replace)
* @return string substituted string
*/
function replace_macros($s,$r) {
$a = get_app();
$arr = array('template' => $s, 'params' => $r);
call_hooks('replace_macros', $arr);
$t = $a->template_engine();
$output = $t->replace_macros($arr['template'],$arr['params']);
return $output;
}
// random string, there are 86 characters max in text mode, 128 for hex
// output is urlsafe
define('RANDOM_STRING_HEX', 0x00 );
define('RANDOM_STRING_TEXT', 0x01 );
function random_string($size = 64,$type = RANDOM_STRING_HEX) {
// generate a bit of entropy and run it through the whirlpool
$s = hash('whirlpool', (string) rand() . uniqid(rand(),true) . (string) rand(),(($type == RANDOM_STRING_TEXT) ? true : false));
$s = (($type == RANDOM_STRING_TEXT) ? str_replace("\n","",base64url_encode($s,true)) : $s);
return(substr($s,0,$size));
}
/**
* This is our primary input filter.
*
* The high bit hack only involved some old IE browser, forget which (IE5/Mac?)
* that had an XSS attack vector due to stripping the high-bit on an 8-bit character
* after cleansing, and angle chars with the high bit set could get through as markup.
*
* This is now disabled because it was interfering with some legitimate unicode sequences
* and hopefully there aren't a lot of those browsers left.
*
* Use this on any text input where angle chars are not valid or permitted
* They will be replaced with safer brackets. This may be filtered further
* if these are not allowed either.
*
* @param string $string Input string
* @return string Filtered string
*/
function notags($string) {
return(str_replace(array("<",">"), array('[',']'), $string));
// High-bit filter no longer used
// return(str_replace(array("<",">","\xBA","\xBC","\xBE"), array('[',']','','',''), $string));
}
// use this on "body" or "content" input where angle chars shouldn't be removed,
// and allow them to be safely displayed.
/**
* use this on "body" or "content" input where angle chars shouldn't be removed,
* and allow them to be safely displayed.
* @param string $string
* @return string
*/
function escape_tags($string) {
return(htmlspecialchars($string, ENT_COMPAT, 'UTF-8', false));
}
function z_input_filter($channel_id,$s,$type = 'text/bbcode') {
if($type === 'text/bbcode')
return escape_tags($s);
if($type === 'text/markdown')
return escape_tags($s);
if($type == 'text/plain')
return escape_tags($s);
$r = q("select account_id, account_roles from account left join channel on channel_account_id = account_id where channel_id = %d limit 1",
intval($channel_id)
);
if($r && ($r[0]['account_roles'] & ACCOUNT_ROLE_ALLOWCODE)) {
if(local_user() && (get_account_id() == $r[0]['account_id'])) {
return $s;
}
}
if($type === 'text/html')
return purify_html($s);
return escape_tags($s);
}
function purify_html($s) {
require_once('library/HTMLPurifier.auto.php');
require_once('include/html2bbcode.php');
// FIXME this function has html output, not bbcode - so safely purify these
// $s = html2bb_video($s);
// $s = oembed_html2bbcode($s);
$config = HTMLPurifier_Config::createDefault();
$config->set('Cache.DefinitionImpl', null);
$purifier = new HTMLPurifier($config);
return $purifier->purify($s);
}
// generate a string that's random, but usually pronounceable.
// used to generate initial passwords
/**
* generate a string that's random, but usually pronounceable.
