aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--boot.php12
-rw-r--r--include/auth.php24
-rw-r--r--mod/dfrn_confirm.php213
3 files changed, 144 insertions, 105 deletions
diff --git a/boot.php b/boot.php
index 8e42c5fad..640c0199f 100644
--- a/boot.php
+++ b/boot.php
@@ -500,14 +500,18 @@ function goaway($s) {
}}
// Generic XML return
-// Outputs a basic XML status structure to STDOUT, with a value variable
-// of $st and terminates the current process.
+// Outputs a basic dfrn XML status structure to STDOUT, with a <status> variable
+// of $st and an optional text <message> of $message and terminates the current process.
if(! function_exists('xml_status')) {
-function xml_status($st) {
+function xml_status($st, $message = '') {
+
+ if(strlen($message))
+ $xml_message = "\t<message>" . xmlify($message) . "</message>\r\n";
+
header( "Content-type: text/xml" );
echo '<?xml version="1.0" encoding="UTF-8"?>'."\r\n";
- echo "<result><status>$st</status></result>\r\n";
+ echo "<result>\r\n\t<status>$st</status>\r\n$xml_message</result>\r\n";
killme();
}}
diff --git a/include/auth.php b/include/auth.php
index e30b94d2e..10d0df645 100644
--- a/include/auth.php
+++ b/include/auth.php
@@ -3,7 +3,11 @@
// login/logout
if((x($_SESSION,'authenticated')) && (! ($_POST['auth-params'] === 'login'))) {
+
if($_POST['auth-params'] === 'logout' || $a->module === 'logout') {
+
+ // process logout request
+
unset($_SESSION['authenticated']);
unset($_SESSION['uid']);
unset($_SESSION['visitor_id']);
@@ -13,18 +17,27 @@ if((x($_SESSION,'authenticated')) && (! ($_POST['auth-params'] === 'login'))) {
notice( t('Logged out.') . EOL);
goaway($a->get_baseurl());
}
+
if(x($_SESSION,'uid')) {
+
+ // already logged in user returning
+
$r = q("SELECT * FROM `user` WHERE `uid` = %d LIMIT 1",
- intval($_SESSION['uid']));
- if($r === NULL || (! count($r))) {
+ intval($_SESSION['uid'])
+ );
+
+ if(! count($r)) {
goaway($a->get_baseurl());
}
+
+ // initialise user environment
+
$a->user = $r[0];
$_SESSION['theme'] = $a->user['theme'];
if(strlen($a->user['timezone']))
date_default_timezone_set($a->user['timezone']);
- $_SESSION['my_url'] = $a->get_baseurl() . '/profile/' . $r[0]['nickname'];
+ $_SESSION['my_url'] = $a->get_baseurl() . '/profile/' . $a->user['nickname'];
$r = q("SELECT * FROM `contact` WHERE `uid` = %s AND `self` = 1 LIMIT 1",
intval($_SESSION['uid']));
@@ -37,16 +50,21 @@ if((x($_SESSION,'authenticated')) && (! ($_POST['auth-params'] === 'login'))) {
}
}
else {
+
unset($_SESSION['authenticated']);
unset($_SESSION['uid']);
unset($_SESSION['visitor_id']);
unset($_SESSION['administrator']);
unset($_SESSION['cid']);
unset($_SESSION['theme']);
+ unset($_SESSION['my_url']);
$encrypted = hash('whirlpool',trim($_POST['password']));
if((x($_POST,'auth-params')) && $_POST['auth-params'] === 'login') {
+
+ // process login request
+
$r = q("SELECT * FROM `user`
