From fe57e7059bc6ef1942a6b054a4da8edfb5a07578 Mon Sep 17 00:00:00 2001 From: Mario Vavti Date: Wed, 25 Nov 2015 15:05:21 +0100 Subject: events: make sure default finish date is one hour after start date and shift the finishdate if startdate is shifted --- mod/events.php | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) (limited to 'mod') diff --git a/mod/events.php b/mod/events.php index d55d22f44..0366c9b02 100755 --- a/mod/events.php +++ b/mod/events.php @@ -366,7 +366,7 @@ function events_content(&$a) { $sdt = ((x($orig_event)) ? $orig_event['start'] : 'now'); - $fdt = ((x($orig_event)) ? $orig_event['finish'] : 'now'); + $fdt = ((x($orig_event)) ? $orig_event['finish'] : '+1 hour'); $tz = date_default_timezone_get(); if(x($orig_event)) @@ -380,8 +380,12 @@ function events_content(&$a) { $smonth = datetime_convert('UTC', $tz, $sdt, 'm'); $sday = datetime_convert('UTC', $tz, $sdt, 'd'); - $shour = ((x($orig_event)) ? datetime_convert('UTC', $tz, $sdt, 'H') : '00'); - $sminute = ((x($orig_event)) ? datetime_convert('UTC', $tz, $sdt, 'i') : '00'); +// $shour = ((x($orig_event)) ? datetime_convert('UTC', $tz, $sdt, 'H') : '00'); +// $sminute = ((x($orig_event)) ? datetime_convert('UTC', $tz, $sdt, 'i') : '00'); + + $shour = datetime_convert('UTC', $tz, $sdt, 'H'); + $sminute = datetime_convert('UTC', $tz, $sdt, 'i'); + $stext = datetime_convert('UTC',$tz,$sdt); $stext = substr($stext,0,14) . "00:00"; @@ -393,8 +397,12 @@ function events_content(&$a) { $fmonth = datetime_convert('UTC', $tz, $fdt, 'm'); $fday = datetime_convert('UTC', $tz, $fdt, 'd'); - $fhour = ((x($orig_event)) ? datetime_convert('UTC', $tz, $fdt, 'H') : '00'); - $fminute = ((x($orig_event)) ? datetime_convert('UTC', $tz, $fdt, 'i') : '00'); +// $fhour = ((x($orig_event)) ? datetime_convert('UTC', $tz, $fdt, 'H') : '00'); +// $fminute = ((x($orig_event)) ? datetime_convert('UTC', $tz, $fdt, 'i') : '00'); + + $fhour = datetime_convert('UTC', $tz, $fdt, 'H'); + $fminute = datetime_convert('UTC', $tz, $fdt, 'i'); + $ftext = datetime_convert('UTC',$tz,$fdt); $ftext = substr($ftext,0,14) . "00:00"; $type = ((x($orig_event)) ? $orig_event['type'] : 'event'); -- cgit v1.2.3 From 3ea84d7eab20947ac52dc7e6c205252f0a76c047 Mon Sep 17 00:00:00 2001 From: Mario Vavti Date: Wed, 25 Nov 2015 22:55:07 +0100 Subject: some basic event styling --- mod/events.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'mod') diff --git a/mod/events.php b/mod/events.php index 0366c9b02..64d7dfb93 100755 --- a/mod/events.php +++ b/mod/events.php @@ -91,7 +91,11 @@ function events_post(&$a) { linkify_tags($a, $location, local_channel()); $action = ($event_hash == '') ? 'new' : "event/" . $event_hash; - $onerror_url = $a->get_baseurl() . "/events/" . $action . "?summary=$summary&description=$desc&location=$location&start=$start_text&finish=$finish_text&adjust=$adjust&nofinish=$nofinish&type=$type"; + + //fixme: this url gives a wsod if there is a linebreak detected in one of the variables ($desc or $location) + //$onerror_url = $a->get_baseurl() . "/events/" . $action . "?summary=$summary&description=$desc&location=$location&start=$start_text&finish=$finish_text&adjust=$adjust&nofinish=$nofinish&type=$type"; + $onerror_url = $a->get_baseurl() . "/events"; + if(strcmp($finish,$start) < 0 && !$nofinish) { notice( t('Event can not end before it has started.') . EOL); if(intval($_REQUEST['preview'])) { -- cgit v1.2.3 From a039869ba0410a35368e978ddfd638b344b17b40 Mon Sep 17 00:00:00 2001 From: redmatrix Date: Wed, 25 Nov 2015 17:30:11 -0800 Subject: issue #185 --- mod/update_channel.php | 2 ++ mod/update_display.php | 4 ++-- mod/update_home.php | 4 ++-- mod/update_network.php | 4 ++-- mod/update_public.php | 4 ++-- mod/update_search.php | 4 ++-- 6 files changed, 12 insertions(+), 10 deletions(-) (limited to 'mod') diff --git a/mod/update_channel.php b/mod/update_channel.php index 5f4436d59..63a3735ea 100644 --- a/mod/update_channel.php +++ b/mod/update_channel.php @@ -39,6 +39,7 @@ function update_channel_content(&$a) { $replace = "'; $pattern = "/<\s*audio[^>]*>(.*?)<\s*\/\s*audio>/i"; @@ -50,6 +51,7 @@ function update_channel_content(&$a) { $pattern = "/<\s*iframe[^>]*>(.*?)<\s*\/\s*iframe>/i"; $text = preg_replace($pattern, $replace, $text); } +*/ /** * reportedly some versions of MSIE don't handle tabs in XMLHttpRequest documents very well diff --git a/mod/update_display.php b/mod/update_display.php index d41e2e5cb..b448c76ee 100644 --- a/mod/update_display.php +++ b/mod/update_display.php @@ -20,7 +20,7 @@ function update_display_content(&$a) { $pattern = "/]*) src=\"([^\"]*)\"/"; $replace = "'; $pattern = "/<\s*audio[^>]*>(.*?)<\s*\/\s*audio>/i"; @@ -32,7 +32,7 @@ function update_display_content(&$a) { $pattern = "/<\s*iframe[^>]*>(.*?)<\s*\/\s*iframe>/i"; $text = preg_replace($pattern, $replace, $text); } - +*/ echo str_replace("\t",' ',$text); echo (($_GET['msie'] == 1) ? '' : ''); echo "\r\n"; diff --git a/mod/update_home.php b/mod/update_home.php index 80ae2438f..4a8000bdb 100644 --- a/mod/update_home.php +++ b/mod/update_home.php @@ -16,7 +16,7 @@ function update_home_content(&$a) { $pattern = "/]*) src=\"([^\"]*)\"/"; $replace = "'; $pattern = "/<\s*audio[^>]*>(.*?)<\s*\/\s*audio>/i"; @@ -28,7 +28,7 @@ function update_home_content(&$a) { $pattern = "/<\s*iframe[^>]*>(.*?)<\s*\/\s*iframe>/i"; $text = preg_replace($pattern, $replace, $text); } - +*/ echo str_replace("\t",' ',$text); echo ((array_key_exists('msie',$_GET) && $_GET['msie'] == 1) ? '' : ''); echo "\r\n"; diff --git a/mod/update_network.php b/mod/update_network.php index acd5ccdc8..03c12312c 100644 --- a/mod/update_network.php +++ b/mod/update_network.php @@ -18,7 +18,7 @@ function update_network_content(&$a) { $pattern = "/]*) src=\"([^\"]*)\"/"; $replace = "'; $pattern = "/<\s*audio[^>]*>(.*?)<\s*\/\s*audio>/i"; @@ -30,7 +30,7 @@ function update_network_content(&$a) { $pattern = "/<\s*iframe[^>]*>(.*?)<\s*\/\s*iframe>/i"; $text = preg_replace($pattern, $replace, $text); } - +*/ echo str_replace("\t",' ',$text); echo ((array_key_exists('msie',$_GET) && $_GET['msie'] == 1) ? '' : ''); echo "\r\n"; diff --git a/mod/update_public.php b/mod/update_public.php index bac1ccf15..fcec792f6 100644 --- a/mod/update_public.php +++ b/mod/update_public.php @@ -16,7 +16,7 @@ function update_public_content(&$a) { $pattern = "/]*) src=\"([^\"]*)\"/"; $replace = "'; $pattern = "/<\s*audio[^>]*>(.*?)<\s*\/\s*audio>/i"; @@ -28,7 +28,7 @@ function update_public_content(&$a) { $pattern = "/<\s*iframe[^>]*>(.*?)<\s*\/\s*iframe>/i"; $text = preg_replace($pattern, $replace, $text); } - +*/ echo str_replace("\t",' ',$text); echo ((array_key_exists('msie',$_GET) && $_GET['msie'] == 1) ? '' : ''); echo "\r\n"; diff --git a/mod/update_search.php b/mod/update_search.php index de29e89bd..25bcffcb6 100644 --- a/mod/update_search.php +++ b/mod/update_search.php @@ -41,7 +41,7 @@ function update_search_content(&$a) { $pattern = "/]*) src=\"([^\"]*)\"/"; $replace = "'; $pattern = "/<\s*audio[^>]*>(.*?)<\s*\/\s*audio>/i"; @@ -53,7 +53,7 @@ function update_search_content(&$a) { $pattern = "/<\s*iframe[^>]*>(.*?)<\s*\/\s*iframe>/i"; $text = preg_replace($pattern, $replace, $text); } - +*/ /** * reportedly some versions of MSIE don't handle tabs in XMLHttpRequest documents very well */ -- cgit v1.2.3 From 61a5e81bc62d8517a1c7a86249c0a1e9a42fe1d8 Mon Sep 17 00:00:00 2001 From: Mario Vavti Date: Fri, 27 Nov 2015 13:55:02 +0100 Subject: only show edit icon for your own events and minoe cleanup --- mod/events.php | 21 +++------------------ 1 file changed, 3 insertions(+), 18 deletions(-) (limited to 'mod') diff --git a/mod/events.php b/mod/events.php index 64d7dfb93..080c39911 100755 --- a/mod/events.php +++ b/mod/events.php @@ -90,7 +90,7 @@ function events_post(&$a) { linkify_tags($a, $desc, local_channel()); linkify_tags($a, $location, local_channel()); - $action = ($event_hash == '') ? 'new' : "event/" . $event_hash; + //$action = ($event_hash == '') ? 'new' : "event/" . $event_hash; //fixme: this url gives a wsod if there is a linebreak detected in one of the variables ($desc or $location) //$onerror_url = $a->get_baseurl() . "/events/" . $action . "?summary=$summary&description=$desc&location=$location&start=$start_text&finish=$finish_text&adjust=$adjust&nofinish=$nofinish&type=$type"; @@ -376,39 +376,24 @@ function events_content(&$a) { if(x($orig_event)) $tz = (($orig_event['adjust']) ? date_default_timezone_get() : 'UTC'); -// $syear = ((x($orig_event)) ? datetime_convert('UTC', $tz, $sdt, 'Y') : '0000'); -// $smonth = ((x($orig_event)) ? datetime_convert('UTC', $tz, $sdt, 'm') : '00'); -// $sday = ((x($orig_event)) ? datetime_convert('UTC', $tz, $sdt, 'd') : '00'); - $syear = datetime_convert('UTC', $tz, $sdt, 'Y'); $smonth = datetime_convert('UTC', $tz, $sdt, 'm'); $sday = datetime_convert('UTC', $tz, $sdt, 'd'); - -// $shour = ((x($orig_event)) ? datetime_convert('UTC', $tz, $sdt, 'H') : '00'); -// $sminute = ((x($orig_event)) ? datetime_convert('UTC', $tz, $sdt, 'i') : '00'); - $shour = datetime_convert('UTC', $tz, $sdt, 'H'); $sminute = datetime_convert('UTC', $tz, $sdt, 'i'); $stext = datetime_convert('UTC',$tz,$sdt); $stext = substr($stext,0,14) . "00:00"; -// $fyear = ((x($orig_event)) ? datetime_convert('UTC', $tz, $fdt, 'Y') : '0000'); -// $fmonth = ((x($orig_event)) ? datetime_convert('UTC', $tz, $fdt, 'm') : '00'); -// $fday = ((x($orig_event)) ? datetime_convert('UTC', $tz, $fdt, 'd') : '00'); - $fyear = datetime_convert('UTC', $tz, $fdt, 'Y'); $fmonth = datetime_convert('UTC', $tz, $fdt, 'm'); $fday = datetime_convert('UTC', $tz, $fdt, 'd'); - -// $fhour = ((x($orig_event)) ? datetime_convert('UTC', $tz, $fdt, 'H') : '00'); -// $fminute = ((x($orig_event)) ? datetime_convert('UTC', $tz, $fdt, 'i') : '00'); - $fhour = datetime_convert('UTC', $tz, $fdt, 'H'); $fminute = datetime_convert('UTC', $tz, $fdt, 'i'); $ftext = datetime_convert('UTC',$tz,$fdt); $ftext = substr($ftext,0,14) . "00:00"; + $type = ((x($orig_event)) ? $orig_event['type'] : 'event'); $f = get_config('system','event_input_format'); @@ -608,7 +593,7 @@ function events_content(&$a) { $last_date = $d; - $edit = array($a->get_baseurl().'/events/'.$rr['event_hash'].'?expandform=1',t('Edit event'),'',''); + $edit = ((local_channel() && $rr['author_xchan'] == get_observer_hash()) ? array($a->get_baseurl().'/events/'.$rr['event_hash'].'?expandform=1',t('Edit event'),'','') : false); $drop = array($a->get_baseurl().'/events/drop/'.