aboutsummaryrefslogtreecommitdiffstats
path: root/include/security.php
diff options
context:
space:
mode:
Diffstat (limited to 'include/security.php')
-rw-r--r--include/security.php102
1 files changed, 1 insertions, 101 deletions
diff --git a/include/security.php b/include/security.php
index b46c3966b..2107ed819 100644
--- a/include/security.php
+++ b/include/security.php
@@ -108,7 +108,6 @@ function atoken_xchan($atoken) {
'xchan_name' => $atoken['atoken_name'],
'xchan_addr' => t('guest:') . $atoken['atoken_name'] . '@' . \App::get_hostname(),
'xchan_network' => 'unknown',
- 'xchan_url' => z_root(),
'xchan_hidden' => 1,
'xchan_photo_mimetype' => 'image/jpeg',
'xchan_photo_l' => get_default_profile_photo(300),
@@ -120,105 +119,6 @@ function atoken_xchan($atoken) {
return null;
}
-function atoken_delete($atoken_id) {
-
- $r = q("select * from atoken where atoken_id = %d",
- intval($atoken_id)
- );
- if(! $r)
- return;
-
- $c = q("select channel_id, channel_hash from channel where channel_id = %d",
- intval($r[0]['atoken_uid'])
- );
- if(! $c)
- return;
-
- $atoken_xchan = substr($c[0]['channel_hash'],0,16) . '.' . $r[0]['atoken_name'];
-
- q("delete from atoken where atoken_id = %d",
- intval($atoken_id)
- );
- q("delete from abconfig where chan = %d and xchan = '%s'",
- intval($c[0]['channel_id']),
- dbesc($atoken_xchan)
- );
-}
-
-
-
-// in order for atoken logins to create content (such as posts) they need a stored xchan.
-// we'll create one on the first atoken_login; it can't really ever go away but perhaps
-// @fixme we should set xchan_deleted if it's expired or removed
-
-function atoken_create_xchan($xchan) {
-
- $r = q("select xchan_hash from xchan where xchan_hash = '%s'",
- dbesc($xchan['xchan_hash'])
- );
- if($r)
- return;
-
- $r = q("insert into xchan ( xchan_hash, xchan_guid, xchan_addr, xchan_url, xchan_name, xchan_network, xchan_photo_mimetype, xchan_photo_l, xchan_photo_m, xchan_photo_s )
- values ('%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s') ",
- dbesc($xchan['xchan_hash']),
- dbesc($xchan['xchan_hash']),
- dbesc($xchan['xchan_addr']),
- dbesc($xchan['xchan_url']),
- dbesc($xchan['xchan_name']),
- dbesc($xchan['xchan_network']),
- dbesc($xchan['xchan_photo_mimetype']),
- dbesc($xchan['xchan_photo_l']),
- dbesc($xchan['xchan_photo_m']),
- dbesc($xchan['xchan_photo_s'])
- );
-
- return true;
-}
-
-function atoken_abook($uid,$xchan_hash) {
-
- if(substr($xchan_hash,16,1) != '.')
- return false;
-
- $r = q("select channel_hash from channel where channel_id = %d limit 1",
- intval($uid)
- );
-
- if(! $r)
- return false;
-
- $x = q("select * from atoken where atoken_uid = %d and atoken_name = '%s'",
- intval($uid),
- dbesc(substr($xchan_hash,17))
- );
-
- if($x) {
- $xchan = atoken_xchan($x[0]);
- $xchan['abook_blocked'] = 0;
- $xchan['abook_ignored'] = 0;
- $xchan['abook_pending'] = 0;
- return $xchan;
- }
-
- return false;
-
-}
-
-
-function pseudo_abook($xchan) {
- if(! $xchan)
- return false;
-
- // set abook_pseudo to flag that we aren't really connected.
-
- $xchan['abook_pseudo'] = 1;
- $xchan['abook_blocked'] = 0;
- $xchan['abook_ignored'] = 0;
- $xchan['abook_pending'] = 0;
- return $xchan;
-
-}
/**
@@ -495,7 +395,7 @@ function public_permissions_sql($observer_hash) {
* In this implementation, a security token is reusable (if the user submits a form, goes back and resubmits the form, maybe with small changes;
* or if the security token is used for ajax-calls that happen several times), but only valid for a certain amout of time (3hours).
* The "typename" seperates the security tokens of different types of forms. This could be relevant in the following case:
- * A security token is used to protekt a link from CSRF (e.g. the "delete this profile"-link).
+ * A security token is used to protekt a link from CSRF (e.g. the "delete this profile"-link).
* If the new page contains by any chance external elements, then the used security token is exposed by the referrer.
* Actually, important actions should not be triggered by Links / GET-Requests at all, but somethimes they still are,
* so this mechanism brings in some damage control (the attacker would be able to forge a request to a form of this type, but not to forms of other types).