From 6b02c664fb9444d66322605c408bb791457ee0b5 Mon Sep 17 00:00:00 2001 From: "M. Dent" Date: Sun, 25 Nov 2018 10:22:09 +0100 Subject: Do not store serialized pconfig value received via to Module/Pconfig.php --- Zotlabs/Module/Pconfig.php | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'Zotlabs/Module') diff --git a/Zotlabs/Module/Pconfig.php b/Zotlabs/Module/Pconfig.php index 44fe5d9a9..f31d5fdf6 100644 --- a/Zotlabs/Module/Pconfig.php +++ b/Zotlabs/Module/Pconfig.php @@ -22,6 +22,11 @@ class Pconfig extends \Zotlabs\Web\Controller { $k = trim(escape_tags($_POST['k'])); $v = trim($_POST['v']); $aj = intval($_POST['aj']); + + // Do not store "serialized" data received in the $_POST + if (preg_match('|^a:[0-9]+:{.*}$|s',$v) || preg_match('O:8:"stdClass":[0-9]+:{.*}$|s',$v)) { + return; + } if(in_array(argv(2),$this->disallowed_pconfig())) { notice( t('This setting requires special processing and editing has been blocked.') . EOL); -- cgit v1.2.3 From 19e4f3c2f082278e524c463cce7ce0858a2258f8 Mon Sep 17 00:00:00 2001 From: zotlabs Date: Tue, 27 Nov 2018 11:53:02 -0800 Subject: prevent incompatible export files (osada/zap) from being imported. This is to keep your DB from getting trashed. We probably need a similar thing for item import since the object formats aren't compatible --- Zotlabs/Module/Import.php | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'Zotlabs/Module') diff --git a/Zotlabs/Module/Import.php b/Zotlabs/Module/Import.php index 6016328a5..0daf28aa9 100644 --- a/Zotlabs/Module/Import.php +++ b/Zotlabs/Module/Import.php @@ -127,6 +127,15 @@ class Import extends \Zotlabs\Web\Controller { // // } + + // prevent incompatible osada or zap data from horking your database + + if(array_path_exists('compatibility/codebase',$data)) { + notice('Data export format is not compatible with this software'); + return; + } + + if($moving) $seize = 1; -- cgit v1.2.3 From bd0fc8a2d7f71e9b9d6fa768fa30484bcb7e22f2 Mon Sep 17 00:00:00 2001 From: Max Kostikov Date: Thu, 29 Nov 2018 10:38:25 +0100 Subject: Add photo cache hooks --- Zotlabs/Module/Photo.php | 90 ++++++++++++++++++++++++++++++------------------ 1 file changed, 57 insertions(+), 33 deletions(-) (limited to 'Zotlabs/Module') diff --git a/Zotlabs/Module/Photo.php b/Zotlabs/Module/Photo.php index 30e8340e2..55e92ca04 100644 --- a/Zotlabs/Module/Photo.php +++ b/Zotlabs/Module/Photo.php @@ -1,19 +1,19 @@ false, // Cache off + 'age' => 86400, // max-age + 'exp' => true, // Use own max-age + 'leak' => false // Do not allow non members use our cache + ); + call_hooks('cache_mode_hook', $cache_mode); + $observer_xchan = get_observer_hash(); $ismodified = $_SERVER['HTTP_IF_MODIFIED_SINCE']; @@ -106,13 +114,14 @@ class Photo extends \Zotlabs\Web\Controller { License link: http://creativecommons.org/licenses/by/3.0/ */ + // @FIXME It seems this part doesn't work because we are not setting such cookie $cookie_value = false; if (isset($_COOKIE['devicePixelRatio'])) { $cookie_value = intval($_COOKIE['devicePixelRatio']); } else { // Force revalidation of cache on next request - $cache_directive = 'no-cache'; + // $prvcachecontrol = 'no-cache'; $status = 'no cookie'; } @@ -129,27 +138,44 @@ class