diff options
Diffstat (limited to 'mod')
| -rw-r--r-- | mod/admin.php | 24 | ||||
| -rw-r--r-- | mod/api.php | 22 | ||||
| -rw-r--r-- | mod/cloud.php | 42 | ||||
| -rw-r--r-- | mod/dirsearch.php | 4 | ||||
| -rwxr-xr-x | mod/events.php | 43 | ||||
| -rw-r--r-- | mod/fbrowser.php | 9 | ||||
| -rw-r--r-- | mod/feed.php | 1 | ||||
| -rw-r--r-- | mod/help.php | 4 | ||||
| -rw-r--r-- | mod/home.php | 2 | ||||
| -rw-r--r-- | mod/invite.php | 34 | ||||
| -rw-r--r-- | mod/item.php | 1 | ||||
| -rw-r--r-- | mod/mail.php | 11 | ||||
| -rw-r--r-- | mod/photos.php | 11 | ||||
| -rw-r--r-- | mod/post.php | 944 | ||||
| -rw-r--r-- | mod/register.php | 4 | ||||
| -rwxr-xr-x | mod/setup.php | 2 | ||||
| -rw-r--r-- | mod/siteinfo.php | 102 | ||||
| -rw-r--r-- | mod/siteinfo_json.php | 8 | ||||
| -rwxr-xr-x | mod/subthread.php | 1 | ||||
| -rw-r--r-- | mod/update_channel.php | 2 | ||||
| -rw-r--r-- | mod/update_display.php | 4 | ||||
| -rw-r--r-- | mod/update_home.php | 4 | ||||
| -rw-r--r-- | mod/update_network.php | 4 | ||||
| -rw-r--r-- | mod/update_public.php | 4 | ||||
| -rw-r--r-- | mod/update_search.php | 4 | ||||
| -rw-r--r-- | mod/wall_attach.php | 28 |
26 files changed, 154 insertions, 1165 deletions
diff --git a/mod/admin.php b/mod/admin.php index 4b7cb3cd9..85ab3627c 100644 --- a/mod/admin.php +++ b/mod/admin.php @@ -6,6 +6,8 @@ * Controller for the /admin/ area. */ +require_once('include/queue_fn.php'); + /** * @param App &$a @@ -164,7 +166,7 @@ function admin_page_summary(&$a) { } // pending registrations - $r = q("SELECT COUNT(id) AS `count` FROM register"); + $r = q("SELECT COUNT(id) AS `count` FROM `register` WHERE `uid` != '0'"); $pending = $r[0]['count']; // available channels, primary and clones @@ -231,7 +233,9 @@ function admin_page_site_post(&$a){ $maximagesize = ((x($_POST,'maximagesize')) ? intval(trim($_POST['maximagesize'])) : 0); $register_policy = ((x($_POST,'register_policy')) ? intval(trim($_POST['register_policy'])) : 0); + $access_policy = ((x($_POST,'access_policy')) ? intval(trim($_POST['access_policy'])) : 0); + $invite_only = ((x($_POST,'invite_only')) ? True : False); $abandon_days = ((x($_POST,'abandon_days')) ? intval(trim($_POST['abandon_days'])) : 0); $register_text = ((x($_POST,'register_text')) ? notags(trim($_POST['register_text'])) : ''); @@ -243,7 +247,7 @@ function admin_page_site_post(&$a){ $not_allowed_email = ((x($_POST,'not_allowed_email')) ? notags(trim($_POST['not_allowed_email'])) : ''); $block_public = ((x($_POST,'block_public')) ? True : False); $force_publish = ((x($_POST,'publish_all')) ? True : False); - $disable_discover_tab = ((x($_POST,'disable_discover_tab')) ? True : False); + $disable_discover_tab = ((x($_POST,'disable_discover_tab')) ? False : True); $login_on_homepage = ((x($_POST,'login_on_homepage')) ? True : False); $global_directory = ((x($_POST,'directory_submit_url')) ? notags(trim($_POST['directory_submit_url'])) : ''); $no_community_page = !((x($_POST,'no_community_page')) ? True : False); @@ -299,6 +303,7 @@ function admin_page_site_post(&$a){ set_config('system','maximagesize', $maximagesize); set_config('system','register_policy', $register_policy); + set_config('system','invitation_only', $invite_only); set_config('system','access_policy', $access_policy); set_config('system','account_abandon_days', $abandon_days); set_config('system','register_text', $register_text); @@ -425,6 +430,13 @@ function admin_page_site(&$a) { // SSL_POLICY_FULL => t("Force all links to use SSL") // ); + $discover_tab = get_config('system','disable_discover_tab'); + // $disable public streams by default + if($discover_tab === false) + $discover_tab = 1; + // now invert the logic for the setting. + $discover_tab = (1 - $discover_tab); + $homelogin = get_config('system','login_on_homepage'); @@ -450,6 +462,7 @@ function admin_page_site(&$a) { '$feed_contacts' => array('feed_contacts', t('Allow Feeds as Connections'),get_config('system','feed_contacts'),t('(Heavy system resource usage)')), '$maximagesize' => array('maximagesize', t("Maximum image size"), intval(get_config('system','maximagesize')), t("Maximum size in bytes of uploaded images. Default is 0, which means no limits.")), '$register_policy' => array('register_policy', t("Does this site allow new member registration?"), get_config('system','register_policy'), "", $register_choices), + '$invite_only' => array('invite_only', t("Invitation only"), get_config('system','invitation_only'), t("Only allow new member registrations with an invitation code. Above register policy must be set to Yes.")), '$access_policy' => array('access_policy', t("Which best describes the types of account offered by this hub?"), get_config('system','access_policy'), "This is displayed on the public server site list.", $access_choices), '$register_text' => array('register_text', t("Register text"), htmlspecialchars(get_config('system','register_text'), ENT_QUOTES, 'UTF-8'), t("Will be displayed prominently on the registration page.")), '$frontpage' => array('frontpage', t("Site homepage to show visitors (default: login box)"), get_config('system','frontpage'), t("example: 'public' to show public stream, 'page/sys/home' to show a system webpage called 'home' or 'include:home.html' to include a file.")), @@ -461,7 +474,7 @@ function admin_page_site(&$a) { '$block_public' => array('block_public', t("Block public"), get_config('system','block_public'), t("Check to block public access to all otherwise public personal pages on this site unless you are currently logged in.")), '$verify_email' => array('verify_email', t("Verify Email Addresses"), get_config('system','verify_email'), t("Check to verify email addresses used in account registration (recommended).")), '$force_publish' => array('publish_all', t("Force publish"), get_config('system','publish_all'), t("Check to force all profiles on this site to be listed in the site directory.")), - '$disable_discover_tab' => array('disable_discover_tab', t("Disable discovery tab"), get_config('system','disable_discover_tab'), t("Remove the tab in the network view with public content pulled from sources chosen for this site.")), + '$disable_discover_tab' => array('disable_discover_tab', t('Import Public Streams'), $discover_tab, t('Import and allow access to public content pulled from other sites. Warning: this content is unmoderated.')), '$login_on_homepage' => array('login_on_homepage', t("login on Homepage"),((intval($homelogin) || $homelogin === false) ? 1 : '') , t("Present a login box to visitors on the home page if no other content has been configured.")), '$directory_server' => (($dir_choices) ? array('directory_server', t("Directory Server URL"), get_config('system','directory_server'), t("Default directory server"), $dir_choices) : null), @@ -605,12 +618,11 @@ function admin_page_queue($a) { if($_REQUEST['drophub']) { require_once('hubloc.php'); hubloc_mark_as_down($_REQUEST['drophub']); + remove_queue_by_posturl($_REQUEST['drophub']); } if($_REQUEST['emptyhub']) { - $r = q("delete from outq where outq_posturl = '%s' ", - dbesc($_REQUEST['emptyhub']) - ); + remove_queue_by_posturl($_REQUEST['emptyhub']); } $r = q("select count(outq_posturl) as total, max(outq_priority) as priority, outq_posturl from outq diff --git a/mod/api.php b/mod/api.php index 08978ee96..232349292 100644 --- a/mod/api.php +++ b/mod/api.php @@ -35,42 +35,40 @@ function api_post(&$a) { } function api_content(&$a) { - if ($a->cmd=='api/oauth/authorize'){ + if($a->cmd=='api/oauth/authorize'){ + /* * api/oauth/authorize interact with the user. return a standard page */ $a->page['template'] = "minimal"; - - + // get consumer/client from request token try { - $request = OAuthRequest::from_request(); + $request = OAuth1Request::from_request(); } catch(Exception $e) { echo "<pre>"; var_dump($e); killme(); } - if (x($_POST,'oauth_yes')){ + if(x($_POST,'oauth_yes')){ $app = oauth_get_client($request); if (is_null($app)) return "Invalid request. Unknown token."; - $consumer = new OAuthConsumer($app['client_id'], $app['pw'], $app['redirect_uri']); + $consumer = new OAuth1Consumer($app['client_id'], $app['pw'], $app['redirect_uri']); $verifier = md5($app['secret'].local_channel()); set_config("oauth", $verifier, local_channel()); - if ($consumer->callback_url!=null) { + if($consumer->callback_url!=null) { $params = $request->get_parameters(); $glue="?"; if (strstr($consumer->callback_url,$glue)) $glue="?"; - goaway($consumer->callback_url.$glue."oauth_token=".OAuthUtil::urlencode_rfc3986($params['oauth_token'])."