diff options
| -rw-r--r-- | include/diaspora.php | 204 |
1 files changed, 174 insertions, 30 deletions
diff --git a/include/diaspora.php b/include/diaspora.php index 0764dfa4a..e089e3f04 100644 --- a/include/diaspora.php +++ b/include/diaspora.php @@ -114,15 +114,29 @@ EOT; } - -function diaspora_decode($importer,$xml) { +/** + * + * diaspora_decode($importer,$xml) + * array $importer -> from user table + * string $xml -> urldecoded Diaspora salmon + * + * Returns array + * 'message' -> decoded Diaspora XML message + * 'author' -> author diaspora handle + * 'key' -> author public key (converted to pkcs#8) + * + * Author and key are used elsewhere to save a lookup for verifying replies and likes + */ +function diaspora_decode($importer,$xml) { $basedom = parse_xml_string($xml); $atom = $basedom->children(NAMESPACE_ATOM1); + // Diaspora devs: This is kind of sucky - 'encrypted_header' does not belong in the atom namespace + $encrypted_header = json_decode(base64_decode($atom->encrypted_header)); $encrypted_aes_key_bundle = base64_decode($encrypted_header->aes_key); @@ -185,7 +199,14 @@ function diaspora_decode($importer,$xml) { // strip whitespace so our data element will return to one big base64 blob $data = str_replace(array(" ","\t","\r","\n"),array("","","",""),$base->data); + // Add back the 60 char linefeeds + + // Diaspora devs: This completely violates the entire principle of salmon magic signatures, + // which was to have a message signing format that was completely ambivalent to linefeeds + // and transport whitespace mangling, and base64 wrapping rules. Guess what? PHP and Ruby + // use different linelengths for base64 output. + $lines = str_split($data,60); $data = implode("\n",$lines); @@ -197,6 +218,8 @@ function diaspora_decode($importer,$xml) { $encoding = $base->encoding; $alg = $base->alg; + // Diaspora devs: I can't even begin to tell you how sucky this is. Read the freaking spec. + $signed_data = $data . (($data[-1] != "\n") ? "\n" : '') . '.' . base64url_encode($type) . "\n" . '.' . base64url_encode($encoding) . "\n" . '.' . base64url_encode($alg) . "\n"; @@ -255,6 +278,20 @@ function diaspora_get_contact_by_handle($uid,$handle) { return false; } +function find_person_by_handle($handle) { + // we don't care about the uid, we just want to save an expensive webfinger probe + $r = q("select * from contact where network = '%s' and addr = '%s' LIMIT 1", + dbesc(NETWORK_DIASPORA), + dbesc($handle) + ); + if(count($r)) + return $r[0]; + $r = probe_url($handle); + // need to cached this, perhaps in fcontact + if(count($r)) + return ($r); + return false; +} function diaspora_request($importer,$xml) { @@ -266,7 +303,12 @@ function diaspora_request($importer,$xml) { $contact = diaspora_get_contact_by_handle($importer['uid'],$sender_handle); + if($contact) { + + // perhaps we were already sharing with this person. Now they're sharing with us. + // That makes us friends. + if($contact['rel'] == CONTACT_IS_FOLLOWER) { q("UPDATE `contact` SET `rel` = %d WHERE `id` = %d AND `uid` = %d LIMIT 1", intval(CONTACT_IS_FRIEND), @@ -414,11 +456,19 @@ function diaspora_post($importer,$xml) { } function diaspora_comment($importer,$xml,$msg) { + $guid = notags(unxmlify($xml->guid)); + $parent_guid = notags(unxmlify($xml->parent_guid)); $diaspora_handle = notags(unxmlify($xml->diaspora_handle)); + $target_type = notags(unxmlify($xml->target_type)); + $text = unxmlify($xml->text); + $author_signature = notags(unxmlify($xml->author_signature)); + $parent_author_signature = (($xml->parent_author_signature) ? notags(unxmlify($xml->parent_author_signature)) : ''); - $contact = diaspora_get_contact_by_handle($importer['uid'],$diaspora_handle); + $text = $xml->text; + + $contact = diaspora_get_contact_by_handle($importer['uid'],$msg['author']); if(! $contact) return; @@ -428,24 +478,109 @@ function diaspora_comment($importer,$xml,$msg) { // NOTREACHED } - - - $message_id = $diaspora_handle . ':' . $guid; - $r = q("SELECT `id` FROM `item` WHERE `uid` = %d AND `guid` = '%s' LIMIT 1", + $r = q("SELECT * FROM `item` WHERE `uid` = %d AND `guid` = '%s' LIMIT 1", intval($importer['uid']), - dbesc($guid) + dbesc($parent_guid) ); - if(! count($r)) + if(! count($r)) { + logger('diaspora_comment: parent item not found: ' . $guid); return; + } + $parent_item = $r[0]; - $owner = q("SELECT * FROM `contact` WHERE `uid` = %d AND `self` = 1 LIMIT 1", - intval($importer['uid']) - ); - if(! count($owner)) + $author_signed_data = $guid . ';' . $parent_guid . ';' . $text . ';' . $diaspora_handle; + + $author_signature = base64_decode($author_signature); + + if(stricmp($diaspora_handle,$msg['author']) == 0) { + $person = $contact; + $key = $msg['key']; + } + else { + $person = find_person_by_handle($diaspora_handle); + + if(is_array($person) && x($person,'pubkey')) + $key = $person['pubkey']; + else { + logger('diaspora_comment: unable to find author details'); + return; + } + } + + if(! rsa_verify($author_signed_data,$author_signature,$key)) { + logger('diaspora_comment: verification failed.'); return; + } - $created = unxmlify($xml->created_at); - $private = ((unxmlify($xml->public) == 'false') ? 1 : 0); + if($parent_author_signature) { + $owner_signed_data = $guid . ';' . $parent_guid . ';' . $text . ';' . $msg['author']; + + $parent_author_signature = base64_decode($parent_author_signature); + + $key = $msg['key']; + + if(! rsa_verify($owner_signed_data,$parent_author_signature,$key)) { + logger('diaspora_comment: owner verification failed.'); + return; + } + } + + // Phew! Everything checks out. Now create an item. + + require_once('library/HTMLPurifier.auto.php'); + require_once('include/html2bbcode.php'); + + $body = $text; + + $maxlen = get_max_import_size(); + if($maxlen && (strlen($body) > $maxlen)) + $body = substr($body,0, $maxlen); + + if((strpos($body,'<') !== false) || (strpos($body,'>') !== false)) { + + $body = preg_replace('#<object[^>]+>.+?' . 'http://www.youtube.com/((?:v|cp)/[A-Za-z0-9\-_=]+).+?</object>#s', + '[youtube]$1[/youtube]', $body); + + $body = preg_replace('#<iframe[^>].+?' . 'http://www.youtube.com/embed/([A-Za-z0-9\-_=]+).+?</iframe>#s', + '[youtube]$1[/youtube]', $body); + + $body = oembed_html2bbcode($body); + + $config = HTMLPurifier_Config::createDefault(); + $config->set('Cache.DefinitionImpl', null); + $purifier = new HTMLPurifier($config); + $body = $purifier->purify($body); + + $body = html2bbcode($body); + } + + $message_id = $diaspora_handle . ':' . $guid; + + $datarray = array(); + $datarray['uid'] = $importer['uid']; + $datarray['contact-id'] = $contact['id']; + $datarray['wall'] = $parent_item['wall']; + $datarray['gravity'] = GRAVITY_COMMENT; + $datarray['guid'] = $guid; + $datarray['uri'] = $message_id; + $datarray['parent-uri'] = $parent_item['uri']; + + // No timestamps for comments? OK, we'll the use current time. + $datarray['created'] = $datarray['edited'] = datetime_convert(); + $datarray['private'] = $parent_item['private']; + + $datarray['owner-name'] = $contact['name']; + $datarray['owner-link'] = $contact['url']; + $datarray['owner-avatar'] = $contact['thumb']; + + $datarray['author-name'] = $person['name']; + $datarray['author-link'] = $person['url']; + $datarray['author-avatar'] = ((x($person,'thumb')) ? $person['thumb'] : $person['photo']); + $datarray['body'] = $body; + + item_store($datarray); + + return; } @@ -456,14 +591,16 @@ function diaspora_like($importer,$xml,$msg) { $diaspora_handle = notags(unxmlify($xml->diaspora_handle)); $target_type = notags(unxmlify($xml->target_type)); $positive = notags(unxmlify($xml->positive)); + $author_signature = notags(unxmlify($xml->author_signature)); $parent_author_signature = (($xml->parent_author_signature) ? notags(unxmlify($xml->parent_author_signature)) : ''); - // likes on comments not supported here + // likes on comments not supported here and likes on photos not supported by Diaspora + if($target_type !== 'Post') return; - $contact = diaspora_get_contact_by_handle($importer['uid'],$msg->author); + $contact = diaspora_get_contact_by_handle($importer['uid'],$msg['author']); if(! $contact) return; @@ -512,10 +649,19 @@ function diaspora_like($importer,$xml,$msg) { $author_signature = base64_decode($author_signature); - if(stricmp($diaspora_handle,$msg['author']) == 0) + if(stricmp($diaspora_handle,$msg['author']) == 0) { + $person = $contact; $key = $msg['key']; - else - $key = get_diaspora_key($diaspora_handle); + } + else { + $person = find_person_by_handle($diaspora_handle); + if(is_array($person) && x($person,'pubkey')) + $key = $person['pubkey']; + else { + logger('diaspora_comment: unable to find author details'); + return; + } + } if(! rsa_verify($author_signed_data,$author_signature,$key)) { logger('diaspora_like: verification failed.'); @@ -539,6 +685,7 @@ function diaspora_like($importer,$xml,$msg) { $uri = $diaspora_handle . ':' . $guid; + $activity = ACTIVITY_LIKE; $post_type = (($parent_item['resource-id']) ? t('photo') : t('status')); $objtype = (($parent_item['resource-id']) ? ACTIVITY_OBJ_PHOTO : ACTIVITY_OBJ_NOTE ); $link = xmlify('<link rel="alternate" type="text/html" href="' . $a->get_baseurl() . '/display/' . $importer['nickname'] . '/' . $parent_item['id'] . '" />' . "\n") ; @@ -568,26 +715,23 @@ EOT; $arr['parent'] = $parent_item['id']; $arr['parent-uri'] = $parent_item['uri']; -// $arr['owner-name'] = $owner['name']; // FIXME -// $arr['owner-link'] = $owner['url']; -// $arr['owner-avatar'] = $owner['thumb']; + $datarray['owner-name'] = $contact['name']; + $datarray['owner-link'] = $contact['url']; + $datarray['owner-avatar'] = $contact['thumb']; - $arr['author-name'] = $contact['name']; - $arr['author-link'] = $contact['url']; - $arr['author-avatar'] = $contact['thumb']; + $datarray['author-name'] = $person['name']; + $datarray['author-link'] = $person['url']; + $datarray['author-avatar'] = ((x($person,'thumb')) ? $person['thumb'] : $person['photo']); $ulink = '[url=' . $contact['url'] . ']' . $contact['name'] . '[/url]'; $alink = '[url=' . $parent_item['author-link'] . ']' . $parent_item['author-name'] . '[/url]'; $plink = '[url=' . $a->get_baseurl() . '/display/' . $importer['nickname'] . '/' . $parent_item['id'] . ']' . $post_type . '[/url]'; $arr['body'] = sprintf( $bodyverb, $ulink, $alink, $plink ); + $arr['private'] = $parent_item['private']; $arr['verb'] = $activity; $arr['object-type'] = $objtype; $arr['object'] = $obj; - $arr['allow_cid'] = $parent_item['allow_cid']; - $arr['allow_gid'] = $parent_item['allow_gid']; - $arr['deny_cid'] = $parent_item['deny_cid']; - $arr['deny_gid'] = $parent_item['deny_gid']; $arr['visible'] = 1; $arr['unseen'] = 1; $arr['last-child'] = 0; |