WHERE `email` = '%s' AND `password` = '%s' AND `blocked` = 0 AND `verified` = 1 LIMIT 1",
dbesc(trim($_POST['login-name'])),
diff --git a/mod/dfrn_confirm.php b/mod/dfrn_confirm.php
index 5d551355b..a4e49fc02 100644
--- a/mod/dfrn_confirm.php
+++ b/mod/dfrn_confirm.php
@@ -18,14 +18,14 @@ function dfrn_confirm_post(&$a) {
$duplex = $_POST['duplex'];
$version_id = $_POST['dfrn_version'];
-
// Find our user's account
$r = q("SELECT * FROM `user` WHERE `nickname` = '%s' LIMIT 1",
dbesc($node));
if(! count($r)) {
- xml_status(3); // failure
+ $message = t('No user record found for ') . '\'' . $node . '\'';
+ xml_status(3,$message); // failure
// NOTREACHED
}
@@ -38,13 +38,21 @@ function dfrn_confirm_post(&$a) {
openssl_private_decrypt($source_url,$decrypted_source_url,$my_prvkey);
+ if(! strlen($decrypted_source_url)) {
+ $message = t('empty site URL was provided.');
+ xml_status(3,$message);
+ // NOTREACHED
+ }
+
$ret = q("SELECT * FROM `contact` WHERE `url` = '%s' AND `uid` = %d LIMIT 1",
dbesc($decrypted_source_url),
- intval($local_uid));
+ intval($local_uid)
+ );
if(! count($ret)) {
- // this is either a bogus confirmation or we deleted the original introduction.
- xml_status(3);
+ // this is either a bogus confirmation (?) or we deleted the original introduction.
+ $message = t('Contact record was not found for you on our site.');
+ xml_status(3,$message);
return; // NOTREACHED
}
@@ -72,7 +80,8 @@ function dfrn_confirm_post(&$a) {
intval($local_uid)
);
if(count($r)) {
- xml_status(1); // Birthday paradox - duplicate dfrn-id
+ $message = t('The ID provided is a duplicate on our system. Please try again.');
+ xml_status(1,$message); // Birthday paradox - duplicate dfrn-id
// NOTREACHED
}
@@ -81,115 +90,115 @@ function dfrn_confirm_post(&$a) {
dbesc($dfrn_pubkey),
intval($dfrn_record)
);
- if($r) {
+ if(! count($r)) {
+ $message = t('Unable to set your credentials on our system.');
+ xml_status(3,$message);
+ }
- // We're good but now we have to scrape the profile photo and send notifications.
+ // We're good but now we have to scrape the profile photo and send notifications.
- require_once("Photo.php");
+ require_once("Photo.php");
- $photo_failure = false;
+ $photo_failure = false;
- $r = q("SELECT `photo` FROM `contact` WHERE `id` = %d LIMIT 1",
- intval($dfrn_record));
- if(count($r)) {
+ $r = q("SELECT `photo` FROM `contact` WHERE `id` = %d LIMIT 1",
+ intval($dfrn_record));
+ if(count($r)) {
- $filename = basename($r[0]['photo']);
- $img_str = fetch_url($r[0]['photo'],true);
- $img = new Photo($img_str);
- if($img->is_valid()) {
+ $filename = basename($r[0]['photo']);
+ $img_str = fetch_url($r[0]['photo'],true);
+ $img = new Photo($img_str);
+ if($img->is_valid()) {
- $img->scaleImageSquare(175);
+ $img->scaleImageSquare(175);
- $hash = photo_new_resource();
+ $hash = photo_new_resource();
- $r = $img->store($local_uid, $dfrn_record, $hash, $filename, t('Contact Photos') , 4);
