From 05654e498034329759351c4a64349734ce6b7204 Mon Sep 17 00:00:00 2001 From: zotlabs Date: Mon, 4 Sep 2017 21:02:44 -0700 Subject: card embed improved --- Zotlabs/Module/Oep.php | 4 ++-- include/bbcode.php | 7 ++++++- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/Zotlabs/Module/Oep.php b/Zotlabs/Module/Oep.php index 9a1317142..5e06d3540 100644 --- a/Zotlabs/Module/Oep.php +++ b/Zotlabs/Module/Oep.php @@ -172,7 +172,7 @@ class Oep extends \Zotlabs\Web\Controller { if(! perm_is_allowed($channel['channel_id'],get_observer_hash(),'view_pages')) return $ret; - $sql_extra = items_permissions_sql($channel['channel_id'],get_observer_hash()); + $sql_extra = item_permissions_sql($channel['channel_id'],get_observer_hash()); $r = q("select * from iconfig where iconfig.cat = 'system' and iconfig.k = 'CARD' and iconfig.v = '%s' limit 1", dbesc($res) @@ -183,7 +183,7 @@ class Oep extends \Zotlabs\Web\Controller { else { return $ret; } - + $r = q("select * from item where item.uid = %d and item_type = %d $sql_extra order by item.created desc", diff --git a/include/bbcode.php b/include/bbcode.php index 470854f06..9a2a6eb9b 100644 --- a/include/bbcode.php +++ b/include/bbcode.php @@ -327,11 +327,16 @@ function bb_ShareAttributes($match) { if ($avatar != "") $headline .= '' . $author . ''; + if(strpos($link,'/cards/')) + $type = t('card'); + else + $type = t('post'); + // Bob Smith wrote the following post 2 hours ago $fmt = sprintf( t('%1$s wrote the following %2$s %3$s'), '' . $author . '', - '' . t('post') . '', + '' . $type . '', $reldate ); -- cgit v1.2.3 From 83d0e48ebe4ba4b8b3ca5918bde98a1aaf005c31 Mon Sep 17 00:00:00 2001 From: zotlabs Date: Mon, 4 Sep 2017 21:49:44 -0700 Subject: some preliminary work on Zot VI --- Zotlabs/Module/Zfinger.php | 3 ++- Zotlabs/Zot/Finger.php | 22 +++++++++++++++++----- 2 files changed, 19 insertions(+), 6 deletions(-) diff --git a/Zotlabs/Module/Zfinger.php b/Zotlabs/Module/Zfinger.php index b978b9769..0f7f6a64b 100644 --- a/Zotlabs/Module/Zfinger.php +++ b/Zotlabs/Module/Zfinger.php @@ -25,7 +25,8 @@ class Zfinger extends \Zotlabs\Web\Controller { if($chan) { $hash = \Zotlabs\Web\HTTPSig::generate_digest($ret,false); $headers['Digest'] = 'SHA-256=' . $hash; - \Zotlabs\Web\HTTPSig::create_sig('',$headers,$chan['channel_prvkey'],z_root() . '/channel/' . $chan['channel_address'],true); + \Zotlabs\Web\HTTPSig::create_sig('',$headers,$chan['channel_prvkey'], + 'acct:' . $chan['channel_address'] . '@' . \App::get_hostname(),true); } else { foreach($headers as $k => $v) { diff --git a/Zotlabs/Zot/Finger.php b/Zotlabs/Zot/Finger.php index 9871b5bbd..865e78517 100644 --- a/Zotlabs/Zot/Finger.php +++ b/Zotlabs/Zot/Finger.php @@ -22,6 +22,7 @@ class Finger { * * @return zotinfo array (with 'success' => true) or array('success' => false); */ + static public function run($webbie, $channel = null, $autofallback = true) { $ret = array('success' => false); @@ -84,18 +85,27 @@ class Finger { 'token' => self::$token ); - $result = z_post_url($url . $rhs,$postvars); + $headers = []; + $headers['X-Zot-Channel'] = $channel['channel_address'] . '@' . \App::get_hostname(); + $headers['X-Zot-Nonce'] = random_string(); + $xhead = \Zotlabs\Web\HTTPSig::create_sig('',$headers,$channel['channel_prvkey'], + 'acct:' . $channel['channel_address'] . '@' . \App::get_hostname(),false); + + $retries = 0; + + $result = z_post_url($url . $rhs,$postvars,$retries, [ 'headers' => $xhead ]); if ((! $result['success']) && ($autofallback)) { if ($https) { logger('zot_finger: https failed. falling back to http'); - $result = z_post_url('http://' . $host . $rhs,$postvars); + $result = z_post_url('http://' . $host . $rhs,$postvars, $retries, [ 'headers' => $xhead ]); } } - } else { + } + else { $rhs .