* used to generate initial passwords
* @param int $len
* @return string
*/
function autoname($len) {
if($len <= 0)
return '';
$vowels = array('a','a','ai','au','e','e','e','ee','ea','i','ie','o','ou','u');
if(mt_rand(0,5) == 4)
$vowels[] = 'y';
$cons = array(
'b','bl','br',
'c','ch','cl','cr',
'd','dr',
'f','fl','fr',
'g','gh','gl','gr',
'h',
'j',
'k','kh','kl','kr',
'l',
'm',
'n',
'p','ph','pl','pr',
'qu',
'r','rh',
's','sc','sh','sm','sp','st',
't','th','tr',
'v',
'w','wh',
'x',
'z','zh'
);
$midcons = array('ck','ct','gn','ld','lf','lm','lt','mb','mm', 'mn','mp',
'nd','ng','nk','nt','rn','rp','rt');
$noend = array('bl', 'br', 'cl','cr','dr','fl','fr','gl','gr',
'kh', 'kl','kr','mn','pl','pr','rh','tr','qu','wh');
$start = mt_rand(0,2);
if($start == 0)
$table = $vowels;
else
$table = $cons;
$word = '';
for ($x = 0; $x < $len; $x ++) {
$r = mt_rand(0,count($table) - 1);
$word .= $table[$r];
if($table == $vowels)
$table = array_merge($cons,$midcons);
else
$table = $vowels;
}
$word = substr($word,0,$len);
foreach($noend as $noe) {
if((strlen($word) > 2) && (substr($word,-2) == $noe)) {
$word = substr($word,0,-1);
break;
}
}
if(substr($word,-1) == 'q')
$word = substr($word,0,-1);
return $word;
}
// escape text ($str) for XML transport
// returns escaped text.
/**
* escape text ($str) for XML transport
* @param string $str
* @return string Escaped text.
*/
function xmlify($str) {
$buffer = '';
$len = mb_strlen($str);
for($x = 0; $x < $len; $x ++) {
$char = mb_substr($str,$x,1);
switch( $char ) {
case "\r" :
break;
case "&" :
$buffer .= '&';
break;
case "'" :
$buffer .= ''';
break;
case "\"" :
$buffer .= '"';
break;
case '<' :
$buffer .= '<';
break;
case '>' :
$buffer .= '>';
break;
case "\n" :
$buffer .= "\n";
break;
default :
$buffer .= $char;
break;
}
}
$buffer = trim($buffer);
return($buffer);
}
// undo an xmlify
// pass xml escaped text ($s), returns unescaped text
function unxmlify($s) {
$ret = str_replace('&','&', $s);
$ret = str_replace(array('<','>','"','''),array('<','>','"',"'"),$ret);
return $ret;
}
// convenience wrapper, reverse the operation "bin2hex"
// This is a built-in function in php >= 5.4
if(! function_exists('hex2bin')) {
function hex2bin($s) {
if(! (is_string($s) && strlen($s)))
return '';
if(strlen($s) & 1) {
logger('hex2bin: illegal hex string: ' . $s);
return $s;
}
if(! ctype_xdigit($s)) {
return($s);
}
return(pack("H*",$s));
}}
// Automatic pagination.
// To use, get the count of total items.
// Then call $a->set_pager_total($number_items);
// Optionally call $a->set_pager_itemspage($n) to the number of items to display on each page
// Then call paginate($a) after the end of the display loop to insert the pager block on the page
// (assuming there are enough items to paginate).
// When using with SQL, the setting LIMIT %d, %d => $a->pager['start'],$a->pager['itemspage']
// will limit the results to the correct items for the current page.
// The actual page handling is then accomplished at the application layer.