&oauth_verifier=".OAuthUtil::urlencode_rfc3986($verifier)); + goaway($consumer->callback_url . $glue . "oauth_token=" . OAuth1Util::urlencode_rfc3986($params['oauth_token']) . "&oauth_verifier=" . OAuth1Util::urlencode_rfc3986($verifier)); killme(); } - - - + $tpl = get_markup_template("oauth_authorize_done.tpl"); $o = replace_macros($tpl, array( '$title' => t('Authorize application connection'), @@ -79,8 +77,6 @@ function api_content(&$a) { )); return $o; - - } diff --git a/mod/cloud.php b/mod/cloud.php index efb33f935..67fc199bf 100644 --- a/mod/cloud.php +++ b/mod/cloud.php @@ -73,36 +73,18 @@ function cloud_init(&$a) { $server->addPlugin($lockPlugin); -/* This next bit should no longer be needed... */ - - // The next section of code allows us to bypass prompting for http-auth if a - // FILE is being accessed anonymously and permissions allow this. This way - // one can create hotlinks to public media files in their cloud and anonymous - // viewers won't get asked to login. - // If a DIRECTORY is accessed or there are permission issues accessing the - // file and we aren't previously authenticated via zot, prompt for HTTP-auth. - // This will be the default case for mounting a DAV directory. - // In order to avoid prompting for passwords for viewing a DIRECTORY, add - // the URL query parameter 'davguest=1'. - -// $isapublic_file = false; -// $davguest = ((x($_SESSION, 'davguest')) ? true : false); - -// if ((! $auth->observer) && ($_SERVER['REQUEST_METHOD'] === 'GET')) { -// try { -// $x = RedFileData('/' . $a->cmd, $auth); -// if($x instanceof RedDAV\RedFile) -// $isapublic_file = true; -// } -// catch (Exception $e) { -// $isapublic_file = false; -// } -// } - -// if ((! $auth->observer) && (! $isapublic_file) && (! $davguest)) { -// logger('mod_cloud: auth exception'); -// http_status_exit(401, 'Permission denied.'); -// } + $is_readable = false; + + if($_SERVER['REQUEST_METHOD'] === 'GET') { + try { + $x = RedFileData('/' . $a->cmd, $auth); + } + catch(\Exception $e) { + if($e instanceof Sabre\DAV\Exception\Forbidden) { + http_status_exit(401, 'Permission denied.'); + } + } + } require_once('include/RedDAV/RedBrowser.php'); // provide a directory view for the cloud in Hubzilla diff --git a/mod/dirsearch.php b/mod/dirsearch.php index 548acbd08..388e5f3ac 100644 --- a/mod/dirsearch.php +++ b/mod/dirsearch.php @@ -26,8 +26,8 @@ function dirsearch_content(&$a) { $token = get_config('system','realm_token'); if($token && $access_token != $token) { - $result['message'] = t('This directory server requires an access token'); - return; + $ret['message'] = t('This directory server requires an access token'); + json_return_and_die($ret); } diff --git a/mod/events.php b/mod/events.php index d55d22f44..74b44906c 100755 --- a/mod/events.php +++ b/mod/events.php @@ -90,8 +90,12 @@ function events_post(&$a) { linkify_tags($a, $desc, local_channel()); linkify_tags($a, $location, local_channel()); - $action = ($event_hash == '') ? 'new' : "event/" . $event_hash; - $onerror_url = $a->get_baseurl() . "/events/" . $action . "?summary=$summary&description=$desc&location=$location&start=$start_text&finish=$finish_text&adjust=$adjust&nofinish=$nofinish&type=$type"; + //$action = ($event_hash == '') ? 'new' : "event/" . $event_hash; + + //fixme: this url gives a wsod if there is a linebreak detected in one of the variables ($desc or $location) + //$onerror_url = $a->get_baseurl() . "/events/" . $action . "?summary=$summary&description=$desc&location=$location&start=$start_text&finish=$finish_text&adjust=$adjust&nofinish=$nofinish&type=$type"; + $onerror_url = $a->get_baseurl() . "/events"; + if(strcmp($finish,$start) < 0 && !$nofinish) { notice( t('Event can not end before it has started.') . EOL); if(intval($_REQUEST['preview'])) { @@ -366,37 +370,30 @@ function events_content(&$a) { $sdt = ((x($orig_event)) ? $orig_event['start'] : 'now'); - $fdt = ((x($orig_event)) ? $orig_event['finish'] : 'now'); + $fdt = ((x($orig_event)) ? $orig_event['finish'] : '+1 hour'); $tz = date_default_timezone_get(); if(x($orig_event)) $tz = (($orig_event['adjust']) ? date_default_timezone_get() : 'UTC'); -// $syear = ((x($orig_event)) ? datetime_convert('UTC', $tz, $sdt, 'Y') : '0000'); -// $smonth = ((x($orig_event)) ? datetime_convert('UTC', $tz, $sdt, 'm') : '00'); -// $sday = ((x($orig_event)) ? datetime_convert('UTC', $tz, $sdt, 'd') : '00'); - $syear = datetime_convert('UTC', $tz, $sdt, 'Y'); $smonth = datetime_convert('UTC', $tz, $sdt, 'm'); $sday = datetime_convert('UTC', $tz, $sdt, 'd'); + $shour = datetime_convert('UTC', $tz, $sdt, 'H'); + $sminute = datetime_convert('UTC', $tz, $sdt, 'i'); - $shour = ((x($orig_event)) ? datetime_convert('UTC', $tz, $sdt, 'H') : '00'); - $sminute = ((x($orig_event)) ? datetime_convert('UTC', $tz, $sdt, 'i') : '00'); $stext = datetime_convert('UTC',$tz,$sdt); $stext = substr($stext,0,14) . "00:00"; -// $fyear = ((x($orig_event)) ? datetime_convert('UTC', $tz, $fdt, 'Y') : '0000'); -// $fmonth = ((x($orig_event)) ? datetime_convert('UTC', $tz, $fdt, 'm') : '00'); -// $fday = ((x($orig_event)) ? datetime_convert('UTC', $tz, $fdt, 'd') : '00'); - $fyear = datetime_convert('UTC', $tz, $fdt, 'Y'); $fmonth = datetime_convert('UTC', $tz, $fdt, 'm'); $fday = datetime_convert('UTC', $tz, $fdt, 'd'); + $fhour = datetime_convert('UTC', $tz, $fdt, 'H'); + $fminute = datetime_convert('UTC', $tz, $fdt, 'i'); - $fhour = ((x($orig_event)) ? datetime_convert('UTC', $tz, $fdt, 'H') : '00'); - $fminute = ((x($orig_event)) ? datetime_convert('UTC', $tz, $fdt, 'i') : '00'); $ftext = datetime_convert('UTC',$tz,$fdt); $ftext = substr($ftext,0,14) . "00:00"; + $type = ((x($orig_event)) ? $orig_event['type'] : 'event'); $f = get_config('system','event_input_format'); @@ -437,22 +434,22 @@ function events_content(&$a) { '$xchan' => $event_xchan, '$mid' => $mid, '$event_hash' => $event_id, - '$summary' => array('summary', t('Event Title'), $t_orig, t('Required'), '*'), + '$summary' => array('summary', (($event_id) ? t('Edit event titel') : t('Event titel')), $t_orig, t('Required'), '*'), '$catsenabled' => $catsenabled, '$placeholdercategory' => t('Categories (comma-separated list)'), - '$c_text' => t('Category'), + '$c_text' => (($event_id) ? t('Edit Category') : t('Category')), '$category' => $category, '$required' => '<span class="required" title="' . t('Required') . '">*</span>', - '$s_dsel' => datetimesel($f,new DateTime(),DateTime::createFromFormat('Y',$syear+5),DateTime::createFromFormat('Y-m-d H:i',"$syear-$smonth-$sday $shour:$sminute"), t('Start date and time'), 'start_text',true,true,'','',true,$first_day), + '$s_dsel' => datetimesel($f,new DateTime(),DateTime::createFromFormat('Y',$syear+5),DateTime::createFromFormat('Y-m-d H:i',"$syear-$smonth-$sday $shour:$sminute"), (($event_id) ? t('Edit start date and time') : t('Start date and time')), 'start_text',true,true,'','',true,$first_day), '$n_text' => t('Finish date and time are not known or not relevant'), '$n_checked' => $n_checked, - '$f_dsel' => datetimesel($f,new DateTime(),DateTime::createFromFormat('Y',$fyear+5),DateTime::createFromFormat('Y-m-d H:i',"$fyear-$fmonth-$fday $fhour:$fminute"), t('Finish date and time'),'finish_text',true,true,'start_text','',false,$first_day), + '$f_dsel' => datetimesel($f,new DateTime(),DateTime::createFromFormat('Y',$fyear+5),DateTime::createFromFormat('Y-m-d H:i',"$fyear-$fmonth-$fday $fhour:$fminute"), (($event_id) ? t('Edit finish date and time') : t('Finish date and time')),'finish_text',true,true,'start_text','',false,$first_day), '$nofinish' => array('nofinish', t('Finish date and time are not known or not relevant'), $n_checked, '', array(t('No'),t('Yes')), 'onclick="enableDisableFinishDate();"'), '$adjust' => array('adjust', t('Adjust for viewer timezone'), $a_checked, t('Important for events that happen in a particular place. Not practical for global holidays.'), array(t('No'),t('Yes'))), '$a_text' => t('Adjust for viewer timezone'), - '$d_text' => t('Description'), + '$d_text' => (($event_id) ? t('Edit Description') : t('Description')), '$d_orig' => $d_orig, - '$l_text' => t('Location'), + '$l_text' => (($event_id) ? t('Edit Location') : t('Location')), '$l_orig' => $l_orig, '$t_orig' => $t_orig, '$sh_text' => t('Share this event'), @@ -596,7 +593,7 @@ function events_content(&$a) { $last_date = $d; - $edit = array($a->get_baseurl().'/events/'.$rr['event_hash'].'?expandform=1',t('Edit event'),'',''); + $edit = ((local_channel() && $rr['author_xchan'] == get_observer_hash()) ? array($a->get_baseurl().'/events/'.$rr['event_hash'].'?expandform=1',t('Edit event'),'','') : false); $drop = array($a->get_baseurl().'/events/drop/'.