= '?f=&address=' . urlencode($address) . '&token=' . self::$token; - $result = z_fetch_url($url . $rhs); + $result = z_fetch_url($url . $rhs); if((! $result['success']) && ($autofallback)) { if($https) { logger('zot_finger: https failed. falling back to http'); @@ -110,8 +120,10 @@ class Finger { return $ret; } + $verify = \Zotlabs\Web\HTTPSig::verify($result); + $x = json_decode($result['body'], true); - if($x) { + if($x && (! $verify['header_valid'])) { $signed_token = ((is_array($x) && array_key_exists('signed_token', $x)) ? $x['signed_token'] : null); if($signed_token) { $valid = rsa_verify('token.' . self::$token, base64url_decode($signed_token), $x['key']); -- cgit v1.2.3 From d58f965b9ab58acd3f218cce3c9d428e27315045 Mon Sep 17 00:00:00 2001 From: zotlabs Date: Mon, 4 Sep 2017 22:30:55 -0700 Subject: some more prep work for Zot VI - some of this will need to be undone or at least re-arranged later but we need to bootstrap a test environment. --- Zotlabs/Web/HTTPSig.php | 13 ++++++++++--- Zotlabs/Zot/Finger.php | 5 +++-- 2 files changed, 13 insertions(+), 5 deletions(-) diff --git a/Zotlabs/Web/HTTPSig.php b/Zotlabs/Web/HTTPSig.php index e9e262125..2b139a2a1 100644 --- a/Zotlabs/Web/HTTPSig.php +++ b/Zotlabs/Web/HTTPSig.php @@ -126,9 +126,16 @@ class HTTPSig { function get_activitypub_key($id) { - $x = q("select xchan_pubkey from xchan where xchan_hash = '%s' and xchan_network = 'activitypub' ", - dbesc($id) - ); + if(strpos($id,'acct:') === 0) { + $x = q("select xchan_pubkey from xchan left join hubloc on xchan_hash = hubloc_hash where hubloc_addr = '%s' limit 1", + dbesc(str_replace('acct:','',$id)) + ); + } + else { + $x = q("select xchan_pubkey from xchan where xchan_hash = '%s' and xchan_network = 'activitypub' ", + dbesc($id) + ); + } if($x && $x[0]['xchan_pubkey']) { return ($x[0]['xchan_pubkey']); diff --git a/Zotlabs/Zot/Finger.php b/Zotlabs/Zot/Finger.php index 865e78517..e205b136f 100644 --- a/Zotlabs/Zot/Finger.php +++ b/Zotlabs/Zot/Finger.php @@ -120,9 +120,10 @@ class Finger { return $ret; } - $verify = \Zotlabs\Web\HTTPSig::verify($result); - $x = json_decode($result['body'], true); + + $verify = \Zotlabs\Web\HTTPSig::verify($result,(($x) ? $x['key'] : ''); + if($x && (! $verify['header_valid'])) { $signed_token = ((is_array($x) && array_key_exists('signed_token', $x)) ? $x['signed_token'] : null); if($signed_token) { -- cgit v1.2.3 From 842a041a888434df7d6312db08ce805c5ee21bf7 Mon Sep 17 00:00:00 2001 From: zotlabs Date: Tue, 5 Sep 2017 16:38:55 -0700 Subject: remove period from characters allowed in username, as this will mess up URL based content-type negotiation. It was previously disallowed but permitted a month or two ago after seeing Diaspora started allowing it. It's OK if they have it, but we can't; as many of our urls are based on username and theirs are primarily based on uid. --- include/channel.php | 4 ++-- include/text.php | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/include/channel.php b/include/channel.php index faf28df28..41feca362 100644 --- a/include/channel.php +++ b/include/channel.php @@ -52,7 +52,7 @@ function identity_check_service_class($account_id) { * * This action is pluggable. * We're currently only checking for an empty name or one that exceeds our - * storage limit (255 chars). 