function paginate(&$a) {
$o = '';
$stripped = preg_replace('/(&page=[0-9]*)/','',$a->query_string);
// $stripped = preg_replace('/&zid=(.*?)([\?&]|$)/ism','',$stripped);
$stripped = str_replace('q=','',$stripped);
$stripped = trim($stripped,'/');
$pagenum = $a->pager['page'];
$url = $a->get_baseurl() . '/' . $stripped;
if($a->pager['total'] > $a->pager['itemspage']) {
$o .= '
'."\r\n";
}
return $o;
}
function alt_pager(&$a, $i, $more = '', $less = '') {
$o = '';
if(! $more)
$more = t('older');
if(! $less)
$less = t('newer');
$stripped = preg_replace('/(&page=[0-9]*)/','',$a->query_string);
$stripped = str_replace('q=','',$stripped);
$stripped = trim($stripped,'/');
$pagenum = $a->pager['page'];
$url = $a->get_baseurl() . '/' . $stripped;
return replace_macros(get_markup_template('alt_pager.tpl'),array(
'$has_less' => (($a->pager['page'] > 1) ? true : false),
'$has_more' => (($i > 0 && $i >= $a->pager['itemspage']) ? true : false),
'$less' => $less,
'$more' => $more,
'$url' => $url,
'$prevpage' => $a->pager['page'] - 1,
'$nextpage' => $a->pager['page'] + 1,
));
}
// Turn user/group ACLs stored as angle bracketed text into arrays
function expand_acl($s) {
// turn string array of angle-bracketed elements into string array
// e.g. "<123xyz><246qyo>" => array(123xyz,246qyo,sxo33e);
$ret = array();
if(strlen($s)) {
$t = str_replace('<','',$s);
$a = explode('>',$t);
foreach($a as $aa) {
if($aa)
$ret[] = $aa;
}
}
return $ret;
}
// Used to wrap ACL elements in angle brackets for storage
function sanitise_acl(&$item) {
if(strlen($item))
$item = '<' . notags(trim($item)) . '>';
else
unset($item);
}
// Convert an ACL array to a storable string
function perms2str($p) {
$ret = '';
if(is_array($p))
$tmp = $p;
else
$tmp = explode(',',$p);
if(is_array($tmp)) {
array_walk($tmp,'sanitise_acl');
$ret = implode('',$tmp);
}
return $ret;
}
// generate a guaranteed unique (for this domain) item ID for ATOM
// safe from birthday paradox
function item_message_id() {
do {
$dups = false;
$hash = random_string();
$mid = $hash . '@' . get_app()->get_hostname();
$r = q("SELECT id FROM item WHERE mid = '%s' LIMIT 1",
dbesc($mid));
if(count($r))
$dups = true;
} while($dups == true);
return $mid;
}
// Generate a guaranteed unique photo ID.
// safe from birthday paradox
function photo_new_resource() {
do {
$found = false;
$resource = hash('md5',uniqid(mt_rand(),true));
$r = q("SELECT id FROM photo WHERE resource_id = '%s' LIMIT 1",
dbesc($resource)
);
if(count($r))
$found = true;
} while($found == true);
return $resource;
}
// for html,xml parsing - let's say you've got
// an attribute foobar="class1 class2 class3"
// and you want to find out if it contains 'class3'.
// you can't use a normal sub string search because you
// might match 'notclass3' and a regex to do the job is
// possible but a bit complicated.
// pass the attribute string as $attr and the attribute you
// are looking for as $s - returns true if found, otherwise false
function attribute_contains($attr,$s) {
$a = explode(' ', $attr);
if(count($a) && in_array($s,$a))
return true;
return false;
}
function logger($msg,$level = 0) {
// turn off logger in install mode
global $a;
global $db;
if(($a->module == 'install') || (! ($db && $db->connected))) return;
$debugging = get_config('system','debugging');
$loglevel = intval(get_config('system','loglevel'));
$logfile = get_config('system','logfile');
if((! $debugging) || (! $logfile) || ($level > $loglevel))
return;
@file_put_contents($logfile, datetime_convert() . ':' . session_id() . ' ' . $msg . "\n", FILE_APPEND);
return;
}
// This is a special logging facility for developers. It allows one to target specific things to trace/debug
// and is identical to logger() with the exception of the log filename. This allows one to isolate specific
// calls while allowing logger() to paint a bigger picture of overall activity and capture more detail.