$rr['event_hash'],t('Delete event'),'',''); -- cgit v1.2.3 From 4e223f816a15c6faec14ddb4f3aa4e4f122167d9 Mon Sep 17 00:00:00 2001 From: Mario Vavti Date: Sat, 28 Nov 2015 17:05:37 +0100 Subject: reflect in form if we are editing or creating --- mod/events.php | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) (limited to 'mod') diff --git a/mod/events.php b/mod/events.php index 080c39911..74b44906c 100755 --- a/mod/events.php +++ b/mod/events.php @@ -434,22 +434,22 @@ function events_content(&$a) { '$xchan' => $event_xchan, '$mid' => $mid, '$event_hash' => $event_id, - '$summary' => array('summary', t('Event Title'), $t_orig, t('Required'), '*'), + '$summary' => array('summary', (($event_id) ? t('Edit event titel') : t('Event titel')), $t_orig, t('Required'), '*'), '$catsenabled' => $catsenabled, '$placeholdercategory' => t('Categories (comma-separated list)'), - '$c_text' => t('Category'), + '$c_text' => (($event_id) ? t('Edit Category') : t('Category')), '$category' => $category, '$required' => '*', - '$s_dsel' => datetimesel($f,new DateTime(),DateTime::createFromFormat('Y',$syear+5),DateTime::createFromFormat('Y-m-d H:i',"$syear-$smonth-$sday $shour:$sminute"), t('Start date and time'), 'start_text',true,true,'','',true,$first_day), + '$s_dsel' => datetimesel($f,new DateTime(),DateTime::createFromFormat('Y',$syear+5),DateTime::createFromFormat('Y-m-d H:i',"$syear-$smonth-$sday $shour:$sminute"), (($event_id) ? t('Edit start date and time') : t('Start date and time')), 'start_text',true,true,'','',true,$first_day), '$n_text' => t('Finish date and time are not known or not relevant'), '$n_checked' => $n_checked, - '$f_dsel' => datetimesel($f,new DateTime(),DateTime::createFromFormat('Y',$fyear+5),DateTime::createFromFormat('Y-m-d H:i',"$fyear-$fmonth-$fday $fhour:$fminute"), t('Finish date and time'),'finish_text',true,true,'start_text','',false,$first_day), + '$f_dsel' => datetimesel($f,new DateTime(),DateTime::createFromFormat('Y',$fyear+5),DateTime::createFromFormat('Y-m-d H:i',"$fyear-$fmonth-$fday $fhour:$fminute"), (($event_id) ? t('Edit finish date and time') : t('Finish date and time')),'finish_text',true,true,'start_text','',false,$first_day), '$nofinish' => array('nofinish', t('Finish date and time are not known or not relevant'), $n_checked, '', array(t('No'),t('Yes')), 'onclick="enableDisableFinishDate();"'), '$adjust' => array('adjust', t('Adjust for viewer timezone'), $a_checked, t('Important for events that happen in a particular place. Not practical for global holidays.'), array(t('No'),t('Yes'))), '$a_text' => t('Adjust for viewer timezone'), - '$d_text' => t('Description'), + '$d_text' => (($event_id) ? t('Edit Description') : t('Description')), '$d_orig' => $d_orig, - '$l_text' => t('Location'), + '$l_text' => (($event_id) ? t('Edit Location') : t('Location')), '$l_orig' => $l_orig, '$t_orig' => $t_orig, '$sh_text' => t('Share this event'), @@ -648,7 +648,7 @@ function events_content(&$a) { $o = replace_macros($tpl, array( '$baseurl' => $a->get_baseurl(), - '$new_event' => array($a->get_baseurl().'/events/new',t('New Event'),'',''), + '$new_event' => array($a->get_baseurl().'/events',(($event_id) ? t('Edit Event') : t('Create Event')),'',''), '$previus' => array($a->get_baseurl()."/events/$prevyear/$prevmonth",t('Previous'),'',''), '$next' => array($a->get_baseurl()."/events/$nextyear/$nextmonth",t('Next'),'',''), '$export' => array($a->get_baseurl()."/events/$y/$m/export",t('Export'),'',''), -- cgit v1.2.3 From 29877963be2f13607976df84e1c88a161714a4a6 Mon Sep 17 00:00:00 2001 From: redmatrix Date: Sun, 29 Nov 2015 18:07:59 -0800 Subject: issue #189 --- mod/feed.php | 1 + 1 file changed, 1 insertion(+) (limited to 'mod') diff --git a/mod/feed.php b/mod/feed.php index 3b622fc17..eb72af9cf 100644 --- a/mod/feed.php +++ b/mod/feed.php @@ -15,6 +15,7 @@ function feed_init(&$a) { $params['start'] = ((x($params,'start')) ? intval($params['start']) : 0); $params['records'] = ((x($params,'records')) ? intval($params['records']) : 40); $params['direction'] = ((x($params,'direction')) ? dbesc($params['direction']) : 'desc'); + $params['cat'] = ((x($_REQUEST,'cat')) ? escape_tags($_REQUEST['cat']) : ''); $channel = ''; if(argc() > 1) { -- cgit v1.2.3 From 3f9412add27ecc225df0e5c23f5c15a4bf4e8971 Mon Sep 17 00:00:00 2001 From: redmatrix Date: Sun, 29 Nov 2015 19:37:03 -0800 Subject: create get_site_info() function so we can have a siteinfo.json module instead of or actually in addition to siteinfo/json --- mod/siteinfo.php | 100 ++------------------------------------------------ mod/siteinfo_json.php | 8 ++++ 2 files changed, 11 insertions(+), 97 deletions(-) create mode 100644 mod/siteinfo_json.php (limited to 'mod') diff --git a/mod/siteinfo.php b/mod/siteinfo.php index 231427290..4c5782abe 100644 --- a/mod/siteinfo.php +++ b/mod/siteinfo.php @@ -1,104 +1,10 @@ argv[1]=="json"){ - $register_policy = Array('REGISTER_CLOSED', 'REGISTER_APPROVE', 'REGISTER_OPEN'); - $directory_mode = Array('DIRECTORY_MODE_NORMAL', 'DIRECTORY_MODE_SECONDARY','DIRECTORY_MODE_PRIMARY', 'DIRECTORY_MODE_STANDALONE'); - - $sql_extra = ''; - - $r = q("select * from channel left join account on account_id = channel_account_id where ( account_roles & 4096 )>0 and account_default_channel = channel_id"); - - - if($r) { - $admin = array(); - foreach($r as $rr) { - if($rr['channel_pageflags'] & PAGE_HUBADMIN) - $admin[] = array( 'name' => $rr['channel_name'], 'address' => $rr['channel_address'] . '@' . get_app()->get_hostname(), 'channel' => z_root() . '/channel/' . $rr['channel_address']); - } - if(! $admin) { - foreach($r as $rr) { - $admin[] = array( 'name' => $rr['channel_name'], 'address' => $rr['channel_address'] . '@' . get_app()->get_hostname(), 'channel' => z_root() . '/channel/' . $rr['channel_address']); - } - } - } - else { - $admin = false; - } - $def_service_class = get_config('system','default_service_class'); - if($def_service_class) - $service_class = get_config('service_class',$def_service_class); - else - $service_class = false; - - $visible_plugins = array(); - if(is_array($a->plugins) && count($a->plugins)) { - $r = q("select * from addon where hidden = 0"); - if(count($r)) - foreach($r as $rr) - $visible_plugins[] = $rr['name']; - } - sort($visible_plugins); - - if(@is_dir('.git') && function_exists('shell_exec')) - $commit = trim(@shell_exec('git log -1 --format="%h"')); - if(! isset($commit) || strlen($commit) > 16) - $commit = ''; - - $site_info = get_config('system','info'); - $site_name = get_config('system','sitename'); - if(! get_config('system','hidden_version_siteinfo')) { - $version = RED_VERSION; - if(@is_dir('.git') && function_exists('shell_exec')) { - $commit = trim( @shell_exec('git log -1 --format="%h"')); - if(! get_config('system','hidden_tag_siteinfo')) - $tag = trim( @shell_exec('git describe --tags --abbrev=0')); - else - $tag = ''; - } - if(! isset($commit) || strlen($commit) > 16) - $commit = ''; - } - else { - $version = $commit = ''; - } - - //Statistics - $channels_total_stat = intval(get_config('system','channels_total_stat')); - $channels_active_halfyear_stat = intval(get_config('system','channels_active_halfyear_stat')); - $channels_active_monthly_stat = intval(get_config('system','channels_active_monthly_stat')); - $local_posts_stat = intval(get_config('system','local_posts_stat')); - $hide_in_statistics = intval(get_config('system','hide_in_statistics')); - $site_expire = intval(get_config('system', 'default_expire_days')); - - - $data = Array( - 'version' => $version, - 'version_tag' => $tag, - 'commit' => $commit, - 'url' => z_root(), - 'plugins' => $visible_plugins, - 'register_policy' => $register_policy[get_config('system','register_policy')], - 'directory_mode' => $directory_mode[get_config('system','directory_mode')], - 'language' => get_config('system','language'), - 'rss_connections' => get_config('system','feed_contacts'), - 'expiration' => $site_expire, - 'default_service_restrictions' => $service_class, - 'admin' => $admin, - 'site_name' => (($site_name) ? $site_name : ''), - 'platform' => PLATFORM_NAME, - 'dbdriver' => $db->getdriver(), - 'lastpoll' => get_config('system','lastpoll'), - 'info' => (($site_info) ? $site_info : ''), - 'channels_total' => $channels_total_stat, - 'channels_active_halfyear' => $channels_active_halfyear_stat, - 'channels_active_monthly' => $channels_active_monthly_stat, - 'local_posts' => $local_posts_stat, - 'hide_in_statistics' => $hide_in_statistics - ); + + if (argv(1) === 'json') { + $data = get_site_info(); json_return_and_die($data); } } diff --git a/mod/siteinfo_json.php b/mod/siteinfo_json.php new file mode 100644 index 000000000..35697917c --- /dev/null +++ b/mod/siteinfo_json.php @@ -0,0 +1,8 @@ + Date: Sun, 29 Nov 2015 20:26:00 -0800 Subject: generalise the site black|white allow lists, also add a channel black|white list for future use --- mod/setup.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'mod') diff --git a/mod/setup.php b/mod/setup.php index e5ac25965..5c9e988d9 100755 --- a/mod/setup.php +++ b/mod/setup.php @@ -14,7 +14,7 @@ $install_wizard_pass = 1; * * @param[in,out] App &$a */ -function setup_init(&$a){ +function setup_init(&$a) { // Ensure that if somebody hasn't read the install documentation and doesn't have all // the required modules or has a totally borked shared hosting provider and they can't -- cgit v1.2.3 From 593423434c0c0e8d1ebb43d97b2dda7e6b4d67bd Mon Sep 17 00:00:00 2001 From: Mario Vavti Date: Wed, 2 Dec 2015 09:44:25 +0100 Subject: fix attachment rendering for mail --- mod/mail.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'mod') diff --git a/mod/mail.php b/mod/mail.php index 536149a28..44c4b479d 100644 --- a/mod/mail.php +++ b/mod/mail.php @@ -329,7 +329,8 @@ function mail_content(&$a) { 'to_url' => chanlink_hash($message['to_xchan']), 'to_photo' => $message['to']['xchan_photo_s'], 'subject' => $message['title'], - 'body' => smilies(bbcode($message['body']) . $s), + 'body' => smilies(bbcode($message['body'])), + 'attachments' => $s, 'delete' => t('Delete message'), 'dreport' => t('Delivery report'), 'recall' => t('Recall message'), -- cgit v1.2.3 From 75058e54b8dc9625ac009781388789cff713e456 Mon Sep 17 00:00:00 2001 From: redmatrix Date: Wed, 2 Dec 2015 18:37:22 -0800 Subject: provide correct error if a directory server requires a realm_token and one wasn't provided --- mod/dirsearch.