From fa710106e5f97744e43a61a7e9ef5a1b993261ee Mon Sep 17 00:00:00 2001
From: friendica <info@friendica.com>
Date: Mon, 2 Feb 2015 17:58:51 -0800
Subject: sign the ratings, fix the bugs

---
 mod/connedit.php | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

(limited to 'mod/connedit.php')

diff --git a/mod/connedit.php b/mod/connedit.php
index 8c0212afe..93cf1b09a 100644
--- a/mod/connedit.php
+++ b/mod/connedit.php
@@ -131,26 +131,35 @@ function connedit_post(&$a) {
 	$new_friend = false;
 
 	if(! $is_self) {
-		$z = q("select * from xlink where xlink_xchan = '%s' and xlink_xlink = '%s' and xlink_static = 1 limit 1",
+
+		$signed = $target . '.' . $rating . '.' . $rating_text;
+
+		$sig = base64url_encode(rsa_sign($signed,$channel['channel_prvkey']));
+
+		$z = q("select * from xlink where xlink_xchan = '%s' and xlink_link = '%s' and xlink_static = 1 limit 1",
 			dbesc($channel['channel_hash']),
 			dbesc($orig_record[0]['abook_xchan'])
 		);
+
+
 		if($z) {
 			$record = $z[0]['xlink_id'];
-			$w = q("update xlink set xlink_rating = '%d', xlink_rating_text = '%s', xlink_updated = '%s' 
+			$w = q("update xlink set xlink_rating = '%d', xlink_rating_text = '%s', xlink_sig = '%s', xlink_updated = '%s' 
 				where xlink_id = %d",
 				intval($rating),
 				dbesc($rating_text),
+				dbesc($sig),
 				dbesc(datetime_convert()),
 				intval($record)
 			);
 		}
 		else {
-			$w = q("insert into xlink ( xlink_xchan, xlink_link, xlink_rating, xlink_rating_text, xlink_updated, xlink_static ) values ( '%s', '%s', %d, '%s', '%s', 1 ) ",
+			$w = q("insert into xlink ( xlink_xchan, xlink_link, xlink_rating, xlink_rating_text, xlink_sig, xlink_updated, xlink_static ) values ( '%s', '%s', %d, '%s', '%s', '%s', 1 ) ",
 				dbesc($channel['channel_hash']),
 				dbesc($orig_record[0]['abook_xchan']),
 				intval($rating),
 				dbesc($rating_text),
+				dbesc($sig),
 				dbesc(datetime_convert())
 			);
 			$z = q("select * from xlink where xlink_xchan = '%s' and xlink_link = '%s' and xlink_static = 1 limit 1",
@@ -564,7 +573,7 @@ function connedit_content(&$a) {
 		}
 
 		$poco_rating = get_config('system','poco_rating_enable');
-		$poco_rating = 0;
+
 		// if unset default to enabled
 		if($poco_rating === false)
 			$poco_rating = true;
-- 
cgit v1.2.3