// If you find dlogger() calls in checked in code, you are free to remove them - so as to provide a noise-free
// development environment which responds to events you are targetting personally.
function dlogger($msg,$level = 0) {
// turn off logger in install mode
global $a;
global $db;
if(($a->module == 'install') || (! ($db && $db->connected))) return;
$debugging = get_config('system','debugging');
$loglevel = intval(get_config('system','loglevel'));
$logfile = get_config('system','dlogfile');
if((! $debugging) || (! $logfile) || ($level > $loglevel))
return;
@file_put_contents($logfile, datetime_convert() . ':' . session_id() . ' ' . $msg . "\n", FILE_APPEND);
return;
}
function profiler($t1,$t2,$label) {
if(file_exists('profiler.out') && $t1 && t2)
@file_put_contents('profiler.out', sprintf('%01.4f %s',$t2 - $t1,$label) . "\n", FILE_APPEND);
}
function activity_match($haystack,$needle) {
if(($haystack === $needle) || ((basename($needle) === $haystack) && strstr($needle,NAMESPACE_ACTIVITY_SCHEMA)))
return true;
return false;
}
// Pull out all #hashtags and @person tags from $s;
// We also get @person@domain.com - which would make
// the regex quite complicated as tags can also
// end a sentence. So we'll run through our results
// and strip the period from any tags which end with one.
// Returns array of tags found, or empty array.
function get_tags($s) {
$ret = array();
// ignore anything in a code block
$s = preg_replace('/\[code\](.*?)\[\/code\]/sm','',$s);
// ignore anything in [style= ]
$s = preg_replace('/\[style=(.*?)\]/sm','',$s);
// match any double quoted tags
if(preg_match_all('/([@#]\"\;.*?\"\;)/',$s,$match)) {
foreach($match[1] as $mtch) {
$ret[] = $mtch;
}
}
// Match full names against @tags including the space between first and last
// We will look these up afterward to see if they are full names or not recognisable.
if(preg_match_all('/(@[^ \x0D\x0A,:?]+ [^ \x0D\x0A@,:?]+)([ \x0D\x0A@,:?]|$)/',$s,$match)) {
foreach($match[1] as $mtch) {
if(strstr($mtch,"]")) {
// we might be inside a bbcode color tag - leave it alone
continue;
}
if(substr($mtch,-1,1) === '.')
$ret[] = substr($mtch,0,-1);
else
$ret[] = $mtch;
}
}
// Otherwise pull out single word tags. These can be @nickname, @first_last
// and #hash tags.
if(preg_match_all('/([@#][^ \x0D\x0A,;:?]+)([ \x0D\x0A,;:?]|$)/',$s,$match)) {
foreach($match[1] as $mtch) {
if(strstr($mtch,"]")) {
// we might be inside a bbcode color tag - leave it alone
continue;
}
if(substr($mtch,-1,1) === '.')
$mtch = substr($mtch,0,-1);
// ignore strictly numeric tags like #1
if((strpos($mtch,'#') === 0) && ( ctype_digit(substr($mtch,1)) || substr($mtch,1,1) === '^'))
continue;
// try not to catch url fragments
if(strpos($s,$mtch) && preg_match('/[a-zA-z0-9\/]/',substr($s,strpos($s,$mtch)-1,1)))
continue;
// or quote remnants from the quoted strings we already picked out earlier
if(strpos($mtch,'"'))
continue;
$ret[] = $mtch;
}
}
// bookmarks
if(preg_match_all('/#\^\[(url|zrl)(.*?)\](.*?)\[\/(url|zrl)\]/',$s,$match,PREG_SET_ORDER)) {
foreach($match as $mtch) {
$ret[] = $mtch[0];
}
}
// make sure the longer tags are returned first so that if two or more have common substrings
// we'll replace the longest ones first. Otherwise the common substring would be found in
// both strings and the string replacement would link both to the shorter strings and
// fail to link the longer string. RedMatrix github issue #378
usort($ret,'tag_sort_length');