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'mod') diff --git a/mod/dirsearch.php b/mod/dirsearch.php index 548acbd08..388e5f3ac 100644 --- a/mod/dirsearch.php +++ b/mod/dirsearch.php @@ -26,8 +26,8 @@ function dirsearch_content(&$a) { $token = get_config('system','realm_token'); if($token && $access_token != $token) { - $result['message'] = t('This directory server requires an access token'); - return; + $ret['message'] = t('This directory server requires an access token'); + json_return_and_die($ret); } -- cgit v1.2.3 From ca55bbdaed8c361fe9203c9823b67dd91f3b7741 Mon Sep 17 00:00:00 2001 From: redmatrix Date: Thu, 3 Dec 2015 17:09:05 -0800 Subject: use the std_version where applicable instead of matching to the git. --- mod/siteinfo.php | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) (limited to 'mod') diff --git a/mod/siteinfo.php b/mod/siteinfo.php index 4c5782abe..52d014de1 100644 --- a/mod/siteinfo.php +++ b/mod/siteinfo.php @@ -1,8 +1,6 @@ 16) $commit = ''; -- cgit v1.2.3 From 5217d89543912aec870f27282b99d8e5e7920c57 Mon Sep 17 00:00:00 2001 From: ken restivo Date: Thu, 3 Dec 2015 18:21:25 -0800 Subject: srand() is for seeding the PRNG. You want rand() here. --- mod/invite.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'mod') diff --git a/mod/invite.php b/mod/invite.php index bda808142..1af5fc1f8 100644 --- a/mod/invite.php +++ b/mod/invite.php @@ -51,7 +51,7 @@ function invite_post(&$a) { } if($invonly && ($x || is_site_admin())) { - $code = autoname(8) . srand(1000,9999); + $code = autoname(8) . rand(1000,9999); $nmessage = str_replace('$invite_code',$code,$message); $r = q("INSERT INTO `register` (`hash`,`created`) VALUES ('%s', '%s') ", -- cgit v1.2.3 From 4ccd9ae6da2f4fbed45af80a11b53c8b4efd9ceb Mon Sep 17 00:00:00 2001 From: redmatrix Date: Sun, 6 Dec 2015 19:16:38 -0800 Subject: start of v4 --- mod/mail.php | 8 ++++++++ mod/post.php | 9 ++++++++- 2 files changed, 16 insertions(+), 1 deletion(-) (limited to 'mod') diff --git a/mod/mail.php b/mod/mail.php index 44c4b479d..59d15772b 100644 --- a/mod/mail.php +++ b/mod/mail.php @@ -17,6 +17,7 @@ function mail_post(&$a) { $body = ((x($_REQUEST,'body')) ? escape_tags(trim($_REQUEST['body'])) : ''); $recipient = ((x($_REQUEST,'messageto')) ? notags(trim($_REQUEST['messageto'])) : ''); $rstr = ((x($_REQUEST,'messagerecip')) ? notags(trim($_REQUEST['messagerecip'])) : ''); + $preview = ((x($_REQUEST,'preview')) ? intval($_REQUEST['preview']) : 0); $expires = ((x($_REQUEST,'expires')) ? datetime_convert(date_default_timezone_get(),'UTC', $_REQUEST['expires']) : NULL_DATE); // If we have a raw string for a recipient which hasn't been auto-filled, @@ -86,6 +87,13 @@ function mail_post(&$a) { require_once('include/text.php'); linkify_tags($a, $body, local_channel()); + if($preview) { + + + + + } + if(! $recipient) { notice('No recipient found.'); $a->argc = 2; diff --git a/mod/post.php b/mod/post.php index 4c52de44a..1842d78ca 100644 --- a/mod/post.php +++ b/mod/post.php @@ -483,6 +483,14 @@ function post_init(&$a) { */ function post_post(&$a) { + require_once('Zotlabs/Zot/Receiver.php'); + + $z = new Zotlabs\Zot\Receiver($_REQUEST['data'],get_config('system','prvkey')); + + // notreached; + +exit; + $encrypted_packet = false; $ret = array('success' => false); @@ -651,7 +659,6 @@ function post_post(&$a) { /* pickup: end */ } - /* * All other message types require us to verify the sender. This is a generic check, so we * will do it once here and bail if anything goes wrong. -- cgit v1.2.3 From 2d799f2c114bbd540a6b2f260e512ad5fcf1db5c Mon Sep 17 00:00:00 2001 From: redmatrix Date: Sun, 6 Dec 2015 19:59:46 -0800 Subject: remove duplicated code --- mod/post.php | 477 +---------------------------------------------------------- 1 file changed, 3 insertions(+), 474 deletions(-) (limited to 'mod') diff --git a/mod/post.php b/mod/post.php index 1842d78ca..6885b0d69 100644 --- a/mod/post.php +++ b/mod/post.php @@ -481,6 +481,8 @@ function post_init(&$a) { * * @param[in,out] App &$a */ + + function post_post(&$a) { require_once('Zotlabs/Zot/Receiver.php'); @@ -489,479 +491,6 @@ function post_post(&$a) { // notreached; -exit; - - $encrypted_packet = false; - $ret = array('success' => false); - - $data = json_decode($_REQUEST['data'],true); - - /* - * Many message packets will arrive encrypted. The existence of an 'iv' - * element tells us we need to unencapsulate the AES-256-CBC content using - * the site private key. - */ - - if($data && array_key_exists('iv',$data)) { - $encrypted_packet = true; - $data = crypto_unencapsulate($data,get_config('system','prvkey')); - logger('mod_zot: decrypt1: ' . $data, LOGGER_DATA); - $data = json_decode($data,true); - } - - if(! $data) { - - // possible Bleichenbacher's attack, just treat it as a - // message we have no handler for. It should fail a bit - // further along with "no hub". Our public key is public - // knowledge. There's no reason why anybody should get the - // encryption wrong unless they're fishing or hacking. If - // they're developing and made a goof, this can be discovered - // in the logs of the destination site. If they're fishing or - // hacking, the bottom line is we can't verify their hub. - // That's all we're going to tell them. - - $data = array('type' => 'bogus'); - } - - - $msgtype = ((array_key_exists('type',$data)) ? $data['type'] : ''); - - if($msgtype === 'ping') { - - // Useful to get a health check on a remote site. - // This will let us know if any important communication details - // that we may have stored are no longer valid, regardless of xchan details. - logger('POST: got ping send pong now back: ' . z_root() , LOGGER_DEBUG ); - - $ret['success'] = true; - $ret['site'] = array(); - $ret['site']['url'] = z_root(); - $ret['site']['url_sig'] = base64url_encode(rsa_sign(z_root(),get_config('system','prvkey'))); - $ret['site']['sitekey'] = get_config('system','pubkey'); - json_return_and_die($ret); - } - - - if($msgtype === 'pickup') { - - /* - * The 'pickup' message arrives with a tracking ID which is associated with a particular outq_hash - * First verify that that the returned signatures verify, then check that we have an outbound queue item - * with the correct hash. - * If everything verifies, find any/all outbound messages in the queue for this hubloc and send them back - */ - - if((! $data['secret']) || (! $data['secret_sig'])) { - $ret['message'] = 'no verification signature'; - logger('mod_zot: pickup: ' . $ret['message'], LOGGER_DEBUG); - json_return_and_die($ret); - } - $r = q("select distinct hubloc_sitekey from hubloc where hubloc_url = '%s' and hubloc_callback = '%s' and hubloc_sitekey != '' group by hubloc_sitekey ", - dbesc($data['url']), - dbesc($data['callback']) - ); - if(! $r) { - $ret['message'] = 'site not found'; - logger('mod_zot: pickup: ' . $ret['message']); - json_return_and_die($ret); - } - - foreach ($r as $hubsite) { - - // verify the url_sig - // If the server was re-installed at some point, there could be multiple hubs with the same url and callback. - // Only one will have a valid key. - - $forgery = true; - $secret_fail = true; - - $sitekey = $hubsite['hubloc_sitekey']; - - logger('mod_zot: Checking sitekey: ' . $sitekey, LOGGER_DATA); - - if(rsa_verify($data['callback'],base64url_decode($data['callback_sig']),$sitekey)) { - $forgery = false; - } - if(rsa_verify($data['secret'],base64url_decode($data['secret_sig']),$sitekey)) { - $secret_fail = false; - } - if((! $forgery) && (! $secret_fail)) - break; - } - - if($forgery) { - $ret['message'] = 'possible site forgery'; - logger('mod_zot: pickup: ' . $ret['message']); - json_return_and_die($ret); - } - - if($secret_fail) { - $ret['message'] = 'secret validation failed'; - logger('mod_zot: pickup: ' . $ret['message']); - json_return_and_die($ret); - } - - /* - * If we made it to here, the signatures verify, but we still don't know if the tracking ID is valid. - * It wouldn't be an error if the tracking ID isn't found, because we may have sent this particular - * queue item with another pickup (after the tracking ID for the other pickup was verified). - */ - - $r = q("select outq_posturl from outq where outq_hash = '%s' and outq_posturl = '%s' limit 1", - dbesc($data['secret']), - dbesc($data['callback']) - ); - if(! $r) { - $ret['message'] = 'nothing to pick up'; - logger('mod_zot: pickup: ' . $ret['message']); - json_return_and_die($ret); - } - - /* - * Everything is good if we made it here, so find all messages that are going to this location - * and send them all. - */ - - $r = q("select * from outq where outq_posturl = '%s'", - dbesc($data['callback']) - ); - if($r) { - logger('mod_zot: successful pickup message received from ' . $data['callback'] . ' ' . count($r) . ' message(s) picked up', LOGGER_DEBUG); - - $ret['success'] = true; - $ret['pickup'] = array(); - foreach($r as $rr) { - if($rr['outq_msg']) { - $x = json_decode($rr['outq_msg'],true); - - if(! $x) - continue; - - if(array_key_exists('message_list',$x)) { - foreach($x['message_list'] as $xx) { - $ret['pickup'][] = array('notify' => json_decode($rr['outq_notify'],true),'message' => $xx); - } - } - else - $ret['pickup'][] = array('notify' => json_decode($rr['outq_notify'],true),'message' => $x); - - $x = q("delete from outq where outq_hash = '%s'", - dbesc($rr['outq_hash']) - ); - } - } - } - - $encrypted = crypto_encapsulate(json_encode($ret),$sitekey); - json_return_and_die($encrypted); - - /* pickup: end */ - } - - /* - * All other message types require us to verify the sender. This is a generic check, so we - * will do it once here and bail if anything goes wrong. - */ - - if (array_key_exists('sender',$data)) { - $sender = $data['sender']; - } - - /* Check if the sender is already verified here */ - - $hubs = zot_gethub($sender,true); - - if (! $hubs) { - - /* Have never seen this guid or this guid coming from this location. Check it and register it. */ - - // (!!) this will validate the sender - $result = zot_register_hub($sender); - - if ((! $result['success']) || (! ($hubs = zot_gethub($sender,true)))) { - $ret['message'] = 'Hub not available.'; - logger('mod_zot: no hub'); - json_return_and_die($ret); - } - } - - - foreach($hubs as $hub) { - - $sitekey = $hub['hubloc_sitekey']; - - if(array_key_exists('sitekey',$sender) && $sender['sitekey']) { - - /* - * This hub has now been proven to be valid. - * Any hub with the same URL and a different sitekey cannot be valid. - * Get rid of them (mark them deleted). There's a good chance they were re-installs. - */ - - q("update hubloc set hubloc_deleted = 1, hubloc_error = 1 where hubloc_url = '%s' and hubloc_sitekey != '%s' ", - dbesc($hub['hubloc_url']), - dbesc($sender['sitekey']) - ); - - $sitekey = $sender['sitekey']; - } - - // $sender['sitekey'] is a new addition to the protcol to distinguish - // hublocs coming from re-installed sites. Older sites will not provide - // this field and we have to still mark them valid, since we can't tell - // if this hubloc has the same sitekey as the packet we received. - - - // Update our DB to show when we last communicated successfully with this hub - // This will allow us to prune dead hubs from using up resources - - $r = q("update hubloc set hubloc_connected = '%s' where hubloc_id = %d and hubloc_sitekey = '%s' ", - dbesc(datetime_convert()), - intval($hub['hubloc_id']), - dbesc($sitekey) - ); - - // a dead hub came back to life - reset any tombstones we might have - - if(intval($hub['hubloc_error'])) { - q("update hubloc set hubloc_error = 0 where hubloc_id = %d and hubloc_sitekey = '%s' ", - intval($hub['hubloc_id']), - dbesc($sitekey) - ); - if(intval($r[0]['hubloc_orphancheck'])) { - q("update hubloc set hubloc_orhpancheck = 0 where hubloc_id = %d and hubloc_sitekey = '%s' ", - intval($hub['hubloc_id']), - dbesc($sitekey) - ); - } - q("update xchan set xchan_orphan = 0 where xchan_orphan = 1 and xchan_hash = '%s'", - dbesc($hub['hubloc_hash']) - ); - } - - $connecting_url = $hub['hubloc_url']; - } - - - /** @TODO check which hub is primary and take action if mismatched */ - - if (array_key_exists('recipients', $data)) - $recipients = $data['recipients']; - - - if ($msgtype === 'auth_check') { - - /* - * Requestor visits /magic/?dest=somewhere on their own site with a browser - * magic redirects them to $destsite/post [with auth args....] - * $destsite sends an auth_check packet to originator site - * The auth_check packet is handled here by the originator's site - * - the browser session is still waiting - * inside $destsite/post for everything to verify - * If everything checks out we'll return a token to $destsite - * and then $destsite will verify the token, authenticate the browser - * session and then redirect to the original destination. - * If authentication fails, the redirection to the original destination - * will still take place but without authentication. - */ - logger('mod_zot: auth_check', LOGGER_DEBUG); - - if (! $encrypted_packet) { - logger('mod_zot: auth_check packet was not encrypted.'); - $ret['message'] .= 'no packet encryption' . EOL; - json_return_and_die($ret); - } - - $arr = $data['sender']; - $sender_hash = make_xchan_hash($arr['guid'],$arr['guid_sig']); - - // garbage collect any old unused notifications - - // This was and should be 10 minutes but my hosting provider has time lag between the DB and - // the web server. We should probably convert this to webserver time rather than DB time so - // that the different clocks won't affect it and allow us to keep the time short. - - q("delete from verify where type = 'auth' and created < %s - INTERVAL %s", - db_utcnow(), db_quoteinterval('30 MINUTE') - ); - - $y = q("select xchan_pubkey from xchan where xchan_hash = '%s' limit 1", - dbesc($sender_hash) - ); - - // We created a unique hash in mod/magic.php when we invoked remote auth, and stored it in - // the verify table. It is now coming back to us as 'secret' and is signed by a channel at the other end. - // First verify their signature. We will have obtained a zot-info packet from them as part of the sender - // verification. - - if ((! $y) || (! rsa_verify($data['secret'], base64url_decode($data['secret_sig']),$y[0]['xchan_pubkey']))) { - logger('mod_zot: auth_check: sender not found or secret_sig invalid.'); - $ret['message'] .= 'sender not found or sig invalid ' . print_r($y,true) . EOL; - json_return_and_die($ret); - } - - // There should be exactly one recipient, the original auth requestor - - $ret['message'] .= 'recipients ' . print_r($recipients,true) . EOL; - - if ($data['recipients']) { - - $arr = $data['recipients'][0]; - $recip_hash = make_xchan_hash($arr['guid'], $arr['guid_sig']); - $c = q("select channel_id, channel_account_id, channel_prvkey from channel where channel_hash = '%s' limit 1", - dbesc($recip_hash) - ); - if (! $c) { - logger('mod_zot: auth_check: recipient channel not found.'); - $ret['message'] .= 'recipient not found.' . EOL; - json_return_and_die($ret); - } - - $confirm = base64url_encode(rsa_sign($data['secret'] . $recip_hash,$c[0]['channel_prvkey'])); - - // This additionally checks for forged sites since we already stored the expected result in meta - // and we've already verified that this is them via zot_gethub() and that their key signed our token - - $z = q("select id from verify where channel = %d and type = 'auth' and token = '%s' and meta = '%s' limit 1", - intval($c[0]['channel_id']), - dbesc($data['secret']), - dbesc($data['sender']['url']) - ); - if (! $z) { - logger('mod_zot: auth_check: verification key not found.'); - $ret['message'] .= 'verification key not found' . EOL; - json_return_and_die($ret); - } - $r = q("delete from verify where id = %d", - intval($z[0]['id']) - ); - - $u = q("select account_service_class from account where account_id = %d limit 1", - intval($c[0]['channel_account_id']) - ); - - logger('mod_zot: auth_check: success', LOGGER_DEBUG); - $ret['success'] = true; - $ret['confirm'] = $confirm; - if ($u && $u[0]['account_service_class']) - $ret['service_class'] = $u[0]['account_service_class']; - - // Set "do not track" flag if this site or this channel's profile is restricted - // in some way - - if (intval(get_config('system','block_public'))) - $ret['DNT'] = true; - if (! perm_is_allowed($c[0]['channel_id'],'','view_profile')) - $ret['DNT'] = true; - if (get_pconfig($c[0]['channel_id'],'system','do_not_track')) - $ret['DNT'] = true; - if (get_pconfig($c[0]['channel_id'],'system','hide_online_status')) - $ret['DNT'] = true; - - json_return_and_die($ret); - } - json_return_and_die($ret); - } - - if ($msgtype === 'request') { - // request a particular post/conversation by message_id - $x = zot_process_message_request($data); - json_return_and_die($x); - } - - if ($msgtype === 'purge') { - if ($recipients) { - // basically this means "unfriend" - foreach ($recipients as $recip) { - $r = q("select channel.*,xchan.* from channel - left join xchan on channel_hash = xchan_hash - where channel_guid = '%s' and channel_guid_sig = '%s' limit 1", - dbesc($recip['guid']), - dbesc($recip['guid_sig']) - ); - if ($r) { - $r = q("select abook_id from abook where uid = %d and abook_xchan = '%s' limit 1", - intval($r[0]['channel_id']), - dbesc(make_xchan_hash($sender['guid'],$sender['guid_sig'])) - ); - if ($r) { - contact_remove($r[0]['channel_id'],$r[0]['abook_id']); - } - } - } - } else { - // Unfriend everybody - basically this means the channel has committed suicide - $arr = $data['sender']; - $sender_hash = make_xchan_hash($arr['guid'],$arr['guid_sig']); - - require_once('include/Contact.php'); - remove_all_xchan_resources($sender_hash); - - $ret['success'] = true; - json_return_and_die($ret); - } - } - - if (($msgtype === 'refresh') || ($msgtype === 'force_refresh')) { - - // remote channel info (such as permissions or photo or something) - // has been updated. Grab a fresh copy and sync it. - // The difference between refresh and force_refresh is that - // force_refresh unconditionally creates a directory update record, - // even if no changes were detected upon processing. - - if ($recipients) { - - // This would be a permissions update, typically for one connection - - foreach ($recipients as $recip) { - $r = q("select channel.*,xchan.* from channel - left join xchan on channel_hash = xchan_hash - where channel_guid = '%s' and channel_guid_sig = '%s' limit 1", - dbesc($recip['guid']), - dbesc($recip['guid_sig']) - ); - - $x = zot_refresh(array( - 'xchan_guid' => $sender['guid'], - 'xchan_guid_sig' => $sender['guid_sig'], - 'hubloc_url' => $sender['url'] - ), $r[0], (($msgtype === 'force_refresh') ? true : false)); - } - } else { - - // system wide refresh - - $x = zot_refresh(array( - 'xchan_guid' => $sender['guid'], - 'xchan_guid_sig' => $sender['guid_sig'], - 'hubloc_url' => $sender['url'] - ), null, (($msgtype === 'force_refresh') ? true : false)); - } - $ret['success'] = true; - json_return_and_die($ret); - } - - if ($msgtype === 'notify') { - - logger('notify received from ' . $connecting_url); - - - $async = get_config('system','queued_fetch'); - - if ($async) { - // add to receive queue - // qreceive_add($data); - } else { - $x = zot_fetch($data); - $ret['delivery_report'] = $x; - } - - $ret['success'] = true; - json_return_and_die($ret); - } + exit; - // catchall - json_return_and_die($ret); } -- cgit v1.2.3 From 69c9f4588c57a1159ab18c5987f99ea5471579d5 Mon Sep 17 00:00:00 2001 From: Mario Vavti Date: Mon, 7 Dec 2015 12:13:51 +0100 Subject: make justify gallery work with more than one albums per page (eg album widget) --- mod/photos.php | 2 ++ 1 file changed, 2 insertions(+) (limited to 'mod') diff --git a/mod/photos.php b/mod/photos.php index 33a895fdf..5a55123cc 100644 --- a/mod/photos.php +++ b/mod/photos.php @@ -779,6 +779,7 @@ function photos_content(&$a) { $o .= replace_macros($tpl, array( '$photos' => $photos, '$album' => $album, + '$album_id' => rand(), '$album_edit' => array(t('Edit Album'), $album_edit), '$can_post' => $can_post, '$upload' => array(t('Upload'), $a->get_baseurl() . '/photos/' . $a->data['channel']['channel_address'] . '/upload/' . bin2hex($album)), @@ -1313,6 +1314,7 @@ function photos_content(&$a) { $tpl = get_markup_template('photos_recent.tpl'); $o .= replace_macros($tpl, array( '$title' => t('Recent Photos'), + '$album_id' => rand(), '$can_post' => $can_post, '$upload' => array(t('Upload'), $a->get_baseurl().'/photos/'.$a->data['channel']['channel_address'].'/upload'), '$photos' => $photos, -- cgit v1.2.3 From 0df4f9c114529478468fa1dbe9ab6032eded4db2 Mon Sep 17 00:00:00 2001 From: Mario Vavti Date: Mon, 7 Dec 2015 13:27:35 +0100 Subject: change album_id logic to make it work with ajax calls --- mod/photos.php | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'mod') diff --git a/mod/photos.php b/mod/photos.php index 5a55123cc..5b3367d40 100644 --- a/mod/photos.php +++ b/mod/photos.php @@ -765,6 +765,7 @@ function photos_content(&$a) { if($photos) { $o = replace_macros(get_markup_template('photosajax.tpl'),array( '$photos' => $photos, + '$album_id' => bin2hex($album) )); } else { @@ -779,7 +780,7 @@ function photos_content(&$a) { $o .= replace_macros($tpl, array( '$photos' => $photos, '$album' => $album, - '$album_id' => rand(), + '$album_id' => bin2hex($album), '$album_edit' => array(t('Edit Album'), $album_edit), '$can_post' => $can_post, '$upload' => array(t('Upload'), $a->get_baseurl() . '/photos/' . $a->data['channel']['channel_address'] . '/upload/' . bin2hex($album)), @@ -1301,6 +1302,7 @@ function photos_content(&$a) { if($photos) { $o = replace_macros(get_markup_template('photosajax.tpl'),array( '$photos' => $photos, + '$album_id' => bin2hex(t('Recent Photos')) )); } else { @@ -1314,7 +1316,7 @@ function photos_content(&$a) { $tpl = get_markup_template('photos_recent.tpl'); $o .= replace_macros($tpl, array( '$title' => t('Recent Photos'), - '$album_id' => rand(), + '$album_id' => bin2hex(t('Recent Photos')), '$can_post' => $can_post, '$upload' => array(t('Upload'), $a->get_baseurl().'/photos/'.