diff options
Diffstat (limited to 'include')
34 files changed, 2326 insertions, 1304 deletions
diff --git a/include/Contact.php b/include/Contact.php index fcc5019e7..20dd04d17 100644 --- a/include/Contact.php +++ b/include/Contact.php @@ -77,6 +77,19 @@ function vcard_from_xchan($xchan, $observer = null, $mode = '') { $a = get_app(); + if(! $xchan) { + if($a->profile['channel_hash']) + $r = q("select * from xchan where xchan_hash = '%s' limit 1", + dbesc($a->profile['channel_hash']) + ); + if($r) + $xchan = $r[0]; + } + + if(! $xchan) + return; + +// FIXME - show connect button to observer if appropriate $connect = false; if(local_user()) { $r = q("select * from abook where abook_xchan = '%s' and abook_channel = %d limit 1", @@ -489,62 +502,6 @@ function unmark_for_death($contact) { ); }} -if(! function_exists('contact_photo_menu')){ -function contact_photo_menu($contact) { - - $a = get_app(); - - $contact_url=""; - $pm_url=""; - $status_link=""; - $photos_link=""; - $posts_link=""; - $poke_link=""; - - $sparkle = false; - if($contact['xchan_network'] === NETWORK_ZOT) { - $sparkle = true; - $profile_link = $a->get_baseurl() . '/magic?f=&id=' . $contact['abook_id']; - } - else - $profile_link = $contact['xchan_url']; - - if($sparkle) { - $status_link = $profile_link . "&url=status"; - $photos_link = $profile_link . "&url=photos"; - $profile_link = $profile_link . "&url=profile"; - $pm_url = $a->get_baseurl() . '/message/new/' . $contact['xchan_hash']; - } - - $poke_link = $a->get_baseurl() . '/poke/?f=&c=' . $contact['abook_id']; - $contact_url = $a->get_baseurl() . '/connections/' . $contact['abook_id']; - $posts_link = $a->get_baseurl() . '/network/?cid=' . $contact['abook_id']; - - $menu = Array( - t("Poke") => $poke_link, - t("View Status") => $status_link, - t("View Profile") => $profile_link, - t("View Photos") => $photos_link, - t("Network Posts") => $posts_link, - t("Edit Contact") => $contact_url, - t("Send PM") => $pm_url, - ); - - - $args = array('contact' => $contact, 'menu' => &$menu); - - call_hooks('contact_photo_menu', $args); - - $o = ""; - foreach($menu as $k=>$v){ - if ($v!="") { - $o .= "<li><a href=\"$v\">$k</a></li>\n"; - } - } - return $o; -}} - - function random_profile() { $r = q("select xchan_url from xchan where 1 order by rand() limit 1"); if($r) @@ -553,26 +510,3 @@ function random_profile() { } -function contacts_not_grouped($uid,$start = 0,$count = 0) { - - if(! $count) { - $r = q("select count(*) as total from contact where uid = %d and self = 0 and id not in (select distinct(`contact-id`) from group_member where uid = %d) ", - intval($uid), - intval($uid) - ); - - return $r; - - - } - - $r = q("select * from contact where uid = %d and self = 0 and id not in (select distinct(`contact-id`) from group_member where uid = %d) and blocked = 0 and pending = 0 limit %d, %d", - intval($uid), - intval($uid), - intval($start), - intval($count) - ); - - return $r; -} - diff --git a/include/acl_selectors.php b/include/acl_selectors.php index 033186151..930f9967a 100644 --- a/include/acl_selectors.php +++ b/include/acl_selectors.php @@ -208,22 +208,22 @@ function contact_select($selname, $selclass, $preselected = false, $size = 4, $p function fixacl(&$item) { - $item = intval(str_replace(array('<','>'),array('',''),$item)); + $item = str_replace(array('<','>'),array('',''),$item); } -function populate_acl($user = null,$celeb = false) { +function populate_acl($defaults = null,$unused = false) { $allow_cid = $allow_gid = $deny_cid = $deny_gid = false; - if(is_array($user)) { - $allow_cid = ((strlen($user['allow_cid'])) - ? explode('><', $user['allow_cid']) : array() ); - $allow_gid = ((strlen($user['allow_gid'])) - ? explode('><', $user['allow_gid']) : array() ); - $deny_cid = ((strlen($user['deny_cid'])) - ? explode('><', $user['deny_cid']) : array() ); - $deny_gid = ((strlen($user['deny_gid'])) - ? explode('><', $user['deny_gid']) : array() ); + if(is_array($defaults)) { + $allow_cid = ((strlen($defaults['allow_cid'])) + ? explode('><', $defaults['allow_cid']) : array() ); + $allow_gid = ((strlen($defaults['allow_gid'])) + ? explode('><', $defaults['allow_gid']) : array() ); + $deny_cid = ((strlen($defaults['deny_cid'])) + ? explode('><', $defaults['deny_cid']) : array() ); + $deny_gid = ((strlen($defaults['deny_gid'])) + ? explode('><', $defaults['deny_gid']) : array() ); array_walk($allow_cid,'fixacl'); array_walk($allow_gid,'fixacl'); array_walk($deny_cid,'fixacl'); diff --git a/include/api.php b/include/api.php index 1dd970cbc..463d29cf8 100644 --- a/include/api.php +++ b/include/api.php @@ -233,7 +233,7 @@ require_once('include/photos.php'); 'updated' => api_date(null), 'atom_updated' => datetime_convert('UTC','UTC','now',ATOM_TIME), 'language' => $user_info['language'], - 'logo' => $a->get_baseurl()."/images/rhash-64.png", + 'logo' => $a->get_baseurl()."/images/rm-64.png", ); return $arr; @@ -362,7 +362,8 @@ require_once('include/photos.php'); 'location' => ($usr) ? $usr[0]['channel_location'] : '', 'profile_image_url' => $uinfo[0]['xchan_photo_l'], 'url' => $uinfo[0]['xchan_url'], - 'contact_url' => $a->get_baseurl()."/connections/".$uinfo[0]['abook_id'], +//FIXME + 'contact_url' => $a->get_baseurl() . "/connections/".$uinfo[0]['abook_id'], 'protected' => false, 'friends_count' => intval($countfriends), 'created_at' => api_date($uinfo[0]['abook_created']), @@ -739,7 +740,7 @@ require_once('include/photos.php'); 'created_at' => api_date($lastwall['created']), 'in_reply_to_status_id' => $in_reply_to_status_id, 'source' => (($lastwall['app']) ? $lastwall['app'] : 'web'), - 'id' => (($w) ? $w[0]['abook_id'] : $user_info['id']), + 'id' => ($lastwall['id']), 'in_reply_to_user_id' => $in_reply_to_user_id, 'in_reply_to_screen_name' => $in_reply_to_screen_name, 'geo' => '', @@ -1080,12 +1081,46 @@ require_once('include/photos.php'); // params $id = intval(argv(3)); + if($id) { + // first prove that we own the item - logger('API: api_statuses_destroy: '.$id); + $r = q("select * from item where id = %d and uid = %d limit 1", + intval($id), + intval($user_info['uid']) + ); + if(! $r) + return false; + } + else { + if($_REQUEST['namespace'] && $_REQUEST['remote_id']) { + $r = q("select * from item_id where service = '%s' and sid = '%s' and uid = %d limit 1", + dbesc($_REQUEST['namespace']), + dbesc($_REQUEST['remote_id']), + intval($user_info['uid']) + ); + if(! $r) + return false; + $id = $r[0]['iid']; + } + if($_REQUEST['namespace'] && $_REQUEST['comment_id']) { + $r = q("select * from item_id left join item on item.id = item_id.iid where service = '%s' and sid = '%s' and uid = %d and item.id != item.parent limit 1", + dbesc($_REQUEST['namespace']), + dbesc($_REQUEST['comment_id']), + intval($user_info['uid']) + ); + if(! $r) + return false; + $id = $r[0]['iid']; + } + } + if(! $id) + return false; + logger('API: api_statuses_destroy: '.$id); require_once('include/items.php'); drop_item($id, false); + if ($type == 'xml') $ok = "true"; else @@ -1106,7 +1141,7 @@ require_once('include/photos.php'); if (api_user()===false) return false; $user_info = api_get_user($a); - // get last newtork messages + // get last network messages // params @@ -1581,7 +1616,7 @@ require_once('include/photos.php'); $name = get_config('system','sitename'); $server = $a->get_hostname(); - $logo = $a->get_baseurl() . '/images/rhash-64.png'; + $logo = $a->get_baseurl() . '/images/rm-64.png'; $email = get_config('system','admin_email'); $closed = ((get_config('system','register_policy') == REGISTER_CLOSED) ? 'true' : 'false'); $private = ((get_config('system','block_public')) ? 'true' : 'false'); diff --git a/include/auth.php b/include/auth.php index 8eb8bf333..c0002e6c1 100644 --- a/include/auth.php +++ b/include/auth.php @@ -22,6 +22,8 @@ function nuke_session() { unset($_SESSION['my_address']); unset($_SESSION['addr']); unset($_SESSION['return_url']); + unset($_SESSION['remote_service_class']); + unset($_SESSION['remote_hub']); } /** diff --git a/include/contact_widgets.php b/include/contact_widgets.php index af05f8c9f..482bbed78 100644 --- a/include/contact_widgets.php +++ b/include/contact_widgets.php @@ -1,30 +1,6 @@ <?php /** @file */ -function follow_widget() { - $a = get_app(); - $uid =$a->channel['channel_id']; - $r = q("select count(*) as total from abook where abook_channel = %d and not (abook_flags & %d) ", - intval($uid), - intval(ABOOK_FLAG_SELF) - ); - if($r) - $total_channels = $r[0]['total']; - $limit = service_class_fetch($uid,'total_channels'); - if($limit !== false) { - $abook_usage_message = sprintf( t("You have %1$.0f of %2$.0f allowed connections."), $total_channels, $limit); - } - else { - $abook_usage_message = ''; - } - return replace_macros(get_markup_template('follow.tpl'),array( - '$connect' => t('Add New Connection'), - '$desc' => t('Enter the channel address'), - '$hint' => t('Example: bob@example.com, http://example.com/barbara'), - '$follow' => t('Connect'), - '$abook_usage_message' => $abook_usage_message - )); -} function findpeople_widget() { require_once('include/Contact.php'); @@ -49,7 +25,8 @@ function findpeople_widget() { '$suggest' => t('Channel Suggestions'), '$similar' => '', // FIXME and uncomment when mod/match working // t('Similar Interests'), '$random' => t('Random Profile'), - '$inv' => t('Invite Friends') + '$inv' => t('Invite Friends'), + '$loggedin' => local_user() )); } @@ -149,4 +126,6 @@ function common_friends_visitor_widget($profile_uid) { '$items' => $r )); -};
\ No newline at end of file +}; + + diff --git a/include/conversation.php b/include/conversation.php index fea53015e..2ba3948bf 100644 --- a/include/conversation.php +++ b/include/conversation.php @@ -203,6 +203,10 @@ function localize_item(&$item){ } if (stristr($item['verb'],ACTIVITY_POKE)) { + + // FIXME for obscured private posts, until then leave untranslated + return; + $verb = urldecode(substr($item['verb'],strpos($item['verb'],'#')+1)); if(! $verb) return; @@ -911,7 +915,7 @@ function item_photo_menu($item){ if($contact) { $poke_link = $a->get_baseurl($ssl_state) . '/poke/?f=&c=' . $contact['abook_id']; - $contact_url = $a->get_baseurl($ssl_state) . '/connections/' . $contact['abook_id']; + $contact_url = $a->get_baseurl($ssl_state) . '/connedit/' . $contact['abook_id']; $posts_link = $a->get_baseurl($ssl_state) . '/network/?cid=' . $contact['abook_id']; $clean_url = normalise_link($item['author-link']); @@ -993,9 +997,9 @@ function format_like($cnt,$arr,$type,$id) { else { $spanatts = 'class="fakelink" onclick="openClose(\'' . $type . 'list-' . $id . '\');"'; $o .= (($type === 'like') ? - sprintf( t('<span %1$s>%2$d people</span> like this.'), $spanatts, $cnt) + sprintf( tt('<span %1$s>%2$d people</span> like this.','<span %1$s>%2$d people</span> like this.',$cnt), $spanatts, $cnt) : - sprintf( t('<span %1$s>%2$d people</span> don\'t like this.'), $spanatts, $cnt) ); + sprintf( tt('<span %1$s>%2$d people</span> don\'t like this.','<span %1$s>%2$d people</span> don\'t like this.',$cnt), $spanatts, $cnt) ); $o .= EOL ; $total = count($arr); if($total >= MAX_LIKERS) @@ -1004,7 +1008,7 @@ function format_like($cnt,$arr,$type,$id) { $arr[count($arr)-1] = t('and') . ' ' . $arr[count($arr)-1]; $str = implode(', ', $arr); if($total >= MAX_LIKERS) - $str .= sprintf( t(', and %d other people'), $total - MAX_LIKERS ); + $str .= sprintf( tt(', and %d other people',', and %d other people',$total - MAX_LIKERS), $total - MAX_LIKERS ); $str = (($type === 'like') ? sprintf( t('%s like this.'), $str) : sprintf( t('%s don\'t like this.'), $str)); $o .= "\t" . '<div id="' . $type . 'list-' . $id . '" style="display: none;" >' . $str . '</div>'; } @@ -1104,7 +1108,7 @@ function status_editor($a,$x,$popup=false) { '$shortsetloc' => t('set location'), '$noloc' => t('Clear browser location'), '$shortnoloc' => t('clear location'), - '$title' => ((x($x,'title')) ? htmlspecialchars($x['title']) : ''), + '$title' => ((x($x,'title')) ? htmlspecialchars($x['title'], ENT_COMPAT,'UTF-8') : ''), '$placeholdertitle' => t('Set title'), '$catsenabled' => ((feature_enabled($x['profile_uid'],'categories') && (! $webpage)) ? 'categories' : ''), '$category' => "", @@ -1113,7 +1117,7 @@ function status_editor($a,$x,$popup=false) { '$permset' => t('Permission settings'), '$shortpermset' => t('permissions'), '$ptyp' => (($notes_cid) ? 'note' : 'wall'), - '$content' => ((x($x,'body')) ? htmlspecialchars($x['body']) : ''), + '$content' => ((x($x,'body')) ? htmlspecialchars($x['body'], ENT_COMPAT,'UTF-8') : ''), '$post_id' => '', '$baseurl' => $a->get_baseurl(true), '$defloc' => $x['default_location'], @@ -1301,7 +1305,191 @@ function prepare_page($item) { '$auth_url' => (($naked) ? '' : $item['author']['xchan_url']), '$date' => (($naked) ? '' : datetime_convert('UTC',date_default_timezone_get(),$item['created'],'Y-m-d H:i')), '$title' => smilies(bbcode($item['title'])), - '$body' => prepare_text($item['body'],$item['mimetype']) + '$body' => prepare_body($item,true) )); } + +function network_tabs() { + $a = get_app(); + $no_active=''; + $starred_active = ''; + $new_active = ''; + $all_active = ''; + $search_active = ''; + $conv_active = ''; + $spam_active = ''; + $postord_active = ''; + + if(x($_GET,'new')) { + $new_active = 'active'; + } + + if(x($_GET,'search')) { + $search_active = 'active'; + } + + if(x($_GET,'star')) { + $starred_active = 'active'; + } + + if(x($_GET,'conv')) { + $conv_active = 'active'; + } + + if(x($_GET,'spam')) { + $spam_active = 'active'; + } + + + + if (($new_active == '') + && ($starred_active == '') + && ($conv_active == '') + && ($search_active == '') + && ($spam_active == '')) { + $no_active = 'active'; + } + + if ($no_active=='active' && x($_GET,'order')) { + switch($_GET['order']){ + case 'post': $postord_active = 'active'; $no_active=''; break; + case 'comment' : $all_active = 'active'; $no_active=''; break; + } + } + + if ($no_active=='active') $all_active='active'; + + $cmd = $a->cmd; + + // tabs + $tabs = array( + array( + 'label' => t('Commented Order'), + 'url'=>$a->get_baseurl(true) . '/' . $cmd . '?f=&order=comment' . ((x($_GET,'cid')) ? '&cid=' . $_GET['cid'] : ''), + 'sel'=>$all_active, + 'title'=> t('Sort by Comment Date'), + ), + array( + 'label' => t('Posted Order'), + 'url'=>$a->get_baseurl(true) . '/' . $cmd . '?f=&order=post' . ((x($_GET,'cid')) ? '&cid=' . $_GET['cid'] : ''), + 'sel'=>$postord_active, + 'title' => t('Sort by Post Date'), + ), + + array( + 'label' => t('Personal'), + 'url' => $a->get_baseurl(true) . '/' . $cmd . ((x($_GET,'cid')) ? '/?f=&cid=' . $_GET['cid'] : '') . '&conv=1', + 'sel' => $conv_active, + 'title' => t('Posts that mention or involve you'), + ), + array( + 'label' => t('New'), + 'url' => $a->get_baseurl(true) . '/' . $cmd . ((x($_GET,'cid')) ? '/?f=&cid=' . $_GET['cid'] : '') . '&new=1', + 'sel' => $new_active, + 'title' => t('Activity Stream - by date'), + ), + + ); + + if(feature_enabled(local_user(),'star_posts')) + $tabs[] = array( + 'label' => t('Starred'), + 'url'=>$a->get_baseurl(true) . '/' . $cmd . ((x($_GET,'cid')) ? '/?f=&cid=' . $_GET['cid'] : '') . '&star=1', + 'sel'=>$starred_active, + 'title' => t('Favourite Posts'), + ); + + // Not yet implemented + + if(feature_enabled(local_user(),'spam_filter')) + $tabs[] = array( + 'label' => t('Spam'), + 'url'=>$a->get_baseurl(true) . '/network?f=&spam=1', + 'sel'=> $spam_active, + 'title' => t('Posts flagged as SPAM'), + ); + + $arr = array('tabs' => $tabs); + call_hooks('network_tabs', $arr); + + $tpl = get_markup_template('common_tabs.tpl'); + + return replace_macros($tpl,array('$tabs' => $arr['tabs'])); + +} + + + +function profile_tabs($a, $is_owner=False, $nickname=Null){ + //echo "<pre>"; var_dump($a->user); killme(); + + $channel = $a->get_channel(); + + if (is_null($nickname)) + $nickname = $channel['channel_address']; + + if(x($_GET,'tab')) + $tab = notags(trim($_GET['tab'])); + + $url = $a->get_baseurl() . '/channel/' . $nickname; + $pr = $a->get_baseurl() . '/profile/' . $nickname; + + $tabs = array( + array( + 'label' => t('Channel'), + 'url' => $url, + 'sel' => ((argv(0) == 'channel') ? 'active' : ''), + 'title' => t('Status Messages and Posts'), + 'id' => 'status-tab', + ), + array( + 'label' => t('About'), + 'url' => $pr, + 'sel' => ((argv(0) == 'profile') ? 'active' : ''), + 'title' => t('Profile Details'), + 'id' => 'profile-tab', + ), + array( + 'label' => t('Photos'), + 'url' => $a->get_baseurl() . '/photos/' . $nickname, + 'sel' => ((argv(0) == 'photos') ? 'active' : ''), + 'title' => t('Photo Albums'), + 'id' => 'photo-tab', + ), + ); + + + if ($is_owner){ + $tabs[] = array( + 'label' => t('Events'), + 'url' => $a->get_baseurl() . '/events', + 'sel' => ((argv(0) == 'events') ? 'active' : ''), + 'title' => t('Events and Calendar'), + 'id' => 'events-tab', + ); + if(feature_enabled(local_user(),'webpages')){ + $tabs[] = array( + 'label' => t('Webpages'), + 'url' => $a->get_baseurl() . '/webpages/' . $nickname, + 'sel' => ((argv(0) == 'webpages') ? 'active' : ''), + 'title' => t('Manage Webpages'), + 'id' => 'webpages-tab', + );} + } + else { + // FIXME + // we probably need a listing of events that were created by + // this channel and are visible to the observer + + + } + + + $arr = array('is_owner' => $is_owner, 'nickname' => $nickname, 'tab' => (($tab) ? $tab : false), 'tabs' => $tabs); + call_hooks('profile_tabs', $arr); + + $tpl = get_markup_template('common_tabs.tpl'); + + return replace_macros($tpl,array('$tabs' => $arr['tabs'])); +} diff --git a/include/crypto.php b/include/crypto.php index a0268ef93..33cdc10c0 100644 --- a/include/crypto.php +++ b/include/crypto.php @@ -4,6 +4,8 @@ function rsa_sign($data,$key,$alg = 'sha256') { if(! $key) return 'no key'; $sig = ''; + if(intval(OPENSSL_ALGO_SHA256) && $alg === 'sha256') + $alg = OPENSSL_ALGO_SHA256; openssl_sign($data,$sig,$key,$alg); return $sig; } @@ -13,6 +15,8 @@ function rsa_verify($data,$sig,$key,$alg = 'sha256') { if(! $key) return false; + if(intval(OPENSSL_ALGO_SHA256) && $alg === 'sha256') + $alg = OPENSSL_ALGO_SHA256; $verify = openssl_verify($data,$sig,$key,$alg); return $verify; } @@ -49,6 +53,13 @@ function AES256CBC_decrypt($data,$key,$iv) { str_pad($iv,16,"\0"))); } +function crypto_encapsulate($data,$pubkey,$alg='aes256cbc') { + if($alg === 'aes256cbc') + return aes_encapsulate($data,$pubkey); + +} + + function aes_encapsulate($data,$pubkey) { if(! $pubkey) logger('aes_encapsulate: no key. data: ' . $data); @@ -60,12 +71,23 @@ function aes_encapsulate($data,$pubkey) { $x = debug_backtrace(); logger('aes_encapsulate: RSA failed. ' . print_r($x[0],true)); } + $result['alg'] = 'aes256cbc'; $result['key'] = base64url_encode($k,true); openssl_public_encrypt($iv,$i,$pubkey); $result['iv'] = base64url_encode($i,true); return $result; } +function crypto_unencapsulate($data,$prvkey) { + if(! $data) + return; + $alg = ((array_key_exists('alg',$data)) ? $data['alg'] : 'aes256cbc'); + if($alg === 'aes256cbc') + return aes_unencapsulate($data,$prvkey); + +} + + function aes_unencapsulate($data,$prvkey) { openssl_private_decrypt(base64url_decode($data['key']),$k,$prvkey); openssl_private_decrypt(base64url_decode($data['iv']),$i,$prvkey); diff --git a/include/datetime.php b/include/datetime.php index 94c2e4f1c..c0503fc7d 100644 --- a/include/datetime.php +++ b/include/datetime.php @@ -443,3 +443,24 @@ function cal($y = 0,$m = 0, $links = false, $class='') { } + + +function z_birthday($dob,$tz,$format="Y-m-d H:i:s") { + + if(! strlen($tz)) + $tz = 'UTC'; + + $tmp_dob = substr($dob,5); + if(intval($tmp_dob)) { + $y = datetime_convert($tz,$tz,'now','Y'); + $bd = $y . '-' . $tmp_dob . ' 00:00'; + $t_dob = strtotime($bd); + $now = strtotime(datetime_convert($tz,$tz,'now')); + if($t_dob < $now) + $bd = $y + 1 . '-' . $tmp_dob . ' 00:00'; + $birthday = datetime_convert($tz,'UTC',$bd,$format); + } + + return $birthday; + +} diff --git a/include/deliver.php b/include/deliver.php index b1314ce39..b0d15e1ef 100644 --- a/include/deliver.php +++ b/include/deliver.php @@ -26,6 +26,7 @@ function deliver_run($argv, $argc) { // If there is no outq_msg, this is a refresh_all message which does not require local handling if($r[0]['outq_msg']) { $msg = array('body' => json_encode(array('pickup' => array(array('notify' => json_decode($r[0]['outq_notify'],true),'message' => json_decode($r[0]['outq_msg'],true)))))); + zot_import($msg,z_root()); $r = q("delete from outq where outq_hash = '%s' limit 1", dbesc($argv[$x]) diff --git a/include/dir_fns.php b/include/dir_fns.php index 0c9a6bd9f..02e8186b7 100644 --- a/include/dir_fns.php +++ b/include/dir_fns.php @@ -22,7 +22,8 @@ function dir_sort_links() { function dir_safe_mode() { $observer = get_observer_hash(); - +if (! $observer) + return; if ($observer) $safe_mode = get_xconfig($observer,'directory','safe_mode'); if($safe_mode === '0') diff --git a/include/enotify.php b/include/enotify.php index 67fe748d1..011a1cde2 100644 --- a/include/enotify.php +++ b/include/enotify.php @@ -4,6 +4,10 @@ function notification($params) { logger('notification: entry', LOGGER_DEBUG); + // throw a small amount of entropy into the system to breakup duplicates arriving at the same precise instant. + usleep(mt_rand(0,10000)); + + $a = get_app(); @@ -79,7 +83,7 @@ function notification($params) { logger('notification: mail'); $subject = sprintf( t('[Red:Notify] New mail received at %s'),$sitename); - $preamble = sprintf( t('%1$s sent you a new private message at %2$s.'),$sender['xchan_name'],$sitename); + $preamble = sprintf( t('%1$s, %2$s sent you a new private message at %3$s.'),$recip['channel_name'], $sender['xchan_name'],$sitename); $epreamble = sprintf( t('%1$s sent you %2$s.'),'[zrl=' . $sender['xchan_url'] . ']' . $sender['xchan_name'] . '[/zrl]', '[zrl=$itemlink]' . t('a private message') . '[/zrl]'); $sitelink = t('Please visit %s to view and/or reply to your private messages.'); $tsitelink = sprintf( $sitelink, $siteurl . '/message/' . $params['item']['id'] ); @@ -132,25 +136,28 @@ function notification($params) { //$possess_desc = str_replace('<!item_type!