aboutsummaryrefslogtreecommitdiffstats
path: root/include
diff options
context:
space:
mode:
authorSimon L'nu <simon.lnu@gmail.com>2012-03-13 22:41:45 -0400
committerSimon L'nu <simon.lnu@gmail.com>2012-03-13 22:41:45 -0400
commita2073bcfc05abadc3e967f40c66d1fa674bba0d3 (patch)
tree6f0412fba9934257465217c9cae283b626d7fb70 /include
parent1763a6c9c2a80642291e13f80be8a092465924ae (diff)
parentde017d1ed76500c01fd11c8e1d36cf4ebd70172d (diff)
downloadvolse-hubzilla-a2073bcfc05abadc3e967f40c66d1fa674bba0d3.tar.gz
volse-hubzilla-a2073bcfc05abadc3e967f40c66d1fa674bba0d3.tar.bz2
volse-hubzilla-a2073bcfc05abadc3e967f40c66d1fa674bba0d3.zip
Merge branch 'master', remote-tracking branch 'remotes/upstream/master'
* remotes/upstream/master: sort inbox by recently replied conversations first file as widget and basic filing implementation for duepuntozero,slackr much more work needed - this is just for test/evaluation currently don't count self in number of contatcs invite potential connectees to the free social web In HTML2BBCode: fetch the URL of [EMBED] using JavaScript instead of an ajax-call to a php-script. Once there actually is embedded Code in the HTML, this function is called after every single keypress. Not only is making an ajax-call every keypress bandith intensive - it also made typing hard / slow. Making a lot of JavaScript-RegExp-Computation every keypress isn't exactly great either, but still performs better. Some security against XSRF-attacks A 'PHP Fatal error: Call to a member function getElementsByTagName() on a non-object in mod/parse_url.php on line 191' occurred when the linked HTML-File doesn't have a HEAD. The HTML-file couln't be link to in the editor therefore. Mostly some checks in order to avoid Notices; 1 real bugfix in /mod/network.php Avoid notices contact.network is used later to check if a direct link or a redirect by /redir/contactid should be used wasn't actually changed before Avoid a notice Avoid a Notice Avoid a Notice Avoid a Notice * master:
Diffstat (limited to 'include')
-rwxr-xr-xinclude/contact_widgets.php29
-rwxr-xr-xinclude/conversation.php11
-rwxr-xr-xinclude/event.php2
-rwxr-xr-xinclude/items.php5
-rwxr-xr-xinclude/oembed.php2
-rwxr-xr-xinclude/security.php46
-rwxr-xr-xinclude/template_processor.php9
-rw-r--r--include/text.php2
8 files changed, 96 insertions, 10 deletions
diff --git a/include/contact_widgets.php b/include/contact_widgets.php
index caa0572d2..605a3eb78 100755
--- a/include/contact_widgets.php
+++ b/include/contact_widgets.php
@@ -75,4 +75,33 @@ function networks_widget($baseurl,$selected = '') {
));
}
+function fileas_widget($baseurl,$selected = '') {
+ $a = get_app();
+ if(! local_user())
+ return '';
+
+ $saved = get_pconfig(local_user(),'system','filetags');
+ if(! strlen($saved))
+ return;
+
+ $matches = false;
+ $terms = array();
+ $cnt = preg_match_all('/\[(.*?)\]/',$saved,$matches,PREG_SET_ORDER);
+ if($cnt) {
+ foreach($matches as $mtch) {
+ $unescaped = file_tag_decode($mtch[1]);
+ $terms[] = array('name' => $unescaped,'selected' => (($selected == $unescaped) ? 'selected' : ''));
+ }
+ }
+
+ return replace_macros(get_markup_template('fileas_widget.tpl'),array(
+ '$title' => t('File Selections'),
+ '$desc' => '',
+ '$sel_all' => (($selected == '') ? 'selected' : ''),
+ '$all' => t('Everything'),
+ '$terms' => $terms,
+ '$base' => $baseurl,
+
+ ));
+}
diff --git a/include/conversation.php b/include/conversation.php
index 526c6ea00..a420e9923 100755
--- a/include/conversation.php
+++ b/include/conversation.php
@@ -375,7 +375,8 @@ function conversation(&$a, $items, $mode, $update, $preview = false) {
$comments[$item['parent']] = 1;
else
$comments[$item['parent']] += 1;
- }