$rr['event_hash'],t('Delete event'),'',''); @@ -651,7 +648,7 @@ function events_content(&$a) { $o = replace_macros($tpl, array( '$baseurl' => $a->get_baseurl(), - '$new_event' => array($a->get_baseurl().'/events/new',t('New Event'),'',''), + '$new_event' => array($a->get_baseurl().'/events',(($event_id) ? t('Edit Event') : t('Create Event')),'',''), '$previus' => array($a->get_baseurl()."/events/$prevyear/$prevmonth",t('Previous'),'',''), '$next' => array($a->get_baseurl()."/events/$nextyear/$nextmonth",t('Next'),'',''), '$export' => array($a->get_baseurl()."/events/$y/$m/export",t('Export'),'',''), diff --git a/mod/fbrowser.php b/mod/fbrowser.php index 90b554edd..13abbfd8a 100644 --- a/mod/fbrowser.php +++ b/mod/fbrowser.php @@ -57,13 +57,8 @@ function fbrowser_content($a){ $types = $ph->supportedTypes(); $ext = $types[$rr['type']]; - if($a->get_template_engine() === 'internal') { - $filename_e = template_escape($rr['filename']); - } - else { - $filename_e = $rr['filename']; - } - + $filename_e = $rr['filename']; + return array( $a->get_baseurl() . '/photo/' . $rr['resource_id'] . '-' . $rr['hiq'] . '.' .$ext, $filename_e, diff --git a/mod/feed.php b/mod/feed.php index 3b622fc17..eb72af9cf 100644 --- a/mod/feed.php +++ b/mod/feed.php @@ -15,6 +15,7 @@ function feed_init(&$a) { $params['start'] = ((x($params,'start')) ? intval($params['start']) : 0); $params['records'] = ((x($params,'records')) ? intval($params['records']) : 40); $params['direction'] = ((x($params,'direction')) ? dbesc($params['direction']) : 'desc'); + $params['cat'] = ((x($_REQUEST,'cat')) ? escape_tags($_REQUEST['cat']) : ''); $channel = ''; if(argc() > 1) { diff --git a/mod/help.php b/mod/help.php index 16ec069a7..c4549a2bd 100644 --- a/mod/help.php +++ b/mod/help.php @@ -143,7 +143,8 @@ function help_content(&$a) { nav_set_selected('help'); if($_REQUEST['search']) { - + + $o .= '<div id="help-content" class="generic-content-wrapper">'; $o .= '<h2>' . t('Documentation Search') . ' - ' . htmlspecialchars($_REQUEST['search']) . '</h2>'; $r = search_doc_files($_REQUEST['search']); @@ -160,6 +161,7 @@ function help_content(&$a) { } $o .= '</ul>'; + $o .= '</div>'; } return $o; } diff --git a/mod/home.php b/mod/home.php index bf2463bbc..bfac17eab 100644 --- a/mod/home.php +++ b/mod/home.php @@ -72,7 +72,7 @@ function home_content(&$a, $update = 0, $load = false) { $sitename = get_config('system','sitename'); if($sitename) - $o .= '<h1>' . sprintf( t("Welcome to %s") ,$sitename) . '</h1>'; + $o .= '<h1 class="home-welcome">' . sprintf( t("Welcome to %s") ,$sitename) . '</h1>'; $loginbox = get_config('system','login_on_homepage'); if(intval($loginbox) || $loginbox === false) diff --git a/mod/invite.php b/mod/invite.php index bda808142..e8bb74ee2 100644 --- a/mod/invite.php +++ b/mod/invite.php @@ -50,23 +50,6 @@ function invite_post(&$a) { continue; } - if($invonly && ($x || is_site_admin())) { - $code = autoname(8) . srand(1000,9999); - $nmessage = str_replace('$invite_code',$code,$message); - - $r = q("INSERT INTO `register` (`hash`,`created`) VALUES ('%s', '%s') ", - dbesc($code), - dbesc(datetime_convert()) - ); - - if(! is_site_admin()) { - $x --; - if($x >= 0) - set_pconfig(local_channel(),'system','invites_remaining',$x); - else - return; - } - } else $nmessage = $message; @@ -117,6 +100,23 @@ function invite_content(&$a) { } } + if($invonly && ($x || is_site_admin())) { + $invite_code = autoname(8) . rand(1000,9999); + $nmessage = str_replace('$invite_code',$invite_code,$message); + + $r = q("INSERT INTO `register` (`hash`,`created`) VALUES ('%s', '%s') ", + dbesc($invite_code), + dbesc(datetime_convert()) + ); + + if(! is_site_admin()) { + $x --; + if($x >= 0) + set_pconfig(local_channel(),'system','invites_remaining',$x); + else + return; + } + } $ob = $a->get_observer(); if(! $ob) diff --git a/mod/item.php b/mod/item.php index f32ff8844..b3ef57529 100644 --- a/mod/item.php +++ b/mod/item.php @@ -107,6 +107,7 @@ function item_post(&$a) { $layout_mid = ((x($_REQUEST,'layout_mid')) ? escape_tags($_REQUEST['layout_mid']): ''); $plink = ((x($_REQUEST,'permalink')) ? escape_tags($_REQUEST['permalink']) : ''); $obj_type = ((x($_REQUEST,'obj_type')) ? escape_tags($_REQUEST['obj_type']) : ACTIVITY_OBJ_NOTE); + // allow API to bulk load a bunch of imported items with sending out a bunch of posts. $nopush = ((x($_REQUEST,'nopush')) ? intval($_REQUEST['nopush']) : 0); diff --git a/mod/mail.php b/mod/mail.php index 536149a28..59d15772b 100644 --- a/mod/mail.php +++ b/mod/mail.php @@ -17,6 +17,7 @@ function mail_post(&$a) { $body = ((x($_REQUEST,'body')) ? escape_tags(trim($_REQUEST['body'])) : ''); $recipient = ((x($_REQUEST,'messageto')) ? notags(trim($_REQUEST['messageto'])) : ''); $rstr = ((x($_REQUEST,'messagerecip')) ? notags(trim($_REQUEST['messagerecip'])) : ''); + $preview = ((x($_REQUEST,'preview')) ? intval($_REQUEST['preview']) : 0); $expires = ((x($_REQUEST,'expires')) ? datetime_convert(date_default_timezone_get(),'UTC', $_REQUEST['expires']) : NULL_DATE); // If we have a raw string for a recipient which hasn't been auto-filled, @@ -86,6 +87,13 @@ function mail_post(&$a) { require_once('include/text.php'); linkify_tags($a, $body, local_channel()); + if($preview) { + + + + + } + if(! $recipient) { notice('No recipient found.'); $a->argc = 2; @@ -329,7 +337,8 @@ function mail_content(&$a) { 'to_url' => chanlink_hash($message['to_xchan']), 'to_photo' => $message['to']['xchan_photo_s'], 'subject' => $message['title'], - 'body' => smilies(bbcode($message['body']) . $s), + 'body' => smilies(bbcode($message['body'])), + 'attachments' => $s, 'delete' => t('Delete message'), 'dreport' => t('Delivery report'), 'recall' => t('Recall message'), diff --git a/mod/photos.php b/mod/photos.php index 33a895fdf..b0d9bc631 100644 --- a/mod/photos.php +++ b/mod/photos.php @@ -698,12 +698,7 @@ function photos_content(&$a) { $album_edit = null; if(($album !== t('Profile Photos')) && ($album !== 'Profile Photos') && ($album !== 'Contact Photos') && ($album !== t('Contact Photos'))) { if($can_post) { - if($a->get_template_engine() === 'internal') { - $album_e = template_escape($album); - } - else { - $album_e = $album; - } + $album_e = $album; $albums = ((array_key_exists('albums', $a->data)) ? $a->data['albums'] : photos_albums_list($a->data['channel'],$a->data['observer'])); // @fixme - syncronise actions with DAV @@ -765,6 +760,7 @@ function photos_content(&$a) { if($photos) { $o = replace_macros(get_markup_template('photosajax.tpl'),array( '$photos' => $photos, + '$album_id' => bin2hex($album) )); } else { @@ -779,6 +775,7 @@ function photos_content(&$a) { $o .= replace_macros($tpl, array( '$photos' => $photos, '$album' => $album, + '$album_id' => bin2hex($album), '$album_edit' => array(t('Edit Album'), $album_edit), '$can_post' => $can_post, '$upload' => array(t('Upload'), $a->get_baseurl() . '/photos/' . $a->data['channel']['channel_address'] . '/upload/' . bin2hex($album)), @@ -1300,6 +1297,7 @@ function photos_content(&$a) { if($photos) { $o = replace_macros(get_markup_template('photosajax.tpl'),array( '$photos' => $photos, + '$album_id' => bin2hex(t('Recent Photos')) )); } else { @@ -1313,6 +1311,7 @@ function photos_content(&$a) { $tpl = get_markup_template('photos_recent.tpl'); $o .= replace_macros($tpl, array( '$title' => t('Recent Photos'), + '$album_id' => bin2hex(t('Recent Photos')), '$can_post' => $can_post, '$upload' => array(t('Upload'), $a->get_baseurl().'/photos/'.$a->data['channel']['channel_address'].'