>',$possess_desc); // "a post" - $dest_str = sprintf(t('%1$s commented on [zrl=%2$s]a %3$s[/zrl]'), - '[zrl=' . $sender['xchan_url'] . ']' . $sender['xchan_name'] . '[/zrl]', - $itemlink, - $item_post_type); + $dest_str = sprintf(t('%1$s, %2$s commented on [zrl=%3$s]a %4$s[/zrl]'), + $recip['channel_name'], + '[zrl=' . $sender['xchan_url'] . ']' . $sender['xchan_name'] . '[/zrl]', + $itemlink, + $item_post_type); // "George Bull's post" if($p) - $dest_str = sprintf(t('%1$s commented on [zrl=%2$s]%3$s\'s %4$s[/zrl]'), - '[zrl=' . $sender['xchan_url'] . ']' . $sender['xchan_name'] . '[/zrl]', - $itemlink, - $p[0]['author']['xchan_name'], - $item_post_type); + $dest_str = sprintf(t('%1$s, %2$s commented on [zrl=%3$s]%4$s\'s %5$s[/zrl]'), + $recip['channel_name'], + '[zrl=' . $sender['xchan_url'] . ']' . $sender['xchan_name'] . '[/zrl]', + $itemlink, + $p[0]['author']['xchan_name'], + $item_post_type); // "your post" if($p[0]['owner']['xchan_name'] == $p[0]['author']['xchan_name'] && ($p[0]['item_flags'] & ITEM_WALL)) - $dest_str = sprintf(t('%1$s commented on [zrl=%2$s]your %3$s[/zrl]'), - '[zrl=' . $sender['xchan_url'] . ']' . $sender['xchan_name'] . '[/zrl]', - $itemlink, - $item_post_type); + $dest_str = sprintf(t('%1$s, %2$s commented on [zrl=%3$s]your %4$s[/zrl]'), + $recip['channel_name'], + '[zrl=' . $sender['xchan_url'] . ']' . $sender['xchan_name'] . '[/zrl]', + $itemlink, + $item_post_type); // Some mail softwares relies on subject field for threading. // So, we cannot have different subjects for notifications of the same thread. @@ -158,7 +165,7 @@ function notification($params) { // differents subjects for messages on the same thread. $subject = sprintf( t('[Red:Notify] Comment to conversation #%1$d by %2$s'), $parent_id, $sender['xchan_name']); - $preamble = sprintf( t('%s commented on an item/conversation you have been following.'), $sender['xchan_name']); + $preamble = sprintf( t('%1$s, %2$s commented on an item/conversation you have been following.'), $recip['channel_name'], $sender['xchan_name']); $epreamble = $dest_str; $sitelink = t('Please visit %s to view and/or reply to the conversation.'); @@ -170,11 +177,13 @@ function notification($params) { if($params['type'] == NOTIFY_WALL) { $subject = sprintf( t('[Red:Notify] %s posted to your profile wall') , $sender['xchan_name']); - $preamble = sprintf( t('%1$s posted to your profile wall at %2$s') , $sender['xchan_name'], $sitename); + $preamble = sprintf( t('%1$s, %2$s posted to your profile wall at %3$s') , $recip['channel_name'], $sender['xchan_name'], $sitename); - $epreamble = sprintf( t('%1$s posted to [zrl=%2$s]your wall[/zrl]') , - '[zrl=' . $sender['xchan_url'] . ']' . $sender['xchan_name'] . '[/zrl]', - $params['link']); + $epreamble = sprintf( t('%1$s, %2$s posted to [zrl=%3$s]your wall[/zrl]') , + $recip['channel_name'], + '[zrl=' . $sender['xchan_url'] . ']' . $sender['xchan_name'] . '[/zrl]', + $params['link']); + // FIXME - check the item privacy $private = false; @@ -198,10 +207,11 @@ function notification($params) { } $subject = sprintf( t('[Red:Notify] %s tagged you') , $sender['xchan_name']); - $preamble = sprintf( t('%1$s tagged you at %2$s') , $sender['xchan_name'], $sitename); - $epreamble = sprintf( t('%1$s [zrl=%2$s]tagged you[/zrl].') , - '[zrl=' . $sender['xchan_url'] . ']' . $sender['xchan_name'] . '[/zrl]', - $params['link']); + $preamble = sprintf( t('%1$s, %2$s tagged you at %3$s') , $recip['channel_name'], $sender['xchan_name'], $sitename); + $epreamble = sprintf( t('%1$s, %2$s [zrl=%3$s]tagged you[/zrl].') , + $recip['channel_name'], + '[zrl=' . $sender['xchan_url'] . ']' . $sender['xchan_name'] . '[/zrl]', + $params['link']); $sitelink = t('Please visit %s to view and/or reply to the conversation.'); $tsitelink = sprintf( $sitelink, $siteurl ); @@ -212,10 +222,11 @@ function notification($params) { if($params['type'] == NOTIFY_POKE) { $subject = sprintf( t('[Red:Notify] %1$s poked you') , $sender['xchan_name']); - $preamble = sprintf( t('%1$s poked you at %2$s') , $sender['xchan_name'], $sitename); - $epreamble = sprintf( t('%1$s [zrl=%2$s]poked you[/zrl].') , - '[zrl=' . $sender['xchan_url'] . ']' . $sender['xchan_name'] . '[/zrl]', - $params['link']); + $preamble = sprintf( t('%1$s, %2$s poked you at %3$s') , $recip['channel_name'], $sender['xchan_name'], $sitename); + $epreamble = sprintf( t('%1$s, %2$s [zrl=%2$s]poked you[/zrl].') , + $recip['channel_name'], + '[zrl=' . $sender['xchan_url'] . ']' . $sender['xchan_name'] . '[/zrl]', + $params['link']); $subject = str_replace('poked', t($params['activity']), $subject); $preamble = str_replace('poked', t($params['activity']), $preamble); @@ -229,10 +240,11 @@ function notification($params) { if($params['type'] == NOTIFY_TAGSHARE) { $subject = sprintf( t('[Red:Notify] %s tagged your post') , $sender['xchan_name']); - $preamble = sprintf( t('%1$s tagged your post at %2$s') , $sender['xchan_name'], $sitename); - $epreamble = sprintf( t('%1$s tagged [zrl=%2$s]your post[/zrl]') , - '[zrl=' . $sender['xchan_url'] . ']' . $sender['xchan_name'] . '[/zrl]', - $itemlink); + $preamble = sprintf( t('%1$s, %2$s tagged your post at %3$s') , $recip['channel_name'],$sender['xchan_name'], $sitename); + $epreamble = sprintf( t('%1$s, %2$s tagged [zrl=%3$s]your post[/zrl]') , + $recip['channel_name'], + '[zrl=' . $sender['xchan_url'] . ']' . $sender['xchan_name'] . '[/zrl]', + $itemlink); $sitelink = t('Please visit %s to view and/or reply to the conversation.'); $tsitelink = sprintf( $sitelink, $siteurl ); @@ -242,10 +254,11 @@ function notification($params) { if($params['type'] == NOTIFY_INTRO) { $subject = sprintf( t('[Red:Notify] Introduction received')); - $preamble = sprintf( t('You\'ve received an introduction from \'%1$s\' at %2$s'), $sender['xchan_name'], $sitename); - $epreamble = sprintf( t('You\'ve received [zrl=%1$s]an introduction[/zrl] from %2$s.'), - $itemlink, - '[zrl=' . $sender['xchan_url'] . ']' . $sender['xchan_name'] . '[/zrl]'); + $preamble = sprintf( t('%1$s, you\'ve received an introduction from \'%2$s\' at %3$s'), $recip['channel_name'], $sender['xchan_name'], $sitename); + $epreamble = sprintf( t('%1$s, you\'ve received [zrl=%2$s]an introduction[/zrl] from %3$s.'), + $recip['channel_name'], + $itemlink, + '[zrl=' . $sender['xchan_url'] . ']' . $sender['xchan_name'] . '[/zrl]'); $body = sprintf( t('You may visit their profile at %s'),$sender['xchan_url']); $sitelink = t('Please visit %s to approve or reject the introduction.'); @@ -256,11 +269,12 @@ function notification($params) { if($params['type'] == NOTIFY_SUGGEST) { $subject = sprintf( t('[Red:Notify] Friend suggestion received')); - $preamble = sprintf( t('You\'ve received a friend suggestion from \'%1$s\' at %2$s'), $sender['xchan_name'], $sitename); - $epreamble = sprintf( t('You\'ve received [zrl=%1$s]a friend suggestion[/zrl] for %2$s from %3$s.'), - $itemlink, - '[zrl=' . $params['item']['url'] . ']' . $params['item']['name'] . '[/zrl]', - '[zrl=' . $sender['xchan_url'] . ']' . $sender['xchan_name'] . '[/zrl]'); + $preamble = sprintf( t('%1$s, you\'ve received a friend suggestion from \'%2$s\' at %3$s'), $recip['channel_name'], $sender['xchan_name'], $sitename); + $epreamble = sprintf( t('%1$s, you\'ve received [zrl=%2$s]a friend suggestion[/zrl] for %3$s from %4$s.'), + $recip['channel_name'], + $itemlink, + '[zrl=' . $params['item']['url'] . ']' . $params['item']['name'] . '[/zrl]', + '[zrl=' . $sender['xchan_url'] . ']' . $sender['xchan_name'] . '[/zrl]'); $body = t('Name:') . ' ' . $params['item']['name'] . "\n"; $body .= t('Photo:') . ' ' . $params['item']['photo'] . "\n"; @@ -322,6 +336,7 @@ function notification($params) { $datarray['url'] = $sender['xchan_url']; $datarray['photo'] = $sender['xchan_photo_s']; $datarray['date'] = datetime_convert(); + $datarray['aid'] = $recip['channel_account_id']; $datarray['uid'] = $recip['channel_id']; $datarray['link'] = $itemlink; $datarray['parent'] = $parent_id; @@ -340,13 +355,14 @@ function notification($params) { // create notification entry in DB - $r = q("insert into notify (hash,name,url,photo,date,uid,link,parent,type,verb,otype) - values('%s','%s','%s','%s','%s',%d,'%s',%d,%d,'%s','%s')", + $r = q("insert into notify (hash,name,url,photo,date,aid,uid,link,parent,type,verb,otype) + values('%s','%s','%s','%s','%s',%d,%d,'%s',%d,%d,'%s','%s')", dbesc($datarray['hash']), dbesc($datarray['name']), dbesc($datarray['url']), dbesc($datarray['photo']), dbesc($datarray['date']), + intval($datarray['aid']), intval($datarray['uid']), dbesc($datarray['link']), intval($datarray['parent']), @@ -559,7 +575,7 @@ class enotify { // send the message $res = mail( - $params['toEmail'], // send to address + $params['toEmail'], // send to address $messageSubject, // subject $multipartMessageBody, // message body $messageHeader // message headers diff --git a/include/features.php b/include/features.php index c5ab95a34..978d7af8a 100644 --- a/include/features.php +++ b/include/features.php @@ -23,6 +23,7 @@ function get_features() { array('content_expire', t('Content Expiration'), t('Remove posts/comments and/or private messages at a future time')), array('multi_profiles', t('Multiple Profiles'), t('Ability to create multiple profiles')), array('webpages', t('Web Pages'), t('Provide managed web pages on your channel')), + array('private_notes', t('Private Notes'), t('Enables a tool to store notes and reminders')), array('prettyphoto', t('Enhanced Photo Albums'), t('Enable photo album with enhanced features')), //FIXME - needs a description, but how the hell do we explain this to normals? array('sendzid', t('Extended Identity Sharing'), t(' ')), @@ -48,6 +49,7 @@ function get_features() { array('personal_tab', t('Network Personal Tab'), t('Enable tab to display only Network posts that you\'ve interacted on')), array('new_tab', t('Network New Tab'), t('Enable tab to display all new Network activity')), array('affinity', t('Affinity Tool'), t('Filter stream activity by depth of relationships')), + array('suggest', t('Suggest Channels'), t('Show channel suggestions')), ), // Item tools diff --git a/include/follow.php b/include/follow.php index 10bcddf2b..845ce11da 100644 --- a/include/follow.php +++ b/include/follow.php @@ -96,7 +96,7 @@ function new_contact($uid,$url,$channel,$interactive = false, $confirm = false) $global_perms = get_perms(); if( array_key_exists('permissions',$j) && array_key_exists('data',$j['permissions'])) { - $permissions = aes_unencapsulate(array( + $permissions = crypto_unencapsulate(array( 'data' => $j['permissions']['data'], 'key' => $j['permissions']['key'], 'iv' => $j['permissions']['iv']), @@ -175,6 +175,10 @@ function new_contact($uid,$url,$channel,$interactive = false, $confirm = false) proc_run('php', 'include/notifier.php', 'permission_update', $result['abook']['abook_id']); } + $arr = array('channel_id' => $uid, 'abook' => $result['abook']); + + call_hooks('follow', $arr); + /** If there is a default group for this channel, add this member to it */ if($default_group) { diff --git a/include/group.php b/include/group.php index eece07983..8f690785d 100644 --- a/include/group.php +++ b/include/group.php @@ -202,7 +202,7 @@ function group_get_members($gid) { return $ret; } -function mini_group_select($uid,$gid = 0) { +function mini_group_select($uid,$group = '') { $grps = array(); $o = ''; @@ -210,10 +210,10 @@ function mini_group_select($uid,$gid = 0) { $r = q("SELECT * FROM `group` WHERE `deleted` = 0 AND `uid` = %d ORDER BY `name` ASC", intval($uid) ); - $grps[] = array('name' => '', 'id' => '0', 'selected' => ''); + $grps[] = array('name' => '', 'hash' => '0', 'selected' => ''); if(count($r)) { foreach($r as $rr) { - $grps[] = array('name' => $rr['name'], 'id' => $rr['id'], 'selected' => (($gid == $rr['id']) ? 'true' : '')); + $grps[] = array('name' => $rr['name'], 'id' => $rr['hash'], 'selected' => (($group == $rr['hash']) ? 'true' : '')); } } @@ -229,7 +229,7 @@ function mini_group_select($uid,$gid = 0) { -function group_side($every="contacts",$each="group",$edit = false, $group_id = 0, $cid = '') { +function group_side($every="contacts",$each="group",$edit = false, $group_id = 0, $cid = '',$mode = 1) { $o = ''; @@ -272,7 +272,7 @@ function group_side($every="contacts",$each="group",$edit = false, $group_id = 0 'cid' => $cid, 'text' => $rr['name'], 'selected' => $selected, - 'href' => (($each === 'network') ? $each.'?f=&gid='.$rr['id'] : $each."/".$rr['id']), + 'href' => (($mode == 0) ? $each.'?f=&gid='.$rr['id'] : $each."/".$rr['id']), 'edit' => $groupedit, 'ismember' => in_array($rr['id'],$member_of), ); diff --git a/include/identity.php b/include/identity.php index e26d2b29f..6bbf193c1 100644 --- a/include/identity.php +++ b/include/identity.php @@ -4,6 +4,21 @@ require_once('include/zot.php'); require_once('include/crypto.php'); +/** + * @function identity_check_service_class($account_id) + * Called when creating a new channel. Checks the account's service class and number + * of current channels to determine whether creating a new channel is within the current + * service class constraints. + * + * @param int $account_id + * Account_id used for this request + * + * @returns array + * 'success' => boolean true if creating a new channel is allowed for this account + * 'message' => if success is false, optional error text + */ + + function identity_check_service_class($account_id) { $ret = array('success' => false, $message => ''); @@ -24,11 +39,22 @@ function identity_check_service_class($account_id) { return $ret; } -// Return an error message if the name is not valid. We're currently only checking -// for an empty name or one that exceeds our storage limit (255 chars). -// 255 chars is probably going to create a mess on some pages. -// Plugins can set additional policies such as full name requirements, character sets, multi-byte -// length, etc. + +/** + * @function validate_channelname($name) + * Determine if the channel name is allowed when creating a new channel. + * This action is pluggable. + * + * @param string $name + * + * @returns nil return if name is valid, or string describing the error state. + * + * We're currently only checking for an empty name or one that exceeds our storage limit (255 chars). + * 255 chars is probably going to create a mess on some pages. + * Plugins can set additional policies such as full name requirements, character sets, multi-byte + * length, etc. + * + */ function validate_channelname($name) { @@ -44,8 +70,13 @@ function validate_channelname($name) { } -// Create the system channel for directory synchronisation - this has no account attached - +/** + * @function create_dir_account() + * Create a system channel - which has no account attached + * + * Currently unused. + * + */ function create_dir_account() { create_identity(array( @@ -57,6 +88,14 @@ function create_dir_account() { )); } +/** + * @channel_total() + * Return the total number of channels on this site. No filtering is performed. + * + * @returns int + * on error returns boolean false + * + */ function channel_total() { $r = q("select channel_id from channel where true"); @@ -66,11 +105,24 @@ function channel_total() { } - -// Required: name, nickname, account_id - -// optional: pageflags - +/** + * @function create_identity($arr) + * Create a new channel + * Also creates the related xchan, hubloc, profile, and "self" abook records, and an + * empty "Friends" group/collection for the new channel + * + * @param array $arr + * 'name' => full name of channel + * 'nickname' => "email/url-compliant" nickname + * 'account_id' => account_id to attach with this channel + * [other identity fields as desired] + * + * @returns array + * 'success' => boolean true or false + * 'message' => optional error text if success is false + * 'channel' => if successful the created channel array + */ + function create_identity($arr) { $a = get_app(); @@ -191,7 +243,7 @@ function create_identity($arr) { $newuid = $ret['channel']['channel_id']; - $r = q("insert into xchan ( xchan_hash, xchan_guid, xchan_guid_sig, xchan_pubkey, xchan_photo_l, xchan_photo_m, xchan_photo_s, xchan_addr, xchan_url, xchan_follow, xchan_name, xchan_network, xchan_photo_date, xchan_name_date ) values ('%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s')", + $r = q("insert into xchan ( xchan_hash, xchan_guid, xchan_guid_sig, xchan_pubkey, xchan_photo_l, xchan_photo_m, xchan_photo_s, xchan_addr, xchan_url, xchan_follow, xchan_connurl, xchan_name, xchan_network, xchan_photo_date, xchan_name_date ) values ('%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s')", dbesc($hash), dbesc($guid), dbesc($sig), @@ -202,6 +254,7 @@ function create_identity($arr) { dbesc($ret['channel']['channel_address'] . '@' . get_app()->get_hostname()), dbesc(z_root() . '/channel/' . $ret['channel']['channel_address']), dbesc(z_root() . '/follow?f=&url=%s'), + dbesc(z_root() . '/poco/' . $ret['channel']['channel_address']), dbesc($ret['channel']['channel_name']), dbesc('zot'), dbesc(datetime_convert()), @@ -254,8 +307,21 @@ function create_identity($arr) { } -// set default identity for account_id to channel_id -// if $force is false only do this if there is no current default + +/** + * @function set_default_login_identity($account_id, $channel_id, $force = true) + * Set default channel to be used on login + * + * @param int $account_id + * login account + * @param int $channel_id + * channel id to set as default for this account + * @param boolean force + * if true, set this default unconditionally + * if $force is false only do this if there is no existing default + * + * @returns nil + */ function set_default_login_identity($account_id,$channel_id,$force = true) { $r = q("select account_default_channel from account where account_id = %d limit 1", @@ -271,6 +337,21 @@ function set_default_login_identity($account_id,$channel_id,$force = true) { } } +/** + * @function identity_basic_export($channel_id) + * Create an array representing the important channel information + * which would be necessary to create a nomadic identity clone. This includes + * most channel resources and connection information with the exception of content. + * + * @param int $channel_id + * Channel_id to export + * + * + * @returns array + * See function for details + * + */ + function identity_basic_export($channel_id) { /* @@ -349,49 +430,682 @@ function identity_basic_export($channel_id) { -function identity_basic_import($arr, $seize_primary = false) { +/** + * + * @function : profile_load(&$a, $nickname, $profile) + * Generate + * @param App $a + * @param string $nickname + * @param string $profile + * + * Summary: Loads a profile into the App structure. + * The function requires a writeable copy of the main App structure, and the nickname + * of a valid channel. + * + * Permissions of the current observer are checked. If a restricted profile is available + * to the current observer, that will be loaded instead of the channel default profile. + * + * The channel owner can set $profile to a valid profile_guid to preview that profile. + * + * The channel default theme is also selected for use, unless over-riden elsewhere. + * + */ - $ret = array('result' => false ); - if($arr['channel']) { - // import channel +function profile_load(&$a, $nickname, $profile = '') { - // create a new xchan (if necessary) + logger('profile_load: ' . $nickname . (($profile) ? ' profile: ' . $profile : '')); - // create a new hubloc and seize control if applicable + $user = q("select channel_id from channel where channel_address = '%s' limit 1", + dbesc($nickname) + ); + + if(! $user) { + logger('profile error: ' . $a->query_string, LOGGER_DEBUG); + notice( t('Requested channel is not available.') . EOL ); + $a->error = 404; + return; + } + // get the current observer + $observer = $a->get_observer(); + // Can the observer see our profile? + require_once('include/permissions.php'); + if(! perm_is_allowed($user[0]['channel_id'],$observer['xchan_hash'],'view_profile')) { + // permission denied + notice( t(' Sorry, you don\'t have the permission to view this profile. ') . EOL); + return; } - if($arr['profile']) { - // FIXME - change profile assignment to a hash instead of an id we have to fix + if(! $profile) { + $r = q("SELECT abook_profile FROM abook WHERE abook_xchan = '%s' and abook_channel = '%d' limit 1", + dbesc($observer['xchan_hash']), + intval($user[0]['channel_id']) + ); + if($r) + $profile = $r[0]['abook_profile']; + } + $r = null; + + if($profile) { + $r = q("SELECT profile.uid AS profile_uid, profile.*, channel.* FROM profile + LEFT JOIN channel ON profile.uid = channel.channel_id + WHERE channel.channel_address = '%s' AND profile.profile_guid = '%s' LIMIT 1", + dbesc($nickname), + dbesc($profile) + ); + } + + if(! $r) { + $r = q("SELECT profile.uid AS profile_uid, profile.*, channel.* FROM profile + LEFT JOIN channel ON profile.uid = channel.channel_id + WHERE channel.channel_address = '%s' and not ( channel_pageflags & %d ) + AND profile.is_default = 1 LIMIT 1", + dbesc($nickname), + intval(PAGE_REMOVED) + ); + } + if(! $r) { + logger('profile error: ' . $a->query_string, LOGGER_DEBUG); + notice( t('Requested profile is not available.') . EOL ); + $a->error = 404; + return; + } + + // fetch user tags if this isn't the default profile + + if(! $r[0]['is_default']) { + $x = q("select `keywords` from `profile` where uid = %d and `is_default` = 1 limit 1", + intval($profile_uid) + ); + if($x) + $r[0]['keywords'] = $x[0]['keywords']; } - if($arr['xchan']) { + if($r[0]['keywords']) { + $keywords = str_replace(array('#',',',' ',',,'),array('',' ',',',','),$r[0]['keywords']); + if(strlen($keywords)) + $a->page['htmlhead'] .