$a->data['channel']['channel_address'].'/upload'), '$photos' => $photos, -- cgit v1.2.3 From 8b974f8f74f6eefc5955a0f9e385f6460504fc42 Mon Sep 17 00:00:00 2001 From: redmatrix Date: Mon, 7 Dec 2015 16:01:54 -0800 Subject: abstract the message handlers --- mod/post.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'mod') diff --git a/mod/post.php b/mod/post.php index 6885b0d69..d1a53e7a6 100644 --- a/mod/post.php +++ b/mod/post.php @@ -486,8 +486,9 @@ function post_init(&$a) { function post_post(&$a) { require_once('Zotlabs/Zot/Receiver.php'); + require_once('Zotlabs/Zot/ZotHandler.php'); - $z = new Zotlabs\Zot\Receiver($_REQUEST['data'],get_config('system','prvkey')); + $z = new Zotlabs\Zot\Receiver($_REQUEST['data'],get_config('system','prvkey'), new Zotlabs\Zot\ZotHandler()); // notreached; -- cgit v1.2.3 From 29ac533cc908a57115d52a8659bce348b36ae6fa Mon Sep 17 00:00:00 2001 From: redmatrix Date: Tue, 8 Dec 2015 16:32:06 -0800 Subject: remove some unused stuff --- mod/fbrowser.php | 9 ++------- mod/photos.php | 7 +------ 2 files changed, 3 insertions(+), 13 deletions(-) (limited to 'mod') diff --git a/mod/fbrowser.php b/mod/fbrowser.php index 90b554edd..13abbfd8a 100644 --- a/mod/fbrowser.php +++ b/mod/fbrowser.php @@ -57,13 +57,8 @@ function fbrowser_content($a){ $types = $ph->supportedTypes(); $ext = $types[$rr['type']]; - if($a->get_template_engine() === 'internal') { - $filename_e = template_escape($rr['filename']); - } - else { - $filename_e = $rr['filename']; - } - + $filename_e = $rr['filename']; + return array( $a->get_baseurl() . '/photo/' . $rr['resource_id'] . '-' . $rr['hiq'] . '.' .$ext, $filename_e, diff --git a/mod/photos.php b/mod/photos.php index 5b3367d40..b0d9bc631 100644 --- a/mod/photos.php +++ b/mod/photos.php @@ -698,12 +698,7 @@ function photos_content(&$a) { $album_edit = null; if(($album !== t('Profile Photos')) && ($album !== 'Profile Photos') && ($album !== 'Contact Photos') && ($album !== t('Contact Photos'))) { if($can_post) { - if($a->get_template_engine() === 'internal') { - $album_e = template_escape($album); - } - else { - $album_e = $album; - } + $album_e = $album; $albums = ((array_key_exists('albums', $a->data)) ? $a->data['albums'] : photos_albums_list($a->data['channel'],$a->data['observer'])); // @fixme - syncronise actions with DAV -- cgit v1.2.3 From 9d04406f9ae8a91f8ec5f3be7f89471ac5605522 Mon Sep 17 00:00:00 2001 From: jeroenpraat Date: Wed, 9 Dec 2015 01:39:02 +0100 Subject: First part of fix for issue #109 --- mod/invite.php | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-) (limited to 'mod') diff --git a/mod/invite.php b/mod/invite.php index 1af5fc1f8..e8bb74ee2 100644 --- a/mod/invite.php +++ b/mod/invite.php @@ -50,23 +50,6 @@ function invite_post(&$a) { continue; } - if($invonly && ($x || is_site_admin())) { - $code = autoname(8) . rand(1000,9999); - $nmessage = str_replace('$invite_code',$code,$message); - - $r = q("INSERT INTO `register` (`hash`,`created`) VALUES ('%s', '%s') ", - dbesc($code), - dbesc(datetime_convert()) - ); - - if(! is_site_admin()) { - $x --; - if($x >= 0) - set_pconfig(local_channel(),'system','invites_remaining',$x); - else - return; - } - } else $nmessage = $message; @@ -117,6 +100,23 @@ function invite_content(&$a) { } } + if($invonly && ($x || is_site_admin())) { + $invite_code = autoname(8) . rand(1000,9999); + $nmessage = str_replace('$invite_code',$invite_code,$message); + + $r = q("INSERT INTO `register` (`hash`,`created`) VALUES ('%s', '%s') ", + dbesc($invite_code), + dbesc(datetime_convert()) + ); + + if(! is_site_admin()) { + $x --; + if($x >= 0) + set_pconfig(local_channel(),'system','invites_remaining',$x); + else + return; + } + } $ob = $a->get_observer(); if(! $ob) -- cgit v1.2.3 From baab9b6fbc45a30dc4cce5b3c85d7c94e8e6a84c Mon Sep 17 00:00:00 2001 From: redmatrix Date: Tue, 8 Dec 2015 18:31:33 -0800 Subject: more libzot stuff --- mod/post.php | 471 +---------------------------------------------------------- 1 file changed, 4 insertions(+), 467 deletions(-) (limited to 'mod') diff --git a/mod/post.php b/mod/post.php index d1a53e7a6..6555a16c2 100644 --- a/mod/post.php +++ b/mod/post.php @@ -9,478 +9,15 @@ require_once('include/zot.php'); -/** - * @brief HTTP POST entry point for Zot. - * - * Most access to this endpoint is via the post method. - * Here we will pick out the magic auth params which arrive as a get request, - * and the only communications to arrive this way. - * - * Magic Auth - * ========== - * - * So-called "magic auth" takes place by a special exchange. On the site where the "channel to be authenticated" lives (e.g. $mysite), - * a redirection is made via $mysite/magic to the zot endpoint of the remote site ($remotesite) with special GET parameters. - * - * The endpoint is typically https://$remotesite/post - or whatever was specified as the callback url in prior communications - * (we will bootstrap an address and fetch a zot info packet if possible where no prior communications exist) - * - * Five GET parameters are supplied: - * * auth => the urlencoded webbie (channel@host.domain) of the channel requesting access - * * dest => the desired destination URL (urlencoded) - * * sec => a random string which is also stored on $mysite for use during the verification phase. - * * version => the zot revision - * * delegate => optional urlencoded webbie of a local channel to invoke delegation rights for - * - * When this packet is received, an "auth-check" zot message is sent to $mysite. - * (e.g. if $_GET['auth'] is foobar@podunk.edu, a zot packet is sent to the podunk.edu zot endpoint, which is typically /post) - * If no information has been recorded about the requesting identity a zot information packet will be retrieved before - * continuing. - * - * The sender of this packet is an arbitrary/random site channel. The recipients will be a single recipient corresponding - * to the guid and guid_sig we have associated with the requesting auth identity - * - * \code{.json} - * { - * "type":"auth_check", - * "sender":{ - * "guid":"kgVFf_...", - * "guid_sig":"PT9-TApz...", - * "url":"http:\/\/podunk.edu", - * "url_sig":"T8Bp7j..." - * }, - * "recipients":{ - * { - * "guid":"ZHSqb...", - * "guid_sig":"JsAAXi..." - * } - * } - * "callback":"\/post", - * "version":1, - * "secret":"1eaa661", - * "secret_sig":"eKV968b1..." - * } - * \endcode - * - * auth_check messages MUST use encapsulated encryption. This message is sent to the origination site, which checks the 'secret' to see - * if it is the same as the 'sec' which it passed originally. It also checks the secret_sig which is the secret signed by the - * destination channel's private key and base64url encoded. If everything checks out, a json packet is returned: - * - * \code{.json} - * { - * "success":1, - * "confirm":"q0Ysovd1u...", - * "service_class":(optional) - * "level":(optional) - * } - * \endcode - * - * 'confirm' in this case is the base64url encoded RSA signature of the concatenation of 'secret' with the - * base64url encoded whirlpool hash of the requestor's guid and guid_sig; signed with the source channel private key. - * This prevents a man-in-the-middle from inserting a rogue success packet. Upon receipt and successful - * verification of this packet, the destination site will redirect to the original destination URL and indicate a successful remote login. - * Service_class can be used by cooperating sites to provide different access rights based on account rights and subscription plans. It is - * a string whose contents are not defined by protocol. Example: "basic" or "gold". - * - * @param[in,out] App &$a - */ function post_init(&$a) { if (array_key_exists('auth', $_REQUEST)) { - - $ret = array('success' => false, 'message' => ''); - - logger('mod_zot: auth request received.'); - $address = $_REQUEST['auth']; - $desturl = $_REQUEST['dest']; - $sec = $_REQUEST['sec']; - $version = $_REQUEST['version']; - $delegate = $_REQUEST['delegate']; - - $test = ((x($_REQUEST, 'test')) ? intval($_REQUEST['test']) : 0); - - // They are authenticating ultimately to the site and not to a particular channel. - // Any channel will do, providing it's currently active. We just need to have an - // identity to attach to the packet we send back. So find one. - - $c = q("select * from channel where channel_removed = 0 limit 1"); - - if (! $c) { - // nobody here - logger('mod_zot: auth: unable to find a response channel'); - if ($test) { - $ret['message'] .= 'no local channels found.' . EOL; - json_return_and_die($ret); - } - - goaway($desturl); - } - - // Try and find a hubloc for the person attempting to auth - $x = q("select * from hubloc left join xchan on xchan_hash = hubloc_hash where hubloc_addr = '%s' order by hubloc_id desc", - dbesc($address) - ); - - if (! $x) { - // finger them if they can't be found. - $ret = zot_finger($address, null); - if ($ret['success']) { - $j = json_decode($ret['body'], true); - if ($j) - import_xchan($j); - $x = q("select * from hubloc left join xchan on xchan_hash = hubloc_hash where hubloc_addr = '%s' order by hubloc_id desc", - dbesc($address) - ); - } - } - if(! $x) { - logger('mod_zot: auth: unable to finger ' . $address); - - if($test) { - $ret['message'] .= 'no hubloc found for ' . $address . ' and probing failed.' . EOL; - json_return_and_die($ret); - } - - goaway($desturl); - } - - - foreach($x as $xx) { - logger('mod_zot: auth request received from ' . $xx['hubloc_addr'] ); - - // check credentials and access - - // If they are already authenticated and haven't changed credentials, - // we can save an expensive network round trip and improve performance. - - $remote = remote_channel(); - $result = null; - $remote_service_class = ''; - $remote_level = 0; - $remote_hub = $xx['hubloc_url']; - $DNT = 0; - - // Also check that they are coming from the same site as they authenticated with originally. - - $already_authed = ((($remote) && ($xx['hubloc_hash'] == $remote) && ($xx['hubloc_url'] === $_SESSION['remote_hub'])) ? true : false); - if($delegate && $delegate !== $_SESSION['delegate_channel']) - $already_authed = false; - - $j = array(); - - if (! $already_authed) { - - // Auth packets MUST use ultra top-secret hush-hush mode - e.g. the entire packet is encrypted using the site private key - // The actual channel sending the packet ($c[0]) is not important, but this provides a generic zot packet with a sender - // which can be verified - - $p = zot_build_packet($c[0],$type = 'auth_check', array(array('guid' => $xx['hubloc_guid'],'guid_sig' => $xx['hubloc_guid_sig'])), $xx['hubloc_sitekey'], $sec); - if ($test) { - $ret['message'] .= 'auth check packet created using sitekey ' . $xx['hubloc_sitekey'] . EOL; - $ret['message'] .