/upload'), '$photos' => $photos, diff --git a/mod/post.php b/mod/post.php index 4c52de44a..6555a16c2 100644 --- a/mod/post.php +++ b/mod/post.php @@ -9,952 +9,26 @@ require_once('include/zot.php'); -/** - * @brief HTTP POST entry point for Zot. - * - * Most access to this endpoint is via the post method. - * Here we will pick out the magic auth params which arrive as a get request, - * and the only communications to arrive this way. - * - * Magic Auth - * ========== - * - * So-called "magic auth" takes place by a special exchange. On the site where the "channel to be authenticated" lives (e.g. $mysite), - * a redirection is made via $mysite/magic to the zot endpoint of the remote site ($remotesite) with special GET parameters. - * - * The endpoint is typically https://$remotesite/post - or whatever was specified as the callback url in prior communications - * (we will bootstrap an address and fetch a zot info packet if possible where no prior communications exist) - * - * Five GET parameters are supplied: - * * auth => the urlencoded webbie (channel@host.domain) of the channel requesting access - * * dest => the desired destination URL (urlencoded) - * * sec => a random string which is also stored on $mysite for use during the verification phase. - * * version => the zot revision - * * delegate => optional urlencoded webbie of a local channel to invoke delegation rights for - * - * When this packet is received, an "auth-check" zot message is sent to $mysite. - * (e.g. if $_GET['auth'] is foobar@podunk.edu, a zot packet is sent to the podunk.edu zot endpoint, which is typically /post) - * If no information has been recorded about the requesting identity a zot information packet will be retrieved before - * continuing. - * - * The sender of this packet is an arbitrary/random site channel. The recipients will be a single recipient corresponding - * to the guid and guid_sig we have associated with the requesting auth identity - * - * \code{.json} - * { - * "type":"auth_check", - * "sender":{ - * "guid":"kgVFf_...", - * "guid_sig":"PT9-TApz...", - * "url":"http:\/\/podunk.edu", - * "url_sig":"T8Bp7j..." - * }, - * "recipients":{ - * { - * "guid":"ZHSqb...", - * "guid_sig":"JsAAXi..." - * } - * } - * "callback":"\/post", - * "version":1, - * "secret":"1eaa661", - * "secret_sig":"eKV968b1..." - * } - * \endcode - * - * auth_check messages MUST use encapsulated encryption. This message is sent to the origination site, which checks the 'secret' to see - * if it is the same as the 'sec' which it passed originally. It also checks the secret_sig which is the secret signed by the - * destination channel's private key and base64url encoded. If everything checks out, a json packet is returned: - * - * \code{.json} - * { - * "success":1, - * "confirm":"q0Ysovd1u...", - * "service_class":(optional) - * "level":(optional) - * } - * \endcode - * - * 'confirm' in this case is the base64url encoded RSA signature of the concatenation of 'secret' with the - * base64url encoded whirlpool hash of the requestor's guid and guid_sig; signed with the source channel private key. - * This prevents a man-in-the-middle from inserting a rogue success packet. Upon receipt and successful - * verification of this packet, the destination site will redirect to the original destination URL and indicate a successful remote login. - * Service_class can be used by cooperating sites to provide different access rights based on account rights and subscription plans. It is - * a string whose contents are not defined by protocol. Example: "basic" or "gold". - * - * @param[in,out] App &$a - */ function post_init(&$a) { if (array_key_exists('auth', $_REQUEST)) { - - $ret = array('success' => false, 'message' => ''); - - logger('mod_zot: auth request received.'); - $address = $_REQUEST['auth']; - $desturl = $_REQUEST['dest']; - $sec = $_REQUEST['sec']; - $version = $_REQUEST['version']; - $delegate = $_REQUEST['delegate']; - - $test = ((x($_REQUEST, 'test')) ? intval($_REQUEST['test']) : 0); - - // They are authenticating ultimately to the site and not to a particular channel. - // Any channel will do, providing it's currently active. We just need to have an - // identity to attach to the packet we send back. So find one. - - $c = q("select * from channel where channel_removed = 0 limit 1"); - - if (! $c) { - // nobody here - logger('mod_zot: auth: unable to find a response channel'); - if ($test) { - $ret['message'] .= 'no local channels found.' . EOL; - json_return_and_die($ret); - } - - goaway($desturl); - } - - // Try and find a hubloc for the person attempting to auth - $x = q("select * from hubloc left join xchan on xchan_hash = hubloc_hash where hubloc_addr = '%s' order by hubloc_id desc", - dbesc($address) - ); - - if (! $x) { - // finger them if they can't be found. - $ret = zot_finger($address, null); - if ($ret['success']) { - $j = json_decode($ret['body'], true); - if ($j) - import_xchan($j); - $x = q("select * from hubloc left join xchan on xchan_hash = hubloc_hash where hubloc_addr = '%s' order by hubloc_id desc", - dbesc($address) - ); - } - } - if(! $x) { - logger('mod_zot: auth: unable to finger ' . $address); - - if($test) { - $ret['message'] .= 'no hubloc found for ' . $address . ' and probing failed.' . EOL; - json_return_and_die($ret); - } - - goaway($desturl); - } - - - foreach($x as $xx) { - logger('mod_zot: auth request received from ' . $xx['hubloc_addr'] ); - - // check credentials and access - - // If they are already authenticated and haven't changed credentials, - // we can save an expensive network round trip and improve performance. - - $remote = remote_channel(); - $result = null; - $remote_service_class = ''; - $remote_level = 0; - $remote_hub = $xx['hubloc_url']; - $DNT = 0; - - // Also check that they are coming from the same site as they authenticated with originally. - - $already_authed = ((($remote) && ($xx['hubloc_hash'] == $remote) && ($xx['hubloc_url'] === $_SESSION['remote_hub'])) ? true : false); - if($delegate && $delegate !== $_SESSION['delegate_channel']) - $already_authed = false; - - $j = array(); - - if (! $already_authed) { - - // Auth packets MUST use ultra top-secret hush-hush mode - e.g. the entire packet is encrypted using the site private key - // The actual channel sending the packet ($c[0]) is not important, but this provides a generic zot packet with a sender - // which can be verified - - $p = zot_build_packet($c[0],$type = 'auth_check', array(array('guid' => $xx['hubloc_guid'],'guid_sig' => $xx['hubloc_guid_sig'])), $xx['hubloc_sitekey'], $sec); - if ($test) { - $ret['message'] .= 'auth check packet created using sitekey ' . $xx['hubloc_sitekey'] . EOL; - $ret['message'] .= 'packet contents: ' . $p . EOL; - } - - $result = zot_zot($xx['hubloc_callback'],$p); - - if (! $result['success']) { - logger('mod_zot: auth_check callback failed.'); - if ($test) { - $ret['message'] .= 'auth check request to your site returned .' . print_r($result, true) . EOL; - continue; - } - continue; - } - $j = json_decode($result['body'], true); - if (! $j) { - logger('mod_zot: auth_check json data malformed.'); - if($test) { - $ret['message'] .= 'json malformed: ' . $result['body'] . EOL; - continue; - } - } - } - - if ($test) { - $ret['message'] .= 'auth check request returned .' . print_r($j, true) . EOL; - } - - if ($already_authed || $j['success']) { - if ($j['success']) { - // legit response, but we do need to check that this wasn't answered by a man-in-middle - if (! rsa_verify($sec . $xx['xchan_hash'],base64url_decode($j['confirm']),$xx['xchan_pubkey'])) { - logger('mod_zot: auth: final confirmation failed.'); - if ($test) { - $ret['message'] .= 'final confirmation failed. ' . $sec . print_r($j,true) . print_r($xx,true); - continue; - } - - continue; - } - if (array_key_exists('service_class',$j)) - $remote_service_class = $j['service_class']; - if (array_key_exists('level',$j)) - $remote_level = $j['level']; - if (array_key_exists('DNT',$j)) - $DNT = $j['DNT']; - } - // everything is good... maybe - if(local_channel()) { - - // tell them to logout if they're logged in locally as anything but the target remote account - // in which case just shut up because they don't need to be doing this at all. - - if ($a->channel['channel_hash'] != $xx['xchan_hash']) { - logger('mod_zot: auth: already authenticated locally as somebody else.'); - notice( t('Remote authentication blocked. You are logged into this site locally. Please logout and retry.') . EOL); - if ($test) { - $ret['message'] .= 'already logged in locally with a conflicting identity.' . EOL; - continue; - } - } - continue; - } - - // log them in - - if ($test) { - $ret['success'] = true; - $ret['message'] .= 'Authentication Success!' . EOL; - json_return_and_die($ret); - } - - $delegation_success = false; - if ($delegate) { - $r = q("select * from channel left join xchan on channel_hash = xchan_hash where xchan_addr = '%s' limit 1", - dbesc($delegate) - ); - if ($r && intval($r[0]['channel_id'])) { - $allowed = perm_is_allowed($r[0]['channel_id'],$xx['xchan_hash'],'delegate'); - if ($allowed) { - $_SESSION['delegate_channel'] = $r[0]['channel_id']; - $_SESSION['delegate'] = $xx['xchan_hash']; - $_SESSION['account_id'] = intval($r[0]['channel_account_id']); - require_once('include/security.php'); - change_channel($r[0]['channel_id']); - $delegation_success = true; - } - } - } - - $_SESSION['authenticated'] = 1; - if (! $delegation_success) { - $_SESSION['visitor_id'] = $xx['xchan_hash']; - $_SESSION['my_url'] = $xx['xchan_url']; - $_SESSION['my_address'] = $address; - $_SESSION['remote_service_class'] = $remote_service_class; - $_SESSION['remote_level'] = $remote_level; - $_SESSION['remote_hub'] = $remote_hub; - $_SESSION['DNT'] = $DNT; - } - - $arr = array('xchan' => $xx, 'url' => $desturl, 'session' => $_SESSION); - call_hooks('magic_auth_success',$arr); - $a->set_observer($xx); - require_once('include/security.php'); - $a->set_groups(init_groups_visitor($_SESSION['visitor_id'])); - info(sprintf( t('Welcome %s. Remote authentication successful.'),$xx['xchan_name'])); - logger('mod_zot: auth success from ' . $xx['xchan_addr']); - } - else { - if ($test) { - $ret['message'] .