= '<meta name="keywords" content="' . htmlentities($keywords,ENT_COMPAT,'UTF-8') . '" />' . "\r\n" ; - // import any xchan and hubloc which are not yet available on this site - // Unset primary for all other hubloc on our own record if $seize_primary + } + $a->profile = $r[0]; + $a->profile_uid = $r[0]['profile_uid']; + $a->page['title'] = $a->profile['channel_name'] . " - " . $a->profile['channel_address'] . "@" . $a->get_hostname(); + + $a->profile['channel_mobile_theme'] = get_pconfig(local_user(),'system', 'mobile_theme'); + $_SESSION['theme'] = $a->profile['channel_theme']; + $_SESSION['mobile_theme'] = $a->profile['channel_mobile_theme']; + + /** + * load/reload current theme info + */ + + $a->set_template_engine(); // reset the template engine to the default in case the user's theme doesn't specify one + + $theme_info_file = "view/theme/".current_theme()."/php/theme.php"; + if (file_exists($theme_info_file)){ + require_once($theme_info_file); } - if($arr['abook']) { - // import the abook entries + return; +} + +function profile_create_sidebar(&$a,$connect = true) { + + $block = (((get_config('system','block_public')) && (! local_user()) && (! remote_user())) ? true : false); + + $a->set_widget('profile',profile_sidebar($a->profile, $block, $connect)); + return; +} + + +/** + * + * Function: profile_sidebar + * + * Formats a profile for display in the sidebar. + * It is very difficult to templatise the HTML completely + * because of all the conditional logic. + * + * @parameter: array $profile + * + * Returns HTML string stuitable for sidebar inclusion + * Exceptions: Returns empty string if passed $profile is wrong type or not populated + * + */ + + + +function profile_sidebar($profile, $block = 0, $show_connect = true) { + + $a = get_app(); + + $observer = $a->get_observer(); + $o = ''; + $location = false; + $address = false; + $pdesc = true; + if((! is_array($profile)) && (! count($profile))) + return $o; + + + head_set_icon($profile['thumb']); + + $is_owner = (($profile['uid'] == local_user()) ? true : false); + + $profile['picdate'] = urlencode($profile['picdate']); + + call_hooks('profile_sidebar_enter', $profile); + + require_once('include/Contact.php'); + + if($show_connect) { + + // This will return an empty string if we're already connected. + + $connect_url = rconnect_url($profile['uid'],get_observer_hash()); + $connect = (($connect_url) ? t('Connect') : ''); + if($connect_url) + $connect_url = sprintf($connect_url,urlencode($profile['channel_address'] . '@' . $a->get_hostname())); + + // premium channel - over-ride + + if($profile['channel_pageflags'] & PAGE_PREMIUM) + $connect_url = z_root() . '/connect/' . $profile['channel_address']; } + // show edit profile to yourself + if($is_owner) { - if($seize_primary) { + $profile['menu'] = array( + 'chg_photo' => t('Change profile photo'), + 'entries' => array(), + ); - // send a refresh message to all our friends, telling them we've moved + if(feature_enabled(local_user(),'multi_profiles')) { + $profile['edit'] = array($a->get_baseurl(). '/profiles', t('Profiles'),"", t('Manage/edit profiles')); + $profile['menu']['cr_new'] = t('Create New Profile'); + } + else + $profile['edit'] = array($a->get_baseurl() . '/profiles/' . $profile['id'], t('Edit Profile'),'',t('Edit Profile')); + + $r = q("SELECT * FROM `profile` WHERE `uid` = %d", + local_user()); + + + if($r) { + foreach($r as $rr) { + $profile['menu']['entries'][] = array( + 'photo' => $rr['thumb'], + 'id' => $rr['id'], + 'alt' => t('Profile Image'), + 'profile_name' => $rr['profile_name'], + 'isdefault' => $rr['is_default'], + 'visible_to_everybody' => t('visible to everybody'), + 'edit_visibility' => t('Edit visibility'), + ); + } + } } - $ret['result'] = true ; - return $ret; + if((x($profile,'address') == 1) + || (x($profile,'locality') == 1) + || (x($profile,'region') == 1) + || (x($profile,'postal_code') == 1) + || (x($profile,'country_name') == 1)) + $location = t('Location:'); + + $gender = ((x($profile,'gender') == 1) ? t('Gender:') : False); + $marital = ((x($profile,'marital') == 1) ? t('Status:') : False); + $homepage = ((x($profile,'homepage') == 1) ? t('Homepage:') : False); + + if(! perm_is_allowed($profile['uid'],((is_array($observer)) ? $observer['xchan_hash'] : ''),'view_profile')) { + $block = true; + } + + if(($profile['hidewall'] || $block) && (! local_user()) && (! remote_user())) { + $location = $pdesc = $gender = $marital = $homepage = False; + } + + $firstname = ((strpos($profile['name'],' ')) + ? trim(substr($profile['name'],0,strpos($profile['name'],' '))) : $profile['name']); + $lastname = (($firstname === $profile['name']) ? '' : trim(substr($profile['name'],strlen($firstname)))); + + if(is_array($observer) + && perm_is_allowed($profile['uid'],$observer['xchan_hash'],'view_contacts')) { + $contact_block = contact_block(); + } + + $channel_menu = false; + $menu = get_pconfig($profile['uid'],'system','channel_menu'); + if($menu) { + require_once('include/menu.php'); + $m = menu_fetch($menu,$profile['uid'],$observer['xchan_hash']); + if($m) + $channel_menu = menu_render($m); + } + $menublock = get_pconfig($profile['uid'],'system','channel_menublock'); + if ($menublock && (! $block)) { + require_once('include/comanche.php'); + $channel_menu .= comanche_block($menublock); + } + + $tpl = get_markup_template('profile_vcard.tpl'); + + $o .= replace_macros($tpl, array( + '$profile' => $profile, + '$connect' => $connect, + '$connect_url' => $connect_url, + '$location' => $location, + '$gender' => $gender, + '$pdesc' => $pdesc, + '$marital' => $marital, + '$homepage' => $homepage, + '$chanmenu' => $channel_menu, + '$contact_block' => $contact_block, + )); + + $arr = array('profile' => &$profile, 'entry' => &$o); + + call_hooks('profile_sidebar', $arr); + + return $o; +} + + +// FIXME or remove + + + function get_birthdays() { + + $a = get_app(); + $o = ''; + + if(! local_user()) + return $o; + + $bd_format = t('g A l F d') ; // 8 AM Friday January 18 + $bd_short = t('F d'); + + $r = q("SELECT `event`.*, `event`.`id` AS `eid`, `contact`.* FROM `event` + LEFT JOIN `contact` ON `contact`.`id` = `event`.`cid` + WHERE `event`.`uid` = %d AND `type` = 'birthday' AND `start` < '%s' AND `finish` > '%s' + ORDER BY `start` ASC ", + intval(local_user()), + dbesc(datetime_convert('UTC','UTC','now + 6 days')), + dbesc(datetime_convert('UTC','UTC','now')) + ); + + if($r && count($r)) { + $total = 0; + $now = strtotime('now'); + $cids = array(); + + $istoday = false; + foreach($r as $rr) { + if(strlen($rr['name'])) + $total ++; + if((strtotime($rr['start'] . ' +00:00') < $now) && (strtotime($rr['finish'] . ' +00:00') > $now)) + $istoday = true; + } + $classtoday = $istoday ? ' birthday-today ' : ''; + if($total) { + foreach($r as &$rr) { + if(! strlen($rr['name'])) + continue; + + // avoid duplicates + + if(in_array($rr['cid'],$cids)) + continue; + $cids[] = $rr['cid']; + + $today = (((strtotime($rr['start'] . ' +00:00') < $now) && (strtotime($rr['finish'] . ' +00:00') > $now)) ? true : false); + $sparkle = ''; + $url = $rr['url']; + if($rr['network'] === NETWORK_DFRN) { + $sparkle = " sparkle"; + $url = $a->get_baseurl() . '/redir/' . $rr['cid']; + } + + $rr['link'] = $url; + $rr['title'] = $rr['name']; + $rr['date'] = day_translate(datetime_convert('UTC', $a->timezone, $rr['start'], $rr['adjust'] ? $bd_format : $bd_short)) . (($today) ? ' ' . t('[today]') : ''); + $rr['startime'] = Null; + $rr['today'] = $today; + + } + } + } + $tpl = get_markup_template("birthdays_reminder.tpl"); + return replace_macros($tpl, array( + '$baseurl' => $a->get_baseurl(), + '$classtoday' => $classtoday, + '$count' => $total, + '$event_reminders' => t('Birthday Reminders'), + '$event_title' => t('Birthdays this week:'), + '$events' => $r, + '$lbr' => '{', // raw brackets mess up if/endif macro processing + '$rbr' => '}' + + )); + } + +// FIXME + + function get_events() { + + require_once('include/bbcode.php'); + + $a = get_app(); + + if(! local_user()) + return $o; + + $bd_format = t('g A l F d') ; // 8 AM Friday January 18 + $bd_short = t('F d'); + + $r = q("SELECT `event`.* FROM `event` + WHERE `event`.`uid` = %d AND `type` != 'birthday' AND `start` < '%s' AND `start` > '%s' + ORDER BY `start` ASC ", + intval(local_user()), + dbesc(datetime_convert('UTC','UTC','now + 6 days')), + dbesc(datetime_convert('UTC','UTC','now - 1 days')) + ); + + if($r && count($r)) { + $now = strtotime('now'); + $istoday = false; + foreach($r as $rr) { + if(strlen($rr['name'])) + $total ++; + + $strt = datetime_convert('UTC',$rr['convert'] ? $a->timezone : 'UTC',$rr['start'],'Y-m-d'); + if($strt === datetime_convert('UTC',$a->timezone,'now','Y-m-d')) + $istoday = true; + } + $classtoday = (($istoday) ? 'event-today' : ''); + + + foreach($r as &$rr) { + if($rr['adjust']) + $md = datetime_convert('UTC',$a->timezone,$rr['start'],'Y/m'); + else + $md = datetime_convert('UTC','UTC',$rr['start'],'Y/m'); + $md .= "/#link-".$rr['id']; + + $title = substr(strip_tags(bbcode($rr['desc'])),0,32) . '... '; + if(! $title) + $title = t('[No description]'); + + $strt = datetime_convert('UTC',$rr['convert'] ? $a->timezone : 'UTC',$rr['start']); + $today = ((substr($strt,0,10) === datetime_convert('UTC',$a->timezone,'now','Y-m-d')) ? true : false); + + $rr['link'] = $md; + $rr['title'] = $title; + $rr['date'] = day_translate(datetime_convert('UTC', $rr['adjust'] ? $a->timezone : 'UTC', $rr['start'], $bd_format)) . (($today) ? ' ' . t('[today]') : ''); + $rr['startime'] = $strt; + $rr['today'] = $today; + } + } + + $tpl = get_markup_template("events_reminder.tpl"); + return replace_macros($tpl, array( + '$baseurl' => $a->get_baseurl(), + '$classtoday' => $classtoday, + '$count' => count($r), + '$event_reminders' => t('Event Reminders'), + '$event_title' => t('Events this week:'), + '$events' => $r, + )); + } + + +function advanced_profile(&$a) { + + if(! perm_is_allowed($a->profile['profile_uid'],get_observer_hash(),'view_profile')) + return ''; + + $o = ''; + + $o .= '<h2>' . t('Profile') . '</h2>'; + + if($a->profile['name']) { + + $tpl = get_markup_template('profile_advanced.tpl'); + + $profile = array(); + + $profile['fullname'] = array( t('Full Name:'), $a->profile['name'] ) ; + + if($a->profile['gender']) $profile['gender'] = array( t('Gender:'), $a->profile['gender'] ); + + + if(($a->profile['dob']) && ($a->profile['dob'] != '0000-00-00')) { + + $year_bd_format = t('j F, Y'); + $short_bd_format = t('j F'); + + + $val = ((intval($a->profile['dob'])) + ? day_translate(datetime_convert('UTC','UTC',$a->profile['dob'] . ' 00:00 +00:00',$year_bd_format)) + : day_translate(datetime_convert('UTC','UTC','2001-' . substr($a->profile['dob'],5) . ' 00:00 +00:00',$short_bd_format))); + + $profile['birthday'] = array( t('Birthday:'), $val); + + } + + if($age = age($a->profile['dob'],$a->profile['timezone'],'')) $profile['age'] = array( t('Age:'), $age ); + + + if($a->profile['marital']) $profile['marital'] = array( t('Status:'), $a->profile['marital']); + + + if($a->profile['with']) $profile['marital']['with'] = $a->profile['with']; + + if(strlen($a->profile['howlong']) && $a->profile['howlong'] !== '0000-00-00 00:00:00') { + $profile['howlong'] = relative_date($a->profile['howlong'], t('for %1$d %2$s')); + } + + if($a->profile['sexual']) $profile['sexual'] = array( t('Sexual Preference:'), $a->profile['sexual'] ); + + if($a->profile['homepage']) $profile['homepage'] = array( t('Homepage:'), linkify($a->profile['homepage']) ); + + if($a->profile['hometown']) $profile['hometown'] = array( t('Hometown:'), linkify($a->profile['hometown']) ); + + if($a->profile['keywords']) $profile['keywords'] = array( t('Tags:'), $a->profile['keywords']); + + if($a->profile['politic']) $profile['politic'] = array( t('Political Views:'), $a->profile['politic']); + + if($a->profile['religion']) $profile['religion'] = array( t('Religion:'), $a->profile['religion']); + + if($txt = prepare_text($a->profile['about'])) $profile['about'] = array( t('About:'), $txt ); + + if($txt = prepare_text($a->profile['interest'])) $profile['interest'] = array( t('Hobbies/Interests:'), $txt); + + if($txt = prepare_text($a->profile['likes'])) $profile['likes'] = array( t('Likes:'), $txt); + + if($txt = prepare_text($a->profile['dislikes'])) $profile['dislikes'] = array( t('Dislikes:'), $txt); + + + if($txt = prepare_text($a->profile['contact'])) $profile['contact'] = array( t('Contact information and Social Networks:'), $txt); + + if($txt = prepare_text($a->profile['music'])) $profile['music'] = array( t('Musical interests:'), $txt); + + if($txt = prepare_text($a->profile['book'])) $profile['book'] = array( t('Books, literature:'), $txt); + + if($txt = prepare_text($a->profile['tv'])) $profile['tv'] = array( t('Television:'), $txt); + + if($txt = prepare_text($a->profile['film'])) $profile['film'] = array( t('Film/dance/culture/entertainment:'), $txt); + + if($txt = prepare_text($a->profile['romance'])) $profile['romance'] = array( t('Love/Romance:'), $txt); + + if($txt = prepare_text($a->profile['work'])) $profile['work'] = array( t('Work/employment:'), $txt); + + if($txt = prepare_text($a->profile['education'])) $profile['education'] = array( t('School/education:'), $txt ); + + $r = q("select * from obj left join term on obj_obj = term_hash where term_hash != '' and obj_page = '%s' and uid = %d and obj_type = %d + order by obj_verb, term", + dbesc($a->profile['profile_guid']), + intval($a->profile['profile_uid']), + intval(TERM_OBJ_THING) + ); + + $things = null; + + if($r) { + $things = array(); + + // Use the system obj_verbs array as a sort key, since we don't really + // want an alphabetic sort. To change the order, use a plugin to + // alter the obj_verbs() array or alter it in code. Unknown verbs come + // after the known ones - in no particular order. + + $v = obj_verbs(); + foreach($v as $k => $foo) + $things[$k] = null; + foreach($r as $rr) { + if(! $things[$rr['obj_verb']]) + $things[$rr['obj_verb']] = array(); + $things[$rr['obj_verb']][] = array('term' => $rr['term'],'url' => $rr['url'],'img' => $rr['imgurl']); + } + $sorted_things = array(); + if($things) + foreach($things as $k => $v) + if(is_array($things[$k])) + $sorted_things[$k] = $v; + } + + logger('mod_profile: things: ' . print_r($sorted_things,true), LOGGER_DATA); + + return replace_macros($tpl, array( + '$title' => t('Profile'), + '$profile' => $profile, + '$things' => $sorted_things + )); + } + + return ''; +} + + + + +function get_my_url() { + if(x($_SESSION,'zrl_override')) + return $_SESSION['zrl_override']; + if(x($_SESSION,'my_url')) + return $_SESSION['my_url']; + return false; +} + +function get_my_address() { + if(x($_SESSION,'zid_override')) + return $_SESSION['zid_override']; + if(x($_SESSION,'my_address')) + return $_SESSION['my_address']; + return false; +} + +/** + * @function zid_init(&$a) + * If somebody arrives at our site using a zid, add their xchan to our DB if we don't have it already. + * And if they aren't already authenticated here, attempt reverse magic auth. + * + * @hooks 'zid_init' + * string 'zid' - their zid + * string 'url' - the destination url + * + */ + +function zid_init(&$a) { + $tmp_str = get_my_address(); + if(validate_email($tmp_str)) { + proc_run('php','include/gprobe.php',bin2hex($tmp_str)); + $arr = array('zid' => $tmp_str, 'url' => $a->cmd); + call_hooks('zid_init',$arr); + if((! local_user()) && (! remote_user())) { + logger('zid_init: not authenticated. Invoking reverse magic-auth for ' . $tmp_str); + $r = q("select * from hubloc where hubloc_addr = '%s' order by hubloc_id desc limit 1", + dbesc($tmp_str) + ); + // try to avoid recursion - but send them home to do a proper magic auth + $dest = '/' . $a->query_string; + $dest = str_replace(array('?zid=','&zid='),array('?rzid=','&rzid='),$dest); + if($r && ($r[0]['hubloc_url'] != z_root()) && (! strstr($dest,'/magic')) && (! strstr($dest,'/rmagic'))) { + goaway($r[0]['hubloc_url'] . '/magic' . '?f=&rev=1&dest=' . z_root() . $dest); + } + else + logger('zid_init: no hubloc found.'); + } + } +} + +/** + * @function zid($s,$address = '') + * Adds a zid parameter to a url + * @param string $s + * The url to accept the zid + * @param boolean $address + * $address to use instead of session environment + * @return string + * + * @hooks 'zid' + * string url - url to accept zid + * string zid - urlencoded zid + * string result - the return string we calculated, change it if you want to return something else + */ + + +function zid($s,$address = '') { + if(! strlen($s) || strpos($s,'zid=')) + return $s; + $has_params = ((strpos($s,'?')) ? true : false); + $num_slashes = substr_count($s,'/'); + if(! $has_params) + $has_params = ((strpos($s,'&')) ? true : false); + $achar = strpos($s,'?') ? '&' : '?'; + + $mine = get_my_url(); + $myaddr = (($address) ? $address : get_my_address()); + + // FIXME checking against our own channel url is no longer reliable. We may have a lot + // of urls attached to out channel. Should probably match against our site, since we + // will not need to remote authenticate on our own site anyway. + + if($mine && $myaddr && (! link_compare($mine,$s))) + $zurl = $s . (($num_slashes >= 3) ? '' : '/') . $achar . 'zid=' . urlencode($myaddr); + else + $zurl = $s; + + $arr = array('url' => $s, 'zid' => urlencode($myaddr), 'result' => $zurl); + call_hooks('zid', $arr); + return $arr['result']; +} + +// Used from within PCSS themes to set theme parameters. If there's a +// puid request variable, that is the "page owner" and normally their theme +// settings take precedence; unless a local user sets the "always_my_theme" +// system pconfig, which means they don't want to see anybody else's theme +// settings except their own while on this site. + +function get_theme_uid() { + $uid = (($_REQUEST['puid']) ? intval($_REQUEST['puid']) : 0); + if(local_user()) { + if((get_pconfig(local_user(),'system','always_my_theme')) || (! $uid)) + return local_user(); + if(! $uid) + return local_user(); + } + return $uid; } diff --git a/include/items.php b/include/items.php index 520ea7230..b328ca2d1 100755 --- a/include/items.php +++ b/include/items.php @@ -202,11 +202,29 @@ function post_activity_item($arr) { return $ret; } - if(array_key_exists('content_type',$arr) && $arr['content_type'] == 'text/html') - $arr['body'] = purify_html($arr['body']); - else - $arr['body'] = escape_tags($arr['body']); + if(! array_key_exists('mimetype',$arr)) + $arr['mimetype'] = 'text/bbcode'; + + if(array_key_exists('item_private',$arr) && $arr['item_private']) { + + $arr['body'] = z_input_filter($arr['uid'],$arr['body'],$arr['mimetype']); + + if($channel) { + if($channel['channel_hash'] === $arr['author_xchan']) { + $arr['sig'] = base64url_encode(rsa_sign($arr['body'],$channel['channel_prvkey'])); + $arr['item_flags'] = $arr['item_flags'] | ITEM_VERIFIED; + } + } + + logger('Encrypting local storage'); + $key = get_config('system','pubkey'); + $arr['item_flags'] = $arr['item_flags'] | ITEM_OBSCURED; + if($arr['title']) + $arr['title'] = json_encode(aes_encapsulate($arr['title'],$key)); + if($arr['body']) + $arr['body'] = json_encode(aes_encapsulate($arr['body'],$key)); + } $arr['mid'] = ((x($arr,'mid')) ? $arr['mid'] : item_message_id()); $arr['parent_mid'] = ((x($arr,'parent_mid')) ? $arr['parent_mid'] : $arr['mid']); @@ -238,7 +256,7 @@ function post_activity_item($arr) { $post = item_store($arr); - if($post['result']) + if($post['success']) $post_id = $post['item_id']; if($post_id) { @@ -546,42 +564,47 @@ function title_is_body($title, $body) { function get_item_elements($x) { -// logger('get_item_elements'); + $arr = array(); - $arr['body'] = (($x['body']) ? htmlentities($x['body'],ENT_COMPAT,'UTF-8',false) : ''); + $arr['body'] = (($x['body']) ? htmlspecialchars($x['body'],ENT_COMPAT,'UTF-8',false) : ''); $arr['created'] = datetime_convert('UTC','UTC',$x['created']); $arr['edited'] = datetime_convert('UTC','UTC',$x['edited']); - $arr['expires'] = ((x($x,'expires') && $x['expires']) - ? datetime_convert('UTC','UTC',$x['expires']) - : '0000-00-00 00:00:00'); if($arr['created'] > datetime_convert()) $arr['created'] = datetime_convert(); if($arr['edited'] > datetime_convert()) $arr['edited'] = datetime_convert(); - $arr['title'] = (($x['title']) ? htmlentities($x['title'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['expires'] = ((x($x,'expires') && $x['expires']) + ? datetime_convert('UTC','UTC',$x['expires']) + : '0000-00-00 00:00:00'); + + $arr['commented'] = ((x($x,'commented') && $x['commented']) + ? datetime_convert('UTC','UTC',$x['commented']) + : $arr['created']); + + $arr['title'] = (($x['title']) ? htmlspecialchars($x['title'], ENT_COMPAT,'UTF-8',false) : ''); if(mb_strlen($arr['title']) > 255) $arr['title'] = mb_substr($arr['title'],0,255); - $arr['app'] = (($x['app']) ? htmlentities($x['app'], ENT_COMPAT,'UTF-8',false) : ''); - $arr['mid'] = (($x['message_id']) ? htmlentities($x['message_id'], ENT_COMPAT,'UTF-8',false) : ''); - $arr['parent_mid'] = (($x['message_top']) ? htmlentities($x['message_top'], ENT_COMPAT,'UTF-8',false) : ''); - $arr['thr_parent'] = (($x['message_parent']) ? htmlentities($x['message_parent'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['app'] = (($x['app']) ? htmlspecialchars($x['app'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['mid'] = (($x['message_id']) ? htmlspecialchars($x['message_id'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['parent_mid'] = (($x['message_top']) ? htmlspecialchars($x['message_top'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['thr_parent'] = (($x['message_parent']) ? htmlspecialchars($x['message_parent'], ENT_COMPAT,'UTF-8',false) : ''); - $arr['plink'] = (($x['permalink']) ? htmlentities($x['permalink'], ENT_COMPAT,'UTF-8',false) : ''); - $arr['location'] = (($x['location']) ? htmlentities($x['location'], ENT_COMPAT,'UTF-8',false) : ''); - $arr['coord'] = (($x['longlat']) ? htmlentities($x['longlat'], ENT_COMPAT,'UTF-8',false) : ''); - $arr['verb'] = (($x['verb']) ? htmlentities($x['verb'], ENT_COMPAT,'UTF-8',false) : ''); - $arr['mimetype'] = (($x['mimetype']) ? htmlentities($x['mimetype'], ENT_COMPAT,'UTF-8',false) : ''); - $arr['obj_type'] = (($x['object_type']) ? htmlentities($x['object_type'], ENT_COMPAT,'UTF-8',false) : ''); - $arr['tgt_type'] = (($x['target_type']) ? htmlentities($x['target_type'], ENT_COMPAT,'UTF-8',false) : ''); - $arr['comment_policy'] = (($x['comment_scope']) ? htmlentities($x['comment_scope'], ENT_COMPAT,'UTF-8',false) : 'contacts'); + $arr['plink'] = (($x['permalink']) ? htmlspecialchars($x['permalink'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['location'] = (($x['location']) ? htmlspecialchars($x['location'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['coord'] = (($x['longlat']) ? htmlspecialchars($x['longlat'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['verb'] = (($x['verb']) ? htmlspecialchars($x['verb'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['mimetype'] = (($x['mimetype']) ? htmlspecialchars($x['mimetype'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['obj_type'] = (($x['object_type']) ? htmlspecialchars($x['object_type'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['tgt_type'] = (($x['target_type']) ? htmlspecialchars($x['target_type'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['comment_policy'] = (($x['comment_scope']) ? htmlspecialchars($x['comment_scope'], ENT_COMPAT,'UTF-8',false) : 'contacts'); - $arr['sig'] = (($x['signature']) ? htmlentities($x['signature'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['sig'] = (($x['signature']) ? htmlspecialchars($x['signature'], ENT_COMPAT,'UTF-8',false) : ''); $arr['object'] = activity_sanitise($x['object']); @@ -604,8 +627,8 @@ function get_item_elements($x) { // once, and after that your hub knows them. Sure some info is in the post, but it's only a transit identifier // and not enough info to be able to look you up from your hash - which is the only thing stored with the post. - if(import_author_xchan($x['author'])) - $arr['author_xchan'] = base64url_encode(hash('whirlpool',$x['author']['guid'] . $x['author']['guid_sig'], true)); + if(($xchan_hash = import_author_xchan($x['author'])) !