Exception\Forbidden('Permission denied.');
+		if(($maxfilesize) && ($r[0]['filesize'] > $maxfilesize)) {
+			q("delete from attach where hash = '%s' and uid = %d limit 1",
+				dbesc($hash),
+				intval($c[0]['channel_id'])
+			);
 			return;
 		}
 
+		$limit = service_class_fetch($c[0]['channel_id'],'attach_upload_limit');
+		if($limit !== false) {
+			$x = q("select sum(filesize) as total from attach where uid = %d ",
+				intval($c[0]['channel_id'])
+			);
+			if(($x) &&  ($x[0]['total'] + $r[0]['filesize'] > $limit)) {
+				q("delete from attach where hash = '%s' and uid = %d limit 1",
+					dbesc($hash),
+					intval($c[0]['channel_id'])
+				);
+				return;
+			}
+		}
+	}
 
 
+	function createDirectory($name) {
 
+		logger('RedDirectory::createDirectory: ' . $name);
 
+		if((! $this->auth->owner_id) || (! perm_is_allowed($this->auth->owner_id,$this->auth->observer,'write_storage'))) {
+			throw new DAV\Exception\Forbidden('Permission denied.');
+			return;
+		}
+
+		$r = q("select * from channel where channel_id = %d limit 1",
+			dbesc($this->auth->owner_id)
+		);
 
+		if($r) {
+			$result = attach_mkdir($r[0],$this->auth->observer,array('filename' => $name,'folder' => $this->folder_hash));
 
+			logger('RedDirectory::createDirectory: ' . print_r($result,true));
 
+		}
 
 	}
 
@@ -235,6 +283,70 @@ dbg(0);
 
 	}
 
+	function getDir() {
+
+		logger('getDir: ' . $this->ext_path);
+		$file = $this->ext_path;
+
+
+		$x = strpos($file,'/cloud');
+		if($x === false)
+			return;
+		if($x === 0) {
+			$file = substr($file,6);
+		}
+
+		if((! $file) || ($file === '/')) {
+			return;
+		}
+
+		$file = trim($file,'/');
+		$path_arr = explode('/', $file);
+	
+		if(! $path_arr)
+			return;
+
+
+		logger('getDir(): path: ' . print_r($path_arr,true));
+
+		$channel_name = $path_arr[0];
+
+		$r = q("select channel_id from channel where channel_address = '%s' limit 1",
+			dbesc($channel_name)
+		);
+
+		if(! $r)
+			return;
+
+		$channel_id = $r[0]['channel_id'];
+		$this->auth->owner_id = $channel_id;
+
+		$path = '/' . $channel_name;
+
+		$folder = '';
+
+		for($x = 1; $x < count($path_arr); $x ++) {		
+
+			$r = q("select id, hash, filename, flags from attach where folder = '%s' and filename = '%s' and (flags & %d)",
+				dbesc($folder),
+				dbesc($path_arr[$x]),
+				intval($channel_id),
+				intval(ATTACH_FLAG_DIR)
+			);
+
+			if($r && ( $r[0]['flags'] & ATTACH_FLAG_DIR)) {
+				$folder = $r[0]['hash'];
+				$path = $path . '/' . $r[0]['filename'];
+			}	
+		}
+		$this->folder_hash = $folder;
+		return;
+	}
+
+
+
+
+
 }
 
 
@@ -264,7 +376,7 @@ class RedFile extends DAV\Node implements DAV\IFile {
 	function setName($newName) {
 		logger('RedFile::setName: ' . basename($this->name) . ' -> ' . $newName);
 
-		if((! $newName) || (! perm_is_allowed($this->auth->channel_id,$this->auth->observer,'write_storage'))) {
+		if((! $newName) || (! $this->auth->owner_id) || (! perm_is_allowed($this->auth->owner_id,$this->auth->observer,'write_storage'))) {
 			throw new DAV\Exception\Forbidden('Permission denied.');
 			return;
 		}
@@ -282,9 +394,8 @@ class RedFile extends DAV\Node implements DAV\IFile {
 
 	function put($data) {
 		logger('RedFile::put: ' . basename($this->name));
-		logger('put():' . stream_get_contents($data));
+//		logger('put():' . stream_get_contents($data));
 