+ } elseif(! x($comments,$item['parent']))
+ $comments[$item['parent']] = 0; // avoid notices later on
}
// map all the like/dislike activities for each parent item
@@ -571,6 +572,7 @@ function conversation(&$a, $items, $mode, $update, $preview = false) {
'classundo' => (($item['starred']) ? "" : "hidden"),
'starred' => t('starred'),
'tagger' => t("add tag"),
+ 'filer' => t("file as"),
'classtagger' => "",
);
}
@@ -873,6 +875,7 @@ function status_editor($a,$x, $notes_cid = 0, $popup=false) {
'$vidurl' => t("Please enter a video link/URL:"),
'$audurl' => t("Please enter an audio link/URL:"),
'$term' => t('Tag term:'),
+ '$fileas' => t('File as:'),
'$whereareu' => t('Where are you right now?'),
'$title' => t('Enter a title for this item')
));
@@ -915,7 +918,7 @@ function status_editor($a,$x, $notes_cid = 0, $popup=false) {
$o .= replace_macros($tpl,array(
'$return_path' => $a->cmd,
'$action' => $a->get_baseurl().'/item',
- '$share' => (($x['button']) ? $x['button'] : t('Share')),
+ '$share' => (x($x,'button') ? $x['button'] : t('Share')),
'$upload' => t('Upload photo'),
'$shortupload' => t('upload photo'),
'$attach' => t('Attach file'),
@@ -980,8 +983,8 @@ function conv_sort($arr,$order) {
usort($parents,'sort_thr_commented');
if(count($parents))
- foreach($parents as $x)
- $x['children'] = array();
+ foreach($parents as $i=>$_x)
+ $parents[$i]['children'] = array();
foreach($arr as $x) {
if($x['id'] != $x['parent']) {
diff --git a/include/event.php b/include/event.php
index 4a9a9a004..29202badd 100755
--- a/include/event.php
+++ b/include/event.php
@@ -163,7 +163,7 @@ function bbtoevent($s) {
if(preg_match("/\[event\-adjust\](.*?)\[\/event\-adjust\]/is",$s,$match))
$ev['adjust'] = $match[1];
$match = '';
- $ev['nofinish'] = (($ev['start'] && (!x($ev, 'finish') || !$ev['finish'])) ? 1 : 0);
+ $ev['nofinish'] = (((x($ev, 'start') && $ev['start']) && (!x($ev, 'finish') || !$ev['finish'])) ? 1 : 0);
return $ev;
}
diff --git a/include/items.php b/include/items.php
index 1a7aa6c46..70c72ae16 100755
--- a/include/items.php
+++ b/include/items.php
@@ -682,7 +682,7 @@ function item_store($arr,$force_parent = false) {
unset($arr['dsprsig']);
}
- if($arr['gravity'])
+ if(x($arr, 'gravity'))
$arr['gravity'] = intval($arr['gravity']);
elseif($arr['parent-uri'] === $arr['uri'])
$arr['gravity'] = 0;
@@ -742,6 +742,7 @@ function item_store($arr,$force_parent = false) {
if($arr['parent-uri'] === $arr['uri']) {
$parent_id = 0;
+ $parent_deleted = 0;
$allow_cid = $arr['allow_cid'];
$allow_gid = $arr['allow_gid'];
$deny_cid = $arr['deny_cid'];
@@ -800,6 +801,8 @@ function item_store($arr,$force_parent = false) {
logger('item_store: item parent was not found - ignoring item');
return 0;
}
+
+ $parent_deleted = 0;
}
}
diff --git a/include/oembed.php b/include/oembed.php
index 5c3c595f5..52068efc7 100755
--- a/include/oembed.php
+++ b/include/oembed.php
@@ -62,7 +62,7 @@ function oembed_fetch_url($embedurl){
function oembed_format_object($j){
$embedurl = $j->embedurl;
- $jhtml = oembed_iframe($j->embedurl,$j->width,$j->height );
+ $jhtml = oembed_iframe($j->embedurl,(isset($j->width) ? $j->width : null), (isset($j->height) ? $j->height : null) );
$ret="<span class='oembed ".$j->type."'>";
switch ($j->type) {
case "video": {
diff --git a/include/security.php b/include/security.php
index 8c536b656..6ea515bff 100755
--- a/include/security.php
+++ b/include/security.php
@@ -288,3 +288,49 @@ function item_permissions_sql($owner_id,$remote_verified = false,$groups = null)
}
+/*
+ * Functions used to protect against Cross-Site Request Forgery
+ * The security token has to base on at least one value that an attacker can't know - here it's the session ID and the private key.