== false) + $arr['author_xchan'] = $xchan_hash; else return array(); @@ -613,8 +636,8 @@ function get_item_elements($x) { if($arr['author_xchan'] === base64url_encode(hash('whirlpool',$x['owner']['guid'] . $x['owner']['guid_sig'], true))) $arr['owner_xchan'] = $arr['author_xchan']; else { - if(import_author_xchan($x['owner'])) - $arr['owner_xchan'] = base64url_encode(hash('whirlpool',$x['owner']['guid'] . $x['owner']['guid_sig'], true)); + if(($xchan_hash = import_author_xchan($x['owner'])) !== false) + $arr['owner_xchan'] = $xchan_hash; else return array(); } @@ -639,12 +662,11 @@ function get_item_elements($x) { $arr['item_flags'] = $arr['item_flags'] | ITEM_OBSCURED; $key = get_config('system','pubkey'); if($arr['title']) - $arr['title'] = json_encode(aes_encapsulate($arr['title'],$key)); + $arr['title'] = json_encode(crypto_encapsulate($arr['title'],$key)); if($arr['body']) - $arr['body'] = json_encode(aes_encapsulate($arr['body'],$key)); + $arr['body'] = json_encode(crypto_encapsulate($arr['body'],$key)); } - return $arr; } @@ -652,21 +674,18 @@ function get_item_elements($x) { function import_author_xchan($x) { - $r = q("select hubloc_url from hubloc where hubloc_guid = '%s' and hubloc_guid_sig = '%s' and (hubloc_flags & %d) limit 1", - dbesc($x['guid']), - dbesc($x['guid_sig']), - intval(HUBLOC_FLAGS_PRIMARY) - ); + $arr = array('xchan' => $x, 'xchan_hash' => ''); + call_hooks('import_author_xchan',$arr); + if($arr['xchan_hash']) + return $arr['xchan_hash']; - if($r) { - logger('import_author_xchan: in cache', LOGGER_DEBUG); - return true; + if((! array_key_exists('network', $x)) || ($x['network'] === 'zot')) { + return import_author_zot($x); } - logger('import_author_xchan: entry not in cache - probing: ' . print_r($x,true), LOGGER_DEBUG); + // TODO: create xchans for other common and/or aligned networks - $them = array('hubloc_url' => $x['url'],'xchan_guid' => $x['guid'], 'xchan_guid_sig' => $x['guid_sig']); - return zot_refresh($them); + return false; } function encode_item($item) { @@ -694,9 +713,9 @@ function encode_item($item) { if(array_key_exists('item_flags',$item) && ($item['item_flags'] & ITEM_OBSCURED)) { $key = get_config('system','prvkey'); if($item['title']) - $item['title'] = aes_unencapsulate(json_decode_plus($item['title']),$key); + $item['title'] = crypto_unencapsulate(json_decode_plus($item['title']),$key); if($item['body']) - $item['body'] = aes_unencapsulate(json_decode_plus($item['body']),$key); + $item['body'] = crypto_unencapsulate(json_decode_plus($item['body']),$key); } if($item['item_restrict'] & ITEM_DELETED) { @@ -714,6 +733,7 @@ function encode_item($item) { $x['created'] = $item['created']; $x['edited'] = $item['edited']; $x['expires'] = $item['expires']; + $x['commented'] = $item['commented']; $x['mimetype'] = $item['mimetype']; $x['title'] = $item['title']; $x['body'] = $item['body']; @@ -779,6 +799,7 @@ function encode_item_xchan($xchan) { $ret['name'] = $xchan['xchan_name']; $ret['address'] = $xchan['xchan_addr']; $ret['url'] = $xchan['hubloc_url']; + $ret['network'] = $xchan['xchan_network']; $ret['photo'] = array('mimetype' => $xchan['xchan_photo_mimetype'], 'src' => $xchan['xchan_photo_m']); $ret['guid'] = $xchan['xchan_guid']; $ret['guid_sig'] = $xchan['xchan_guid_sig']; @@ -810,8 +831,8 @@ function decode_tags($t) { $ret = array(); foreach($t as $x) { $tag = array(); - $tag['term'] = htmlentities($x['tag'], ENT_COMPAT,'UTF-8',false); - $tag['url'] = htmlentities($x['url'], ENT_COMPAT,'UTF-8',false); + $tag['term'] = htmlspecialchars($x['tag'], ENT_COMPAT,'UTF-8',false); + $tag['url'] = htmlspecialchars($x['url'], ENT_COMPAT,'UTF-8',false); switch($x['type']) { case 'hashtag': $tag['type'] = TERM_HASHTAG; @@ -854,12 +875,12 @@ function activity_sanitise($arr) { if(is_array($x)) $ret[$k] = activity_sanitise($x); else - $ret[$k] = htmlentities($x, ENT_COMPAT,'UTF-8',false); + $ret[$k] = htmlspecialchars($x, ENT_COMPAT,'UTF-8',false); } return $ret; } else { - return htmlentities($arr, ENT_COMPAT,'UTF-8', false); + return htmlspecialchars($arr, ENT_COMPAT,'UTF-8', false); } } return ''; @@ -871,7 +892,7 @@ function array_sanitise($arr) { if($arr) { $ret = array(); foreach($arr as $x) { - $ret[] = htmlentities($x, ENT_COMPAT,'UTF-8',false); + $ret[] = htmlspecialchars($x, ENT_COMPAT,'UTF-8',false); } return $ret; } @@ -902,9 +923,9 @@ function encode_mail($item) { if(array_key_exists('mail_flags',$item) && ($item['mail_flags'] & MAIL_OBSCURED)) { $key = get_config('system','prvkey'); if($item['title']) - $item['title'] = aes_unencapsulate(json_decode_plus($item['title']),$key); + $item['title'] = crypto_unencapsulate(json_decode_plus($item['title']),$key); if($item['body']) - $item['body'] = aes_unencapsulate(json_decode_plus($item['body']),$key); + $item['body'] = crypto_unencapsulate(json_decode_plus($item['body']),$key); } $x['message_id'] = $item['mid']; @@ -936,8 +957,8 @@ function get_mail_elements($x) { $arr = array(); - $arr['body'] = (($x['body']) ? htmlentities($x['body'], ENT_COMPAT,'UTF-8',false) : ''); - $arr['title'] = (($x['title'])? htmlentities($x['title'],ENT_COMPAT,'UTF-8',false) : ''); + $arr['body'] = (($x['body']) ? htmlspecialchars($x['body'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['title'] = (($x['title'])? htmlspecialchars($x['title'],ENT_COMPAT,'UTF-8',false) : ''); $arr['created'] = datetime_convert('UTC','UTC',$x['created']); if((! array_key_exists('expires',$x)) || ($x['expires'] === '0000-00-00 00:00:00')) @@ -955,34 +976,32 @@ function get_mail_elements($x) { $key = get_config('system','pubkey'); $arr['mail_flags'] |= MAIL_OBSCURED; - $arr['body'] = htmlentities($arr['body'],ENT_COMPAT,'UTF-8',false); + $arr['body'] = htmlspecialchars($arr['body'],ENT_COMPAT,'UTF-8',false); if($arr['body']) - $arr['body'] = json_encode(aes_encapsulate($arr['body'],$key)); - $arr['title'] = htmlentities($arr['title'],ENT_COMPAT,'UTF-8',false); + $arr['body'] = json_encode(crypto_encapsulate($arr['body'],$key)); + $arr['title'] = htmlspecialchars($arr['title'],ENT_COMPAT,'UTF-8',false); if($arr['title']) - $arr['title'] = json_encode(aes_encapsulate($arr['title'],$key)); + $arr['title'] = json_encode(crypto_encapsulate($arr['title'],$key)); if($arr['created'] > datetime_convert()) $arr['created'] = datetime_convert(); - $arr['mid'] = (($x['message_id']) ? htmlentities($x['message_id'], ENT_COMPAT,'UTF-8',false) : ''); - $arr['parent_mid'] = (($x['message_parent']) ? htmlentities($x['message_parent'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['mid'] = (($x['message_id']) ? htmlspecialchars($x['message_id'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['parent_mid'] = (($x['message_parent']) ? htmlspecialchars($x['message_parent'], ENT_COMPAT,'UTF-8',false) : ''); if($x['attach']) $arr['attach'] = activity_sanitise($x['attach']); - - if(import_author_xchan($x['from'])) - $arr['from_xchan'] = base64url_encode(hash('whirlpool',$x['from']['guid'] . $x['from']['guid_sig'], true)); + if(($xchan_hash = import_author_xchan($x['from'])) !== false) + $arr['from_xchan'] = $xchan_hash; else return array(); - if(import_author_xchan($x['to'])) - $arr['to_xchan'] = base64url_encode(hash('whirlpool',$x['to']['guid'] . $x['to']['guid_sig'], true)); + if(($xchan_hash = import_author_xchan($x['to'])) !== false) + $arr['to_xchan'] = $xchan_hash; else return array(); - return $arr; } @@ -992,23 +1011,23 @@ function get_profile_elements($x) { $arr = array(); - if(import_author_xchan($x['from'])) - $arr['xprof_hash'] = base64url_encode(hash('whirlpool',$x['from']['guid'] . $x['from']['guid_sig'], true)); + if(($xchan_hash = import_author_xchan($x['from'])) !== false) + $arr['xprof_hash'] = $xchan_hash; else return array(); - $arr['desc'] = (($x['title']) ? htmlentities($x['title'],ENT_COMPAT,'UTF-8',false) : ''); + $arr['desc'] = (($x['title']) ? htmlspecialchars($x['title'],ENT_COMPAT,'UTF-8',false) : ''); $arr['dob'] = datetime_convert('UTC','UTC',$x['birthday'],'Y-m-d'); $arr['age'] = (($x['age']) ? intval($x['age']) : 0); - $arr['gender'] = (($x['gender']) ? htmlentities($x['gender'], ENT_COMPAT,'UTF-8',false) : ''); - $arr['marital'] = (($x['marital']) ? htmlentities($x['marital'], ENT_COMPAT,'UTF-8',false) : ''); - $arr['sexual'] = (($x['sexual']) ? htmlentities($x['sexual'], ENT_COMPAT,'UTF-8',false) : ''); - $arr['locale'] = (($x['locale']) ? htmlentities($x['locale'], ENT_COMPAT,'UTF-8',false) : ''); - $arr['region'] = (($x['region']) ? htmlentities($x['region'], ENT_COMPAT,'UTF-8',false) : ''); - $arr['postcode'] = (($x['postcode']) ? htmlentities($x['postcode'], ENT_COMPAT,'UTF-8',false) : ''); - $arr['country'] = (($x['country']) ? htmlentities($x['country'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['gender'] = (($x['gender']) ? htmlspecialchars($x['gender'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['marital'] = (($x['marital']) ? htmlspecialchars($x['marital'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['sexual'] = (($x['sexual']) ? htmlspecialchars($x['sexual'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['locale'] = (($x['locale']) ? htmlspecialchars($x['locale'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['region'] = (($x['region']) ? htmlspecialchars($x['region'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['postcode'] = (($x['postcode']) ? htmlspecialchars($x['postcode'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['country'] = (($x['country']) ? htmlspecialchars($x['country'], ENT_COMPAT,'UTF-8',false) : ''); $arr['keywords'] = (($x['keywords'] && is_array($x['keywords'])) ? array_sanitise($x['keywords']) : array()); @@ -1426,6 +1445,12 @@ function encode_rel_links($links) { function item_store($arr,$allow_exec = false) { + $d = array('item' => $arr, 'allow_exec' => $allow_exec); + call_hooks('item_store', $d ); + $arr = $d['item']; + $allow_exec = $d['allow_exec']; + + $ret = array('result' => false, 'item_id' => 0); if(! $arr['uid']) { @@ -1510,9 +1535,9 @@ function item_store($arr,$allow_exec = false) { $key = get_config('system','pubkey'); $arr['item_flags'] = $arr['item_flags'] | ITEM_OBSCURED; if($arr['title']) - $arr['title'] = json_encode(aes_encapsulate($arr['title'],$key)); + $arr['title'] = json_encode(crypto_encapsulate($arr['title'],$key)); if($arr['body']) - $arr['body'] = json_encode(aes_encapsulate($arr['body'],$key)); + $arr['body'] = json_encode(crypto_encapsulate($arr['body'],$key)); } } @@ -1539,8 +1564,8 @@ function item_store($arr,$allow_exec = false) { $arr['owner_xchan'] = ((x($arr,'owner_xchan')) ? notags(trim($arr['owner_xchan'])) : ''); $arr['created'] = ((x($arr,'created') !== false) ? datetime_convert('UTC','UTC',$arr['created']) : datetime_convert()); $arr['edited'] = ((x($arr,'edited') !== false) ? datetime_convert('UTC','UTC',$arr['edited']) : datetime_convert()); - $arr['expires'] = ((x($arr,'expires') !== false) ? datetime_convert('UTC','UTC',$arr['expires']) : '0000-00-00 00:00:00'); - $arr['commented'] = datetime_convert(); + $arr['expires'] = ((x($arr,'expires') !== false) ? datetime_convert('UTC','UTC',$arr['expires']) : '0000-00-00 00:00:00'); + $arr['commented'] = ((x($arr,'commented') !== false) ? datetime_convert('UTC','UTC',$arr['commented']) : datetime_convert()); $arr['received'] = datetime_convert(); $arr['changed'] = datetime_convert(); $arr['location'] = ((x($arr,'location')) ? notags(trim($arr['location'])) : ''); @@ -1777,8 +1802,13 @@ function item_store($arr,$allow_exec = false) { // update the commented timestamp on the parent + $z = q("select max(created) as commented from item where parent_mid = '%s' and uid = %d ", + dbesc($arr['parent_mid']), + intval($arr['uid']) + ); + q("UPDATE item set commented = '%s', changed = '%s' WHERE id = %d LIMIT 1", - dbesc(datetime_convert()), + dbesc(($z) ? $z[0]['commented'] : (datetime_convert())), dbesc(datetime_convert()), intval($parent_id) ); @@ -1797,6 +1827,15 @@ function item_store($arr,$allow_exec = false) { function item_store_update($arr,$allow_exec = false) { + + + $d = array('item' => $arr, 'allow_exec' => $allow_exec); + call_hooks('item_store_update', $d ); + $arr = $d['item']; + $allow_exec = $d['allow_exec']; + + + $ret = array('result' => false, 'item_id' => 0); if(! intval($arr['uid'])) { logger('item_store_update: no uid'); @@ -1833,8 +1872,6 @@ function item_store_update($arr,$allow_exec = false) { $arr['item_flags'] = intval($arr['item_flags']) | $orig[0]['item_flags']; $arr['item_restrict'] = intval($arr['item_restrict']) | $orig[0]['item_restrict']; - unset($arr['id']); - unset($arr['uid']); if(array_key_exists('edit',$arr)) unset($arr['edit']); @@ -1876,9 +1913,9 @@ function item_store_update($arr,$allow_exec = false) { $key = get_config('system','pubkey'); $arr['item_flags'] = $arr['item_flags'] | ITEM_OBSCURED; if($arr['title']) - $arr['title'] = json_encode(aes_encapsulate($arr['title'],$key)); + $arr['title'] = json_encode(crypto_encapsulate($arr['title'],$key)); if($arr['body']) - $arr['body'] = json_encode(aes_encapsulate($arr['body'],$key)); + $arr['body'] = json_encode(crypto_encapsulate($arr['body'],$key)); } } @@ -1900,7 +1937,8 @@ function item_store_update($arr,$allow_exec = false) { } - + unset($arr['id']); + unset($arr['uid']); unset($arr['aid']); unset($arr['mid']); unset($arr['parent']); @@ -2232,7 +2270,7 @@ function tag_deliver($uid,$item_id) { if($item['item_flags'] & ITEM_OBSCURED) { $key = get_config('system','prvkey'); if($item['body']) - $body = aes_unencapsulate(json_decode_plus($item['body']),$key); + $body = crypto_unencapsulate(json_decode_plus($item['body']),$key); } else $body = $item['body']; @@ -2324,12 +2362,13 @@ function tgroup_check($uid,$item) { $mention = false; // check that the message originated elsewhere and is a top-level post - // or is a followup and we have already accepted the top level post + // or is a followup and we have already accepted the top level post as an uplink if($item['mid'] != $item['parent_mid']) { - $r = q("select id from item where mid = '%s' and uid = %d limit 1", + $r = q("select id from item where mid = '%s' and uid = %d and ( item_flags & %d ) limit 1", dbesc($item['parent_mid']), - intval($uid) + intval($uid), + intval(ITEM_UPLINK) ); if($r) return true; @@ -2554,198 +2593,6 @@ function mail_store($arr) { - - - -function dfrn_deliver($owner,$contact,$atom, $dissolve = false) { - - $a = get_app(); - - $idtosend = $orig_id = (($contact['dfrn_id']) ? $contact['dfrn_id'] : $contact['issued_id']); - - if($contact['duplex'] && $contact['dfrn_id']) - $idtosend = '0:' . $orig_id; - if($contact['duplex'] && $contact['issued_id']) - $idtosend = '1:' . $orig_id; - - $rino = ((function_exists('mcrypt_encrypt')) ? 1 : 0); - - $rino_enable = get_config('system','rino_encrypt'); - - if(! $rino_enable) - $rino = 0; - -// $ssl_val = intval(get_config('system','ssl_policy')); -// $ssl_policy = ''; - -// switch($ssl_val){ -// case SSL_POLICY_FULL: -// $ssl_policy = 'full'; -// break; -// case SSL_POLICY_SELFSIGN: -// $ssl_policy = 'self'; -// break; -// case SSL_POLICY_NONE: -// default: -// $ssl_policy = 'none'; -// break; -// } - - $url = $contact['notify'] . '&dfrn_id=' . $idtosend . '&dfrn_version=' . DFRN_PROTOCOL_VERSION . (($rino) ? '&rino=1' : ''); - - logger('dfrn_deliver: ' . $url); - - $xml = fetch_url($url); - - $curl_stat = $a->get_curl_code(); - if(! $curl_stat) - return(-1); // timed out - - logger('dfrn_deliver: ' . $xml, LOGGER_DATA); - - if(! $xml) - return 3; - - if(strpos($xml,'<?xml') === false) { - logger('dfrn_deliver: no valid XML returned'); - logger('dfrn_deliver: returned XML: ' . $xml, LOGGER_DATA); - return 3; - } - - $res = parse_xml_string($xml); - - if((intval($res->status) != 0) || (! strlen($res->challenge)) || (! strlen($res->dfrn_id))) - return (($res->status) ? $res->status : 3); - - $postvars = array(); - $sent_dfrn_id = hex2bin((string) $res->dfrn_id); - $challenge = hex2bin((string) $res->challenge); - $perm = (($res->perm) ? $res->perm : null); - $dfrn_version = (float) (($res->dfrn_version) ? $res->dfrn_version : 2.0); - $rino_allowed = ((intval($res->rino) === 1) ? 1 : 0); - $page = (($owner['page-flags'] == PAGE_COMMUNITY) ? 1 : 0); - - if($owner['page-flags'] == PAGE_PRVGROUP) - $page = 2; - - $final_dfrn_id = ''; - - if($perm) { - if((($perm == 'rw') && (! intval($contact['writable']))) - || (($perm == 'r') && (intval($contact['writable'])))) { - q("update contact set writable = %d where id = %d limit 1", - intval(($perm == 'rw') ? 1 : 0), - intval($contact['id']) - ); - $contact['writable'] = (string) 1 - intval($contact['writable']); - } - } - - if(($contact['duplex'] && strlen($contact['pubkey'])) - || ($owner['page-flags'] == PAGE_COMMUNITY && strlen($contact['pubkey'])) - || ($contact['rel'] == CONTACT_IS_SHARING && strlen($contact['pubkey']))) { - openssl_public_decrypt($sent_dfrn_id,$final_dfrn_id,$contact['pubkey']); - openssl_public_decrypt($challenge,$postvars['challenge'],$contact['pubkey']); - } - else { - openssl_private_decrypt($sent_dfrn_id,$final_dfrn_id,$contact['prvkey']); - openssl_private_decrypt($challenge,$postvars['challenge'],$contact['prvkey']); - } - - $final_dfrn_id = substr($final_dfrn_id, 0, strpos($final_dfrn_id, '.')); - - if(strpos($final_dfrn_id,':') == 1) - $final_dfrn_id = substr($final_dfrn_id,2); - - if($final_dfrn_id != $orig_id) { - logger('dfrn_deliver: wrong dfrn_id.'); - // did not decode properly - cannot trust this site - return 3; - } - - $postvars['dfrn_id'] = $idtosend; - $postvars['dfrn_version'] = DFRN_PROTOCOL_VERSION; - if($dissolve) - $postvars['dissolve'] = '1'; - - - if((($contact['rel']) && ($contact['rel'] != CONTACT_IS_SHARING) && (! $contact['blocked'])) || ($owner['page-flags'] == PAGE_COMMUNITY)) { - $postvars['data'] = $atom; - $postvars['perm'] = 'rw'; - } - else { - $postvars['data'] = str_replace('<dfrn:comment-allow>1','<dfrn:comment-allow>0',$atom); - $postvars['perm'] = 'r'; - } - -// $postvars['ssl_policy'] = $ssl_policy; - - if($page) - $postvars['page'] = $page; - - if($rino && $rino_allowed && (! $dissolve)) { - $key = substr(random_string(),0,16); - $data = bin2hex(aes_encrypt($postvars['data'],$key)); - $postvars['data'] = $data; - logger('rino: sent key = ' . $key, LOGGER_DEBUG); - - - if($dfrn_version >= 2.1) { - if(($contact['duplex'] && strlen($contact['pubkey'])) - || ($owner['page-flags'] == PAGE_COMMUNITY && strlen($contact['pubkey'])) - || ($contact['rel'] == CONTACT_IS_SHARING && strlen($contact['pubkey']))) { - - openssl_public_encrypt($key,$postvars['key'],$contact['pubkey']); - } - else { - openssl_private_encrypt($key,$postvars['key'],$contact['prvkey']); - } - } - else { - if(($contact['duplex'] && strlen($contact['prvkey'])) || ($owner['page-flags'] == PAGE_COMMUNITY)) { - openssl_private_encrypt($key,$postvars['key'],$contact['prvkey']); - } - else { - openssl_public_encrypt($key,$postvars['key'],$contact['pubkey']); - } - } - - logger('md5 rawkey ' . md5($postvars['key'])); - - $postvars['key'] = bin2hex($postvars['key']); - } - - logger('dfrn_deliver: ' . "SENDING: " . print_r($postvars,true), LOGGER_DATA); - - $xml = post_url($contact['notify'],$postvars); - - logger('dfrn_deliver: ' . "RECEIVED: " . $xml, LOGGER_DATA); - - $curl_stat = $a->get_curl_code(); - if((! $curl_stat) || (! strlen($xml))) - return(-1); // timed out - - if(($curl_stat == 503) && (stristr($a->get_curl_headers(),'retry-after'))) - return(-1); - - if(strpos($xml,'<?xml') === false) { - logger('dfrn_deliver: phase 2: no valid XML returned'); - logger('dfrn_deliver: phase 2: returned XML: ' . $xml, LOGGER_DATA); - return 3; - } - - if($contact['term_date'] != '0000-00-00 00:00:00') { - logger("dfrn_deliver: $url back from the dead - removing mark for death"); - require_once('include/Contact.php'); - unmark_for_death($contact); - } - - $res = parse_xml_string($xml); - - return $res->status; -} - - /** * * consume_feed - process atom feed and update anything/everything we might need to update @@ -3515,7 +3362,7 @@ function drop_item($id,$interactive = true) { intval($id) ); - if(! $r) { + if((! $r) || ($r[0]['item_restrict'] & ITEM_DELETED)) { if(! $interactive) return 0; notice( t('Item not found.') . EOL); @@ -3541,6 +3388,17 @@ function drop_item($id,$interactive = true) { if($ok_to_delete) { + // set the deleted flag immediately on this item just in case the + // hook calls a remote process which loops. We'll delete it properly in a second. + + $r = q("UPDATE item SET item_restrict = ( item_restrict | %d ) WHERE id = %d LIMIT 1", + intval(ITEM_DELETED), + intval($item['id']) + ); + + $arr = array('item' => $item); + call_hooks('drop_item', $arr ); + $notify_id = intval($item['id']); $items = q("select * from item where parent = %d and uid = %d", @@ -3757,6 +3615,7 @@ function fetch_post_tags($items,$link = false) { function zot_feed($uid,$observer_xchan,$mindate) { + $result = array(); $mindate = datetime_convert('UTC','UTC',$mindate); if(! $mindate) @@ -3764,10 +3623,14 @@ function zot_feed($uid,$observer_xchan,$mindate) { $mindate = dbesc($mindate); + logger('zot_feed: ' . $uid); + if(! perm_is_allowed($uid,$observer_xchan,'view_stream')) { + logger('zot_feed: permission denied.'); return $result; } + require_once('include/security.php'); $sql_extra = item_permissions_sql($uid); if($mindate != '0000-00-00 00:00:00') { @@ -3829,6 +3692,8 @@ function items_fetch($arr,$channel = null,$observer_hash = null,$client_mode = C $sql_options = ''; $sql_extra2 = ''; $sql_extra3 = ''; + $def_acl = ''; + $item_uids = ' true '; if($channel) { @@ -3845,7 +3710,7 @@ function items_fetch($arr,$channel = null,$observer_hash = null,$client_mode = C $sql_extra = " AND item.parent IN ( SELECT parent FROM item WHERE (item_flags & " . intval(ITEM_THREAD_TOP) . ") $sql_options ) "; - if($arr['group'] && $uid) { + if($arr['gid'] && $uid) { $r = q("SELECT * FROM `group` WHERE id = %d AND uid = %d LIMIT 1", intval($arr['group']), intval($uid) @@ -3855,7 +3720,6 @@ function items_fetch($arr,$channel = null,$observer_hash = null,$client_mode = C return $result; } - $contact_str = ''; $contacts = group_get_members($group); if($contacts) { @@ -3867,11 +3731,15 @@ function items_fetch($arr,$channel = null,$observer_hash = null,$client_mode = C } else { $contact_str = ' 0 '; - info( t('Group is empty')); + $result['message'] = t('Collection is empty.'); + return $result; } $sql_extra = " AND item.parent IN ( SELECT DISTINCT parent FROM item WHERE true $sql_options AND (( author_xchan IN ( $contact_str ) OR owner_xchan in ( $contact_str)) or allow_gid like '" . protect_sprintf('%<' . dbesc($r[0]['hash']) . '>%') . "' ) and id = parent and item_restrict = 0 ) "; + $x = group_rec_byhash($uid,$r[0]['hash']); + $result['headline'] = sprintf( t('Collection: %s'),$x['name']); + } elseif($arr['cid'] && $uid) { @@ -3881,6 +3749,7 @@ function items_fetch($arr,$channel = null,$observer_hash = null,$client_mode = C ); if($r) { $sql_extra = " AND item.parent IN ( SELECT DISTINCT parent FROM item WHERE true $sql_options AND uid = " . intval($arr['uid']) . " AND ( author_xchan = '" . dbesc($r[0]['abook_xchan']) . "' or owner_xchan = '" . dbesc($r[0]['abook_xchan']) . "' ) and item_restrict = 0 ) "; + $result['headline'] = sprintf( t('Connection: %s'),$r[0]['xchan_name']); } else { $result['message'] = t('Connection not found.'); diff --git a/include/menu.php b/include/menu.php index 900b48e65..c10a669b3 100644 --- a/include/menu.php +++ b/include/menu.php @@ -196,6 +196,31 @@ function menu_add_item($menu_id, $uid, $arr) { $mitem_desc = escape_tags($arr['mitem_desc']); $mitem_order = intval($arr['mitem_order']); $mitem_flags = intval($arr['mitem_flags']); + + if(local_user() == $uid) { + $channel = get_app()->get_channel(); + } + + if ((! $arr['contact_allow']) + && (! $arr['group_allow']) + && (! $arr['contact_deny']) + && (! $arr['group_deny'])) { + $str_group_allow = $channel['channel_allow_gid']; + $str_contact_allow = $channel['channel_allow_cid']; + $str_group_deny = $channel['channel_deny_gid']; + $str_contact_deny = $channel['channel_deny_cid']; + } + else { + + // use the posted permissions + + $str_group_allow = perms2str($arr['group_allow']); + $str_contact_allow = perms2str($arr['contact_allow']); + $str_group_deny = perms2str($arr['group_deny']); + $str_contact_deny = perms2str($arr['contact_deny']); + } + + $allow_cid = perms2str($arr['allow_cid']); $allow_gid = perms2str($arr['allow_gid']); $deny_cid = perms2str($arr['deny_cid']); @@ -205,10 +230,10 @@ function menu_add_item($menu_id, $uid, $arr) { dbesc($mitem_link), dbesc($mitem_desc), intval($mitem_flags), - dbesc($allow_cid), - dbesc($allow_gid), - dbesc($deny_cid), - dbesc($deny_gid), + dbesc($str_contact_allow), + dbesc($str_group_allow), + dbesc($str_contact_deny), + dbesc($str_group_deny), intval($uid), intval($menu_id), intval($mitem_order) @@ -225,19 +250,40 @@ function menu_edit_item($menu_id, $uid, $arr) { $mitem_desc = escape_tags($arr['mitem_desc']); $mitem_order = intval($arr['mitem_order']); $mitem_flags = intval($arr['mitem_flags']); - $allow_cid = perms2str($arr['allow_cid']); - $allow_gid = perms2str($arr['allow_gid']); - $deny_cid = perms2str($arr['deny_cid']); - $deny_gid = perms2str($arr['deny_gid']); + + + if(local_user() == $uid) { + $channel = get_app()->get_channel(); + } + + if ((! $arr['contact_allow']) + && (! $arr['group_allow']) + && (! $arr['contact_deny']) + && (! $arr['group_deny'])) { + $str_group_allow = $channel['channel_allow_gid']; + $str_contact_allow = $channel['channel_allow_cid']; + $str_group_deny = $channel['channel_deny_gid']; + $str_contact_deny = $channel['channel_deny_cid']; + } + else { + + // use the posted permissions + + $str_group_allow = perms2str($arr['group_allow']); + $str_contact_allow = perms2str($arr['contact_allow']); + $str_group_deny = perms2str($arr['group_deny']); + $str_contact_deny = perms2str($arr['contact_deny']); + } + $r = q("update menu_item set mitem_link = '%s', mitem_desc = '%s', mitem_flags = %d, allow_cid = '%s', allow_gid = '%s', deny_cid = '%s', deny_gid = '%s', mitem_order = %d where mitem_channel_id = %d and mitem_menu_id = %d and mitem_id = %d limit 1", dbesc($mitem_link), dbesc($mitem_desc), intval($mitem_flags), - dbesc($allow_cid), - dbesc($allow_gid), - dbesc($deny_cid), - dbesc($deny_gid), + dbesc($str_contact_allow), + dbesc($str_group_allow), + dbesc($str_contact_deny), + dbesc($str_group_deny), intval($mitem_order), intval($uid), intval($menu_id), diff --git a/include/message.php b/include/message.php index 2fca9bef0..a95021583 100644 --- a/include/message.php +++ b/include/message.php @@ -109,9 +109,9 @@ function send_message($uid = 0, $recipient='', $body='', $subject='', $replyto=' $key = get_config('system','pubkey'); if($subject) - $subject = json_encode(aes_encapsulate($subject,$key)); + $subject = json_encode(crypto_encapsulate($subject,$key)); if($body) - $body = json_encode(aes_encapsulate($body,$key)); + $body = json_encode(crypto_encapsulate($body,$key)); @@ -231,9 +231,9 @@ function private_messages_list($uid, $mailbox = '', $start = 0, $numitems = 0) { $key = get_config('system','prvkey'); if($r[$k]['title']) - $r[$k]['title'] = aes_unencapsulate(json_decode_plus($r[$k]['title']),$key); + $r[$k]['title'] = crypto_unencapsulate(json_decode_plus($r[$k]['title']),$key); if($r[$k]['body']) - $r[$k]['body'] = aes_unencapsulate(json_decode_plus($r[$k]['body']),$key); + $r[$k]['body'] = crypto_unencapsulate(json_decode_plus($r[$k]['body']),$key); } } @@ -270,9 +270,9 @@ function private_messages_fetch_message($channel_id, $messageitem_id, $updatesee if($messages[$k]['mail_flags'] & MAIL_OBSCURED) { $key = get_config('system','prvkey'); if($messages[$k]['title']) - $messages[$k]['title'] = aes_unencapsulate(json_decode_plus($messages[$k]['title']),$key); + $messages[$k]['title'] = crypto_unencapsulate(json_decode_plus($messages[$k]['title']),$key); if($messages[$k]['body']) - $messages[$k]['body'] = aes_unencapsulate(json_decode_plus($messages[$k]['body']),$key); + $messages[$k]['body'] = crypto_unencapsulate(json_decode_plus($messages[$k]['body']),$key); } } @@ -358,9 +358,9 @@ function private_messages_fetch_conversation($channel_id, $messageitem_id, $upda if($messages[$k]['mail_flags'] & MAIL_OBSCURED) { $key = get_config('system','prvkey'); if($messages[$k]['title']) - $messages[$k]['title'] = aes_unencapsulate(json_decode_plus($messages[$k]['title']),$key); + $messages[$k]['title'] = crypto_unencapsulate(json_decode_plus($messages[$k]['title']),$key); if($messages[$k]['body']) - $messages[$k]['body'] = aes_unencapsulate(json_decode_plus($messages[$k]['body']),$key); + $messages[$k]['body'] = crypto_unencapsulate(json_decode_plus($messages[$k]['body']),$key); } } diff --git a/include/nav.php b/include/nav.php index 51c1cc583..7e99c782e 100644 --- a/include/nav.php +++ b/include/nav.php @@ -147,16 +147,13 @@ EOT; if(local_user()) { $nav['network'] = array('network', t('Matrix'), "", t('Your matrix')); - $nav['network']['all']=array('notifications/network', t('See all matrix notifications'), "", ""); $nav['network']['mark'] = array('', t('Mark all matrix notifications seen'), '',''); $nav['home'] = array('channel/' . $channel['channel_address'], t('Channel Home'), "", t('Channel home')); - $nav['home']['all']=array('notifications/channel', t('See all channel notifications'), "", ""); $nav['home']['mark'] = array('', t('Mark all channel notifications seen'), '',''); $nav['intros'] = array('connections/pending', t('Intros'), "", t('New Connections')); - $nav['intros']['all']=array('intro', t('See all channel introductions'), "", ""); $nav['notifications'] = array('notifications/system', t('Notices'), "", t('Notifications')); @@ -199,7 +196,10 @@ EOT; $banner = get_config('system','banner'); if($banner === false) - $banner = 'red'; + $banner = get_config('system','sitename'); + + $x = array('nav' => $nav, 'usermenu' => $userinfo ); + call_hooks('nav', $x); $tpl = get_markup_template('nav.tpl'); @@ -207,10 +207,10 @@ EOT; '$baseurl' => $a->get_baseurl(), '$langselector' => ((get_config('system','select_language')) ? lang_selector() : ''), '$sitelocation' => $sitelocation, - '$nav' => $nav, + '$nav' => $x['nav'], '$banner' => $banner, '$emptynotifications' => t('Nothing new here'), - '$userinfo' => $userinfo, + '$userinfo' => $x['usermenu'], '$localuser' => local_user(), '$sel' => $a->nav_sel, '$apps' => $a->get_apps(), diff --git a/include/network.php b/include/network.php index 99a0a8e2b..7446c2384 100644 --- a/include/network.php +++ b/include/network.php @@ -6,204 +6,6 @@ function get_capath() { return appdirpath() . '/library/cacert.pem'; } - - -// curl wrapper. If binary flag is true, return binary -// results. - -/** - * fetch_url is deprecated and being replaced by the more capable z_fetch_url - * please use that function instead. - * Once all occurrences of fetch_url are removed from the codebase we will - * remove this function and perhaps rename z_fetch_url back to fetch_url - */ - - - -function fetch_url($url,$binary = false, &$redirects = 0, $timeout = 0, $accept_content=Null) { - - $a = get_app(); - - $ch = @curl_init($url); - if(($redirects > 8) || (! $ch)) - return false; - - @curl_setopt($ch, CURLOPT_HEADER, true); - @curl_setopt($ch, CURLOPT_CAINFO, get_capath()); - - if (!is_null($accept_content)){ - curl_setopt($ch,CURLOPT_HTTPHEADER, array ( - "Accept: " . $accept_content - )); - } - - @curl_setopt($ch, CURLOPT_RETURNTRANSFER,true); - @curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (compatible; Red)"); - - - if(intval($timeout)) { - @curl_setopt($ch, CURLOPT_TIMEOUT, $timeout); - } - else { - $curl_time = intval(get_config('system','curl_timeout')); - @curl_setopt($ch, CURLOPT_TIMEOUT, (($curl_time !== false) ? $curl_time : 60)); - } - // by default we will allow self-signed certs - // but you can override this - - $check_cert = get_config('system','verifyssl'); - @curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, (($check_cert) ? true : false)); - - $prx = get_config('system','proxy'); - if(strlen($prx)) { - @curl_setopt($ch, CURLOPT_HTTPPROXYTUNNEL, 1); - @curl_setopt($ch, CURLOPT_PROXY, $prx); - $prxusr = @get_config('system','proxyuser'); - if(strlen($prxusr)) - @curl_setopt($ch, CURLOPT_PROXYUSERPWD, $prxusr); - } - if($binary) - @curl_setopt($ch, CURLOPT_BINARYTRANSFER,1); - - $a->set_curl_code(0); - - // don't let curl abort the entire application - // if it throws any errors. - - $s = @curl_exec($ch); - - $base = $s; - $curl_info = @curl_getinfo($ch); - $http_code = $curl_info['http_code']; -// logger('fetch_url:' . $http_code . ' data: ' . $s); - $header = ''; - - // Pull out multiple headers, e.g. proxy and continuation headers - // allow for HTTP/2.x without fixing code - - while(preg_match('/^HTTP\/[1-2].+? [1-5][0-9][0-9]/',$base)) { - $chunk = substr($base,0,strpos($base,"\r\n\r\n")+4); - $header .= $chunk; - $base = substr($base,strlen($chunk)); - } - - if($http_code == 301 || $http_code == 302 || $http_code == 303 || $http_code == 307 || $http_code == 308) { - $matches = array(); - preg_match('/(Location:|URI:)(.*?)\n/', $header, $matches); - $newurl = trim(array_pop($matches)); - if(strpos($newurl,'/') === 0) - $newurl = $url . $newurl; - $url_parsed = @parse_url($newurl); - if (isset($url_parsed)) { - $redirects++; - @curl_close($ch); - return fetch_url($newurl,$binary,$redirects,$timeout); - } - } - - $a->set_curl_code($http_code); - - $body = substr($s,strlen($header)); - $a->set_curl_headers($header); - @curl_close($ch); - return($body); -} - -// post request to $url. $params is an array of post variables. - - -function post_url($url,$params, $headers = null, &$redirects = 0, $timeout = 0) { - $a = get_app(); - $ch = curl_init($url); - if(($redirects > 8) || (! $ch)) - return false; - - curl_setopt($ch, CURLOPT_HEADER, true); - @curl_setopt($ch, CURLOPT_CAINFO, get_capath()); - curl_setopt($ch, CURLOPT_RETURNTRANSFER,true); - curl_setopt($ch, CURLOPT_POST,1); - curl_setopt($ch, CURLOPT_POSTFIELDS,$params); - curl_setopt($ch, CURLOPT_USERAGENT, "Red"); - - if(intval($timeout)) { - curl_setopt($ch, CURLOPT_TIMEOUT, $timeout); - } - else { - $curl_time = intval(get_config('system','curl_timeout')); - curl_setopt($ch, CURLOPT_TIMEOUT, (($curl_time !== false) ? $curl_time : 60)); - } - - if(defined('LIGHTTPD')) { - if(!is_array($headers)) { - $headers = array('Expect:'); - } else { - if(!in_array('Expect:', $headers)) { - array_push($headers, 'Expect:'); - } - } - } - if($headers) - curl_setopt($ch, CURLOPT_HTTPHEADER, $headers); - - $check_cert = get_config('system','verifyssl'); - curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, (($check_cert) ? true : false)); - $prx = get_config('system','proxy'); - if(strlen($prx)) { - curl_setopt($ch, CURLOPT_HTTPPROXYTUNNEL, 1); - curl_setopt($ch, CURLOPT_PROXY, $prx); - $prxusr = get_config('system','proxyuser'); - if(strlen($prxusr)) - curl_setopt($ch, CURLOPT_PROXYUSERPWD, $prxusr); - } - - $a->set_curl_code(0); - - // don't let curl abort the entire application - // if it throws any errors. - - $s = @curl_exec($ch); - - $base = $s; - $curl_info = curl_getinfo($ch); - $http_code = $curl_info['http_code']; - - $header = ''; - - // Pull out multiple headers, e.g. proxy and continuation headers - // allow for HTTP/2.x without fixing code - - while(preg_match('/^HTTP\/[1-2].+? [1-5][0-9][0-9]/',$base)) { - $chunk = substr($base,0,strpos($base,"\r\n\r\n")+4); - $header .= $chunk; - $base = substr($base,strlen($chunk)); - } - - if($http_code == 301 || $http_code == 302 || $http_code == 303 || $http_code == 307 || $http_code == 308) { - $matches = array(); - preg_match('/(Location:|URI:)(.*?)\n/', $header, $matches); - $newurl = trim(array_pop($matches)); - if(strpos($newurl,'/') === 0) - $newurl = $url . $newurl; - $url_parsed = @parse_url($newurl); - if (isset($url_parsed)) { - $redirects++; - @curl_close($ch); - if($http_code == 303) { - return fetch_url($newurl,false,$redirects,$timeout); - } else { - return post_url($newurl,$params,$redirects,$timeout); - } - } - } - $a->set_curl_code($http_code); - $body = substr($s,strlen($header)); - - $a->set_curl_headers($header); - - curl_close($ch); - return($body); -} - /** * @function z_fetch_url * @param string $url @@ -347,6 +149,8 @@ function z_post_url($url,$params, $redirects = 0, $opts = array()) { "Accept: " . $opts['accept_content'] )); } + if(x($opts,'headers')) + curl_setopt($ch, CURLOPT_HTTPHEADER, $opts['headers']); if(x($opts,'timeout') && intval($opts['timeout'])) { @curl_setopt($ch, CURLOPT_TIMEOUT, $opts['timeout']); @@ -586,175 +390,6 @@ function webfinger($s, $debug = false) { } -function lrdd($uri, $debug = false) { - - $a = get_app(); - - // default priority is host priority, host-meta first - - $priority = 'host'; - - // All we have is an email address. Resource-priority is irrelevant - // because our URI isn't directly resolvable. - - if(strstr($uri,'@')) { - return(webfinger($uri)); - } - - // get the host meta file - - $host = @parse_url($uri); - - if($host) { - $url = ((x($host,'scheme')) ? $host['scheme'] : 'http') . '://'; - $url .= $host['host'] . '/.well-known/host-meta' ; - } - else - return array(); - - logger('lrdd: constructed url: ' . $url); - - $xml = fetch_url($url); - $headers = $a->get_curl_headers(); - - if (! $xml) - return array(); - - logger('lrdd: host_meta: ' . $xml, LOGGER_DATA); - - if(! stristr($xml,'<xrd')) - return array(); - - $h = parse_xml_string($xml); - if(! $h) - return array(); - - $arr = convert_xml_element_to_array($h); - - if(isset($arr['xrd']['property'])) { - $property = $arr['crd']['property']; - if(! isset($property[0])) - $properties = array($property); - else - $properties = $property; - foreach($properties as $prop) - if((string) $prop['@attributes'] === 'http://lrdd.net/priority/resource') - $priority = 'resource'; - } - - // save the links in case we need them - - $links = array(); - - if(isset($arr['xrd']['link'])) { - $link = $arr['xrd']['link']; - if(! isset($link[0])) - $links = array($link); - else - $links = $link; - } - - // do we have a template or href? - - if(count($links)) { - foreach($links as $link) { - if($link['@attributes']['rel'] && attribute_contains($link['@attributes']['rel'],'lrdd')) { - if(x($link['@attributes'],'template')) - $tpl = $link['@attributes']['template']; - elseif(x($link['@attributes'],'href')) - $href = $link['@attributes']['href']; - } - } - } - - if((! isset($tpl)) || (! strpos($tpl,'{uri}'))) - $tpl = ''; - - if($priority === 'host') { - if(strlen($tpl)) - $pxrd = str_replace('{uri}', urlencode($uri), $tpl); - elseif(isset($href)) - $pxrd = $href; - if(isset($pxrd)) { - logger('lrdd: (host priority) pxrd: ' . $pxrd); - $links = fetch_xrd_links($pxrd); - return $links; - } - - $lines = explode("\n",$headers); - if(count($lines)) { - foreach($lines as $line) { - if((stristr($line,'link:')) && preg_match('/<([^>].*)>.*rel\=[\'\"]lrdd[\'\"]/',$line,$matches)) { - return(fetch_xrd_links($matches[1])); - break; - } - } - } - } - - - // priority 'resource' - - - $html = fetch_url($uri); - $headers = $a->get_curl_headers(); - logger('lrdd: headers=' . $headers, LOGGER_DEBUG); - - // don't try and parse raw xml as html - if(! strstr($html,'<?xml')) { - require_once('library/HTML5/Parser.php'); - - try { - $dom = HTML5_Parser::parse($html); - } catch (DOMException $e) { - logger('lrdd: parse error: ' . $e); - } - - if(isset($dom) && $dom) { - $items = $dom->getElementsByTagName('link'); - foreach($items as $item) { - $x = $item->getAttribute('rel'); - if($x == "lrdd") { - $pagelink = $item->getAttribute('href'); - break; - } - } - } - } - - if(isset($pagelink)) - return(fetch_xrd_links($pagelink)); - - // next look in HTTP headers - - $lines = explode("\n",$headers); - if(count($lines)) { - foreach($lines as $line) { - // TODO alter the following regex to support multiple relations (space separated) - if((stristr($line,'link:')) && preg_match('/<([^>].*)>.