255 chars is probably going to create a mess on + * storage limit (191 chars). 191 chars is probably going to create a mess on * some pages. * Plugins can set additional policies such as full name requirements, character * sets, multi-byte length, etc. @@ -67,7 +67,7 @@ function validate_channelname($name) { if (! $name) return t('Empty name'); - if (strlen($name) > 255) + if (mb_strlen($name) > 191) return t('Name too long'); $arr = ['name' => $name]; diff --git a/include/text.php b/include/text.php index ea21e2184..a3c2bbc08 100644 --- a/include/text.php +++ b/include/text.php @@ -1984,14 +1984,14 @@ function is_a_date_arg($s) { } function legal_webbie($s) { - if(! strlen($s)) + if(! $s) return ''; - // WARNING: This regex will not work in a federated environment. + // WARNING: This regex may not work in a federated environment. // You will probably want something like // preg_replace('/([^a-z0-9\_])/','',strtolower($s)); - $r = preg_replace('/([^a-z0-9\-\_\.])/','',strtolower($s)); + $r = preg_replace('/([^a-z0-9\-\_])/','',strtolower($s)); $x = [ 'input' => $s, 'output' => $r ]; call_hooks('legal_webbie',$x); @@ -2003,7 +2003,7 @@ function legal_webbie_text() { // WARNING: This will not work in a federated environment. - $s = t('a-z, 0-9, -, _, and . only'); + $s = t('a-z, 0-9, -, and _ only'); $x = [ 'text' => $s ]; call_hooks('legal_webbie_text',$x); -- cgit v1.2.3 From 6147f819ce908d7a52f905658e827c48aad92074 Mon Sep 17 00:00:00 2001 From: zotlabs Date: Tue, 5 Sep 2017 17:12:31 -0700 Subject: avoid a security patch and resultant compatibility issues; instead restrict the input characters we accept in token verification strings to hex digits. This will all be changing in the coming weeks/months anyway. --- Zotlabs/Zot/Auth.php | 1 - include/zot.php | 3 +-- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/Zotlabs/Zot/Auth.php b/Zotlabs/Zot/Auth.php index 44f01174e..8d198f506 100644 --- a/Zotlabs/Zot/Auth.php +++ b/Zotlabs/Zot/Auth.php @@ -167,7 +167,6 @@ class Auth { dbesc($hubloc['hubloc_url']) ); - // needs a nonce!!!! $p = zot_build_packet($channel,$type = 'auth_check', array(array('guid' => $hubloc['hubloc_guid'],'guid_sig' => $hubloc['hubloc_guid_sig'])), $hubloc['hubloc_sitekey'], (($x) ? $x[0]['site_crypto'] : ''), $this->sec); diff --git a/include/zot.php b/include/zot.php index 56bd7d212..cb213eff3 100644 --- a/include/zot.php +++ b/include/zot.php @@ -137,7 +137,7 @@ function zot_build_packet($channel, $type = 'notify', $recipients = null, $remot } if ($secret) { - $data['secret'] = $secret; + $data['secret'] = preg_replace('/[^0-9a-fA-F]/','',$secret); $data['secret_sig'] = base64url_encode(rsa_sign($secret,$channel['channel_prvkey'],$sig_method)); } @@ -4621,7 +4621,6 @@ function zot_reply_auth_check($data,$encrypted_packet) { // First verify their signature. We will have obtained a zot-info packet from them as part of the sender // verification. - // needs a nonce!!!! if ((! $y) || (! rsa_verify($data['secret'], base64url_decode($data['secret_sig']),$y[0]['xchan_pubkey']))) { logger('mod_zot: auth_check: sender not found or secret_sig invalid.'); $ret['message'] .