+ $r = $img->store($local_uid, $dfrn_record, $hash, $filename, t('Contact Photos') , 4);
- if($r === false)
- $photo_failure = true;
+ if($r === false)
+ $photo_failure = true;
- $img->scaleImage(80);
- $r = $img->store($local_uid, $dfrn_record, $hash, $filename, t('Contact Photos') , 5);
-
- if($r === false)
- $photo_failure = true;
+ $img->scaleImage(80);
+ $r = $img->store($local_uid, $dfrn_record, $hash, $filename, t('Contact Photos') , 5);
- $photo = $a->get_baseurl() . '/photo/' . $hash . '-4.jpg';
- $thumb = $a->get_baseurl() . '/photo/' . $hash . '-5.jpg';
- }
- else
+ if($r === false)
$photo_failure = true;
+
+ $photo = $a->get_baseurl() . '/photo/' . $hash . '-4.jpg';
+ $thumb = $a->get_baseurl() . '/photo/' . $hash . '-5.jpg';
}
else
$photo_failure = true;
+ }
+ else
+ $photo_failure = true;
- if($photo_failure) {
- $photo = $a->get_baseurl() . '/images/default-profile.jpg';
- $thumb = $a->get_baseurl() . '/images/default-profile-sm.jpg';
- }
+ if($photo_failure) {
+ $photo = $a->get_baseurl() . '/images/default-profile.jpg';
+ $thumb = $a->get_baseurl() . '/images/default-profile-sm.jpg';
+ }
- $new_relation = REL_FAN;
- if(($relation == REL_VIP) || ($duplex))
- $new_relation = REL_BUD;
-
- $r = q("UPDATE `contact` SET
- `photo` = '%s',
- `thumb` = '%s',
- `rel` = %d,
- `name-date` = '%s',
- `uri-date` = '%s',
- `avatar-date` = '%s',
- `blocked` = 0,
- `pending` = 0,
- `duplex` = %d,
- `network` = 'dfrn' WHERE `id` = %d LIMIT 1
- ",
- dbesc($photo),
- dbesc($thumb),
- intval($new_relation),
- dbesc(datetime_convert()),
- dbesc(datetime_convert()),
- dbesc(datetime_convert()),
- intval($duplex),
- intval($dfrn_record)
- );
- if($r === false)
- notice( t("Unable to set contact photo info.") . EOL);
+ $new_relation = REL_FAN;
+ if(($relation == REL_VIP) || ($duplex))
+ $new_relation = REL_BUD;
- // Otherwise everything seems to have worked and we are almost done. Yay!
- // Send an email notification
+ $r = q("UPDATE `contact` SET
+ `photo` = '%s',
+ `thumb` = '%s',
+ `rel` = %d,
+ `name-date` = '%s',
+ `uri-date` = '%s',
+ `avatar-date` = '%s',
+ `blocked` = 0,
+ `pending` = 0,
+ `duplex` = %d,
+ `network` = 'dfrn' WHERE `id` = %d LIMIT 1
+ ",
+ dbesc($photo),
+ dbesc($thumb),
+ intval($new_relation),
+ dbesc(datetime_convert()),
+ dbesc(datetime_convert()),
+ dbesc(datetime_convert()),
+ intval($duplex),
+ intval($dfrn_record)
+ );
+ if($r === false) { // should not happen unless schema is messed up
+ $message = t('Unable to update your contact profile on our system');
+ xml_status(3,$message);
+ }
- $r = q("SELECT * FROM `contact` LEFT JOIN `user` ON `contact`.`uid` = `user`.`uid`
- WHERE `contact`.`id` = %d LIMIT 1",
- intval($dfrn_record)
- );
- if((count($r)) && ($r[0]['notify-flags'] & NOTIFY_CONFIRM)) {
+ // Otherwise everything seems to have worked and we are almost done. Yay!