*rel\=[\'\"]lrdd[\'\"]/',$line,$matches)) { - $pagelink = $matches[1]; - break; - } - // don't try and run feeds through the html5 parser - if(stristr($line,'content-type:') && ((stristr($line,'application/atom+xml')) || (stristr($line,'application/rss+xml')))) - return array(); - if(stristr($html,'<rss') || stristr($html,'<feed')) - return array(); - } - } - - if(isset($pagelink)) - return(fetch_xrd_links($pagelink)); - - // If we haven't found any links, return the host xrd links (which we have already fetched) - - if(isset($links)) - return $links; - - return array(); - -} - // Given a host name, locate the LRDD template from that @@ -785,58 +420,6 @@ function fetch_lrdd_template($host) { return $tpl; } -// Given a URL, retrieve the page as an XRD document. -// Return an array of links. -// on error/failure return empty array. - - -function fetch_xrd_links($url) { - - $xrd_timeout = intval(get_config('system','xrd_timeout')); - $redirects = 0; - $xml = fetch_url($url,false,$redirects,(($xrd_timeout) ? $xrd_timeout : 30)); - - logger('fetch_xrd_links: ' . $xml, LOGGER_DATA); - - if ((! $xml) || (! stristr($xml,'<xrd'))) - return array(); - - // fix diaspora's bad xml - $xml = str_replace(array('href="','"/>'),array('href="','"/>'),$xml); - - $arr = xml2array($xml); - - logger('fetch_xrd_links: ' . print_r($arr,true), LOGGER_DATA); - - $links = array(); - - if(isset($arr['xrd']['link'])) { - $link = $arr['xrd']['link']; - if(! isset($link[0])) - $links = array($link); - else - $links = $link; - } - if(isset($arr['xrd']['alias'])) { - $alias = $arr['xrd']['alias']; - if(! isset($alias[0])) - $aliases = array($alias); - else - $aliases = $alias; - if(is_array($aliases) && count($aliases)) { - foreach($aliases as $alias) { - $links[]['@attributes'] = array('rel' => 'alias' , 'href' => $alias); - } - } - } - - logger('fetch_xrd_links: ' . print_r($links,true), LOGGER_DATA); - - return $links; - -} - - // Take a URL from the wild, prepend http:// if necessary // and check DNS to see if it's real (or check if is a valid IP address) // return true if it's OK, false if something is wrong with it @@ -965,7 +548,7 @@ function avatar_img($email) { call_hooks('avatar_lookup', $avatar); if(! $avatar['success']) - $avatar['url'] = $a->get_baseurl() . '/images/person-175.jpg'; + $avatar['url'] = $a->get_baseurl() . '/images/default_profile_photos/rainbow_man/175.jpg'; logger('Avatar: ' . $avatar['email'] . ' ' . $avatar['url'], LOGGER_DEBUG); return $avatar['url']; @@ -993,70 +576,13 @@ function parse_xml_string($s,$strict = true) { return $x; } -function add_fcontact($arr,$update = false) { - - if($update) { - $r = q("UPDATE `fcontact` SET - `name` = '%s', - `photo` = '%s', - `request` = '%s', - `nick` = '%s', - `addr` = '%s', - `batch` = '%s', - `notify` = '%s', - `poll` = '%s', - `confirm` = '%s', - `alias` = '%s', - `pubkey` = '%s', - `updated` = '%s' - WHERE `url` = '%s' AND `network` = '%s' LIMIT 1", - dbesc($arr['name']), - dbesc($arr['photo']), - dbesc($arr['request']), - dbesc($arr['nick']), - dbesc($arr['addr']), - dbesc($arr['batch']), - dbesc($arr['notify']), - dbesc($arr['poll']), - dbesc($arr['confirm']), - dbesc($arr['alias']), - dbesc($arr['pubkey']), - dbesc(datetime_convert()), - dbesc($arr['url']), - dbesc($arr['network']) - ); - } - else { - $r = q("insert into fcontact ( `url`,`name`,`photo`,`request`,`nick`,`addr`, - `batch`, `notify`,`poll`,`confirm`,`network`,`alias`,`pubkey`,`updated` ) - values('%s','%s','%s','%s','%s','%s','%s','%s','%s','%s','%s','%s','%s','%s')", - dbesc($arr['url']), - dbesc($arr['name']), - dbesc($arr['photo']), - dbesc($arr['request']), - dbesc($arr['nick']), - dbesc($arr['addr']), - dbesc($arr['batch']), - dbesc($arr['notify']), - dbesc($arr['poll']), - dbesc($arr['confirm']), - dbesc($arr['network']), - dbesc($arr['alias']), - dbesc($arr['pubkey']), - dbesc(datetime_convert()) - ); - } - - return $r; -} - function scale_external_images($s, $include_link = true, $scale_replace = false) { $a = get_app(); // Picture addresses can contain special characters - $s = htmlspecialchars_decode($s); + $s = htmlspecialchars_decode($s, ENT_COMPAT); $matches = null; $c = preg_match_all('/\[img(.*?)\](.*?)\[\/img\]/ism',$s,$matches,PREG_SET_ORDER); @@ -1085,19 +611,20 @@ function scale_external_images($s, $include_link = true, $scale_replace = false) $scaled = str_replace($scale_replace[0], $scale_replace[1], $mtch[2]); else $scaled = $mtch[2]; - $i = fetch_url($scaled); + $i = z_fetch_url($scaled); + $cache = get_config('system','itemcache'); if (($cache != '') and is_dir($cache)) { $cachefile = $cache."/".hash("md5", $scaled); - file_put_contents($cachefile, $i); + file_put_contents($cachefile, $i['body']); } // guess mimetype from headers or filename - $type = guess_image_type($mtch[2],true); + $type = guess_image_type($mtch[2],$i['header']); - if($i) { - $ph = photo_factory($i, $type); + if($i['success']) { + $ph = photo_factory($i['body'], $type); if($ph->is_valid()) { $orig_width = $ph->getWidth(); $orig_height = $ph->getHeight(); @@ -1126,52 +653,6 @@ function scale_external_images($s, $include_link = true, $scale_replace = false) return $s; } - -function fix_contact_ssl_policy(&$contact,$new_policy) { - - $ssl_changed = false; - if((intval($new_policy) == SSL_POLICY_SELFSIGN || $new_policy === 'self') && strstr($contact['url'],'https:')) { - $ssl_changed = true; - $contact['url'] = str_replace('https:','http:',$contact['url']); - $contact['request'] = str_replace('https:','http:',$contact['request']); - $contact['notify'] = str_replace('https:','http:',$contact['notify']); - $contact['poll'] = str_replace('https:','http:',$contact['poll']); - $contact['confirm'] = str_replace('https:','http:',$contact['confirm']); - $contact['poco'] = str_replace('https:','http:',$contact['poco']); - } - - if((intval($new_policy) == SSL_POLICY_FULL || $new_policy === 'full') && strstr($contact['url'],'http:')) { - $ssl_changed = true; - $contact['url'] = str_replace('http:','https:',$contact['url']); - $contact['request'] = str_replace('http:','https:',$contact['request']); - $contact['notify'] = str_replace('http:','https:',$contact['notify']); - $contact['poll'] = str_replace('http:','https:',$contact['poll']); - $contact['confirm'] = str_replace('http:','https:',$contact['confirm']); - $contact['poco'] = str_replace('http:','https:',$contact['poco']); - } - - if($ssl_changed) { - q("update contact set - url = '%s', - request = '%s', - notify = '%s', - poll = '%s', - confirm = '%s', - poco = '%s' - where id = %d limit 1", - dbesc($contact['url']), - dbesc($contact['request']), - dbesc($contact['notify']), - dbesc($contact['poll']), - dbesc($contact['confirm']), - dbesc($contact['poco']), - intval($contact['id']) - ); - } -} - - - /** * xml2array() will convert the given XML text to an array in the XML structure. * Link: http://www.bin-co.com/php/scripts/xml2array/ diff --git a/include/notifier.php b/include/notifier.php index 1407be4b3..0868ac77e 100644 --- a/include/notifier.php +++ b/include/notifier.php @@ -382,12 +382,27 @@ function notifier_run($argv, $argc){ $env_recips = (($private) ? array() : null); - $details = q("select xchan_hash, xchan_addr, xchan_guid, xchan_guid_sig from xchan where xchan_hash in (" . implode(',',$recipients) . ")"); + $details = q("select xchan_hash, xchan_instance_url, xchan_addr, xchan_guid, xchan_guid_sig from xchan where xchan_hash in (" . implode(',',$recipients) . ")"); $recip_list = array(); if($details) { foreach($details as $d) { + + // If the recipient is federated from a traditional network they won't be able to + // handle nomadic identity. If we're publishing from a site that they aren't + // directly connected with, ignore them. + + // FIXME: make sure we run through a notifier loop on the hub they're connected + // with if this post comes in from a different hub - so that we will deliver to them. + + // On the down side, these channels will stop working if the hub they connected with + // goes down permanently, as they are (doh) not nomadic. + + if(($d['xchan_instance_url']) && ($d['xchan_instance_url'] != z_root())) + continue; + + $recip_list[] = $d['xchan_addr'] . ' (' . $d['xchan_hash'] . ')'; if($private) $env_recips[] = array('guid' => $d['xchan_guid'],'guid_sig' => $d['xchan_guid_sig']); @@ -408,9 +423,9 @@ function notifier_run($argv, $argc){ // for public posts always include our own hub - $sql_extra = (($private) ? "" : " or hubloc_url = '" . z_root() . "' "); + $sql_extra = (($private) ? "" : " or hubloc_url = '" . dbesc(z_root()) . "' "); - $r = q("select distinct hubloc_sitekey, hubloc_flags, hubloc_callback, hubloc_host from hubloc + $r = q("select hubloc_sitekey, hubloc_flags, hubloc_callback, hubloc_host from hubloc where hubloc_hash in (" . implode(',',$recipients) . ") $sql_extra group by hubloc_sitekey"); if(! $r) { logger('notifier: no hubs'); @@ -419,10 +434,14 @@ function notifier_run($argv, $argc){ $hubs = $r; $hublist = array(); + $keys = array(); + foreach($hubs as $hub) { - // don't try to deliver to deleted hublocs - if(! ($hub['hubloc_flags'] & HUBLOC_FLAGS_DELETED)) { + // don't try to deliver to deleted hublocs - and inexplicably SQL "distinct" and "group by" + // both return records with duplicate keys in rare circumstances + if((! ($hub['hubloc_flags'] & HUBLOC_FLAGS_DELETED)) && (! in_array($hub['hubloc_sitekey'],$keys))) { $hublist[] = $hub['hubloc_host']; + $keys[] = $hub['hubloc_sitekey']; } } diff --git a/include/oembed.php b/include/oembed.php index 5da842170..520b69892 100755 --- a/include/oembed.php +++ b/include/oembed.php @@ -44,7 +44,8 @@ function oembed_fetch_url($embedurl){ $entries = $xpath->query("//link[@type='application/json+oembed']"); foreach($entries as $e){ $href = $e->getAttributeNode("href")->nodeValue; - $txt = fetch_url($href . '&maxwidth=' . $a->videowidth); + $x = z_fetch_url($href . '&maxwidth=' . $a->videowidth); + $txt = $x['body']; break; } } diff --git a/include/onepoll.php b/include/onepoll.php index 50c2566be..a821b76cf 100644 --- a/include/onepoll.php +++ b/include/onepoll.php @@ -36,11 +36,12 @@ function onepoll_run($argv, $argc){ $contacts = q("SELECT abook.*, xchan.*, account.* FROM abook LEFT JOIN account on abook_account = account_id left join xchan on xchan_hash = abook_xchan where abook_id = %d - AND (( abook_flags = %d ) OR ( abook_flags = %d )) + AND (( abook_flags = %d ) OR ( abook_flags = %d ) OR ( abook_flags & %d )) AND (( account_flags = %d ) OR ( account_flags = %d )) limit 1", intval($contact_id), intval(ABOOK_FLAG_HIDDEN), intval(0), + intval(ABOOK_FLAG_PENDING), intval(ACCOUNT_OK), intval(ACCOUNT_UNVERIFIED) ); @@ -67,7 +68,7 @@ function onepoll_run($argv, $argc){ logger("onepoll: poll: ({$contact['id']}) IMPORTER: {$importer['xchan_name']}, CONTACT: {$contact['xchan_name']}"); - $last_update = (($contact['abook_updated'] === '0000-00-00 00:00:00') + $last_update = ((($contact['abook_updated'] === $contact['abook_created']) || ($contact['abook_updated'] === '0000-00-00 00:00:00')) ? datetime_convert('UTC','UTC','now - 7 days') : datetime_convert('UTC','UTC',$contact['abook_updated'] . ' - 2 days') ); @@ -98,17 +99,31 @@ function onepoll_run($argv, $argc){ return; if($contact['xchan_connurl']) { - $feedurl = str_replace('/poco/','/zotfeed/',$channel['xchan_connurl']); - $x = z_fetch_url($feedurl . '?f=&mindate=' . $last_update); - if($x['success']) { + $fetch_feed = true; + $x = null; + + if(! ($contact['abook_their_perms'] & PERMS_R_STREAM )) + $fetch_feed = false; + + if($fetch_feed) { + + $feedurl = str_replace('/poco/','/zotfeed/',$contact['xchan_connurl']); + $x = z_fetch_url($feedurl . '?f=&mindate=' . urlencode($last_update)); + + logger('feed_update: ' . print_r($x,true), LOGGER_DATA); + + } + + if(($x) && ($x['success'])) { $total = 0; logger('onepoll: feed update ' . $contact['xchan_name']); $j = json_decode($x['body'],true); if($j['success'] && $j['messages']) { foreach($j['messages'] as $message) { - $results = process_delivery(array('hash' => $contact['xchan_hash']),$message, + $results = process_delivery(array('hash' => $contact['xchan_hash']), get_item_elements($message), array(array('hash' => $importer['xchan_hash'])), false); + logger('onepoll: feed_update: process_delivery: ' . print_r($results,true)); $total ++; } logger("onepoll: $total messages processed"); diff --git a/include/photo/photo_driver.php b/include/photo/photo_driver.php index 38210ba26..8730b4298 100644 --- a/include/photo/photo_driver.php +++ b/include/photo/photo_driver.php @@ -473,19 +473,19 @@ abstract class photo_driver { * @arg $fromcurl boolean Check Content-Type header from curl request */ -function guess_image_type($filename, $fromcurl=false) { +function guess_image_type($filename, $headers = '') { logger('Photo: guess_image_type: '.$filename . ($fromcurl?' from curl headers':''), LOGGER_DEBUG); $type = null; - if ($fromcurl) { + if ($headers) { $a = get_app(); - $headers=array(); - $h = explode("\n",$a->get_curl_headers()); + $hdrs=array(); + $h = explode("\n",$headers); foreach ($h as $l) { list($k,$v) = array_map("trim", explode(":", trim($l), 2)); - $headers[$k] = $v; + $hdrs[$k] = $v; } - if (array_key_exists('Content-Type', $headers)) - $type = $headers['Content-Type']; + if (array_key_exists('Content-Type', $hdrs)) + $type = $hdrs['Content-Type']; } if (is_null($type)){ // FIXME!!!! @@ -576,9 +576,9 @@ function import_profile_photo($photo,$xchan) { $photo_failure = true; } if($photo_failure) { - $photo = $a->get_baseurl() . '/images/person-175.jpg'; - $thumb = $a->get_baseurl() . '/images/person-80.jpg'; - $micro = $a->get_baseurl() . '/images/person-48.jpg'; + $photo = $a->get_baseurl() . '/images/default_profile_photos/rainbow_man/175.jpg'; + $thumb = $a->get_baseurl() . '/images/default_profile_photos/rainbow_man/80.jpg'; + $micro = $a->get_baseurl() . '/images/default_profile_photos/rainbow_man/48.jpg'; $type = 'image/jpeg'; } diff --git a/include/photos.php b/include/photos.php index ea4b494e0..9828140b8 100644 --- a/include/photos.php +++ b/include/photos.php @@ -279,8 +279,16 @@ function photos_album_widget($channelx,$observer,$albums = null) { $o = ''; - if(! $albums) - $albums = photos_albums_list($channelx,$observer); + // If we weren't passed an album list, see if the photos module + // dropped one for us to find in $a->data['albums']. + // If all else fails, load it. + + if(! $albums) { + if(array_key_exists('albums', get_app()->data)) + $albums = get_app()->data['albums']; + else + $albums = photos_albums_list($channelx,$observer); + } if($albums) { $o = replace_macros(get_markup_template('photo_albums.tpl'),array( diff --git a/include/plugin.php b/include/plugin.php index ea88a61df..9982a48a2 100755 --- a/include/plugin.php +++ b/include/plugin.php @@ -181,12 +181,14 @@ function unregister_hook($hook,$file,$function) { // // It might not be obvious but themes can manually add hooks to the $a->hooks // array in their theme_init() and use this to customise the app behaviour. +// UPDATE: use insert_hook($hookname,$function_name) to do this // function load_hooks() { $a = get_app(); - $a->hooks = array(); +// if(! is_array($a->hooks)) + $a->hooks = array(); $r = q("SELECT * FROM hook WHERE true ORDER BY priority DESC"); if($r) { foreach($r as $rr) { @@ -195,8 +197,40 @@ function load_hooks() { $a->hooks[$rr['hook']][] = array($rr['file'],$rr['function']); } } +//logger('hooks: ' . print_r($a->hooks,true)); + } +/** + * + * @function insert_hook($hook,$fn) + * + * Insert a short-lived hook into the running page request. + * Hooks are normally persistent so that they can be called + * across asynchronous processes such as delivery and poll + * processes. + * + * insert_hook lets you attach a hook callback immediately + * which will not persist beyond the life of this page request + * or the current process. + * + * @param string $hook; + * name of hook to attach callback + * @param string $fn; + * function name of callback handler + * + */ + +function insert_hook($hook,$fn) { + $a = get_app(); + if(! is_array($a->hooks)) + $a->hooks = array(); + if(! array_key_exists($hook,$a->hooks)) + $a->hooks[$hook] = array(); + $a->hooks[$hook][] = array('',$fn); +} + + function call_hooks($name, &$data = null) { @@ -204,7 +238,8 @@ function call_hooks($name, &$data = null) { if((is_array($a->hooks)) && (array_key_exists($name,$a->hooks))) { foreach($a->hooks[$name] as $hook) { - @include_once($hook[0]); + if($hook[0]) + @include_once($hook[0]); if(function_exists($hook[1])) { $func = $hook[1]; $func($a,$data); @@ -298,10 +333,10 @@ function get_theme_info($theme){ 'name' => $theme, 'description' => "", 'author' => array(), - 'maintainer' => array(), 'version' => "", - 'credits' => "", 'compat' => "", + 'credits' => "", + 'maintainer' => array(), 'experimental' => false, 'unsupported' => false ); @@ -459,6 +494,15 @@ function head_add_css($src,$media = 'screen') { get_app()->css_sources[] = array($src,$media); } + +function head_remove_css($src,$media = 'screen') { + $a = get_app(); + $index = array_search(array($src,$media),$a->css_sources); + if($index !== false) + unset($a->css_sources[$index]); + +} + function head_get_css() { $str = ''; $sources = get_app()->css_sources; @@ -476,15 +520,44 @@ function format_css_if_exists($source) { $path = theme_include($source[0]); if($path) - return '<link rel="stylesheet" href="' . z_root() . '/' . $path . '" type="text/css" media="' . $source[1] . '" />' . "\r\n"; + return '<link rel="stylesheet" href="' . script_path() . '/' . $path . '" type="text/css" media="' . $source[1] . '" />' . "\r\n"; } +function script_path() { + if(x($_SERVER,'HTTPS') && $_SERVER['HTTPS']) + $scheme = 'https'; + elseif(x($_SERVER,'SERVER_PORT') && (intval($_SERVER['SERVER_PORT']) == 443)) + $scheme = 'https'; + else + $scheme = 'http'; + + if(x($_SERVER,'SERVER_NAME')) { + $hostname = $_SERVER['SERVER_NAME']; + } + else { + return z_root(); + } + + if(x($_SERVER,'SERVER_PORT') && $_SERVER['SERVER_PORT'] != 80 && $_SERVER['SERVER_PORT'] != 443) { + $hostname .= ':' . $_SERVER['SERVER_PORT']; + } + + return $scheme . '://' . $hostname; +} function head_add_js($src) { get_app()->js_sources[] = $src; } +function head_remove_js($src) { + $a = get_app(); + $index = array_search($src,$a->js_sources); + if($index !== false) + unset($a->js_sources[$index]); + +} + function head_get_js() { $str = ''; $sources = get_app()->js_sources; @@ -501,7 +574,7 @@ function format_js_if_exists($source) { else $path = theme_include($source); if($path) - return '<script src="' . z_root() . '/' . $path . '" ></script>' . "\r\n" ; + return '<script src="' . script_path() . '/' . $path . '" ></script>' . "\r\n" ; } diff --git a/include/poller.php b/include/poller.php index 3c4e6402c..0dcec4c0f 100644 --- a/include/poller.php +++ b/include/poller.php @@ -117,7 +117,10 @@ function poller_run($argv, $argc){ set_config('system','last_expire_day',$d2); + // Uncomment when expire protocol component is working +// Update - this is not going to happen. We are only going to +// implement per-item expire, not blanket expiration // proc_run('php','include/expire.php'); proc_run('php','include/cli_suggest.php'); diff --git a/include/profile_advanced.php b/include/profile_advanced.php deleted file mode 100644 index 21606185d..000000000 --- a/include/profile_advanced.php +++ /dev/null @@ -1,125 +0,0 @@ -<?php /** @file */ - -function advanced_profile(&$a) { - - $o = ''; - - $o .= '<h2>' . t('Profile') . '</h2>'; - - if($a->profile['name']) { - - $tpl = get_markup_template('profile_advanced.tpl'); - - $profile = array(); - - $profile['fullname'] = array( t('Full Name:'), $a->profile['name'] ) ; - - if($a->profile['gender']) $profile['gender'] = array( t('Gender:'), $a->profile['gender'] ); - - - if(($a->profile['dob']) && ($a->profile['dob'] != '0000-00-00')) { - - $year_bd_format = t('j F, Y'); - $short_bd_format = t('j F'); - - - $val = ((intval($a->profile['dob'])) - ? day_translate(datetime_convert('UTC','UTC',$a->profile['dob'] . ' 00:00 +00:00',$year_bd_format)) - : day_translate(datetime_convert('UTC','UTC','2001-' . substr($a->profile['dob'],5) . ' 00:00 +00:00',$short_bd_format))); - - $profile['birthday'] = array( t('Birthday:'), $val); - - } - - if($age = age($a->profile['dob'],$a->profile['timezone'],'')) $profile['age'] = array( t('Age:'), $age ); - - - if($a->profile['marital']) $profile['marital'] = array( t('Status:'), $a->profile['marital']); - - - if($a->profile['with']) $profile['marital']['with'] = $a->profile['with']; - - if(strlen($a->profile['howlong']) && $a->profile['howlong'] !== '0000-00-00 00:00:00') { - $profile['howlong'] = relative_date($a->profile['howlong'], t('for %1$d %2$s')); - } - - if($a->profile['sexual']) $profile['sexual'] = array( t('Sexual Preference:'), $a->profile['sexual'] ); - - if($a->profile['homepage']) $profile['homepage'] = array( t('Homepage:'), linkify($a->profile['homepage']) ); - - if($a->profile['hometown']) $profile['hometown'] = array( t('Hometown:'), linkify($a->profile['hometown']) ); - - if($a->profile['keywords']) $profile['keywords'] = array( t('Tags:'), $a->profile['keywords']); - - if($a->profile['politic']) $profile['politic'] = array( t('Political Views:'), $a->profile['politic']); - - if($a->profile['religion']) $profile['religion'] = array( t('Religion:'), $a->profile['religion']); - - if($txt = prepare_text($a->profile['about'])) $profile['about'] = array( t('About:'), $txt ); - - if($txt = prepare_text($a->profile['interest'])) $profile['interest'] = array( t('Hobbies/Interests:'), $txt); - - if($txt = prepare_text($a->profile['likes'])) $profile['likes'] = array( t('Likes:'), $txt); - - if($txt = prepare_text($a->profile['dislikes'])) $profile['dislikes'] = array( t('Dislikes:'), $txt); - - - if($txt = prepare_text($a->profile['contact'])) $profile['contact'] = array( t('Contact information and Social Networks:'), $txt); - - if($txt = prepare_text($a->profile['music'])) $profile['music'] = array( t('Musical interests:'), $txt); - - if($txt = prepare_text($a->profile['book'])) $profile['book'] = array( t('Books, literature:'), $txt); - - if($txt = prepare_text($a->profile['tv'])) $profile['tv'] = array( t('Television:'), $txt); - - if($txt = prepare_text($a->profile['film'])) $profile['film'] = array( t('Film/dance/culture/entertainment:'), $txt); - - if($txt = prepare_text($a->profile['romance'])) $profile['romance'] = array( t('Love/Romance:'), $txt); - - if($txt = prepare_text($a->profile['work'])) $profile['work'] = array( t('Work/employment:'), $txt); - - if($txt = prepare_text($a->profile['education'])) $profile['education'] = array( t('School/education:'), $txt ); - - $r = q("select * from obj left join term on obj_obj = term_hash where term_hash != '' and obj_page = '%s' and uid = %d and obj_type = %d - order by obj_verb, term", - dbesc($a->profile['profile_guid']), - intval($a->profile['profile_uid']), - intval(TERM_OBJ_THING) - ); - - $things = null; - - if($r) { - $things = array(); - - // Use the system obj_verbs array as a sort key, since we don't really - // want an alphabetic sort. To change the order, use a plugin to - // alter the obj_verbs() array or alter it in code. Unknown verbs come - // after the known ones - in no particular order. - - $v = obj_verbs(); - foreach($v as $k => $foo) - $things[$k] = null; - foreach($r as $rr) { - if(! $things[$rr['obj_verb']]) - $things[$rr['obj_verb']] = array(); - $things[$rr['obj_verb']][] = array('term' => $rr['term'],'url' => $rr['url'],'img' => $rr['imgurl']); - } - $sorted_things = array(); - if($things) - foreach($things as $k => $v) - if(is_array($things[$k])) - $sorted_things[$k] = $v; - } - - logger('mod_profile: things: ' . print_r($sorted_things,true), LOGGER_DATA); - - return replace_macros($tpl, array( - '$title' => t('Profile'), - '$profile' => $profile, - '$things' => $sorted_things - )); - } - - return ''; -} diff --git a/include/security.php b/include/security.php index 1181e6bf2..296fa450f 100644 --- a/include/security.php +++ b/include/security.php @@ -386,12 +386,12 @@ function check_form_security_token_ForbiddenOnErr($typename = '', $formname = 'f if(! function_exists('init_groups_visitor')) { function init_groups_visitor($contact_id) { $groups = array(); - $r = q("SELECT gid FROM group_member WHERE xchan = '%s' ", + $r = q("SELECT hash FROM `group` left join group_member on group.id = group_member.gid WHERE xchan = '%s' ", dbesc($contact_id) ); if(count($r)) { foreach($r as $rr) - $groups[] = $rr['gid']; + $groups[] = $rr['hash']; } return $groups; }} diff --git a/include/socgraph.php b/include/socgraph.php index b34d5142c..0e91eba60 100644 --- a/include/socgraph.php +++ b/include/socgraph.php @@ -287,11 +287,13 @@ function suggestion_query($uid, $myxchan, $start = 0, $limit = 80) { and not xlink_link in ( select xchan from xign where uid = %d ) and xlink_xchan != '' and not ( xchan_flags & %d ) + and not ( xchan_flags & %d ) group by xchan_hash order by total desc limit %d, %d ", intval($uid), intval($uid), intval($uid), intval(XCHAN_FLAGS_HIDDEN), + intval(XCHAN_FLAGS_DELETED), intval($start), intval($limit) ); @@ -305,10 +307,12 @@ function suggestion_query($uid, $myxchan, $start = 0, $limit = 80) { and not xlink_link in ( select abook_xchan from abook where abook_channel = %d ) and not xlink_link in ( select xchan from xign where uid = %d ) and not ( xchan_flags & %d ) + and not ( xchan_flags & %d ) group by xchan_hash order by total desc limit %d, %d ", intval($uid), intval($uid), intval(XCHAN_FLAGS_HIDDEN), + intval(XCHAN_FLAGS_DELETED), intval($start), intval($limit) ); diff --git a/include/taxonomy.php b/include/taxonomy.php index 5159dad02..65d082bb0 100644 --- a/include/taxonomy.php +++ b/include/taxonomy.php @@ -87,9 +87,9 @@ function format_term_for_display($term) { return $s; if($term['url']) - $s .