= 'packet contents: ' . $p . EOL; - } - - $result = zot_zot($xx['hubloc_callback'],$p); - - if (! $result['success']) { - logger('mod_zot: auth_check callback failed.'); - if ($test) { - $ret['message'] .= 'auth check request to your site returned .' . print_r($result, true) . EOL; - continue; - } - continue; - } - $j = json_decode($result['body'], true); - if (! $j) { - logger('mod_zot: auth_check json data malformed.'); - if($test) { - $ret['message'] .= 'json malformed: ' . $result['body'] . EOL; - continue; - } - } - } - - if ($test) { - $ret['message'] .= 'auth check request returned .' . print_r($j, true) . EOL; - } - - if ($already_authed || $j['success']) { - if ($j['success']) { - // legit response, but we do need to check that this wasn't answered by a man-in-middle - if (! rsa_verify($sec . $xx['xchan_hash'],base64url_decode($j['confirm']),$xx['xchan_pubkey'])) { - logger('mod_zot: auth: final confirmation failed.'); - if ($test) { - $ret['message'] .= 'final confirmation failed. ' . $sec . print_r($j,true) . print_r($xx,true); - continue; - } - - continue; - } - if (array_key_exists('service_class',$j)) - $remote_service_class = $j['service_class']; - if (array_key_exists('level',$j)) - $remote_level = $j['level']; - if (array_key_exists('DNT',$j)) - $DNT = $j['DNT']; - } - // everything is good... maybe - if(local_channel()) { - - // tell them to logout if they're logged in locally as anything but the target remote account - // in which case just shut up because they don't need to be doing this at all. - - if ($a->channel['channel_hash'] != $xx['xchan_hash']) { - logger('mod_zot: auth: already authenticated locally as somebody else.'); - notice( t('Remote authentication blocked. You are logged into this site locally. Please logout and retry.') . EOL); - if ($test) { - $ret['message'] .= 'already logged in locally with a conflicting identity.' . EOL; - continue; - } - } - continue; - } - - // log them in - - if ($test) { - $ret['success'] = true; - $ret['message'] .= 'Authentication Success!' . EOL; - json_return_and_die($ret); - } - - $delegation_success = false; - if ($delegate) { - $r = q("select * from channel left join xchan on channel_hash = xchan_hash where xchan_addr = '%s' limit 1", - dbesc($delegate) - ); - if ($r && intval($r[0]['channel_id'])) { - $allowed = perm_is_allowed($r[0]['channel_id'],$xx['xchan_hash'],'delegate'); - if ($allowed) { - $_SESSION['delegate_channel'] = $r[0]['channel_id']; - $_SESSION['delegate'] = $xx['xchan_hash']; - $_SESSION['account_id'] = intval($r[0]['channel_account_id']); - require_once('include/security.php'); - change_channel($r[0]['channel_id']); - $delegation_success = true; - } - } - } - - $_SESSION['authenticated'] = 1; - if (! $delegation_success) { - $_SESSION['visitor_id'] = $xx['xchan_hash']; - $_SESSION['my_url'] = $xx['xchan_url']; - $_SESSION['my_address'] = $address; - $_SESSION['remote_service_class'] = $remote_service_class; - $_SESSION['remote_level'] = $remote_level; - $_SESSION['remote_hub'] = $remote_hub; - $_SESSION['DNT'] = $DNT; - } - - $arr = array('xchan' => $xx, 'url' => $desturl, 'session' => $_SESSION); - call_hooks('magic_auth_success',$arr); - $a->set_observer($xx); - require_once('include/security.php'); - $a->set_groups(init_groups_visitor($_SESSION['visitor_id'])); - info(sprintf( t('Welcome %s. Remote authentication successful.'),$xx['xchan_name'])); - logger('mod_zot: auth success from ' . $xx['xchan_addr']); - } - else { - if ($test) { - $ret['message'] .= 'auth failure. ' . print_r($_REQUEST,true) . print_r($j,true) . EOL; - continue; - } - logger('mod_zot: magic-auth failure - not authenticated: ' . $xx['xchan_addr']); - } - - if ($test) { - $ret['message'] .= 'auth failure fallthrough ' . print_r($_REQUEST,true) . print_r($j,true) . EOL; - continue; - } - } - - /** - * @FIXME we really want to save the return_url in the session before we - * visit rmagic. This does however prevent a recursion if you visit - * rmagic directly, as it would otherwise send you back here again. - * But z_root() probably isn't where you really want to go. - */ - - if(strstr($desturl,z_root() . '/rmagic')) - goaway(z_root()); - - if ($test) { - json_return_and_die($ret); - } - - goaway($desturl); + require_once('Zotlabs/Zot/Auth.php'); + $x = new Zotlabs\Zot\Auth($_REQUEST); + exit; } -} - -/** - * @brief zot communications and messaging. - * - * Sender HTTP posts to this endpoint ($site/post typically) with 'data' parameter set to json zot message packet. - * This packet is optionally encrypted, which we will discover if the json has an 'iv' element. - * $contents => array( 'alg' => 'aes256cbc', 'iv' => initialisation vector, 'key' => decryption key, 'data' => encrypted data); - * $contents->iv and $contents->key are random strings encrypted with this site's RSA public key and then base64url encoded. - * Currently only 'aes256cbc' is used, but this is extensible should that algorithm prove inadequate. - * - * Once decrypted, one will find the normal json_encoded zot message packet. - * - * Defined packet types are: notify, purge, refresh, force_refresh, auth_check, ping, and pickup - * - * Standard packet: (used by notify, purge, refresh, force_refresh, and auth_check) - * \code{.json} - * { - * "type": "notify", - * "sender":{ - * "guid":"kgVFf_1...", - * "guid_sig":"PT9-TApzp...", - * "url":"http:\/\/podunk.edu", - * "url_sig":"T8Bp7j5...", - * }, - * "recipients": { optional recipient array }, - * "callback":"\/post", - * "version":1, - * "secret":"1eaa...", - * "secret_sig": "df89025470fac8..." - * } - * \endcode - * - * Signature fields are all signed with the sender channel private key and base64url encoded. - * Recipients are arrays of guid and guid_sig, which were previously signed with the recipients private - * key and base64url encoded and later obtained via channel discovery. Absence of recipients indicates - * a public message or visible to all potential listeners on this site. - * - * "pickup" packet: - * The pickup packet is sent in response to a notify packet from another site - * \code{.json} - * { - * "type":"pickup", - * "url":"http:\/\/example.com", - * "callback":"http:\/\/example.com\/post", - * "callback_sig":"teE1_fLI...", - * "secret":"1eaa...", - * "secret_sig":"O7nB4_..." - * } - * \endcode - * - * In the pickup packet, the sig fields correspond to the respective data - * element signed with this site's system private key and then base64url encoded. - * The "secret" is the same as the original secret from the notify packet. - * - * If verification is successful, a json structure is returned containing a - * success indicator and an array of type 'pickup'. - * Each pickup element contains the original notify request and a message field - * whose contents are dependent on the message type. - * - * This JSON array is AES encapsulated using the site public key of the site - * that sent the initial zot pickup packet. - * Using the above example, this would be example.com. - * - * \code{.json} - * { - * "success":1, - * "pickup":{ - * "notify":{ - * "type":"notify", - * "sender":{ - * "guid":"kgVFf_...", - * "guid_sig":"PT9-TApz...", - * "url":"http:\/\/z.podunk.edu", - * "url_sig":"T8Bp7j5D..." - * }, - * "callback":"\/post", - * "version":1, - * "secret":"1eaa661..." - * }, - * "message":{ - * "type":"activity", - * "message_id":"10b049ce384cbb2da9467319bc98169ab36290b8bbb403aa0c0accd9cb072e76@podunk.edu", - * "message_top":"10b049ce384cbb2da9467319bc98169ab36290b8bbb403aa0c0accd9cb072e76@podunk.edu", - * "message_parent":"10b049ce384cbb2da9467319bc98169ab36290b8bbb403aa0c0accd9cb072e76@podunk.edu", - * "created":"2012-11-20 04:04:16", - * "edited":"2012-11-20 04:04:16", - * "title":"", - * "body":"Hi Nickordo", - * "app":"", - * "verb":"post", - * "object_type":"", - * "target_type":"", - * "permalink":"", - * "location":"", - * "longlat":"", - * "owner":{ - * "name":"Indigo", - * "address":"indigo@podunk.edu", - * "url":"http:\/\/podunk.edu", - * "photo":{ - * "mimetype":"image\/jpeg", - * "src":"http:\/\/podunk.edu\/photo\/profile\/m\/5" - * }, - * "guid":"kgVFf_...", - * "guid_sig":"PT9-TAp...", - * }, - * "author":{ - * "name":"Indigo", - * "address":"indigo@podunk.edu", - * "url":"http:\/\/podunk.edu", - * "photo":{ - * "mimetype":"image\/jpeg", - * "src":"http:\/\/podunk.edu\/photo\/profile\/m\/5" - * }, - * "guid":"kgVFf_...", - * "guid_sig":"PT9-TAp..." - * } - * } - * } - * } - * \endcode - * - * Currently defined message types are 'activity', 'mail', 'profile', 'location' - * and 'channel_sync', which each have different content schemas. - * - * Ping packet: - * A ping packet does not require any parameters except the type. It may or may - * not be encrypted. - * - * \code{.json} - * { - * "type": "ping" - * } - * \endcode - * - * On receipt of a ping packet a ping response will be returned: - * - * \code{.json} - * { - * "success" : 1, - * "site" { - * "url": "http:\/\/podunk.edu", - * "url_sig": "T8Bp7j5...", - * "sitekey": "-----BEGIN PUBLIC KEY----- - * MIICIjANBgkqhkiG9w0BAQE..." - * } - * } - * \endcode - * - * The ping packet can be used to verify that a site has not been re-installed, and to - * initiate corrective action if it has. The url_sig is signed with the site private key - * and base64url encoded - and this should verify with the enclosed sitekey. Failure to - * verify indicates the site is corrupt or otherwise unable to communicate using zot. - * This return packet is not otherwise verified, so should be compared with other - * results obtained from this site which were verified prior to taking action. For instance - * if you have one verified result with this signature and key, and other records for this - * url which have different signatures and keys, it indicates that the site was re-installed - * and corrective action may commence (remove or mark invalid any entries with different - * signatures). - * If you have no records which match this url_sig and key - no corrective action should - * be taken as this packet may have been returned by an imposter. - * - * @param[in,out] App &$a - */ +} function post_post(&$a) { -- cgit v1.2.3 From 47f7165b07e17721d6074e1464a42af1ef99afe3 Mon Sep 17 00:00:00 2001 From: jeroenpraat Date: Wed, 9 Dec 2015 23:41:37 +0100 Subject: Some work on the login, register and default home page. Mostly neatly centering things on different viewport widths. Bluegrid schema updated. --- mod/home.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'mod') diff --git a/mod/home.php b/mod/home.php index bf2463bbc..bfac17eab 100644 --- a/mod/home.php +++ b/mod/home.php @@ -72,7 +72,7 @@ function home_content(&$a, $update = 0, $load = false) { $sitename = get_config('system','sitename'); if($sitename) - $o .= '