= 'auth failure. ' . print_r($_REQUEST,true) . print_r($j,true) . EOL; - continue; - } - logger('mod_zot: magic-auth failure - not authenticated: ' . $xx['xchan_addr']); - } - - if ($test) { - $ret['message'] .= 'auth failure fallthrough ' . print_r($_REQUEST,true) . print_r($j,true) . EOL; - continue; - } - } - - /** - * @FIXME we really want to save the return_url in the session before we - * visit rmagic. This does however prevent a recursion if you visit - * rmagic directly, as it would otherwise send you back here again. - * But z_root() probably isn't where you really want to go. - */ - - if(strstr($desturl,z_root() . '/rmagic')) - goaway(z_root()); - - if ($test) { - json_return_and_die($ret); - } - - goaway($desturl); + require_once('Zotlabs/Zot/Auth.php'); + $x = new Zotlabs\Zot\Auth($_REQUEST); + exit; } + } -/** - * @brief zot communications and messaging. - * - * Sender HTTP posts to this endpoint ($site/post typically) with 'data' parameter set to json zot message packet. - * This packet is optionally encrypted, which we will discover if the json has an 'iv' element. - * $contents => array( 'alg' => 'aes256cbc', 'iv' => initialisation vector, 'key' => decryption key, 'data' => encrypted data); - * $contents->iv and $contents->key are random strings encrypted with this site's RSA public key and then base64url encoded. - * Currently only 'aes256cbc' is used, but this is extensible should that algorithm prove inadequate. - * - * Once decrypted, one will find the normal json_encoded zot message packet. - * - * Defined packet types are: notify, purge, refresh, force_refresh, auth_check, ping, and pickup - * - * Standard packet: (used by notify, purge, refresh, force_refresh, and auth_check) - * \code{.json} - * { - * "type": "notify", - * "sender":{ - * "guid":"kgVFf_1...", - * "guid_sig":"PT9-TApzp...", - * "url":"http:\/\/podunk.edu", - * "url_sig":"T8Bp7j5...", - * }, - * "recipients": { optional recipient array }, - * "callback":"\/post", - * "version":1, - * "secret":"1eaa...", - * "secret_sig": "df89025470fac8..." - * } - * \endcode - * - * Signature fields are all signed with the sender channel private key and base64url encoded. - * Recipients are arrays of guid and guid_sig, which were previously signed with the recipients private - * key and base64url encoded and later obtained via channel discovery. Absence of recipients indicates - * a public message or visible to all potential listeners on this site. - * - * "pickup" packet: - * The pickup packet is sent in response to a notify packet from another site - * \code{.json} - * { - * "type":"pickup", - * "url":"http:\/\/example.com", - * "callback":"http:\/\/example.com\/post", - * "callback_sig":"teE1_fLI...", - * "secret":"1eaa...", - * "secret_sig":"O7nB4_..." - * } - * \endcode - * - * In the pickup packet, the sig fields correspond to the respective data - * element signed with this site's system private key and then base64url encoded. - * The "secret" is the same as the original secret from the notify packet. - * - * If verification is successful, a json structure is returned containing a - * success indicator and an array of type 'pickup'. - * Each pickup element contains the original notify request and a message field - * whose contents are dependent on the message type. - * - * This JSON array is AES encapsulated using the site public key of the site - * that sent the initial zot pickup packet. - * Using the above example, this would be example.com. - * - * \code{.json} - * { - * "success":1, - * "pickup":{ - * "notify":{ - * "type":"notify", - * "sender":{ - * "guid":"kgVFf_...", - * "guid_sig":"PT9-TApz...", - * "url":"http:\/\/z.podunk.edu", - * "url_sig":"T8Bp7j5D..." - * }, - * "callback":"\/post", - * "version":1, - * "secret":"1eaa661..." - * }, - * "message":{ - * "type":"activity", - * "message_id":"10b049ce384cbb2da9467319bc98169ab36290b8bbb403aa0c0accd9cb072e76@podunk.edu", - * "message_top":"10b049ce384cbb2da9467319bc98169ab36290b8bbb403aa0c0accd9cb072e76@podunk.edu", - * "message_parent":"10b049ce384cbb2da9467319bc98169ab36290b8bbb403aa0c0accd9cb072e76@podunk.edu", - * "created":"2012-11-20 04:04:16", - * "edited":"2012-11-20 04:04:16", - * "title":"", - * "body":"Hi Nickordo", - * "app":"", - * "verb":"post", - * "object_type":"", - * "target_type":"", - * "permalink":"", - * "location":"", - * "longlat":"", - * "owner":{ - * "name":"Indigo", - * "address":"indigo@podunk.edu", - * "url":"http:\/\/podunk.edu", - * "photo":{ - * "mimetype":"image\/jpeg", - * "src":"http:\/\/podunk.edu\/photo\/profile\/m\/5" - * }, - * "guid":"kgVFf_...", - * "guid_sig":"PT9-TAp...", - * }, - * "author":{ - * "name":"Indigo", - * "address":"indigo@podunk.edu", - * "url":"http:\/\/podunk.edu", - * "photo":{ - * "mimetype":"image\/jpeg", - * "src":"http:\/\/podunk.edu\/photo\/profile\/m\/5" - * }, - * "guid":"kgVFf_...", - * "guid_sig":"PT9-TAp..." - * } - * } - * } - * } - * \endcode - * - * Currently defined message types are 'activity', 'mail', 'profile', 'location' - * and 'channel_sync', which each have different content schemas. - * - * Ping packet: - * A ping packet does not require any parameters except the type. It may or may - * not be encrypted. - * - * \code{.json} - * { - * "type": "ping" - * } - * \endcode - * - * On receipt of a ping packet a ping response will be returned: - * - * \code{.json} - * { - * "success" : 1, - * "site" { - * "url": "http:\/\/podunk.edu", - * "url_sig": "T8Bp7j5...", - * "sitekey": "-----BEGIN PUBLIC KEY----- - * MIICIjANBgkqhkiG9w0BAQE..." - * } - * } - * \endcode - * - * The ping packet can be used to verify that a site has not been re-installed, and to - * initiate corrective action if it has. The url_sig is signed with the site private key - * and base64url encoded - and this should verify with the enclosed sitekey. Failure to - * verify indicates the site is corrupt or otherwise unable to communicate using zot. - * This return packet is not otherwise verified, so should be compared with other - * results obtained from this site which were verified prior to taking action. For instance - * if you have one verified result with this signature and key, and other records for this - * url which have different signatures and keys, it indicates that the site was re-installed - * and corrective action may commence (remove or mark invalid any entries with different - * signatures). - * If you have no records which match this url_sig and key - no corrective action should - * be taken as this packet may have been returned by an imposter. - * - * @param[in,out] App &$a - */ function post_post(&$a) { - $encrypted_packet = false; - $ret = array('success' => false); - - $data = json_decode($_REQUEST['data'],true); - - /* - * Many message packets will arrive encrypted. The existence of an 'iv' - * element tells us we need to unencapsulate the AES-256-CBC content using - * the site private key. - */ - - if($data && array_key_exists('iv',$data)) { - $encrypted_packet = true; - $data = crypto_unencapsulate($data,get_config('system','prvkey')); - logger('mod_zot: decrypt1: ' . $data, LOGGER_DATA); - $data = json_decode($data,true); - } - - if(! $data) { - - // possible Bleichenbacher's attack, just treat it as a - // message we have no handler for. It should fail a bit - // further along with "no hub". Our public key is public - // knowledge. There's no reason why anybody should get the - // encryption wrong unless they're fishing or hacking. If - // they're developing and made a goof, this can be discovered - // in the logs of the destination site. If they're fishing or - // hacking, the bottom line is we can't verify their hub. - // That's all we're going to tell them. - - $data = array('type' => 'bogus'); - } - - - $msgtype = ((array_key_exists('type',$data)) ? $data['type'] : ''); - - if($msgtype === 'ping') { - - // Useful to get a health check on a remote site. - // This will let us know if any important communication details - // that we may have stored are no longer valid, regardless of xchan details. - logger('POST: got ping send pong now back: ' . z_root() , LOGGER_DEBUG ); - - $ret['success'] = true; - $ret['site'] = array(); - $ret['site']['url'] = z_root(); - $ret['site']['url_sig'] = base64url_encode(rsa_sign(z_root(),get_config('system','prvkey'))); - $ret['site']['sitekey'] = get_config('system','pubkey'); - json_return_and_die($ret); - } - - - if($msgtype === 'pickup') { - - /* - * The 'pickup' message arrives with a tracking ID which is associated with a particular outq_hash - * First verify that that the returned signatures verify, then check that we have an outbound queue item - * with the correct hash. - * If everything verifies, find any/all outbound messages in the queue for this hubloc and send them back - */ - - if((! $data['secret']) || (! $data['secret_sig'])) { - $ret['message'] = 'no verification signature'; - logger('mod_zot: pickup: ' . $ret['message'], LOGGER_DEBUG); - json_return_and_die($ret); - } - $r = q("select distinct hubloc_sitekey from hubloc where hubloc_url = '%s' and hubloc_callback = '%s' and hubloc_sitekey != '' group by hubloc_sitekey ", - dbesc($data['url']), - dbesc($data['callback']) - ); - if(! $r) { - $ret['message'] = 'site not found'; - logger('mod_zot: pickup: ' . $ret['message']); - json_return_and_die($ret); - } - - foreach ($r as $hubsite) { + require_once('Zotlabs/Zot/Receiver.php'); + require_once('Zotlabs/Zot/ZotHandler.php'); - // verify the url_sig - // If the server was re-installed at some point, there could be multiple hubs with the same url and callback. - // Only one will have a valid key. - - $forgery = true; - $secret_fail = true; - - $sitekey = $hubsite['hubloc_sitekey']; - - logger('mod_zot: Checking sitekey: ' . $sitekey, LOGGER_DATA); - - if(rsa_verify($data['callback'],base64url_decode($data['callback_sig']),$sitekey)) { - $forgery = false; - } - if(rsa_verify($data['secret'],base64url_decode($data['secret_sig']),$sitekey)) { - $secret_fail = false; - } - if((! $forgery) && (! $secret_fail)) - break; - } - - if($forgery) { - $ret['message'] = 'possible site forgery'; - logger('mod_zot: pickup: ' . $ret['message']); - json_return_and_die($ret); - } - - if($secret_fail) { - $ret['message'] = 'secret validation failed'; - logger('mod_zot: pickup: ' . $ret['message']); - json_return_and_die($ret); - } - - /* - * If we made it to here, the signatures verify, but we still don't know if the tracking ID is valid. - * It wouldn't be an error if the tracking ID isn't found, because we may have sent this particular - * queue item with another pickup (after the tracking ID for the other pickup was verified). - */ - - $r = q("select outq_posturl from outq where outq_hash = '%s' and outq_posturl = '%s' limit 1", - dbesc($data['secret']), - dbesc($data['callback']) - ); - if(! $r) { - $ret['message'] = 'nothing to pick up'; - logger('mod_zot: pickup: ' . $ret['message']); - json_return_and_die($ret); - } - - /* - * Everything is good if we made it here, so find all messages that are going to this location - * and send them all. - */ - - $r = q("select * from outq where outq_posturl = '%s'", - dbesc($data['callback']) - ); - if($r) { - logger('mod_zot: successful pickup message received from ' . $data['callback'] . ' ' . count($r) . ' message(s) picked up', LOGGER_DEBUG); - - $ret['success'] = true; - $ret['pickup'] = array(); - foreach($r as $rr) { - if($rr['outq_msg']) { - $x = json_decode($rr['outq_msg'],true); - - if(! $x) - continue; - - if(array_key_exists('message_list',$x)) { - foreach($x['message_list'] as $xx) { - $ret['pickup'][] = array('notify' => json_decode($rr['outq_notify'],true),'message' => $xx); - } - } - else - $ret['pickup'][] = array('notify' => json_decode($rr['outq_notify'],true),'message' => $x); - - $x = q("delete from outq where outq_hash = '%s'", - dbesc($rr['outq_hash']) - ); - } - } - } - - $encrypted = crypto_encapsulate(json_encode($ret),$sitekey); - json_return_and_die($encrypted); - - /* pickup: end */ - } - - - /* - * All other message types require us to verify the sender. This is a generic check, so we - * will do it once here and bail if anything goes wrong. - */ - - if (array_key_exists('sender',$data)) { - $sender = $data['sender']; - } - - /* Check if the sender is already verified here */ - - $hubs = zot_gethub($sender,true); - - if (! $hubs) { - - /* Have never seen this guid or this guid coming from this location. Check it and register it. */ - - // (!!) this will validate the sender - $result = zot_register_hub($sender); - - if ((! $result['success']) || (! ($hubs = zot_gethub($sender,true)))) { - $ret['message'] = 'Hub not available.'; - logger('mod_zot: no hub'); - json_return_and_die($ret); - } - } - - - foreach($hubs as $hub) { - - $sitekey = $hub['hubloc_sitekey']; - - if(array_key_exists('sitekey',$sender) && $sender['sitekey']) { - - /* - * This hub has now been proven to be valid. - * Any hub with the same URL and a different sitekey cannot be valid. - * Get rid of them (mark them deleted). There's a good chance they were re-installs. - */ + $z = new Zotlabs\Zot\Receiver($_REQUEST['data'],get_config('system','prvkey'), new Zotlabs\Zot\ZotHandler()); - q("update hubloc set hubloc_deleted = 1, hubloc_error = 1 where hubloc_url = '%s' and hubloc_sitekey != '%s' ", - dbesc($hub['hubloc_url']), - dbesc($sender['sitekey']) - ); - - $sitekey = $sender['sitekey']; - } - - // $sender['sitekey'] is a new addition to the protcol to distinguish - // hublocs coming from re-installed sites. Older sites will not provide - // this field and we have to still mark them valid, since we can't tell - // if this hubloc has the same sitekey as the packet we received. - - - // Update our DB to show when we last communicated successfully with this hub - // This will allow us to prune dead hubs from using up resources - - $r = q("update hubloc set hubloc_connected = '%s' where hubloc_id = %d and hubloc_sitekey = '%s' ", - dbesc(datetime_convert()), - intval($hub['hubloc_id']), - dbesc($sitekey) - ); - - // a dead hub came back to life - reset any tombstones we might have - - if(intval($hub['hubloc_error'])) { - q("update hubloc set hubloc_error = 0 where hubloc_id = %d and hubloc_sitekey = '%s' ", - intval($hub['hubloc_id']), - dbesc($sitekey) - ); - if(intval($r[0]['hubloc_orphancheck'])) { - q("update hubloc set hubloc_orhpancheck = 0 where hubloc_id = %d and hubloc_sitekey = '%s' ", - intval($hub['hubloc_id']), - dbesc($sitekey) - ); - } - q("update xchan set xchan_orphan = 0 where xchan_orphan = 1 and xchan_hash = '%s'", - dbesc($hub['hubloc_hash']) - ); - } - - $connecting_url = $hub['hubloc_url']; - } - - - /** @TODO check which hub is primary and take action if mismatched */ - - if (array_key_exists('recipients', $data)) - $recipients = $data['recipients']; - + // notreached; - if ($msgtype === 'auth_check') { - - /* - * Requestor visits /magic/?dest=somewhere on their own site with a browser - * magic redirects them to $destsite/post [with auth args....] - * $destsite sends an auth_check packet to originator site - * The auth_check packet is handled here by the originator's site - * - the browser session is still waiting - * inside $destsite/post for everything to verify - * If everything checks out we'll return a token to $destsite - * and then $destsite will verify the token, authenticate the browser - * session and then redirect to the original destination. - * If authentication fails, the redirection to the original destination - * will still take place but without authentication. - */ - logger('mod_zot: auth_check', LOGGER_DEBUG); - - if (! $encrypted_packet) { - logger('mod_zot: auth_check packet was not encrypted.'); - $ret['message'] .= 'no packet encryption' . EOL; - json_return_and_die($ret); - } - - $arr = $data['sender']; - $sender_hash = make_xchan_hash($arr['guid'],$arr['guid_sig']); - - // garbage collect any old unused notifications - - // This was and should be 10 minutes but my hosting provider has time lag between the DB and - // the web server. We should probably convert this to webserver time rather than DB time so - // that the different clocks won't affect it and allow us to keep the time short. - - q("delete from verify where type = 'auth' and created < %s - INTERVAL %s", - db_utcnow(), db_quoteinterval('30 MINUTE') - ); - - $y = q("select xchan_pubkey from xchan where xchan_hash = '%s' limit 1", - dbesc($sender_hash) - ); - - // We created a unique hash in mod/magic.php when we invoked remote auth, and stored it in - // the verify table. It is now coming back to us as 'secret' and is signed by a channel at the other end. - // First verify their signature. We will have obtained a zot-info packet from them as part of the sender - // verification. - - if ((! $y) || (! rsa_verify($data['secret'], base64url_decode($data['secret_sig']),$y[0]['xchan_pubkey']))) { - logger('mod_zot: auth_check: sender not found or secret_sig invalid.'); - $ret['message'] .