Photo extends \Zotlabs\Web\Controller { $resolution = 1; } - $r = q("SELECT uid, photo_usage FROM photo WHERE resource_id = '%s' AND imgscale = %d LIMIT 1", + $r = q("SELECT uid, photo_usage, expires, display_path FROM photo WHERE resource_id = '%s' AND imgscale = %d LIMIT 1", dbesc($photo), intval($resolution) ); if($r) { - $allowed = (-1); - if(intval($r[0]['photo_usage'])) { + $u = intval($r[0]['photo_usage']); + if($u) { $allowed = 1; - if(intval($r[0]['photo_usage']) === PHOTO_COVER) + if($u === PHOTO_COVER) if($resolution < PHOTO_RES_COVER_1200) $allowed = (-1); - if(intval($r[0]['photo_usage']) === PHOTO_PROFILE) + if($u === PHOTO_PROFILE) if(! in_array($resolution,[4,5,6])) $allowed = (-1); + if($u === PHOTO_CACHE) { + $origurl = $r[0]['display_path']; + // Cached image leak protection + if(! (local_channel() || $cache_mode['leak'])) { + header("Location: " . $origurl); + killme(); + } + // Revalidate cache + if($cache_mode['on'] && strtotime($r[0]['expires']) - 60 < time()) { + $cache = array( + 'url' => $origurl, + 'uid' => $r[0]['uid'] + ); + call_hooks('cache_url_hook', $cache); + if(! $cache['status']) + http_status_exit(404,'not found'); + } + } } - if($allowed === (-1)) { + if($allowed === (-1)) $allowed = attach_can_view($r[0]['uid'],$observer_xchan,$photo); - } $channel = channelx_by_n($r[0]['uid']); @@ -160,16 +186,19 @@ class Photo extends \Zotlabs\Web\Controller { ); $exists = (($e) ? true : false); - + if($exists && $allowed) { + $expires = strtotime($e[0]['expires'] . 'Z'); $data = dbunescbin($e[0]['content']); $filesize = $e[0]['filesize']; $mimetype = $e[0]['mimetype']; $modified = strtotime($e[0]['edited'] . 'Z'); - if(intval($e[0]['os_storage'])) + + if(intval($e[0]['os_storage'])) { $streaming = $data; + } if($e[0]['allow_cid'] != '' || $e[0]['allow_gid'] != '' || $e[0]['deny_gid'] != '' || $e[0]['deny_gid'] != '') - $prvcachecontrol = true; + $prvcachecontrol = 'no-store, no-cache, must-revalidate'; } else { if(! $allowed) { @@ -180,9 +209,9 @@ class Photo extends \Zotlabs\Web\Controller { } } - } else { + } + else http_status_exit(404,'not found'); - } } header_remove('Pragma'); @@ -225,24 +254,14 @@ class Photo extends \Zotlabs\Web\Controller { $mimetype = $ph->getType(); } } - - // @FIXME Seems never invoked - // Writing in cachefile - if (isset($cachefile) && $cachefile != '') { - file_put_contents($cachefile, $data); - $modified = filemtime($cachefile); - } - - header("Content-type: " . $mimetype); - - if($prvcachecontrol) { + if(isset($prvcachecontrol)) { // it is a private photo that they have no permission to view. // tell the browser not to cache it, in case they authenticate // and subsequently have permission to see it - header("Cache-Control: no-store, no-cache, must-revalidate"); + header("Cache-Control: " . $prvcachecontrol); } else { @@ -255,18 +274,23 @@ class Photo extends \Zotlabs\Web\Controller { // This has performance considerations but we highly recommend you // leave it alone. - $cache = get_config('system','photo_cache_time', 86400); // 1 day by default + $maxage = $cache_mode['age']; - header("Expires: " . gmdate("D, d M Y H:i:s", time() + $cache) . " GMT"); - header("Cache-Control: max-age=" . $cache); + if($cache_mode['exp'] || (! isset($expires)) || (isset($expires) && $expires - 60 < time())) + $expires = time() + $maxage; + else + $maxage = $expires - time(); + + header("Expires: " . gmdate("D, d M Y H:i:s", $expires) . " GMT"); + header("Cache-Control: max-age=" . $maxage); } + header("Content-type: " . $mimetype); header("Last-Modified: " . gmdate("D, d M Y H:i:s", $modified) . " GMT"); header("Content-Length: " . (isset($filesize) ? $filesize : strlen($data))); // If it's a file resource, stream it. - if($streaming && $channel) { if(strpos($streaming,'store') !== false) $istream = fopen($streaming,'rb'); -- cgit v1.2.3 From 6aa99a903fd221d306c62a807cf3c1a4564f0b4d Mon Sep 17 00:00:00 2001 From: Max Kostikov Date: Thu, 29 Nov 2018 11:56:56 +0100 Subject: Code cleanup --- Zotlabs/Module/Photo.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'Zotlabs/Module') diff --git a/Zotlabs/Module/Photo.php b/Zotlabs/Module/Photo.php index 55e92ca04..b8d1c36f2 100644 --- a/Zotlabs/Module/Photo.php +++ b/Zotlabs/Module/Photo.php @@ -5,6 +5,7 @@ namespace Zotlabs\Module; require_once('include/security.php'); require_once('include/attach.php'); +require_once('include/photo/photo_driver.php'); class Photo extends \Zotlabs\Web\Controller { @@ -155,16 +156,15 @@ class Photo extends \Zotlabs\Web\Controller { if(! in_array($resolution,[4,5,6])) $allowed = (-1); if($u === PHOTO_CACHE) { - $origurl = $r[0]['display_path']; // Cached image leak protection if(! (local_channel() || $cache_mode['leak'])) { - header("Location: " . $origurl); + header("Location: " . $r[0]['display_path']); killme(); } // Revalidate cache if($cache_mode['on'] && strtotime($r[0]['expires']) - 60 < time()) { $cache = array( - 'url' => $origurl, + 'url' => $r[0]['display_path'], 'uid' => $r[0]['uid'] ); call_hooks('cache_url_hook', $cache); -- cgit v1.2.3 From f3831fa77fe62d8696f867259ae9f007a0a3d2ea Mon Sep 17 00:00:00 2001 From: Max Kostikov Date: Thu, 29 Nov 2018 21:27:06 +0100 Subject: Better cache settings logic --- Zotlabs/Module/Photo.php | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'Zotlabs/Module') diff --git a/Zotlabs/Module/Photo.php b/Zotlabs/Module/Photo.php index b8d1c36f2..d85db7307 100644 --- a/Zotlabs/Module/Photo.php +++ b/Zotlabs/Module/Photo.php @@ -32,10 +32,10 @@ class Photo extends \Zotlabs\Web\Controller { } $cache_mode = array( - 'on' => false, // Cache off - 'age' => 86400, // max-age - 'exp' => true, // Use own max-age - 'leak' => false // Do not allow non members use our cache + 'on' => get_config('system','photo_cache_enable', 0), + 'age' => 86400, + 'exp' => true, + 'leak' => false ); call_hooks('cache_mode_hook', $cache_mode); -- cgit v1.2.3 From c6acb6191ca558fce121e7df26a8aba88beac2d9 Mon Sep 17 00:00:00 2001 From: zotlabs Date: Fri, 30 Nov 2018 19:03:14 -0800 Subject: allow notification filtering by name or addr --- Zotlabs/Module/Ping.php | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'Zotlabs/Module') diff --git a/Zotlabs/Module/Ping.php b/Zotlabs/Module/Ping.php index f660c3b55..12244d88c 100644 --- a/Zotlabs/Module/Ping.php +++ b/Zotlabs/Module/Ping.php @@ -330,6 +330,7 @@ class Ping extends \Zotlabs\Web\Controller { $notifs[] = array( 'notify_link' => z_root() . '/mail/' . $zz['id'], 'name' => $zz['xchan_name'], + 'addr' => $zz['xchan_addr'], 'url' => $zz['xchan_url'], 'photo' => $zz['xchan_photo_s'], 'when' => relative_date($zz['created']), @@ -383,6 +384,7 @@ class Ping extends \Zotlabs\Web\Controller { $result[] = array( 'notify_link' => z_root() . '/connections/ifpending', 'name' => $rr['xchan_name'], + 'addr' => $rr['xchan_addr'], 'url' => $rr['xchan_url'], 'photo' => $rr['xchan_photo_s'], 'when' => relative_date($rr['abook_created']), @@ -407,6 +409,7 @@ class Ping extends \Zotlabs\Web\Controller { $result[] = array( 'notify_link' => z_root() . '/admin/accounts', 'name' => $rr['account_email'], + 'addr' => $rr['account_email'], 'url' => '', 'photo' => z_root() . '/' . get_default_profile_photo(48), 'when' => relative_date($rr['account_created']), @@ -444,6 +447,7 @@ class Ping extends \Zotlabs\Web\Controller { $result[] = array( 'notify_link' => z_root() . '/events', /// @FIXME this takes you to an edit page and it may not be yours, we really want to just view the single event --> '/events/event/' . $rr['event_hash'], 'name' => $rr['xchan_name'], + 'addr' => $rr['xchan_addr'], 'url' => $rr['xchan_url'], 'photo' => $rr['xchan_photo_s'], 'when' => $when, @@ -460,7 +464,7 @@ class Ping extends \Zotlabs\Web\Controller { if(argc() > 1 && (argv(1) === 'files')) { $result = array(); - $r = q("SELECT item.created, xchan.xchan_name, xchan.xchan_url, xchan.xchan_photo_s FROM item + $r = q("SELECT item.created, xchan.xchan_name, xchan.xchan_addr, xchan.xchan_url, xchan.xchan_photo_s FROM item LEFT JOIN xchan on author_xchan = xchan_hash WHERE item.verb = '%s' AND item.obj_type = '%s' @@ -477,6 +481,7 @@ class Ping extends \Zotlabs\Web\Controller { $result[] = array( 'notify_link' => z_root() . '/sharedwithme', 'name' => $rr['xchan_name'], + 'addr' => $rr['xchan_addr'], 'url' => $rr['xchan_url'], 'photo' => $rr['xchan_photo_s'], 'when' => relative_date($rr['created']), @@ -658,6 +663,7 @@ class Ping extends \Zotlabs\Web\Controller { if($r[0]['unseen']) { $forums[$x]['notify_link'] = (($forums[$x]['private_forum']) ? $forums[$x]['xchan_url'] : z_root() . '/network/?f=&pf=1&unseen=1&cid=' . $forums[$x]['abook_id']); $forums[$x]['name'] = $forums[$x]['xchan_name']; + $forums[$x]['addr'] = $forums[$x]['xchan_addr']; $forums[$x]['url'] = $forums[$x]['xchan_url']; $forums[$x]['photo'] = $forums[$x]['xchan_photo_s']; $forums[$x]['unseen'] = $r[0]['unseen']; -- cgit v1.2.3 From 57ebd7e1704597b1eea31610cd08c076ea7473cf Mon Sep 17 00:00:00 2001 From: Max Kostikov Date: Mon, 3 Dec 2018 13:10:55 +0100 Subject: New logic for less dependence on cache logic --- Zotlabs/Module/Photo.php | 27 ++++++++++++--------------- 1 file changed, 12 insertions(+), 15 deletions(-) (limited to 'Zotlabs/Module') diff --git a/Zotlabs/Module/Photo.php b/Zotlabs/Module/Photo.php index d85db7307..da5d4c39b 100644 --- a/Zotlabs/Module/Photo.php +++ b/Zotlabs/Module/Photo.php @@ -139,7 +139,7 @@ class Photo extends \Zotlabs\Web\Controller { $resolution = 1; } - $r = q("SELECT uid, photo_usage, expires, display_path FROM photo WHERE resource_id = '%s' AND imgscale = %d LIMIT 1", + $r = q("SELECT uid, photo_usage, display_path FROM photo WHERE resource_id = '%s' AND imgscale = %d LIMIT 1", dbesc($photo), intval($resolution) ); @@ -156,20 +156,17 @@ class Photo extends \Zotlabs\Web\Controller { if(! in_array($resolution,[4,5,6])) $allowed = (-1); if($u === PHOTO_CACHE) { - // Cached image leak protection - if(! (local_channel() || $cache_mode['leak'])) { - header("Location: " . $r[0]['display_path']); - killme(); - } - // Revalidate cache - if($cache_mode['on'] && strtotime($r[0]['expires']) - 60 < time()) { - $cache = array( - 'url' => $r[0]['display_path'], - 'uid' => $r[0]['uid'] - ); + // Validate cache + $cache = array( + 'resid' => $photo, + 'uid' => $r[0]['uid'], + 'status' => true + ); + if($cache_mode['on']) call_hooks('cache_url_hook', $cache); - if(! $cache['status']) - http_status_exit(404,'not found'); + if((! (local_channel() || $cache_mode['leak'])) || (! $cache['status'])) { + header("Location: " . htmlspecialchars_decode($r[0]['display_path'])); + killme(); } } } @@ -184,7 +181,7 @@ class Photo extends \Zotlabs\Web\Controller { dbesc($photo), intval($resolution) ); - + $exists = (($e) ? true : false); if($exists && $allowed) { -- cgit v1.2.3 From 244c0d828a31447cb215251d88b0123508f0101d Mon Sep 17 00:00:00 2001 From: Max Kostikov Date: Mon, 3 Dec 2018 13:29:27 +0100 Subject: Update Photo.php --- Zotlabs/Module/Photo.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'Zotlabs/Module') diff --git a/Zotlabs/Module/Photo.php b/Zotlabs/Module/Photo.php index da5d4c39b..f96d478f2 100644 --- a/Zotlabs/Module/Photo.php +++ b/Zotlabs/Module/Photo.php @@ -160,7 +160,7 @@ class Photo extends \Zotlabs\Web\Controller { $cache = array( 'resid' => $photo, 'uid' => $r[0]['uid'], - 'status' => true + 'status' => false ); if($cache_mode['on']) call_hooks('cache_url_hook', $cache); -- cgit v1.2.3 From b586fcebabfad0c062deb3070d1679414595dc95 Mon Sep 17 00:00:00 2001 From: Max Kostikov Date: Mon, 3 Dec 2018 21:21:23 +0100 Subject: Update Photo.php --- Zotlabs/Module/Photo.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'Zotlabs/Module') diff --git a/Zotlabs/Module/Photo.php b/Zotlabs/Module/Photo.php index f96d478f2..a73492ae2 100644 --- a/Zotlabs/Module/Photo.php +++ b/Zotlabs/Module/Photo.php @@ -164,7 +164,7 @@ class Photo extends \Zotlabs\Web\Controller { ); if($cache_mode['on']) call_hooks('cache_url_hook', $cache); - if((! (local_channel() || $cache_mode['leak'])) || (! $cache['status'])) { + if(! $cache['status'] && $cache_mode['leak']) { header("Location: " . htmlspecialchars_decode($r[0]['display_path'])); killme(); } -- cgit v1.2.3 From 1c44912aff2c7f026fe1e5e74eb1d70920d17747 Mon Sep 17 00:00:00 2001 From: Max Kostikov Date: Mon, 3 Dec 2018 21:33:32 +0100 Subject: Update Photo.php --- Zotlabs/Module/Photo.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'Zotlabs/Module') diff --git a/Zotlabs/Module/Photo.php b/Zotlabs/Module/Photo.php index a73492ae2..ddff3a68e 100644 --- a/Zotlabs/Module/Photo.php +++ b/Zotlabs/Module/Photo.php @@ -164,7 +164,7 @@ class Photo extends \Zotlabs\Web\Controller { ); if($cache_mode['on']) call_hooks('cache_url_hook', $cache); - if(! $cache['status'] && $cache_mode['leak']) { + if(! $cache['status']) { header("Location: " . htmlspecialchars_decode($r[0]['display_path'])); killme(); } -- cgit v1.2.3 From 7a693500c4a112e9116e0df5dc2f0b531f6de2c7 Mon Sep 17 00:00:00 2001 From: zotlabs Date: Mon, 3 Dec 2018 14:21:33 -0800 Subject: fix generated plink --- Zotlabs/Module/Item.