= 'sender not found or sig invalid ' . print_r($y,true) . EOL; -- cgit v1.2.3 From 45eb61bcf079557094fed8714afc994f1120e6db Mon Sep 17 00:00:00 2001 From: zotlabs Date: Tue, 5 Sep 2017 18:32:37 -0700 Subject: provide sharing of cards --- Zotlabs/Lib/ThreadItem.php | 3 ++- Zotlabs/Module/Rpost.php | 41 +++++++++++++++++++++++++++++++++++++++++ include/conversation.php | 1 + view/tpl/conv_item.tpl | 2 +- view/tpl/conv_list.tpl | 2 +- view/tpl/jot-header.tpl | 27 ++++++++++++++++----------- 6 files changed, 62 insertions(+), 14 deletions(-) diff --git a/Zotlabs/Lib/ThreadItem.php b/Zotlabs/Lib/ThreadItem.php index d33f3c183..d916ce2c1 100644 --- a/Zotlabs/Lib/ThreadItem.php +++ b/Zotlabs/Lib/ThreadItem.php @@ -313,7 +313,8 @@ class ThreadItem { $tmp_item = array( 'template' => $this->get_template(), - 'mode' => $mode, + 'mode' => $mode, + 'item_type' => intval($item['item_type']), 'type' => implode("",array_slice(explode("/",$item['verb']),-1)), 'body' => $body['html'], 'tags' => $body['tags'], diff --git a/Zotlabs/Module/Rpost.php b/Zotlabs/Module/Rpost.php index 56f4f23f6..e716d1330 100644 --- a/Zotlabs/Module/Rpost.php +++ b/Zotlabs/Module/Rpost.php @@ -20,6 +20,7 @@ require_once('include/zot.php'); * body= Body of post * url= URL which will be parsed and the results appended to the body * source= Source application + * post_id= post_id of post to 'share' (local use only) * remote_return= absolute URL to return after posting is finished * type= choices are 'html' or 'bbcode', default is 'bbcode' * @@ -108,6 +109,46 @@ class Rpost extends \Zotlabs\Web\Controller { if($x['success']) $_REQUEST['body'] = $_REQUEST['body'] . $x['body']; } + + if($_REQUEST['post_id']) { + $r = q("SELECT * from item WHERE id = %d LIMIT 1", + intval($_REQUEST['post_id']) + ); + if(($r) && (! intval($r[0]['item_private']))) { + $sql_extra = item_permissions_sql($r[0]['uid']); + + $r = q("select * from item where id = %d $sql_extra", + intval($_REQUEST['post_id']) + ); + if($r && $r[0]['mimetype'] === 'text/bbcode') { + + xchan_query($r); + + $is_photo = (($r[0]['obj_type'] === ACTIVITY_OBJ_PHOTO) ? true : false); + if($is_photo) { + $object = json_decode($r[0]['obj'],true); + $photo_bb = $object['body']; + } + + if (strpos($r[0]['body'], "[/share]") !== false) { + $pos = strpos($r[0]['body'], "[share"); + $i = substr($r[0]['body'], $pos); + } else { + $i = "[share author='".urlencode($r[0]['author']['xchan_name']). + "' profile='".$r[0]['author']['xchan_url'] . + "' avatar='".$r[0]['author']['xchan_photo_s']. + "' link='".$r[0]['plink']. + "' posted='".$r[0]['created']. + "' message_id='".$r[0]['mid']."']"; + if($r[0]['title']) + $i .= '[b]'.$r[0]['title'].'[/b]'."\r\n"; + $i .= (($is_photo) ? $photo_bb . "\r\n" . $r[0]['body'] : $r[0]['body']); + $i .= "[/share]"; + } + } + } + $_REQUEST['body'] = $_REQUEST['body'] . $i; + } $x = array( 'is_owner' => true, diff --git a/include/conversation.php b/include/conversation.php index ec445ba4c..c034e8a65 100644 --- a/include/conversation.php +++ b/include/conversation.php @@ -709,6 +709,7 @@ function conversation($items, $mode, $update, $page_mode = 'traditional', $prepa $tmp_item = array( 'template' => $tpl, 'toplevel' => 'toplevel_item', + 'item_type' => intval($item['item_type']), 'mode' => $mode, 'approve' => t('Approve'), 'delete' => t('Delete'), diff --git a/view/tpl/conv_item.tpl b/view/tpl/conv_item.tpl index 663b02890..b3fe60750 100755 --- a/view/tpl/conv_item.tpl +++ b/view/tpl/conv_item.tpl @@ -151,7 +151,7 @@