= 'sender not found or sig invalid ' . print_r($y,true) . EOL; - json_return_and_die($ret); - } - - // There should be exactly one recipient, the original auth requestor - - $ret['message'] .= 'recipients ' . print_r($recipients,true) . EOL; - - if ($data['recipients']) { - - $arr = $data['recipients'][0]; - $recip_hash = make_xchan_hash($arr['guid'], $arr['guid_sig']); - $c = q("select channel_id, channel_account_id, channel_prvkey from channel where channel_hash = '%s' limit 1", - dbesc($recip_hash) - ); - if (! $c) { - logger('mod_zot: auth_check: recipient channel not found.'); - $ret['message'] .= 'recipient not found.' . EOL; - json_return_and_die($ret); - } - - $confirm = base64url_encode(rsa_sign($data['secret'] . $recip_hash,$c[0]['channel_prvkey'])); - - // This additionally checks for forged sites since we already stored the expected result in meta - // and we've already verified that this is them via zot_gethub() and that their key signed our token - - $z = q("select id from verify where channel = %d and type = 'auth' and token = '%s' and meta = '%s' limit 1", - intval($c[0]['channel_id']), - dbesc($data['secret']), - dbesc($data['sender']['url']) - ); - if (! $z) { - logger('mod_zot: auth_check: verification key not found.'); - $ret['message'] .= 'verification key not found' . EOL; - json_return_and_die($ret); - } - $r = q("delete from verify where id = %d", - intval($z[0]['id']) - ); - - $u = q("select account_service_class from account where account_id = %d limit 1", - intval($c[0]['channel_account_id']) - ); - - logger('mod_zot: auth_check: success', LOGGER_DEBUG); - $ret['success'] = true; - $ret['confirm'] = $confirm; - if ($u && $u[0]['account_service_class']) - $ret['service_class'] = $u[0]['account_service_class']; - - // Set "do not track" flag if this site or this channel's profile is restricted - // in some way - - if (intval(get_config('system','block_public'))) - $ret['DNT'] = true; - if (! perm_is_allowed($c[0]['channel_id'],'','view_profile')) - $ret['DNT'] = true; - if (get_pconfig($c[0]['channel_id'],'system','do_not_track')) - $ret['DNT'] = true; - if (get_pconfig($c[0]['channel_id'],'system','hide_online_status')) - $ret['DNT'] = true; - - json_return_and_die($ret); - } - json_return_and_die($ret); - } - - if ($msgtype === 'request') { - // request a particular post/conversation by message_id - $x = zot_process_message_request($data); - json_return_and_die($x); - } - - if ($msgtype === 'purge') { - if ($recipients) { - // basically this means "unfriend" - foreach ($recipients as $recip) { - $r = q("select channel.*,xchan.* from channel - left join xchan on channel_hash = xchan_hash - where channel_guid = '%s' and channel_guid_sig = '%s' limit 1", - dbesc($recip['guid']), - dbesc($recip['guid_sig']) - ); - if ($r) { - $r = q("select abook_id from abook where uid = %d and abook_xchan = '%s' limit 1", - intval($r[0]['channel_id']), - dbesc(make_xchan_hash($sender['guid'],$sender['guid_sig'])) - ); - if ($r) { - contact_remove($r[0]['channel_id'],$r[0]['abook_id']); - } - } - } - } else { - // Unfriend everybody - basically this means the channel has committed suicide - $arr = $data['sender']; - $sender_hash = make_xchan_hash($arr['guid'],$arr['guid_sig']); - - require_once('include/Contact.php'); - remove_all_xchan_resources($sender_hash); - - $ret['success'] = true; - json_return_and_die($ret); - } - } - - if (($msgtype === 'refresh') || ($msgtype === 'force_refresh')) { - - // remote channel info (such as permissions or photo or something) - // has been updated. Grab a fresh copy and sync it. - // The difference between refresh and force_refresh is that - // force_refresh unconditionally creates a directory update record, - // even if no changes were detected upon processing. - - if ($recipients) { - - // This would be a permissions update, typically for one connection - - foreach ($recipients as $recip) { - $r = q("select channel.*,xchan.* from channel - left join xchan on channel_hash = xchan_hash - where channel_guid = '%s' and channel_guid_sig = '%s' limit 1", - dbesc($recip['guid']), - dbesc($recip['guid_sig']) - ); - - $x = zot_refresh(array( - 'xchan_guid' => $sender['guid'], - 'xchan_guid_sig' => $sender['guid_sig'], - 'hubloc_url' => $sender['url'] - ), $r[0], (($msgtype === 'force_refresh') ? true : false)); - } - } else { - - // system wide refresh - - $x = zot_refresh(array( - 'xchan_guid' => $sender['guid'], - 'xchan_guid_sig' => $sender['guid_sig'], - 'hubloc_url' => $sender['url'] - ), null, (($msgtype === 'force_refresh') ? true : false)); - } - $ret['success'] = true; - json_return_and_die($ret); - } - - if ($msgtype === 'notify') { - - logger('notify received from ' . $connecting_url); - - - $async = get_config('system','queued_fetch'); - - if ($async) { - // add to receive queue - // qreceive_add($data); - } else { - $x = zot_fetch($data); - $ret['delivery_report'] = $x; - } - - $ret['success'] = true; - json_return_and_die($ret); - } + exit; - // catchall - json_return_and_die($ret); } diff --git a/mod/register.php b/mod/register.php index 70bdcf350..2e9967c60 100644 --- a/mod/register.php +++ b/mod/register.php @@ -103,7 +103,9 @@ function register_post(&$a) { if($using_invites && $invite_code) { q("delete * from register where hash = '%s'", dbesc($invite_code)); - set_pconfig($result['account']['account_id'],'system','invites_remaining',$num_invites); +// @FIXME - this total needs to be stored by account, but pconfig operates on channels +// This also needs to be considered when using 'invites_remaining' in mod/invite.php +// set_pconfig($result['account']['account_id'],'system','invites_remaining',$num_invites); } if($policy == REGISTER_OPEN ) { diff --git a/mod/setup.php b/mod/setup.php index e5ac25965..5c9e988d9 100755 --- a/mod/setup.php +++ b/mod/setup.php @@ -14,7 +14,7 @@ $install_wizard_pass = 1; * * @param[in,out] App &$a */ -function setup_init(&$a){ +function setup_init(&$a) { // Ensure that if somebody hasn't read the install documentation and doesn't have all // the required modules or has a totally borked shared hosting provider and they can't diff --git a/mod/siteinfo.php b/mod/siteinfo.php index 231427290..52d014de1 100644 --- a/mod/siteinfo.php +++ b/mod/siteinfo.php @@ -1,104 +1,8 @@ <?php function siteinfo_init(&$a) { - global $db; - - if ($a->argv[1]=="json"){ - $register_policy = Array('REGISTER_CLOSED', 'REGISTER_APPROVE', 'REGISTER_OPEN'); - $directory_mode = Array('DIRECTORY_MODE_NORMAL', 'DIRECTORY_MODE_SECONDARY','DIRECTORY_MODE_PRIMARY', 'DIRECTORY_MODE_STANDALONE'); - - $sql_extra = ''; - - $r = q("select * from channel left join account on account_id = channel_account_id where ( account_roles & 4096 )>0 and account_default_channel = channel_id"); - - - if($r) { - $admin = array(); - foreach($r as $rr) { - if($rr['channel_pageflags'] & PAGE_HUBADMIN) - $admin[] = array( 'name' => $rr['channel_name'], 'address' => $rr['channel_address'] . '@' . get_app()->get_hostname(), 'channel' => z_root() . '/channel/' . $rr['channel_address']); - } - if(! $admin) { - foreach($r as $rr) { - $admin[] = array( 'name' => $rr['channel_name'], 'address' => $rr['channel_address'] . '@' . get_app()->get_hostname(), 'channel' => z_root() . '/channel/' . $rr['channel_address']); - } - } - } - else { - $admin = false; - } - - $def_service_class = get_config('system','default_service_class'); - if($def_service_class) - $service_class = get_config('service_class',$def_service_class); - else - $service_class = false; - - $visible_plugins = array(); - if(is_array($a->plugins) && count($a->plugins)) { - $r = q("select * from addon where hidden = 0"); - if(count($r)) - foreach($r as $rr) - $visible_plugins[] = $rr['name']; - } - sort($visible_plugins); - - if(@is_dir('.git') && function_exists('shell_exec')) - $commit = trim(@shell_exec('git log -1 --format="%h"')); - if(! isset($commit) || strlen($commit) > 16) - $commit = ''; - - $site_info = get_config('system','info'); - $site_name = get_config('system','sitename'); - if(! get_config('system','hidden_version_siteinfo')) { - $version = RED_VERSION; - if(@is_dir('.git') && function_exists('shell_exec')) { - $commit = trim( @shell_exec('git log -1 --format="%h"')); - if(! get_config('system','hidden_tag_siteinfo')) - $tag = trim( @shell_exec('git describe --tags --abbrev=0')); - else - $tag = ''; - } - if(! isset($commit) || strlen($commit) > 16) - $commit = ''; - } - else { - $version = $commit = ''; - } - - //Statistics - $channels_total_stat = intval(get_config('system','channels_total_stat')); - $channels_active_halfyear_stat = intval(get_config('system','channels_active_halfyear_stat')); - $channels_active_monthly_stat = intval(get_config('system','channels_active_monthly_stat')); - $local_posts_stat = intval(get_config('system','local_posts_stat')); - $hide_in_statistics = intval(get_config('system','hide_in_statistics')); - $site_expire = intval(get_config('system', 'default_expire_days')); - - - $data = Array( - 'version' => $version, - 'version_tag' => $tag, - 'commit' => $commit, - 'url' => z_root(), - 'plugins' => $visible_plugins, - 'register_policy' => $register_policy[get_config('system','register_policy')], - 'directory_mode' => $directory_mode[get_config('system','directory_mode')], - 'language' => get_config('system','language'), - 'rss_connections' => get_config('system','feed_contacts'), - 'expiration' => $site_expire, - 'default_service_restrictions' => $service_class, - 'admin' => $admin, - 'site_name' => (($site_name) ? $site_name : ''), - 'platform' => PLATFORM_NAME, - 'dbdriver' => $db->getdriver(), - 'lastpoll' => get_config('system','lastpoll'), - 'info' => (($site_info) ? $site_info : ''), - 'channels_total' => $channels_total_stat, - 'channels_active_halfyear' => $channels_active_halfyear_stat, - 'channels_active_monthly' => $channels_active_monthly_stat, - 'local_posts' => $local_posts_stat, - 'hide_in_statistics' => $hide_in_statistics - ); + if (argv(1) === 'json') { + $data = get_site_info(); json_return_and_die($data); } } @@ -111,7 +15,7 @@ function siteinfo_content(&$a) { $version = sprintf( t('Version %s'), RED_VERSION ); if(@is_dir('.git') && function_exists('shell_exec')) { $commit = @shell_exec('git log -1 --format="%h"'); - $tag = @shell_exec('git describe --tags --abbrev=0'); + $tag = get_std_version(); // @shell_exec('git describe --tags --abbrev=0'); } if(! isset($commit) || strlen($commit) > 16) $commit = ''; diff --git a/mod/siteinfo_json.php b/mod/siteinfo_json.php new file mode 100644 index 000000000..35697917c --- /dev/null +++ b/mod/siteinfo_json.php @@ -0,0 +1,8 @@ +<?php + +function siteinfo_json_init(&$a) { + + $data = get_site_info(); + json_return_and_die($data); + +} diff --git a/mod/subthread.php b/mod/subthread.php index 74d742b6a..ce087806e 100755 --- a/mod/subthread.php +++ b/mod/subthread.php @@ -147,7 +147,6 @@ function subthread_content(&$a) { $arr['deny_cid'] = $item['deny_cid']; $arr['deny_gid'] = $item['deny_gid']; - $post = item_store($arr); $post_id = $post['item_id']; diff --git a/mod/update_channel.php b/mod/update_channel.php index 5f4436d59..63a3735ea 100644 --- a/mod/update_channel.php +++ b/mod/update_channel.php @@ -39,6 +39,7 @@ function update_channel_content(&$a) { $replace = "<img\${1} dst=\"\${2}\""; // $text = preg_replace($pattern, $replace, $text); +/* if(! $load) { $replace = '<br />' . t('[Embedded content - reload page to view]') . '<br />'; $pattern = "/<\s*audio[^>]*>(.*?)<\s*\/\s*audio>/i"; @@ -50,6 +51,7 @@ function update_channel_content(&$a) { $pattern = "/<\s*iframe[^>]*>(.*?)<\s*\/\s*iframe>/i"; $text = preg_replace($pattern, $replace, $text); } +*/ /** * reportedly some versions of MSIE don't handle tabs in XMLHttpRequest documents very well diff --git a/mod/update_display.php b/mod/update_display.php index d41e2e5cb..b448c76ee 100644 --- a/mod/update_display.php +++ b/mod/update_display.php @@ -20,7 +20,7 @@ function update_display_content(&$a) { $pattern = "/<img([^>]*) src=\"([^\"]*)\"/"; $replace = "<img\${1} dst=\"\${2}\""; // $text = preg_replace($pattern, $replace, $text); - +/* if(! $load) { $replace = '<br />' . t('[Embedded content - reload page to view]') . '<br />'; $pattern = "/<\s*audio[^>]*>(.*?)<\s*\/\s*audio>/i"; @@ -32,7 +32,7 @@ function update_display_content(&$a) { $pattern = "/<\s*iframe[^>]*>(.*?)<\s*\/\s*iframe>/i"; $text = preg_replace($pattern, $replace, $text); } - +*/ echo str_replace("\t",' ',$text); echo (($_GET['msie'] == 1) ? '</div>' : '</section>'); echo "</body></html>\r\n"; diff --git a/mod/update_home.php b/mod/update_home.php index 80ae2438f..4a8000bdb 100644 --- a/mod/update_home.php +++ b/mod/update_home.php @@ -16,7 +16,7 @@ function update_home_content(&$a) { $pattern = "/<img([^>]*) src=\"([^\"]*)\"/"; $replace = "<img\${1} dst=\"\${2}\""; // $text = preg_replace($pattern, $replace, $text); - +/* if(! $load) { $replace = '<br />' . t('[Embedded content - reload page to view]') . '<br />'; $pattern = "/<\s*audio[^>]*>(.*?)<\s*\/\s*audio>/i"; @@ -28,7 +28,7 @@ function update_home_content(&$a) { $pattern = "/<\s*iframe[^>]*>(.*?)<\s*\/\s*iframe>/i"; $text = preg_replace($pattern, $replace, $text); } - +*/ echo str_replace("\t",' ',$text); echo ((array_key_exists('msie',$_GET) && $_GET['msie'] == 1) ? '</div>' : '</section>'); echo "</body></html>\r\n"; diff --git a/mod/update_network.php b/mod/update_network.php index acd5ccdc8..03c12312c 100644 --- a/mod/update_network.php +++ b/mod/update_network.php @@ -18,7 +18,7 @@ function update_network_content(&$a) { $pattern = "/<img([^>]*) src=\"([^\"]*)\"/"; $replace = "<img\${1} dst=\"\${2}\""; // $text = preg_replace($pattern, $replace, $text); - +/* if(! $load) { $replace = '<br />' . t('[Embedded content - reload page to view]') . '<br />'; $pattern = "/<\s*audio[^>]*>(.*?)<\s*\/\s*audio>/i"; @@ -30,7 +30,7 @@ function update_network_content(&$a) { $pattern = "/<\s*iframe[^>]*>(.*?)<\s*\/\s*iframe>/i"; $text = preg_replace($pattern, $replace, $text); } - +*/ echo str_replace("\t",' ',$text); echo ((array_key_exists('msie',$_GET) && $_GET['msie'] == 1) ? '</div>' : '</section>'); echo "</body></html>\r\n"; diff --git a/mod/update_public.php b/mod/update_public.php index bac1ccf15..fcec792f6 100644 --- a/mod/update_public.php +++ b/mod/update_public.php @@ -16,7 +16,7 @@ function update_public_content(&$a) { $pattern = "/<img([^>]*) src=\"([^\"]*)\"/"; $replace = "<img\${1} dst=\"\${2}\""; // $text = preg_replace($pattern, $replace, $text); - +/* if(! $load) { $replace = '<br />' . t('[Embedded content - reload page to view]') . '<br />'; $pattern = "/<\s*audio[^>]*>(.*?)<\s*\/\s*audio>/i"; @@ -28,7 +28,7 @@ function update_public_content(&$a) { $pattern = "/<\s*iframe[^>]*>(.*?)<\s*\/\s*iframe>/i"; $text = preg_replace($pattern, $replace, $text); } - +*/ echo str_replace("\t",' ',$text); echo ((array_key_exists('msie',$_GET) && $_GET['msie'] == 1) ? '</div>' : '</section>'); echo "</body></html>\r\n"; diff --git a/mod/update_search.php b/mod/update_search.php index de29e89bd..25bcffcb6 100644 --- a/mod/update_search.php +++ b/mod/update_search.php @@ -41,7 +41,7 @@ function update_search_content(&$a) { $pattern = "/<img([^>]*) src=\"([^\"]*)\"/"; $replace = "<img\${1} dst=\"\${2}\""; // $text = preg_replace($pattern, $replace, $text); - +/* if(! $load) { $replace = '<br />' . t('[Embedded content - reload page to view]') . '<br />'; $pattern = "/<\s*audio[^>]*>(.*?)<\s*\/\s*audio>/i"; @@ -53,7 +53,7 @@ function update_search_content(&$a) { $pattern = "/<\s*iframe[^>]*>(.*?)<\s*\/\s*iframe>/i"; $text = preg_replace($pattern, $replace, $text); } - +*/ /** * reportedly some versions of MSIE don't handle tabs in XMLHttpRequest documents very well */ diff --git a/mod/wall_attach.php b/mod/wall_attach.php index 8677c2b83..f52a4f2e5 100644 --- a/mod/wall_attach.php +++ b/mod/wall_attach.php @@ -6,14 +6,16 @@ require_once('include/photos.php'); function wall_attach_post(&$a) { - if(argc() > 1) - $channel = get_channel_by_nick(argv(1)); - elseif($_FILES['media']) { - require_once('include/api.php'); - $user_info = api_get_user($a); + $using_api = false; + + if($a->data['api_info'] && array_key_exists('media',$_FILES)) { + $using_api = true; + $user_info = $a->data['api_info']; $nick = $user_info['screen_name']; $channel = get_channel_by_nick($user_info['screen_name']); - } + } + elseif(argc() > 1) + $channel = get_channel_by_nick(argv(1)); if(! $channel) killme(); @@ -49,12 +51,16 @@ function wall_attach_post(&$a) { } if(intval($r['data']['is_photo'])) { - echo "\n\n" . $r['body'] . "\n\n"; - if($using_api) - return; - killme(); + $s = "\n\n" . $r['body'] . "\n\n"; + } + else { + $s = "\n\n" . '[attachment]' . $r['data']['hash'] . ',' . $r['data']['revision'] . '[/attachment]' . "\n"; } - echo "\n\n" . '[attachment]' . $r['data']['hash'] . ',' . $r['data']['revision'] . '[/attachment]' . "\n"; + + if($using_api) + return $s; + + echo $s; killme(); } |