-dbg(1);
 		$r = q("update attach set data = '%s' where hash = '%s' and uid = %d limit 1",
 			dbesc(stream_get_contents($data)),
 			dbesc($this->data['hash']),
@@ -294,8 +405,35 @@ dbg(1);
 			dbesc($this->data['hash']),
 			intval($this->data['uid'])
 		);
-dbg(0);
 
+		$r = q("select filesize from attach where hash = '%s' and uid = %d limit 1",
+			dbesc($this->data['hash']),
+			intval($c[0]['channel_id'])
+		);
+
+		$maxfilesize = get_config('system','maxfilesize');
+
+		if(($maxfilesize) && ($r[0]['filesize'] > $maxfilesize)) {
+			q("delete from attach where hash = '%s' and uid = %d limit 1",
+				dbesc($this->data['hash']),
+				intval($c[0]['channel_id'])
+			);
+			return;
+		}
+
+		$limit = service_class_fetch($c[0]['channel_id'],'attach_upload_limit');
+		if($limit !== false) {
+			$x = q("select sum(filesize) as total from attach where uid = %d ",
+				intval($c[0]['channel_id'])
+			);
+			if(($x) &&  ($x[0]['total'] + $r[0]['filesize'] > $limit)) {
+				q("delete from attach where hash = '%s' and uid = %d limit 1",
+					dbesc($this->data['hash']),
+					intval($c[0]['channel_id'])
+				);
+				return;
+			}
+		}
 	}
 
 
@@ -390,15 +528,16 @@ logger('dbg1: ' . print_r($r,true));
 		return null;
 
 	$channel_id = $r[0]['channel_id'];
+	$auth->owner_id = $channel_id;
 
 	$path = '/' . $channel_name;
 
 	$folder = '';
 
 	for($x = 1; $x < count($path_arr); $x ++) {		
-		$r = q("select id, hash, filename, flags from attach where folder = '%s' and (flags & %d)",
+		$r = q("select id, hash, filename, flags from attach where folder = '%s' and filename = '%s' and (flags & %d)",
 			dbesc($folder),
-			intval($channel_id),
+			dbesc($path_arr[$x]),
 			intval(ATTACH_FLAG_DIR)
 		);
 		if($r && ( $r[0]['flags'] & ATTACH_FLAG_DIR)) {
@@ -437,7 +576,7 @@ logger('dbg2: ' . print_r($r,true));
 
 function RedFileData($file, &$auth,$test = false) {
 
-logger('RedFileData:' . $file);
+logger('RedFileData:' . $file . (($test) ? ' (test mode) ' : ''));
 
 
 	$x = strpos($file,'/cloud');
@@ -479,6 +618,11 @@ logger('file=' . $file);
 
 	$path = '/' . $channel_name;
 
+	$auth->owner_id = $channel_id;
+
+	$permission_error = false;
+
+
 	$folder = '';
 //dbg(1);
 
@@ -489,8 +633,9 @@ logger('file=' . $file);
 
 	for($x = 1; $x < count($path_arr); $x ++) {		
 dbg(1);
-		$r = q("select id, hash, filename, flags from attach where folder = '%s' and uid = %d and (flags & %d) $perms",
+		$r = q("select id, hash, filename, flags from attach where folder = '%s' and filename = '%s' and uid = %d and (flags & %d) $perms",
 			dbesc($folder),
+			dbesc($path_arr[$x]),
 			intval($channel_id),
 			intval(ATTACH_FLAG_DIR)
 		);
@@ -510,13 +655,27 @@ dbg(0);
 
 			);
 		}
-		if(! $r)
+		if(! $r) {
+
 			$errors = true;
+			$r = q("select id, uid, hash, filename, filetype, filesize, revision, folder, flags, created, edited from attach 
+				where folder = '%s' and filename = '%s' and uid = %d group by filename limit 1",
+				dbesc($folder),
+				basename($file),
+				intval($channel_id)
+			);
+			if($r)
+				$permission_error = true;
+
+		}
+
 	}
 
 	logger('dbg1: ' . print_r($r,true));
 
 	if($path === '/' . $file) {
+		if($test)
+			return true;
 		// final component was a directory.
 		return new RedDirectory('/cloud/' . $file,$auth);
 	}
@@ -524,11 +683,18 @@ dbg(0);
 	if($errors) {
 		if($test)
 			return false;
-		throw new DAV\Exception\Forbidden('Permission denied.');
+		if($permission_error) {
+			logger('RedFileData: permission error');	
+			throw new DAV\Exception\Forbidden('Permission denied.');
+		}
+		logger('RedFileData: not found');
 		return;
 	}
 
 	if($r) {
+		if($test)
+			return true;
+
 		if($r[0]['flags'] & ATTACH_FLAG_DIR)
 			return new RedDirectory('/cloud' . $path . '/' . $r[0]['filename'],$auth);
 		else
@@ -538,3 +704,90 @@ dbg(0);
 }
 