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'Zotlabs/Module') diff --git a/Zotlabs/Module/Item.php b/Zotlabs/Module/Item.php index 1d64ef60c..24949c626 100644 --- a/Zotlabs/Module/Item.php +++ b/Zotlabs/Module/Item.php @@ -760,7 +760,7 @@ class Item extends Controller { // fix permalinks for cards if($webpage == ITEM_TYPE_CARD) { - $plink = z_root() . '/cards/' . $channel['channel_address'] . '/' . (($pagetitle) ? $pagetitle : substr($mid,0,16)); + $plink = z_root() . '/cards/' . $channel['channel_address'] . '/' . (($pagetitle) ? $pagetitle : $uuid); } if(($parent_item) && ($parent_item['item_type'] == ITEM_TYPE_CARD)) { $r = q("select v from iconfig where iconfig.cat = 'system' and iconfig.k = 'CARD' and iconfig.iid = %d limit 1", @@ -772,7 +772,7 @@ class Item extends Controller { } if($webpage == ITEM_TYPE_ARTICLE) { - $plink = z_root() . '/articles/' . $channel['channel_address'] . '/' . (($pagetitle) ? $pagetitle : substr($mid,0,16)); + $plink = z_root() . '/articles/' . $channel['channel_address'] . '/' . (($pagetitle) ? $pagetitle : $uuid); } if(($parent_item) && ($parent_item['item_type'] == ITEM_TYPE_ARTICLE)) { $r = q("select v from iconfig where iconfig.cat = 'system' and iconfig.k = 'ARTICLE' and iconfig.iid = %d limit 1", @@ -784,7 +784,7 @@ class Item extends Controller { } if ((! $plink) && ($item_thread_top)) { - $plink = z_root() . '/channel/' . $channel['channel_address'] . '/?f=&mid=' . $mid; + $plink = z_root() . '/channel/' . $channel['channel_address'] . '/?f=&mid=' . gen_link_id($mid); $plink = substr($plink,0,190); } -- cgit v1.2.3 From 42aeb19562b9e72436a72e090772da669e34fd66 Mon Sep 17 00:00:00 2001 From: zotlabs Date: Mon, 3 Dec 2018 20:09:57 -0800 Subject: partial solution for obj|tgt multiple (zot and zot6) encodings; the zot6 version will be stored under $item['obj']['asld'] --- Zotlabs/Module/Like.php | 3 +++ Zotlabs/Module/Wfinger.php | 3 +++ 2 files changed, 6 insertions(+) (limited to 'Zotlabs/Module') diff --git a/Zotlabs/Module/Like.php b/Zotlabs/Module/Like.php index c39726b88..d19154eb4 100644 --- a/Zotlabs/Module/Like.php +++ b/Zotlabs/Module/Like.php @@ -1,6 +1,8 @@ $objtype, 'id' => $item['mid'], + 'asld' => Activity::fetch_item( [ 'id' => $item['mid'] ] ), 'parent' => (($item['thr_parent']) ? $item['thr_parent'] : $item['parent_mid']), 'link' => $links, 'title' => $item['title'], diff --git a/Zotlabs/Module/Wfinger.php b/Zotlabs/Module/Wfinger.php index e4591df12..03275abbc 100644 --- a/Zotlabs/Module/Wfinger.php +++ b/Zotlabs/Module/Wfinger.php @@ -43,6 +43,9 @@ class Wfinger extends \Zotlabs\Web\Controller { if(strpos($resource,'acct:') === 0) { $channel = str_replace('acct:','',$resource); + if(substr($channel,0,1) === '@' && strpos(substr($channel,1),'@')) { + $channel = substr($channel,1); + } if(strpos($channel,'@') !== false) { $host = substr($channel,strpos($channel,'@')+1); -- cgit v1.2.3