' . sprintf( t("Welcome to %s") ,$sitename) . '

'; + $o .= '

' . sprintf( t("Welcome to %s") ,$sitename) . '

'; $loginbox = get_config('system','login_on_homepage'); if(intval($loginbox) || $loginbox === false) -- cgit v1.2.3 From 7fa944ed953cbf2b9ee044d46e74dfd299237fa7 Mon Sep 17 00:00:00 2001 From: redmatrix Date: Thu, 10 Dec 2015 15:13:10 -0800 Subject: don't spit out sabre xml on permission denied exceptions, just provide a 401 --- mod/cloud.php | 42 ++++++++++++------------------------------ 1 file changed, 12 insertions(+), 30 deletions(-) (limited to 'mod') diff --git a/mod/cloud.php b/mod/cloud.php index efb33f935..67fc199bf 100644 --- a/mod/cloud.php +++ b/mod/cloud.php @@ -73,36 +73,18 @@ function cloud_init(&$a) { $server->addPlugin($lockPlugin); -/* This next bit should no longer be needed... */ - - // The next section of code allows us to bypass prompting for http-auth if a - // FILE is being accessed anonymously and permissions allow this. This way - // one can create hotlinks to public media files in their cloud and anonymous - // viewers won't get asked to login. - // If a DIRECTORY is accessed or there are permission issues accessing the - // file and we aren't previously authenticated via zot, prompt for HTTP-auth. - // This will be the default case for mounting a DAV directory. - // In order to avoid prompting for passwords for viewing a DIRECTORY, add - // the URL query parameter 'davguest=1'. - -// $isapublic_file = false; -// $davguest = ((x($_SESSION, 'davguest')) ? true : false); - -// if ((! $auth->observer) && ($_SERVER['REQUEST_METHOD'] === 'GET')) { -// try { -// $x = RedFileData('/' . $a->cmd, $auth); -// if($x instanceof RedDAV\RedFile) -// $isapublic_file = true; -// } -// catch (Exception $e) { -// $isapublic_file = false; -// } -// } - -// if ((! $auth->observer) && (! $isapublic_file) && (! $davguest)) { -// logger('mod_cloud: auth exception'); -// http_status_exit(401, 'Permission denied.'); -// } + $is_readable = false; + + if($_SERVER['REQUEST_METHOD'] === 'GET') { + try { + $x = RedFileData('/' . $a->cmd, $auth); + } + catch(\Exception $e) { + if($e instanceof Sabre\DAV\Exception\Forbidden) { + http_status_exit(401, 'Permission denied.'); + } + } + } require_once('include/RedDAV/RedBrowser.php'); // provide a directory view for the cloud in Hubzilla -- cgit v1.2.3 From f73c82632f213ac7971b54220b4a0c87d354ca1e Mon Sep 17 00:00:00 2001 From: redmatrix Date: Thu, 10 Dec 2015 19:18:55 -0800 Subject: some minor cleanup - change the default of the discover tab (public stream access) --- mod/admin.php | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) (limited to 'mod') diff --git a/mod/admin.php b/mod/admin.php index 4b7cb3cd9..bac0148e0 100644 --- a/mod/admin.php +++ b/mod/admin.php @@ -243,7 +243,7 @@ function admin_page_site_post(&$a){ $not_allowed_email = ((x($_POST,'not_allowed_email')) ? notags(trim($_POST['not_allowed_email'])) : ''); $block_public = ((x($_POST,'block_public')) ? True : False); $force_publish = ((x($_POST,'publish_all')) ? True : False); - $disable_discover_tab = ((x($_POST,'disable_discover_tab')) ? True : False); + $disable_discover_tab = ((x($_POST,'disable_discover_tab')) ? False : True); $login_on_homepage = ((x($_POST,'login_on_homepage')) ? True : False); $global_directory = ((x($_POST,'directory_submit_url')) ? notags(trim($_POST['directory_submit_url'])) : ''); $no_community_page = !((x($_POST,'no_community_page')) ? True : False); @@ -425,6 +425,13 @@ function admin_page_site(&$a) { // SSL_POLICY_FULL => t("Force all links to use SSL") // ); + $discover_tab = get_config('system','disable_discover_tab'); + // $disable public streams by default + if($discover_tab === false) + $discover_tab = 1; + // now invert the logic for the setting. + $discover_tab = (1 - $discover_tab); + $homelogin = get_config('system','login_on_homepage'); @@ -461,7 +468,7 @@ function admin_page_site(&$a) { '$block_public' => array('block_public', t("Block public"), get_config('system','block_public'), t("Check to block public access to all otherwise public personal pages on this site unless you are currently logged in.")), '$verify_email' => array('verify_email', t("Verify Email Addresses"), get_config('system','verify_email'), t("Check to verify email addresses used in account registration (recommended).")), '$force_publish' => array('publish_all', t("Force publish"), get_config('system','publish_all'), t("Check to force all profiles on this site to be listed in the site directory.")), - '$disable_discover_tab' => array('disable_discover_tab', t("Disable discovery tab"), get_config('system','disable_discover_tab'), t("Remove the tab in the network view with public content pulled from sources chosen for this site.")), + '$disable_discover_tab' => array('disable_discover_tab', t('Import Public Streams'), $discover_tab, t('Import and allow access to public content pulled from other sites. Warning: this content is unmoderated.')), '$login_on_homepage' => array('login_on_homepage', t("login on Homepage"),((intval($homelogin) || $homelogin === false) ? 1 : '') , t("Present a login box to visitors on the home page if no other content has been configured.")), '$directory_server' => (($dir_choices) ? array('directory_server', t("Directory Server URL"), get_config('system','directory_server'), t("Default directory server"), $dir_choices) : null), -- cgit v1.2.3 From 9fb7a12849cd0e91e16c68041a525b9a552242d0 Mon Sep 17 00:00:00 2001 From: redmatrix Date: Fri, 11 Dec 2015 02:52:43 -0800 Subject: incorrect obj_type on several items --- mod/item.php | 1 + mod/subthread.php | 1 - 2 files changed, 1 insertion(+), 1 deletion(-) (limited to 'mod') diff --git a/mod/item.php b/mod/item.php index f32ff8844..b3ef57529 100644 --- a/mod/item.php +++ b/mod/item.php @@ -107,6 +107,7 @@ function item_post(&$a) { $layout_mid = ((x($_REQUEST,'layout_mid')) ? escape_tags($_REQUEST['layout_mid']): ''); $plink = ((x($_REQUEST,'permalink')) ? escape_tags($_REQUEST['permalink']) : ''); $obj_type = ((x($_REQUEST,'obj_type')) ? escape_tags($_REQUEST['obj_type']) : ACTIVITY_OBJ_NOTE); + // allow API to bulk load a bunch of imported items with sending out a bunch of posts. $nopush = ((x($_REQUEST,'nopush')) ? intval($_REQUEST['nopush']) : 0); diff --git a/mod/subthread.php b/mod/subthread.php index 74d742b6a..ce087806e 100755 --- a/mod/subthread.php +++ b/mod/subthread.php @@ -147,7 +147,6 @@ function subthread_content(&$a) { $arr['deny_cid'] = $item['deny_cid']; $arr['deny_gid'] = $item['deny_gid']; - $post = item_store($arr); $post_id = $post['item_id']; -- cgit v1.2.3 From bb0e4044bf08bbac9d73a3e3b75d74c33dcacd7f Mon Sep 17 00:00:00 2001 From: redmatrix Date: Sun, 13 Dec 2015 15:35:45 -0800 Subject: remove the unqualified "OAuth" namespace from the project. We need to reference either OAuth1 or OAuth2. --- mod/api.php | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-) (limited to 'mod') diff --git a/mod/api.php b/mod/api.php index 08978ee96..232349292 100644 --- a/mod/api.php +++ b/mod/api.php @@ -35,42 +35,40 @@ function api_post(&$a) { } function api_content(&$a) { - if ($a->cmd=='api/oauth/authorize'){ + if($a->cmd=='api/oauth/authorize'){ + /* * api/oauth/authorize interact with the user. return a standard page */ $a->page['template'] = "minimal"; - - + // get consumer/client from request token try { - $request = OAuthRequest::from_request(); + $request = OAuth1Request::from_request(); } catch(Exception $e) { echo "
"; var_dump($e); killme();
 		}
 		