// logger('get_tags: ' . print_r($ret,true));
return $ret;
}
function tag_sort_length($a,$b) {
if(mb_strlen($a) == mb_strlen($b))
return 0;
return((mb_strlen($b) < mb_strlen($a)) ? (-1) : 1);
}
function strip_zids($s) {
return preg_replace('/[\?&]zid=(.*?)(&|$)/ism','$2',$s);
}
// quick and dirty quoted_printable encoding
function qp($s) {
return str_replace ("%","=",rawurlencode($s));
}
function get_mentions($item,$tags) {
$o = '';
if(! count($tags))
return $o;
foreach($tags as $x) {
if($x['type'] == TERM_MENTION) {
$o .= "\t\t" . '' . "\r\n";
$o .= "\t\t" . '' . "\r\n";
}
}
return $o;
}
function contact_block() {
$o = '';
$a = get_app();
if(! $a->profile['uid'])
return;
if(! perm_is_allowed($a->profile['uid'],get_observer_hash(),'view_contacts'))
return;
$shown = get_pconfig($a->profile['uid'],'system','display_friend_count');
if($shown === false)
$shown = 24;
if($shown == 0)
return;
$is_owner = ((local_user() && local_user() == $a->profile['uid']) ? true : false);
$abook_flags = ABOOK_FLAG_PENDING|ABOOK_FLAG_SELF;
$xchan_flags = XCHAN_FLAGS_ORPHAN|XCHAN_FLAGS_DELETED;
if(! $is_owner) {
$abook_flags = $abook_flags | ABOOK_FLAGS_HIDDEN;
$xchan_flags = $xchan_flags | XCHAN_FLAGS_HIDDEN;
}
if((! is_array($a->profile)) || ($a->profile['hide_friends']))
return $o;
$r = q("SELECT COUNT(abook_id) AS total FROM abook left join xchan on abook_xchan = xchan_hash WHERE abook_channel = %d and not ( abook_flags & %d ) and not (xchan_flags & %d)",
intval($a->profile['uid']),
intval($abook_flags),
intval($xchan_flags)
);
if(count($r)) {
$total = intval($r[0]['total']);
}
if(! $total) {
$contacts = t('No connections');
$micropro = Null;
} else {
$r = q("SELECT abook.*, xchan.* FROM abook left join xchan on abook.abook_xchan = xchan.xchan_hash WHERE abook_channel = %d AND not ( abook_flags & %d) and not (xchan_flags & %d ) ORDER BY RAND() LIMIT %d",
intval($a->profile['uid']),
intval($abook_flags),
intval($xchan_flags),
intval($shown)
);
if(count($r)) {
$contacts = sprintf( tt('%d Connection','%d Connections', $total),$total);
$micropro = Array();
foreach($r as $rr) {
$micropro[] = micropro($rr,true,'mpfriend');
}
}
}
$tpl = get_markup_template('contact_block.tpl');
$o = replace_macros($tpl, array(
'$contacts' => $contacts,
'$nickname' => $a->profile['channel_address'],
'$viewconnections' => t('View Connections'),
'$micropro' => $micropro,
));
$arr = array('contacts' => $r, 'output' => $o);
call_hooks('contact_block_end', $arr);
return $o;
}
function chanlink_hash($s) {
return z_root() . '/chanview?f=&hash=' . urlencode($s);
}
function chanlink_url($s) {
return z_root() . '/chanview?f=&url=' . urlencode($s);
}
function chanlink_cid($d) {
return z_root() . '/chanview?f=&cid=' . intval($d);
}
function magiclink_url($observer,$myaddr,$url) {
return (($observer)
? z_root() . '/magic?f=&dest=' . $url . '&addr=' . $myaddr
: $url
);
}
function micropro($contact, $redirect = false, $class = '', $textmode = false) {
if($contact['click'])
$url = '#';
else
$url = chanlink_hash($contact['xchan_hash']);
return replace_macros(get_markup_template(($textmode)?'micropro_txt.tpl':'micropro_img.tpl'),array(
'$click' => (($contact['click']) ? $contact['click'] : ''),
'$class' => $class,
'$url' => $url,
'$photo' => $contact['xchan_photo_s'],
'$name' => $contact['xchan_name'],
'$title' => $contact['xchan_name'] . ' [' . $contact['xchan_addr'] . ']',
));
}
function search($s,$id='search-box',$url='/search',$save = false) {
$a = get_app();
$o = '