 
+class RedBasicAuth extends Sabre\DAV\Auth\Backend\AbstractBasic {
+
+	public $channel_name = '';
+	public $channel_id = 0;
+	public $channel_hash = '';
+	public $observer = '';
+	public $browser;
+	public $owner_id;
+
+    protected function validateUserPass($username, $password) {
+		require_once('include/auth.php');
+		$record = account_verify_password($email,$pass);
+		if($record && $record['account_default_channel']) {
+			$r = q("select * from channel where channel_account_id = %d and channel_id = %d limit 1",
+				intval($record['account_id']),
+				intval($record['account_default_channel'])
+			);
+			if($r) {
+				$this->currentUser = $r[0]['channel_address'];
+				$this->channel_name = $r[0]['channel_address'];
+				$this->channel_id = $r[0]['channel_id'];
+				$this->channel_hash = $this->observer = $r[0]['channel_hash'];
+				return true;
+			}
+		}
+		$r = q("select * from channel where channel_address = '%s' limit 1",
+			dbesc($username)
+		);
+		if($r) {
+			$x = q("select * from account where account_id = %d limit 1",
+				intval($r[0]['channel_account_id'])
+			);
+			if($x) {
+			    foreach($x as $record) {
+			        if(($record['account_flags'] == ACCOUNT_OK) || ($record['account_flags'] == ACCOUNT_UNVERIFIED)
+            		&& (hash('whirlpool',$record['account_salt'] . $password) === $record['account_password'])) {
+			            logger('(DAV) RedBasicAuth: password verified for ' . $username);
+						$this->currentUser = $r[0]['channel_address'];
+						$this->channel_name = $r[0]['channel_address'];
+						$this->channel_id = $r[0]['channel_id'];
+						$this->channel_hash = $this->observer = $r[0]['channel_hash'];
+            			return true;
+        			}
+    			}
+			}
+		}
+	    logger('(DAV) RedBasicAuth: password failed for ' . $username);
+    	return false;
+	}
+
+	function setCurrentUser($name) {
+		$this->currentUser = $name;
+	}
+
+	function setBrowserPlugin($browser) {
+		$this->browser = $browser;
+	}
+		
+}
+
+
+class RedBrowser extends DAV\Browser\Plugin {
+
+	private $auth;
+
+	function __construct(&$auth) {
+
+		$this->auth = $auth;
+
+
+	}
+
+	function set_writeable() {
+		logger('RedBrowser: ' . print_r($this->auth,true));
+
+		if(! $this->auth->owner_id)
+			$this->enablePost = false;
+
+
+		if(! perm_is_allowed($this->auth->owner_id, get_observer_hash(), 'write_storage'))
+			$this->enablePost = false;
+		else
+			$this->enablePost = true;
+
+	}
+
+}
\ No newline at end of file
diff --git a/include/zot.php b/include/zot.php
index 97c9c4a36..168ccaaa5 100644
--- a/include/zot.php
+++ b/include/zot.php
@@ -1726,7 +1726,7 @@ function import_directory_profile($hash,$profile,$addr,$ud_flags = 1, $suppress_
 	else {
 		$update = true;
 		logger('import_directory_profile: new profile');
-		$x = q("insert into xprof (xprof_hash, xprof_desc, xprof_dob, xprof_age, xprof_gender, xprof_marital, xprof_sexual, xprof_locale, xprof_region, xprof_postcode, xprof_country, xrpof_about, xprof_homepage, xprof_hometown, xprof_keywords) values ('%s', '%s', '%s', %d, '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s') ",
+		$x = q("insert into xprof (xprof_hash, xprof_desc, xprof_dob, xprof_age, xprof_gender, xprof_marital, xprof_sexual, xprof_locale, xprof_region, xprof_postcode, xprof_country, xprof_about, xprof_homepage, xprof_hometown, xprof_keywords) values ('%s', '%s', '%s', %d, '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s') ",
 			dbesc($arr['xprof_hash']),
 			dbesc($arr['xprof_desc']),
 			dbesc($arr['xprof_dob']),