 		
-		if (x($_POST,'oauth_yes')){
+		if(x($_POST,'oauth_yes')){
 		
 			$app = oauth_get_client($request);
 			if (is_null($app)) return "Invalid request. Unknown token.";
-			$consumer = new OAuthConsumer($app['client_id'], $app['pw'], $app['redirect_uri']);
+			$consumer = new OAuth1Consumer($app['client_id'], $app['pw'], $app['redirect_uri']);
 
 			$verifier = md5($app['secret'].local_channel());
 			set_config("oauth", $verifier, local_channel());
 			
 			
-			if ($consumer->callback_url!=null) {
+			if($consumer->callback_url!=null) {
 				$params = $request->get_parameters();
 				$glue="?";
 				if (strstr($consumer->callback_url,$glue)) $glue="?";
-				goaway($consumer->callback_url.$glue."oauth_token=".OAuthUtil::urlencode_rfc3986($params['oauth_token'])."&oauth_verifier=".OAuthUtil::urlencode_rfc3986($verifier));
+				goaway($consumer->callback_url . $glue . "oauth_token=" . OAuth1Util::urlencode_rfc3986($params['oauth_token']) . "&oauth_verifier=" . OAuth1Util::urlencode_rfc3986($verifier));
 				killme();
 			}
-			
-			
-			
+						
 			$tpl = get_markup_template("oauth_authorize_done.tpl");
 			$o = replace_macros($tpl, array(
 				'$title' => t('Authorize application connection'),
@@ -79,8 +77,6 @@ function api_content(&$a) {
 			));
 		
 			return $o;
-		
-		
 		}
 		
 		
-- 
cgit v1.2.3


From fdd2da905a27fab838aa34ef7baf0ee2c5c3c5f7 Mon Sep 17 00:00:00 2001
From: redmatrix 
Date: Sun, 13 Dec 2015 19:15:42 -0800
Subject: more work on api media uploads

---
 mod/wall_attach.php | 28 +++++++++++++++++-----------
 1 file changed, 17 insertions(+), 11 deletions(-)

(limited to 'mod')

diff --git a/mod/wall_attach.php b/mod/wall_attach.php
index 8677c2b83..f52a4f2e5 100644
--- a/mod/wall_attach.php
+++ b/mod/wall_attach.php
@@ -6,14 +6,16 @@ require_once('include/photos.php');
 
 function wall_attach_post(&$a) {
 
-	if(argc() > 1)
-		$channel = get_channel_by_nick(argv(1));
-	elseif($_FILES['media']) {
-		require_once('include/api.php');
-		$user_info = api_get_user($a);
+	$using_api = false;
+
+	if($a->data['api_info'] && array_key_exists('media',$_FILES)) {
+		$using_api = true;
+		$user_info = $a->data['api_info'];
 		$nick = $user_info['screen_name'];
 		$channel = get_channel_by_nick($user_info['screen_name']);
-    }
+	}
+	elseif(argc() > 1)
+		$channel = get_channel_by_nick(argv(1));
 
 	if(! $channel)
 		killme();
@@ -49,12 +51,16 @@ function wall_attach_post(&$a) {
 	}
 
 	if(intval($r['data']['is_photo'])) {
-		echo "\n\n" . $r['body'] . "\n\n";
-		if($using_api)
-			return;
-		killme();
+		$s = "\n\n" . $r['body'] . "\n\n";
+	}
+	else {
+		$s =  "\n\n" . '[attachment]' . $r['data']['hash'] . ',' . $r['data']['revision'] . '[/attachment]' . "\n";
 	}
-	echo  "\n\n" . '[attachment]' . $r['data']['hash'] . ',' . $r['data']['revision'] . '[/attachment]' . "\n";
+
+	if($using_api)
+		return $s;
+
+	echo $s;
 	killme();
 
 }
-- 
cgit v1.2.3


From 5a59cd9b8cd6e0c00260f47c50e5433b070155d1 Mon Sep 17 00:00:00 2001
From: jeroenpraat 
Date: Tue, 15 Dec 2015 21:00:40 +0100
Subject: Invitation only added to the admin site page. Plus css wrapper class
 to docu search.

---
 mod/admin.php | 6 +++++-
 mod/help.php  | 4 +++-
 2 files changed, 8 insertions(+), 2 deletions(-)

(limited to 'mod')

diff --git a/mod/admin.php b/mod/admin.php
index bac0148e0..070c06ea0 100644
--- a/mod/admin.php
+++ b/mod/admin.php
@@ -164,7 +164,7 @@ function admin_page_summary(&$a) {
 	}
 
 	// pending registrations
-	$r = q("SELECT COUNT(id) AS `count` FROM register");
+	$r = q("SELECT COUNT(id) AS `count` FROM `register` WHERE `uid` != '0'");
 	$pending = $r[0]['count'];
 
 	// available channels, primary and clones
@@ -231,7 +231,9 @@ function admin_page_site_post(&$a){
 	$maximagesize		=	((x($_POST,'maximagesize'))		? intval(trim($_POST['maximagesize']))				:  0);
 
 	$register_policy	=	((x($_POST,'register_policy'))	? intval(trim($_POST['register_policy']))	:  0);
+	
 	$access_policy	=	((x($_POST,'access_policy'))	? intval(trim($_POST['access_policy']))	:  0);
+	$invite_only        = ((x($_POST,'invite_only'))		? True	: False);
 	$abandon_days	    =	((x($_POST,'abandon_days'))	    ? intval(trim($_POST['abandon_days']))	    :  0);
 
 	$register_text		=	((x($_POST,'register_text'))	? notags(trim($_POST['register_text']))		: '');
@@ -299,6 +301,7 @@ function admin_page_site_post(&$a){
 	set_config('system','maximagesize', $maximagesize);
 
 	set_config('system','register_policy', $register_policy);
+	set_config('system','invitation_only', $invite_only);	
 	set_config('system','access_policy', $access_policy);
 	set_config('system','account_abandon_days', $abandon_days);
 	set_config('system','register_text', $register_text);
@@ -457,6 +460,7 @@ function admin_page_site(&$a) {
 		'$feed_contacts'    => array('feed_contacts', t('Allow Feeds as Connections'),get_config('system','feed_contacts'),t('(Heavy system resource usage)')), 
 		'$maximagesize'		=> array('maximagesize', t("Maximum image size"), intval(get_config('system','maximagesize')), t("Maximum size in bytes of uploaded images. Default is 0, which means no limits.")),
 		'$register_policy'	=> array('register_policy', t("Does this site allow new member registration?"), get_config('system','register_policy'), "", $register_choices),
+		'$invite_only'		=> array('invite_only', t("Invitation only"), get_config('system','invitation_only'), t("Only allow new member registrations with an invitation code. Above register policy must be set to Yes.")),
 		'$access_policy'	=> array('access_policy', t("Which best describes the types of account offered by this hub?"), get_config('system','access_policy'), "This is displayed on the public server site list.", $access_choices),
 		'$register_text'	=> array('register_text', t("Register text"), htmlspecialchars(get_config('system','register_text'), ENT_QUOTES, 'UTF-8'), t("Will be displayed prominently on the registration page.")),
 		'$frontpage'	=> array('frontpage', t("Site homepage to show visitors (default: login box)"), get_config('system','frontpage'), t("example: 'public' to show public stream, 'page/sys/home' to show a system webpage called 'home' or 'include:home.html' to include a file.")),
diff --git a/mod/help.php b/mod/help.php
index 16ec069a7..c4549a2bd 100644
--- a/mod/help.php
+++ b/mod/help.php
@@ -143,7 +143,8 @@ function help_content(&$a) {
 	nav_set_selected('help');
 
 	if($_REQUEST['search']) {
-
+	
+		$o .= '
';
 		$o .= '
' . t('Documentation Search') . ' - ' . htmlspecialchars($_REQUEST['search']) . '
';
 
 		$r = search_doc_files($_REQUEST['search']);
@@ -160,6 +161,7 @@ function help_content(&$a) {
 
 			}
 			$o .= '';
+			$o .= '
';
 		}
 		return $o;
 	}
-- 
cgit v1.2.3


From 20dcf37976ee269adcb2c004c5f612d8509b7f11 Mon Sep 17 00:00:00 2001
From: redmatrix 
Date: Tue, 15 Dec 2015 17:42:49 -0800
Subject: issue #221

---
 mod/admin.php | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

(limited to 'mod')

diff --git a/mod/admin.php b/mod/admin.php
index 070c06ea0..85ab3627c 100644
--- a/mod/admin.php
+++ b/mod/admin.php
@@ -6,6 +6,8 @@
  * Controller for the /admin/ area.
  */
 
+require_once('include/queue_fn.php');
+
 
 /**
  * @param App &$a
@@ -616,12 +618,11 @@ function admin_page_queue($a) {
 	if($_REQUEST['drophub']) {
 		require_once('hubloc.php');
 		hubloc_mark_as_down($_REQUEST['drophub']);
+		remove_queue_by_posturl($_REQUEST['drophub']);
 	}
 
 	if($_REQUEST['emptyhub']) {
-		$r = q("delete from outq where outq_posturl = '%s' ",
-			dbesc($_REQUEST['emptyhub'])
-		);
+		remove_queue_by_posturl($_REQUEST['emptyhub']);
 	}
 
 	$r = q("select count(outq_posturl) as total, max(outq_priority) as priority, outq_posturl from outq 
-- 
cgit v1.2.3


From b155f2260f56c0f72058d7f9190c8d221f463e80 Mon Sep 17 00:00:00 2001
From: redmatrix 
Date: Wed, 16 Dec 2015 14:47:30 -0800
Subject: some notifier optimisations. Also put a fixme on the invite total
 generations for new accounts, which is incorrect and now commented out.

---
 mod/register.php | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'mod')

diff --git a/mod/register.php b/mod/register.php
index 70bdcf350..2e9967c60 100644
--- a/mod/register.php
+++ b/mod/register.php
@@ -103,7 +103,9 @@ function register_post(&$a) {
 
 	if($using_invites && $invite_code) {
 		q("delete * from register where hash = '%s'", dbesc($invite_code));
-		set_pconfig($result['account']['account_id'],'system','invites_remaining',$num_invites);
+// @FIXME - this total needs to be stored by account, but pconfig operates on channels
+// This also needs to be considered when using 'invites_remaining' in mod/invite.php
+//		set_pconfig($result['account']['account_id'],'system','invites_remaining',$num_invites);
 	}
 
 	if($policy == REGISTER_OPEN ) {
-- 
cgit v1.2.3