= '<a href="' . $term['url'] . '">' . htmlspecialchars($term['term']) . '</a>'; + $s .= '<a href="' . $term['url'] . '">' . htmlspecialchars($term['term'], ENT_COMPAT,'UTF-8') . '</a>'; else - $s .= htmlspecialchars($term['term']); + $s .= htmlspecialchars($term['term'], ENT_COMPAT,'UTF-8'); return $s; } diff --git a/include/text.php b/include/text.php index fc70e3509..f808fb0a0 100755 --- a/include/text.php +++ b/include/text.php @@ -15,8 +15,11 @@ require_once("include/friendica_smarty.php"); function replace_macros($s,$r) { $a = get_app(); + $arr = array('template' => $s, 'params' => $r); + call_hooks('replace_macros', $arr); + $t = $a->template_engine(); - $output = $t->replace_macros($s,$r); + $output = $t->replace_macros($arr['template'],$arr['params']); return $output; } @@ -125,6 +128,9 @@ function purify_html($s) { } + + + // generate a string that's random, but usually pronounceable. // used to generate initial passwords @@ -728,13 +734,27 @@ function search($s,$id='search-box',$url='/search',$save = false) { $o .= '<form action="' . $a->get_baseurl((stristr($url,'network')) ? true : false) . $url . '" method="get" >'; $o .= '<input type="text" class="icon-search" name="search" id="search-text" placeholder="" value="' . $s .'" onclick="this.submit();" />'; $o .= '<input type="submit" name="submit" id="search-submit" value="' . t('Search') . '" />'; - if($save) + if(feature_enabled(local_user(),'savedsearch')) $o .= '<input type="submit" name="save" id="search-save" value="' . t('Save') . '" />'; $o .= '</form></div>'; return $o; } +function searchbox($s,$id='search-box',$url='/search',$save = false) { + $a = get_app(); + $o = '<div id="' . $id . '">'; + $o .= '<form action="' . z_root() . '/' . $url . '" method="get" >'; + $o .= '<input type="hidden" name="f" value="" />'; + $o .= '<input type="text" class="icon-search" name="search" id="search-text" placeholder="" value="' . $s .'" onclick="this.submit();" />'; + $o .= '<input type="submit" name="submit" id="search-submit" value="' . t('Search') . '" />'; + if(feature_enabled(local_user(),'savedsearch')) + $o .= '<input type="submit" name="searchsave" id="search-save" value="' . t('Save') . '" />'; + $o .= '</form></div>'; + return $o; +} + + function valid_email($x){ if(get_config('system','disable_email_validation')) @@ -878,9 +898,7 @@ function smilies($s, $sample = false) { ':like', ':dislike', 'red#', - 'r#', - '~friendica' - + 'r#' ); $icons = array( @@ -916,9 +934,9 @@ function smilies($s, $sample = false) { '<img class="smiley" src="' . $a->get_baseurl() . '/images/smiley-facepalm.gif" alt=":facepalm" />', '<img class="smiley" src="' . $a->get_baseurl() . '/images/like.gif" alt=":like" />', '<img class="smiley" src="' . $a->get_baseurl() . '/images/dislike.gif" alt=":dislike" />', - '<a href="http://getzot.com"><img class="smiley" src="' . $a->get_baseurl() . '/images/rhash-16.png" alt="red#" /> the Red Matrix</a>', - '<a href="http://getzot.com"><img class="smiley" src="' . $a->get_baseurl() . '/images/rhash-16.png" alt="r#" /> the Red Matrix</a>', - '<a href="http://friendica.com">~friendica <img class="smiley" src="' . $a->get_baseurl() . '/images/friendica-16.png" alt="~friendica" /></a>' + '<a href="http://getzot.com"><strong>red<img class="smiley" src="' . $a->get_baseurl() . '/images/rm-16.png" alt="red#" />matrix</strong></a>', + '<a href="http://getzot.com"><strong>red<img class="smiley" src="' . $a->get_baseurl() . '/images/rm-16.png" alt="r#" />matrix</strong></a>' + ); $params = array('texts' => $texts, 'icons' => $icons, 'string' => $s); @@ -1010,9 +1028,9 @@ function unobscure(&$item) { if(array_key_exists('item_flags',$item) && ($item['item_flags'] & ITEM_OBSCURED)) { $key = get_config('system','prvkey'); if($item['title']) - $item['title'] = aes_unencapsulate(json_decode_plus($item['title']),$key); + $item['title'] = crypto_unencapsulate(json_decode_plus($item['title']),$key); if($item['body']) - $item['body'] = aes_unencapsulate(json_decode_plus($item['body']),$key); + $item['body'] = crypto_unencapsulate(json_decode_plus($item['body']),$key); } } @@ -1047,7 +1065,7 @@ function theme_attachments(&$item) { break; } - $title = htmlentities($r['title'], ENT_COMPAT,'UTF-8'); + $title = htmlspecialchars($r['title'], ENT_COMPAT,'UTF-8'); if(! $title) $title = t('unknown.???'); $title .= ' ' . $r['length'] . ' ' . t('bytes'); @@ -1077,11 +1095,11 @@ function format_categories(&$item,$writeable) { if($terms) { $categories = array(); foreach($terms as $t) { - $term = htmlspecialchars($t['term'],ENT_COMPAT,'UTF-8') ; + $term = htmlspecialchars($t['term'],ENT_COMPAT,'UTF-8',false) ; if(! trim($term)) continue; $removelink = (($writeable) ? z_root() . '/filerm/' . $item['id'] . '?f=&cat=' . urlencode($t['term']) : ''); - $categories[] = array('term' => $term, 'writeable' => $writeable, 'removelink' => $removelink, 'url' => $t['url']); + $categories[] = array('term' => $term, 'writeable' => $writeable, 'removelink' => $removelink, 'url' => zid($t['url'])); } } $s = replace_macros(get_markup_template('item_categories.tpl'),array( @@ -1099,7 +1117,7 @@ function format_filer(&$item) { if($terms) { $categories = array(); foreach($terms as $t) { - $term = htmlspecialchars($t['term'],ENT_COMPAT,'UTF-8') ; + $term = htmlspecialchars($t['term'],ENT_COMPAT,'UTF-8',false) ; if(! trim($term)) continue; $removelink = z_root() . '/filerm/' . $item['id'] . '?f=&term=' . urlencode($t['term']); diff --git a/include/widgets.php b/include/widgets.php index 87941f40f..9d6617aa2 100644 --- a/include/widgets.php +++ b/include/widgets.php @@ -1,5 +1,18 @@ <?php /** @file */ +function list_widgets() { + $widgets = array( + 'profile' => t('Displays a full channel profile'), + 'tagcloud' => t('Tag cloud of webpage categories'), + 'collections' => t('List and filter by collection'), + 'suggestions' => t('Show a couple of channel suggestion'), + 'follow' => t('Provide a channel follow form') + ); + $arr = array('widgets' => $widgets); + call_hooks('list_widgets',$arr); + return $arr['widgets']; +} + function widget_profile($args) { $a = get_app(); @@ -32,3 +45,453 @@ function widget_tagcloud($args) { return $o; } +function widget_collections($args) { + require_once('include/group.php'); + $page = argv(0); + $gid = $_REQUEST['gid']; + + return group_side($page,$page,true,$_REQUEST['gid'],'',0); + +} + + +function widget_suggestions($arr) { + + if((! local_user()) || (! feature_enabled(local_user(),'suggest'))) + return ''; + + require_once('include/socgraph.php'); + + $r = suggestion_query(local_user(),get_observer_hash(),0,20); + + if(! $r) { + return; + } + + $arr = array(); + + // Get two random entries from the top 20 returned. + // We'll grab the first one and the one immediately following. + // This will throw some entropy intot he situation so you won't + // be looking at the same two mug shots every time the widget runs + + + $index = ((count($r) > 2) ? mt_rand(0,count($r) - 2) : 0); + + + for($x = $index; $x <= ($index+1); $x ++) { + + $rr = $r[$x]; + if(! $rr['xchan_url']) + break; + + $connlnk = z_root() . '/follow/?url=' . $rr['xchan_addr']; + + $arr[] = array( + 'url' => chanlink_url($rr['xchan_url']), + 'profile' => $rr['xchan_url'], + 'name' => $rr['xchan_name'], + 'photo' => $rr['xchan_photo_m'], + 'ignlnk' => z_root() . '/suggest?ignore=' . $rr['xchan_hash'], + 'conntxt' => t('Connect'), + 'connlnk' => $connlnk, + 'ignore' => t('Ignore/Hide') + ); + } + + + $o = replace_macros(get_markup_template('suggest_widget.tpl'),array( + '$title' => t('Suggestions'), + '$more' => t('See more...'), + '$entries' => $arr + )); + + return $o; + +} + + +function widget_follow($args) { + if(! local_user()) + return ''; + $a = get_app(); + $uid =$a->channel['channel_id']; + $r = q("select count(*) as total from abook where abook_channel = %d and not (abook_flags & %d) ", + intval($uid), + intval(ABOOK_FLAG_SELF) + ); + if($r) + $total_channels = $r[0]['total']; + $limit = service_class_fetch($uid,'total_channels'); + if($limit !== false) { + $abook_usage_message = sprintf( t("You have %1$.0f of %2$.0f allowed connections."), $total_channels, $limit); + } + else { + $abook_usage_message = ''; + } + return replace_macros(get_markup_template('follow.tpl'),array( + '$connect' => t('Add New Connection'), + '$desc' => t('Enter the channel address'), + '$hint' => t('Example: bob@example.com, http://example.com/barbara'), + '$follow' => t('Connect'), + '$abook_usage_message' => $abook_usage_message + )); + +} + + +function widget_notes($arr) { + if(! local_user()) + return ''; + if(! feature_enabled(local_user(),'private_notes')) + return ''; + + $text = get_pconfig(local_user(),'notes','text'); + + $o = replace_macros(get_markup_template('notes.tpl'), array( + '$banner' => t('Notes'), + '$text' => $text, + '$save' => t('Save'), + )); + return $o; +} + + +function widget_savedsearch($arr) { + if((! local_user()) || (! feature_enabled(local_user(),'savedsearch'))) + return ''; + + $a = get_app(); + + $search = ((x($_GET,'search')) ? $_GET['search'] : ''); + + if(x($_GET,'searchsave') && $search) { + $r = q("select * from `term` where `uid` = %d and `type` = %d and `term` = '%s' limit 1", + intval(local_user()), + intval(TERM_SAVEDSEARCH), + dbesc($search) + ); + if(! $r) { + q("insert into `term` ( `uid`,`type`,`term` ) values ( %d, %d, '%s') ", + intval(local_user()), + intval(TERM_SAVEDSEARCH), + dbesc($search) + ); + } + } + + if(x($_GET,'searchremove') && $search) { + q("delete from `term` where `uid` = %d and `type` = %d and `term` = '%s' limit 1", + intval(local_user()), + intval(TERM_SAVEDSEARCH), + dbesc($search) + ); + $search = ''; + } + + + + $srchurl = $a->query_string; + + $srchurl = rtrim(preg_replace('/searchsave\=[^\&].*?(\&|$)/is','',$srchurl),'&'); + $hasq = ((strpos($srchurl,'?') !== false) ? true : false); + $srchurl = rtrim(preg_replace('/searchremove\=[^\&].*?(\&|$)/is','',$srchurl),'&'); + $hasq = ((strpos($srchurl,'?') !== false) ? true : false); + + $srchurl = rtrim(preg_replace('/search\=[^\&].*?(\&|$)/is','',$srchurl),'&'); + $srchurl = str_replace(array('?f=','&f='),array('',''),$srchurl); + $hasq = ((strpos($srchurl,'?') !== false) ? true : false); + + $o = ''; + + $r = q("select `tid`,`term` from `term` WHERE `uid` = %d and `type` = %d ", + intval(local_user()), + intval(TERM_SAVEDSEARCH) + ); + + $saved = array(); + + if(count($r)) { + foreach($r as $rr) { + + $saved[] = array( + 'id' => $rr['tid'], + 'term' => $rr['term'], + 'dellink' => z_root() . '/' . $srchurl . (($hasq) ? '' : '?f=') . '&searchremove=1&search=' . urlencode($rr['term']), + 'srchlink' => z_root() . '/' . $srchurl . (($hasq) ? '' : '?f=') . '&search=' . urlencode($rr['term']), + 'displayterm' => htmlspecialchars($rr['term'], ENT_COMPAT,'UTF-8'), + 'encodedterm' => urlencode($rr['term']), + 'delete' => t('Remove term'), + 'selected' => ($search==$rr['term']), + ); + } + } + + + $tpl = get_markup_template("saved_searches.tpl"); + $o = replace_macros($tpl, array( + '$title' => t('Saved Searches'), + '$add' => t('add'), + '$searchbox' => searchbox('','netsearch-box',$srchurl . (($hasq) ? '' : '?f='),true), + '$saved' => $saved, + )); + + return $o; + +} + + +function widget_filer($arr) { + if(! local_user()) + return ''; + + $a = get_app(); + + $selected = ((x($_REQUEST,'file')) ? $_REQUEST['file'] : ''); + + $terms = array(); + $r = q("select distinct(term) from term where uid = %d and type = %d order by term asc", + intval(local_user()), + intval(TERM_FILE) + ); + if(! $r) + return; + + foreach($r as $rr) + $terms[] = array('name' => $rr['term'], 'selected' => (($selected == $rr['term']) ? 'selected' : '')); + + return replace_macros(get_markup_template('fileas_widget.tpl'),array( + '$title' => t('Saved Folders'), + '$desc' => '', + '$sel_all' => (($selected == '') ? 'selected' : ''), + '$all' => t('Everything'), + '$terms' => $terms, + '$base' => z_root() . '/' . $a->cmd + + )); +} + +function widget_archive($arr) { + + $o = ''; + $a = get_app(); + + if(! $a->profile_uid) { + return ''; + } + + $uid = $a->profile_uid; + + if(! feature_enabled($uid,'archives')) + return ''; + + + $wall = ((array_key_exists('wall', $arr)) ? intval($arr['wall']) : 0); + $url = z_root() . '/' . $a->cmd; + + + $ret = posted_dates($uid,$wall); + + if(! count($ret)) + return ''; + + $o = replace_macros(get_markup_template('posted_date_widget.tpl'),array( + '$title' => t('Archives'), + '$size' => ((count($ret) > 6) ? 6 : count($ret)), + '$url' => $url, + '$dates' => $ret + )); + return $o; +} + + +function widget_fullprofile($arr) { + $a = get_app(); + if(! $a->profile['profile_uid']) + return; + + $block = (((get_config('system','block_public')) && (! local_user()) && (! remote_user())) ? true : false); + + return profile_sidebar($a->profile, $block); +} + +function widget_categories($arr) { + $a = get_app(); + $cat = ((x($_REQUEST,'cat')) ? htmlspecialchars($_REQUEST['cat'],ENT_COMPAT,'UTF-8') : ''); + $srchurl = $a->query_string; + $srchurl = rtrim(preg_replace('/cat\=[^\&].*?(\&|$)/is','',$srchurl),'&'); + $srchurl = str_replace(array('?f=','&f='),array('',''),$srchurl); + return categories_widget($srchurl,$cat); + +} + +function widget_tagcloud_wall($arr) { + $a = get_app(); + if((! $a->profile['profile_uid']) || (! $a->profile['channel_hash'])) + return ''; + $limit = ((array_key_exists('limit',$arr)) ? intval($arr['limit']) : 50); + if(feature_enabled($a->profile['profile_uid'],'tagadelic')) + return tagblock('search',$a->profile['profile_uid'],$limit,$a->profile['channel_hash'],ITEM_WALL); + return ''; +} + + +function widget_affinity($arr) { + + if(! local_user()) + return ''; + + $cmin = ((x($_REQUEST,'cmin')) ? intval($_REQUEST['cmin']) : 0); + $cmax = ((x($_REQUEST,'cmax')) ? intval($_REQUEST['cmax']) : 99); + + if(feature_enabled(local_user(),'affinity')) { + $tpl = get_markup_template('main_slider.tpl'); + $x = replace_macros($tpl,array( + '$val' => $cmin . ';' . $cmax, + '$refresh' => t('Refresh'), + '$me' => t('Me'), + '$intimate' => t('Best Friends'), + '$friends' => t('Friends'), + '$coworkers' => t('Co-workers'), + '$oldfriends' => t('Former Friends'), + '$acquaintances' => t('Acquaintances'), + '$world' => t('Everybody') + )); + $arr = array('html' => $x); + call_hooks('main_slider',$arr); + return $arr['html']; + } + return ''; +} + + +function widget_settings_menu($arr) { + + if(! local_user()) + return; + + $a = get_app(); + $channel = $a->get_channel(); + + $abook_self_id = 0; + + // Retrieve the 'self' address book entry for use in the auto-permissions link + + $abk = q("select abook_id from abook where abook_channel = %d and ( abook_flags & %d ) limit 1", + intval(local_user()), + intval(ABOOK_FLAG_SELF) + ); + if($abk) + $abook_self_id = $abk[0]['abook_id']; + + + $tabs = array( + array( + 'label' => t('Account settings'), + 'url' => $a->get_baseurl(true).'/settings/account', + 'selected' => ((argv(1) === 'account') ? 'active' : ''), + ), + + array( + 'label' => t('Channel settings'), + 'url' => $a->get_baseurl(true).'/settings/channel', + 'selected' => ((argv(1) === 'channel') ? 'active' : ''), + ), + + array( + 'label' => t('Additional features'), + 'url' => $a->get_baseurl(true).'/settings/features', + 'selected' => ((argv(1) === 'features') ? 'active' : ''), + ), + + array( + 'label' => t('Feature settings'), + 'url' => $a->get_baseurl(true).'/settings/featured', + 'selected' => ((argv(1) === 'featured') ? 'active' : ''), + ), + + array( + 'label' => t('Display settings'), + 'url' => $a->get_baseurl(true).'/settings/display', + 'selected' => ((argv(1) === 'display') ? 'active' : ''), + ), + + array( + 'label' => t('Connected apps'), + 'url' => $a->get_baseurl(true) . '/settings/oauth', + 'selected' => ((argv(1) === 'oauth') ? 'active' : ''), + ), + + array( + 'label' => t('Export channel'), + 'url' => $a->get_baseurl(true) . '/uexport/basic', + 'selected' => '' + ), + +// array( +// 'label' => t('Export account'), +// 'url' => $a->get_baseurl(true) . '/uexport/complete', +// 'selected' => '' +// ), + + array( + 'label' => t('Automatic Permissions (Advanced)'), + 'url' => $a->get_baseurl(true) . '/connedit/' . $abook_self_id, + 'selected' => '' + ), + + + ); + + if(feature_enabled(local_user(),'premium_channel')) { + $tabs[] = array( + 'label' => t('Premium Channel Settings'), + 'url' => $a->get_baseurl(true) . '/connect/' . $channel['channel_address'], + 'selected' => '' + ); + + } + + if(feature_enabled(local_user(),'channel_sources')) { + $tabs[] = array( + 'label' => t('Channel Sources'), + 'url' => $a->get_baseurl(true) . '/sources', + 'selected' => '' + ); + + } + + + + $tabtpl = get_markup_template("generic_links_widget.tpl"); + return replace_macros($tabtpl, array( + '$title' => t('Settings'), + '$class' => 'settings-widget', + '$items' => $tabs, + )); + +} + + +function widget_mailmenu($arr) { + if (! local_user()) + return; + + $a = get_app(); + return replace_macros(get_markup_template('message_side.tpl'), array( + '$tabs'=> array(), + + '$check'=>array( + 'label' => t('Check Mail'), + 'url' => $a->get_baseurl(true) . '/message', + 'sel' => (argv(1) == ''), + ), + '$new'=>array( + 'label' => t('New Message'), + 'url' => $a->get_baseurl(true) . '/message/new', + 'sel'=> (argv(1) == 'new'), + ) + + )); + +}