+ // Send an email notification
- $tpl = (($new_relation == REL_BUD)
- ? load_view_file('view/friend_complete_eml.tpl')
- : load_view_file('view/intro_complete_eml.tpl'));
-
- $email_tpl = replace_macros($tpl, array(
- '$sitename' => $a->config['sitename'],
- '$siteurl' => $a->get_baseurl(),
- '$username' => $r[0]['username'],
- '$email' => $r[0]['email'],
- '$fn' => $r[0]['name'],
- '$dfrn_url' => $r[0]['url'],
- '$uid' => $newuid )
- );
+ $r = q("SELECT * FROM `contact` LEFT JOIN `user` ON `contact`.`uid` = `user`.`uid`
+ WHERE `contact`.`id` = %d LIMIT 1",
+ intval($dfrn_record)
+ );
+ if((count($r)) && ($r[0]['notify-flags'] & NOTIFY_CONFIRM)) {
+
+ $tpl = (($new_relation == REL_BUD)
+ ? load_view_file('view/friend_complete_eml.tpl')
+ : load_view_file('view/intro_complete_eml.tpl'));
+
+ $email_tpl = replace_macros($tpl, array(
+ '$sitename' => $a->config['sitename'],
+ '$siteurl' => $a->get_baseurl(),
+ '$username' => $r[0]['username'],
+ '$email' => $r[0]['email'],
+ '$fn' => $r[0]['name'],
+ '$dfrn_url' => $r[0]['url'],
+ '$uid' => $newuid )
+ );
- $res = mail($r[0]['email'], t("Connection accepted at ") . $a->config['sitename'],
- $email_tpl, 'From: ' . t('Administrator') . '@' . $_SERVER[SERVER_NAME] );
- if(!$res) {
- notice( t("Email notification failed.") . EOL );
- }
+ $res = mail($r[0]['email'], t("Connection accepted at ") . $a->config['sitename'],
+ $email_tpl, 'From: ' . t('Administrator') . '@' . $_SERVER[SERVER_NAME] );
+ if(!$res) {
+ notice( t("Email notification failed.") . EOL );
}
- xml_status(0); // Success
- // NOTREACHED
- }
- else {
- xml_status(2); // Hopefully temporary problem that can be retried.
}
+ xml_status(0); // Success
return; // NOTREACHED
////////////////////// End of this scenario ///////////////////////////////////////////////
@@ -212,7 +221,7 @@ function dfrn_confirm_post(&$a) {
$r = q("SELECT * FROM `contact` WHERE `issued-id` = '%s' AND `uid` = %d LIMIT 1",
dbesc($dfrn_id),
intval($uid)
- );
+ );
if(! count($r)) {
notice( t('Node does not exist.') . EOL );
@@ -257,7 +266,9 @@ function dfrn_confirm_post(&$a) {
$params['public_key'] = $public_key;
- openssl_public_encrypt($_SESSION['my_url'], $params['source_url'], $site_pubkey);
+ $my_url = $a->get_baseurl() . '/profile/' . $a->user['nickname'];
+
+ openssl_public_encrypt($my_url, $params['source_url'], $site_pubkey);
if($aes_allow && function_exists('openssl_encrypt')) {
openssl_public_encrypt($src_aes_key, $params['aes_key'], $site_pubkey);
@@ -297,9 +308,12 @@ function dfrn_confirm_post(&$a) {
$xml = simplexml_load_string($res);
$status = (int) $xml->status;
+ $message = unxmlify($xml->message);
switch($status) {
case 0:
- notice( t("Confirmation completed successfully") . EOL);
+ notice( t("Confirmation completed successfully.") . EOL);
+ if(strlen($message))
+ notice( t('Remote site reported: ') . $message . EOL);
break;
case 1:
// birthday paradox - generate new dfrn-id and fall through.
@@ -312,15 +326,19 @@ function dfrn_confirm_post(&$a) {
case 2:
notice( t("Temporary failure. Please wait and try again.") . EOL);
+ if(strlen($message))
+ notice( t('Remote site reported: ') . $message . EOL);
break;
case 3:
- notice( t("Introduction failed or was revoked. Cannot complete.") . EOL);
+ notice( t("Introduction failed or was revoked.") . EOL);
+ if(strlen($message))
+ notice( t('Remote site reported: ') . $message . EOL);
break;
}
- if(($status == 0 || $status == 3) && ($intro_id)) {
+ if(($status == 0) && ($intro_id)) {
//delete the notification
@@ -334,7 +352,6 @@ function dfrn_confirm_post(&$a) {
if($status != 0)
return;
-
require_once("Photo.php");
$photo_failure = false;