+ * In this implementation, a security token is reusable (if the user submits a form, goes back and resubmits the form, maybe with small changes;
+ * or if the security token is used for ajax-calls that happen several times), but only valid for a certain amout of time (3hours).
+ * The "typename" seperates the security tokens of different types of forms. This could be relevant in the following case:
+ * A security token is used to protekt a link from CSRF (e.g. the "delete this profile"-link).
+ * If the new page contains by any chance external elements, then the used security token is exposed by the referrer.
+ * Actually, important actions should not be triggered by Links / GET-Requests at all, but somethimes they still are,
+ * so this mechanism brings in some damage control (the attacker would be able to forge a request to a form of this type, but not to forms of other types).
+ */
+function get_form_security_token($typename = "") {
+ $a = get_app();
+
+ $timestamp = time();
+ $sec_hash = hash('whirlpool', $a->user["guid"] . $a->user["prvkey"] . session_id() . $timestamp . $typename);
+
+ return $timestamp . "." . $sec_hash;
+}
+
+function check_form_security_token($typename = "", $formname = 'form_security_token') {
+ if (!x($_REQUEST, $formname)) return false;
+ $hash = $_REQUEST[$formname];
+
+ $max_livetime = 10800; // 3 hours
+
+ $a = get_app();
+
+ $x = explode(".", $hash);
+ if (time() > (IntVal($x[0]) + $max_livetime)) return false;
+
+ $sec_hash = hash('whirlpool', $a->user["guid"] . $a->user["prvkey"] . session_id() . $x[0] . $typename);
+
+ return ($sec_hash == $x[1]);
+}
+
+function check_form_security_std_err_msg() {
+ return t('The form security token was not correct. This probably happened because the form has been opened for too long (>3 hours) before subitting it.') . EOL;
+}
+function check_form_security_token_redirectOnErr($err_redirect, $typename = "", $formname = 'form_security_token') {
+ if (!check_form_security_token($typename, $formname)) {
+ $a = get_app();
+ notice( check_form_security_std_err_msg() );
+ goaway($a->get_baseurl() . $err_redirect );
+ }
+}
diff --git a/include/template_processor.php b/include/template_processor.php
index 8671587fc..7f7b0b55b 100755
--- a/include/template_processor.php
+++ b/include/template_processor.php
@@ -80,8 +80,13 @@
*/
private function _replcb_for($args){
$m = array_map('trim', explode(" as ", $args[2]));
- list($keyname, $varname) = explode("=>",$m[1]);
- if (is_null($varname)) { $varname=$keyname; $keyname=""; }
+ $x = explode("=>",$m[1]);
+ if (count($x) == 1) {
+ $varname = $x[0];
+ $keyname = "";
+ } else {
+ list($keyname, $varname) = $x;
+ }
if ($m[0]=="" || $varname=="" || is_null($varname)) die("template error: 'for ".$m[0]." as ".$varname."'") ;
//$vals = $this->r[$m[0]];
$vals = $this->_get_var($m[0]);
diff --git a/include/text.php b/include/text.php
index 2663bdeba..c44b4d178 100644
--- a/include/text.php
+++ b/include/text.php
@@ -1294,7 +1294,7 @@ function file_tag_save_file($uid,$item,$file) {
if(count($r)) {
if(! stristr($r[0]['file'],'[' . file_tag_encode($file) . ']'))
q("update item set file = '%s' where id = %d and uid = %d limit 1",
- dbesc($r[0]['file'] . '[' . $file_tag_encode($file) . ']'),
+ dbesc($r[0]['file'] . '[' . file_tag_encode($file) . ']'),
intval($item),
intval($uid)
);