\ No newline at end of file diff --git a/include/zot.php b/include/zot.php index 09a3c28fa..b0d87cea9 100644 --- a/include/zot.php +++ b/include/zot.php @@ -4,9 +4,26 @@ require_once('include/crypto.php'); require_once('include/items.php'); /** + * Red implementation of zot protocol. + * + * https://github.com/friendica/red/wiki/zot + * https://github.com/friendica/red/wiki/Zot---A-High-Level-Overview + * + */ + + +/** * * @function zot_new_uid($channel_nick) - * @channel_id = unique nickname of controlling entity + * + * Generates a unique string for use as a zot guid using our DNS-based url, the channel nickname and some entropy. + * The entropy ensures uniqueness against re-installs where the same URL and nickname are chosen. + * NOTE: zot doesn't require this to be unique. Internally we use a whirlpool hash of this guid and the signature + * of this guid signed with the channel private key. This can be verified and should make the probability of + * collision of the verified result negligible within the constraints of our immediate universe. + * + * @param string channel_nickname = unique nickname of controlling entity + * * @returns string * */ @@ -18,41 +35,58 @@ function zot_new_uid($channel_nick) { /** - * - * Given an array of zot hashes, return all distinct hubs - * If primary is true, return only primary hubs - * Result is ordered by url to assist in batching. - * Return only the first primary hub as there should only be one. + * @function zot_get_hublocs($hash) + * Given a zot hash, return all distinct hubs. + * This function is used in building the zot discovery packet + * and therefore should only be used by channels which are defined + * on this hub + * @param string $hash - xchan_hash + * @retuns array of hubloc (hub location structures) + * hubloc_id int + * hubloc_guid char(255) + * hubloc_guid_sig text + * hubloc_hash char(255) + * hubloc_addr char(255) + * hubloc_flags int + * hubloc_status int + * hubloc_url char(255) + * hubloc_url_sig text + * hubloc_host char(255) + * hubloc_callback char(255) + * hubloc_connect char(255) + * hubloc_sitekey text + * hubloc_updated datetime + * hubloc_connected datetime * */ -function zot_get_hubloc($arr,$primary = false) { +function zot_get_hublocs($hash) { - $tmp = ''; - - if(is_array($arr)) { - foreach($arr as $e) { - if(strlen($tmp)) - $tmp .= ','; - $tmp .= "'" . dbesc($e) . "'" ; - } - } - - if(! strlen($tmp)) - return array(); - - $sql_extra = (($primary) ? " and hubloc_flags & " . intval(HUBLOC_FLAGS_PRIMARY) : "" ); - $limit = (($primary) ? " limit 1 " : ""); - return q("select * from hubloc where hubloc_hash in ( $tmp ) $sql_extra order by hubloc_url $limit"); + /** Only search for active hublocs - e.g. those that haven't been marked deleted */ + $ret = q("select * from hubloc where hubloc_hash = '%s' and not ( hubloc_flags & %d ) group by hubloc_url ", + dbesc($hash), + intval(HUBLOC_FLAGS_DELETED) + ); + return $ret; } -/* +/** + * + * @function zot_build_packet($channel,$type = 'notify',$recipients = null, $remote_key = null, $secret = null) + * builds a zot notification packet that you can either + * store in the queue with a message array or call zot_zot to immediately + * zot it to the other side * - * zot_build_packet builds a notification packet that you can either - * store in the queue with a message array or call zot_zot to immediately - * zot it to the other side + * @param array $channel => sender channel structure + * @param string $type => packet type: one of 'ping', 'pickup', 'purge', 'refresh', 'notify', 'auth_check' + * @param array $recipients => envelope information, array ( 'guid' => string, 'guid_sig' => string ); empty for public posts + * @param string $remote_key => optional public site key of target hub used to encrypt entire packet + * NOTE: remote_key and encrypted packets are required for 'auth_check' packets, optional for all others + * @param string $secret => random string, required for packets which require verification/callback + * e.g. 'pickup', 'purge', 'notify', 'auth_check' --- 'ping' and 'refresh' do not require verification * + * @returns string json encoded zot packet */ function zot_build_packet($channel,$type = 'notify',$recipients = null, $remote_key = null, $secret = null) { @@ -82,7 +116,7 @@ function zot_build_packet($channel,$type = 'notify',$recipients = null, $remote_ // Hush-hush ultra top-secret mode if($remote_key) { - $data = aes_encapsulate(json_encode($data),$remote_key); + $data = crypto_encapsulate(json_encode($data),$remote_key); } return json_encode($data); @@ -194,12 +228,27 @@ function zot_finger($webbie,$channel,$autofallback = true) { } /** - * @function: zot_refresh + * @function: zot_refresh($them, $channel = null) * - * zot_refresh is typically invoked when somebody has changed permissions of a channel and they are notified - * to fetch new permissions via a finger operation. This may result in a new connection (abook entry) being added to a local channel - * and it may result in auto-permissions being granted. + * zot_refresh is typically invoked when somebody has changed permissions of a channel and they are notified + * to fetch new permissions via a finger/discovery operation. This may result in a new connection + * (abook entry) being added to a local channel and it may result in auto-permissions being granted. + * + * Friending in zot is accomplished by sending a refresh packet to a specific channel which indicates a + * permission change has been made by the sender which affects the target channel. The hub controlling + * the target channel does targetted discovery (a zot-finger request requesting permissions for the local + * channel). These are decoded here, and if necessary and abook structure (addressbook) is created to store + * the permissions assigned to this channel. + * + * Initially these abook structures are created with a 'pending' flag, so that no reverse permissions are + * implied until this is approved by the owner channel. A channel can also auto-populate permissions in + * return and send back a refresh packet of its own. This is used by forum and group communication channels + * so that friending and membership in the channel's "club" is automatic. + * + * @param array $them => xchan structure of sender + * @param array $channel => local channel structure of target recipient, required for "friending" operations * + * @returns boolean true if successful, else false */ function zot_refresh($them,$channel = null) { @@ -269,7 +318,7 @@ function zot_refresh($them,$channel = null) { if($channel) { $global_perms = get_perms(); if($j['permissions']['data']) { - $permissions = aes_unencapsulate(array( + $permissions = crypto_unencapsulate(array( 'data' => $j['permissions']['data'], 'key' => $j['permissions']['key'], 'iv' => $j['permissions']['iv']), @@ -306,6 +355,11 @@ function zot_refresh($them,$channel = null) { ); if(! $y) logger('abook update failed'); + else { + // if we were just granted read stream permission and didn't have it before, try to pull in some posts + if((! ($r[0]['abook_their_perms'] & PERMS_R_STREAM)) && ($their_perms & PERMS_R_STREAM)) + proc_run('php','include/onepoll.php',$r[0]['abook_id']); + } } else { $default_perms = 0; @@ -330,7 +384,6 @@ function zot_refresh($them,$channel = null) { ); if($y) { - logger("New introduction received for {$channel['channel_name']}"); if($default_perms) { // send back a permissions update for auto-friend/auto-permissions @@ -342,6 +395,14 @@ function zot_refresh($them,$channel = null) { if($z) proc_run('php','include/notifier.php','permission_update',$z[0]['abook_id']); } + $new_connection = q("select abook_id, abook_flags from abook where abook_channel = %d and abook_xchan = '%s' order by abook_created desc limit 1", + intval($channel['channel_id']), + dbesc($x['hash']) + ); + + if($new_connection && (! ($new_connection[0]['abook_flags'] & ABOOK_FLAG_PENDING)) && ($their_perms & PERMS_R_STREAM)) + proc_run('php','include/onepoll.php',$new_connection[0]['abook_id']); + } } } @@ -354,7 +415,17 @@ function zot_refresh($them,$channel = null) { * @function: zot_gethub * * A guid and a url, both signed by the sender, distinguish a known sender at a known location - * This function looks these up to see if the channel is known. If not, we will need to verify it. + * This function looks these up to see if the channel is known and therefore previously verified. + * If not, we will need to verify it. + * + * @param array $arr + * $arr must contain: + * string $arr['guid'] => guid of conversant + * string $arr['guid_sig'] => guid signed with conversant's private key + * string $arr['url'] => URL of the origination hub of this communication + * string $arr['url_sig'] => URL signed with conversant's private key + * + * * @returns: array => hubloc record */ @@ -381,6 +452,27 @@ function zot_gethub($arr) { return null; } +/** + * @function zot_register_hub($arr) + * + * A communication has been received which has an unknown (to us) sender. + * Perform discovery based on our calculated hash of the sender at the origination address. + * This will fetch the discovery packet of the sender, which contains the public key we + * need to verify our guid and url signatures. + * + * @param array $arr + * $arr must contain: + * string $arr['guid'] => guid of conversant + * string $arr['guid_sig'] => guid signed with conversant's private key + * string $arr['url'] => URL of the origination hub of this communication + * string $arr['url_sig'] => URL signed with conversant's private key + * + * + * @returns array => 'success' (boolean true or false) + * 'message' (optional error string only if success is false) + */ + + function zot_register_hub($arr) { $result = array('success' => false); @@ -399,22 +491,49 @@ function zot_register_hub($arr) { if($x['success']) { $record = json_decode($x['body'],true); - $c = import_xchan($record); - if($c['success']) - $result['success'] = true; + + /* + * We now have a key - only continue registration if our signatures are valid + * AND the guid and guid sig in the returned packet match those provided in + * our current communication. + */ + + if((rsa_verify($arr['guid'],base64url_decode($arr['guid_sig']),$record['key'])) + && (rsa_verify($arr['url'],base64url_decode($arr['url_sig']),$record['key'])) + && ($arr['guid'] === $record['guid']) + && ($arr['guid_sig'] === $record['guid_sig'])) { + + $c = import_xchan($record); + if($c['success']) + $result['success'] = true; + } + else { + logger('zot_register_hub: failure to verify returned packet.'); + } } } return $result; } - -// Takes a json associative array from zot_finger and imports the xchan and hublocs -// If the xchan already exists, update the name and photo if these have changed. -// +/** + * @function import_xchan($arr,$ud_flags = 1) + * Takes an associative array of a fecthed discovery packet and updates + * all internal data structures which need to be updated as a result. + * + * @param array $arr => json_decoded discovery packet + * @param int $ud_flags + * Determines whether to create a directory update record if any changes occur, default 1 or true + * + * @returns array => 'success' (boolean true or false) + * 'message' (optional error string only if success is false) + */ function import_xchan($arr,$ud_flags = 1) { + + call_hooks('import_xchan', $arr); + $ret = array('success' => false); $dirmode = intval(get_config('system','directory_mode')); @@ -437,7 +556,6 @@ function import_xchan($arr,$ud_flags = 1) { return $ret; } - logger('import_xchan: ' . $xchan_hash, LOGGER_DEBUG); $r = q("select * from xchan where xchan_hash = '%s' limit 1", @@ -552,19 +670,41 @@ function import_xchan($arr,$ud_flags = 1) { require_once('include/photo/photo_driver.php'); - $photos = import_profile_photo($arr['photo'],$xchan_hash); - $r = q("update xchan set xchan_photo_date = '%s', xchan_photo_l = '%s', xchan_photo_m = '%s', xchan_photo_s = '%s', xchan_photo_mimetype = '%s' + // see if this is a channel clone that's hosted locally - which we treat different from other xchans/connections + + $local = q("select channel_account_id, channel_id from channel where channel_hash = '%s' limit 1", + dbesc($xchan_hash) + ); + if($local) { + $ph = z_fetch_url($arr['photo'],true); + if($ph['success']) { + import_channel_photo($ph['body'], $arr['photo_mimetype'], $local[0]['channel_account_id'],$local[0]['channel_id']); + // reset the names in case they got messed up when we had a bug in this function + $photos = array( + z_root() . '/photo/profile/l/' . $local[0]['channel_id'], + z_root() . '/photo/profile/m/' . $local[0]['channel_id'], + z_root() . '/photo/profile/s/' . $local[0]['channel_id'], + $arr['photo_mimetype'] + ); + } + } + else { + $photos = import_profile_photo($arr['photo'],$xchan_hash); + } + if($photos) { + $r = q("update xchan set xchan_photo_date = '%s', xchan_photo_l = '%s', xchan_photo_m = '%s', xchan_photo_s = '%s', xchan_photo_mimetype = '%s' where xchan_hash = '%s' limit 1", - dbesc($arr['photo_updated']), + dbesc(datetime_convert('UTC','UTC',$arr['photo_updated'])), dbesc($photos[0]), dbesc($photos[1]), dbesc($photos[2]), dbesc($photos[3]), dbesc($xchan_hash) - ); + ); - $what .= 'photo '; - $changed = true; + $what .= 'photo '; + $changed = true; + } } // what we are missing for true hub independence is for any changes in the primary hub to @@ -572,10 +712,20 @@ function import_xchan($arr,$ud_flags = 1) { if($arr['locations']) { - $xisting = q("select hubloc_id, hubloc_url from hubloc where hubloc_hash = '%s'", + $xisting = q("select hubloc_id, hubloc_url, hubloc_sitekey from hubloc where hubloc_hash = '%s'", dbesc($xchan_hash) ); + // See if a primary is specified + + $has_primary = false; + foreach($arr['locations'] as $location) { + if($location['primary']) { + $has_primary = true; + break; + } + } + foreach($arr['locations'] as $location) { if(! rsa_verify($location['url'],base64url_decode($location['url_sig']),$arr['key'])) { logger('import_xchan: Unable to verify site signature for ' . $location['url']); @@ -583,15 +733,21 @@ function import_xchan($arr,$ud_flags = 1) { continue; } + // Ensure that they have one primary hub + + if(! $has_primary) + $location['primary'] = true; + + for($x = 0; $x < count($xisting); $x ++) { - if($xisting[$x]['hubloc_url'] == $location['url']) { + if(($xisting[$x]['hubloc_url'] === $location['url']) && ($xisting[$x]['hubloc_sitekey'] === $location['sitekey'])) { $xisting[$x]['updated'] = true; } } // match as many fields as possible in case anything at all changed. - $r = q("select * from hubloc where hubloc_hash = '%s' and hubloc_guid = '%s' and hubloc_guid_sig = '%s' and hubloc_url = '%s' and hubloc_url_sig = '%s' and hubloc_host = '%s' and hubloc_addr = '%s' and hubloc_callback = '%s' and hubloc_sitekey = '%s' limit 1", + $r = q("select * from hubloc where hubloc_hash = '%s' and hubloc_guid = '%s' and hubloc_guid_sig = '%s' and hubloc_url = '%s' and hubloc_url_sig = '%s' and hubloc_host = '%s' and hubloc_addr = '%s' and hubloc_callback = '%s' and hubloc_sitekey = '%s' ", dbesc($xchan_hash), dbesc($arr['guid']), dbesc($arr['guid_sig']), @@ -612,6 +768,16 @@ function import_xchan($arr,$ud_flags = 1) { intval($r[0]['hubloc_id']) ); } + + // Remove pure duplicates + if(count($r) > 1) { + for($h = 1; $h < count($r); $h ++) { + q("delete from hubloc where hubloc_id = %d limit 1", + intval($r[$h]['hubloc_id']) + ); + } + } + if((($r[0]['hubloc_flags'] & HUBLOC_FLAGS_PRIMARY) && (! $location['primary'])) || ((! ($r[0]['hubloc_flags'] & HUBLOC_FLAGS_PRIMARY)) && ($location['primary']))) { $r = q("update hubloc set hubloc_flags = (hubloc_flags ^ %d), hubloc_updated = '%s' where hubloc_id = %d limit 1", @@ -719,8 +885,6 @@ function import_xchan($arr,$ud_flags = 1) { } } - - if($changed) { $guid = random_string() . '@' . get_app()->get_hostname(); update_modtime($xchan_hash,$guid,$arr['address'],$ud_flags); @@ -744,6 +908,20 @@ function import_xchan($arr,$ud_flags = 1) { return $ret; } +/** + * @function zot_process_response($hub,$arr,$outq) { + * Called immediately after sending a zot message which is using queue processing + * Updates the queue item according to the response result and logs any information + * returned to aid communications troubleshooting. + * + * @param string $hub - url of site we just contacted + * @param array $arr - output of z_post_url() + * @param array $outq - The queue structure attached to this request + * + * @returns nothing + */ + + function zot_process_response($hub,$arr,$outq) { if(! $arr['success']) { @@ -779,14 +957,16 @@ function zot_process_response($hub,$arr,$outq) { } /** - * @function: zot_fetch + * @function zot_fetch($arr) * - * We received a notification packet (in mod/post.php) that a message is waiting for us, and we've verified the sender. - * Now send back a pickup message, using our message tracking ID ($arr['secret']), which we will sign. - * The entire pickup message is encrypted with the remote site's public key. - * If everything checks out on the remote end, we will receive back a packet containing one or more messages, - * which will be processed before returning. - * + * We received a notification packet (in mod/post.php) that a message is waiting for us, and we've verified the sender. + * Now send back a pickup message, using our message tracking ID ($arr['secret']), which we will sign with our site private key. + * The entire pickup message is encrypted with the remote site's public key. + * If everything checks out on the remote end, we will receive back a packet containing one or more messages, + * which will be processed and delivered before this function ultimately returns. + * + * @param array $arr + * decrypted and json decoded notify packet from remote site */ @@ -811,7 +991,7 @@ function zot_fetch($arr) { 'secret_sig' => base64url_encode(rsa_sign($arr['secret'],get_config('system','prvkey'))) ); - $datatosend = json_encode(aes_encapsulate(json_encode($data),$ret_hub['hubloc_sitekey'])); + $datatosend = json_encode(crypto_encapsulate(json_encode($data),$ret_hub['hubloc_sitekey'])); $fetch = zot_zot($url,$datatosend); $result = zot_import($fetch, $arr['sender']['url']); @@ -824,7 +1004,16 @@ function zot_fetch($arr) { * Process an incoming array of messages which were obtained via pickup, and * import, update, delete as directed. * - * The message types handled here are 'activity' (e.g. posts), 'mail' and 'profile' + * @param array $arr => 'pickup' structure returned from remote site + * @param string $sender_url => the url specified by the sender in the initial communication + * we will verify the sender and url in each returned message structure and also verify + * that all the messages returned match the site url that we are currently processing. + * + * The message types handled here are 'activity' (e.g. posts), 'mail' , 'profile', and 'channel_sync' + * + * @returns array => array ( [0] => string $channel_hash, [1] => string $delivery_status, [2] => string $address ) + * suitable for logging remotely, enumerating the processing results of each message/recipient combination. + * */ function zot_import($arr, $sender_url) { @@ -837,7 +1026,7 @@ function zot_import($arr, $sender_url) { } if(array_key_exists('iv',$data)) { - $data = json_decode(aes_unencapsulate($data,get_config('system','prvkey')),true); + $data = json_decode(crypto_unencapsulate($data,get_config('system','prvkey')),true); } $incoming = $data['pickup']; @@ -849,7 +1038,7 @@ function zot_import($arr, $sender_url) { $result = null; if(array_key_exists('iv',$i['notify'])) { - $i['notify'] = json_decode(aes_unencapsulate($i['notify'],get_config('system','prvkey')),true); + $i['notify'] = json_decode(crypto_unencapsulate($i['notify'],get_config('system','prvkey')),true); } logger('zot_import: notify: ' . print_r($i['notify'],true), LOGGER_DATA); @@ -898,11 +1087,29 @@ function zot_import($arr, $sender_url) { $deliveries = allowed_public_recips($i); } + + // Go through the hash array and remove duplicates. array_unique() won't do this because the array is more than one level. + + $no_dups = array(); + if($deliveries) { + foreach($deliveries as $d) { + if(! in_array($d['hash'],$no_dups)) + $no_dups[] = $d['hash']; + } + + if($no_dups) { + $deliveries = array(); + foreach($no_dups as $n) { + $deliveries[] = array('hash' => $n); + } + } + } + if(! $deliveries) { logger('zot_import: no deliveries on this site'); continue; } - + if($i['message']) { if($i['message']['type'] === 'activity') { $arr = get_item_elements($i['message']); @@ -1426,22 +1633,22 @@ function import_directory_profile($hash,$profile,$addr,$ud_flags = 1, $suppress_ $arr = array(); $arr['xprof_hash'] = $hash; - $arr['xprof_desc'] = (($profile['description']) ? htmlentities($profile['description'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['xprof_desc'] = (($profile['description']) ? htmlspecialchars($profile['description'], ENT_COMPAT,'UTF-8',false) : ''); $arr['xprof_dob'] = datetime_convert('','',$profile['birthday'],'Y-m-d'); // !!!! check this for 0000 year $arr['xprof_age'] = (($profile['age']) ? intval($profile['age']) : 0); - $arr['xprof_gender'] = (($profile['gender']) ? htmlentities($profile['gender'], ENT_COMPAT,'UTF-8',false) : ''); - $arr['xprof_marital'] = (($profile['marital']) ? htmlentities($profile['marital'], ENT_COMPAT,'UTF-8',false) : ''); - $arr['xprof_sexual'] = (($profile['sexual']) ? htmlentities($profile['sexual'], ENT_COMPAT,'UTF-8',false) : ''); - $arr['xprof_locale'] = (($profile['locale']) ? htmlentities($profile['locale'], ENT_COMPAT,'UTF-8',false) : ''); - $arr['xprof_region'] = (($profile['region']) ? htmlentities($profile['region'], ENT_COMPAT,'UTF-8',false) : ''); - $arr['xprof_postcode'] = (($profile['postcode']) ? htmlentities($profile['postcode'], ENT_COMPAT,'UTF-8',false) : ''); - $arr['xprof_country'] = (($profile['country']) ? htmlentities($profile['country'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['xprof_gender'] = (($profile['gender']) ? htmlspecialchars($profile['gender'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['xprof_marital'] = (($profile['marital']) ? htmlspecialchars($profile['marital'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['xprof_sexual'] = (($profile['sexual']) ? htmlspecialchars($profile['sexual'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['xprof_locale'] = (($profile['locale']) ? htmlspecialchars($profile['locale'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['xprof_region'] = (($profile['region']) ? htmlspecialchars($profile['region'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['xprof_postcode'] = (($profile['postcode']) ? htmlspecialchars($profile['postcode'], ENT_COMPAT,'UTF-8',false) : ''); + $arr['xprof_country'] = (($profile['country']) ? htmlspecialchars($profile['country'], ENT_COMPAT,'UTF-8',false) : ''); $clean = array(); if(array_key_exists('keywords',$profile) and is_array($profile['keywords'])) { import_directory_keywords($hash,$profile['keywords']); foreach($profile['keywords'] as $kw) { - $kw = trim(htmlentities($kw,ENT_COMPAT,'UTF-8',false)); + $kw = trim(htmlspecialchars($kw,ENT_COMPAT,'UTF-8',false)); $kw = trim($kw,','); $clean[] = $kw; } @@ -1543,7 +1750,7 @@ function import_directory_keywords($hash,$keywords) { $clean = array(); foreach($keywords as $kw) { - $kw = trim(htmlentities($kw,ENT_COMPAT,'UTF-8',false)); + $kw = trim(htmlspecialchars($kw,ENT_COMPAT,'UTF-8',false)); $kw = trim($kw,','); $clean[] = $kw; } @@ -1642,10 +1849,10 @@ function import_site($arr,$pubkey) { $access_policy = ACCESS_TIERED; } - $directory_url = htmlentities($arr['directory_url'],ENT_COMPAT,'UTF-8',false); - $url = htmlentities($arr['url'],ENT_COMPAT,'UTF-8',false); - $sellpage = htmlentities($arr['sellpage'],ENT_COMPAT,'UTF-8',false); - $site_location = htmlentities($arr['location'],ENT_COMPAT,'UTF-8',false); + $directory_url = htmlspecialchars($arr['directory_url'],ENT_COMPAT,'UTF-8',false); + $url = htmlspecialchars($arr['url'],ENT_COMPAT,'UTF-8',false); + $sellpage = htmlspecialchars($arr['sellpage'],ENT_COMPAT,'UTF-8',false); + $site_location = htmlspecialchars($arr['location'],ENT_COMPAT,'UTF-8',false); if($exists) { if(($siterecord['site_flags'] != $site_directory) @@ -1916,3 +2123,24 @@ function get_rpost_path($observer) { } +function import_author_zot($x) { + $hash = base64url_encode(hash('whirlpool',$x['guid'] . $x['guid_sig'], true)); + $r = q("select hubloc_url from hubloc where hubloc_guid = '%s' and hubloc_guid_sig = '%s' and (hubloc_flags & %d) limit 1", + dbesc($x['guid']), + dbesc($x['guid_sig']), + intval(HUBLOC_FLAGS_PRIMARY) + ); + + if($r) { + logger('import_author_zot: in cache', LOGGER_DEBUG); + return $hash; + } + + logger('import_author_zot: entry not in cache - probing: ' . print_r($x,true), LOGGER_DEBUG); + + $them = array('hubloc_url' => $x['url'],'xchan_guid' => $x['guid'], 'xchan_guid_sig' => $x['guid_sig']); + if(zot_refresh($them)) + return $hash; + return false; +} + |