]> git.mxchange.org Git - friendica.git/blob - mod/contacts.php
sanitise all incoming url's - also stop them from getting mangled by simplepie
[friendica.git] / mod / contacts.php
1 <?php
2
3 require_once('include/Contact.php');
4
5 function contacts_init(&$a) {
6         require_once('include/group.php');
7         if(! x($a->page,'aside'))
8                 $a->page['aside'] = '';
9         $a->page['aside'] .= group_side();
10
11         if($a->config['register_policy'] != REGISTER_CLOSED)
12                 $a->page['aside'] .= '<div class="side-invite-link-wrapper" id="side-invite-link-wrapper" ><a href="invite" class="side-invite-link" id="side-invite-link">' . t("Invite Friends") . '</a></div>';
13
14         $tpl = load_view_file('view/follow.tpl');
15         $a->page['aside'] .= replace_macros($tpl,array(
16                 '$label' => t('Connect/Follow [profile address]'),
17                 '$hint' => t('Example: bob@example.com, http://example.com/barbara'),
18                 '$follow' => t('Follow')
19         ));
20
21 }
22
23 function contacts_post(&$a) {
24         
25         if(! local_user())
26                 return;
27
28         $contact_id = intval($a->argv[1]);
29         if(! $contact_id)
30                 return;
31
32         $orig_record = q("SELECT * FROM `contact` WHERE `id` = %d AND `uid` = %d LIMIT 1",
33                 intval($contact_id),
34                 intval(local_user())
35         );
36
37         if(! count($orig_record)) {
38                 notice( t('Could not access contact record.') . EOL);
39                 goaway($a->get_baseurl() . '/contacts');
40                 return; // NOTREACHED
41         }
42
43         call_hooks('contact_edit_post', $_POST);
44
45         $profile_id = intval($_POST['profile-assign']);
46         if($profile_id) {
47                 $r = q("SELECT `id` FROM `profile` WHERE `id` = %d AND `uid` = %d LIMIT 1",
48                         intval($profile_id),
49                         intval(local_user())
50                 );
51                 if(! count($r)) {
52                         notice( t('Could not locate selected profile.') . EOL);
53                         return;
54                 }
55         }
56 logger('contact_edit ' . print_r($_POST,true));
57
58         $priority = intval($_POST['poll']);
59         if($priority == (-1))
60                 
61         if($priority > 5 || $priority < 0)
62                 $priority = 0;
63
64         $rating = intval($_POST['reputation']);
65         if($rating > 5 || $rating < 0)
66                 $rating = 0;
67
68         $reason = notags(trim($_POST['reason']));
69
70         $info = escape_tags(trim($_POST['info']));
71
72         $r = q("UPDATE `contact` SET `profile-id` = %d, `priority` = %d , `rating` = %d, `reason` = '%s', `info` = '%s'
73                 WHERE `id` = %d AND `uid` = %d LIMIT 1",
74                 intval($profile_id),
75                 intval($priority),
76                 intval($rating),
77                 dbesc($reason),
78                 dbesc($info),
79                 intval($contact_id),
80                 intval(local_user())
81         );
82         if($r)
83                 notice( t('Contact updated.') . EOL);
84         else
85                 notice( t('Failed to update contact record.') . EOL);
86         return;
87
88 }
89
90
91
92 function contacts_content(&$a) {
93
94         $sort_type = 0;
95         $o = '';
96         $o .= '<script> $(document).ready(function() { $(\'#nav-contacts-link\').addClass(\'nav-selected\'); });</script>';
97
98         $_SESSION['return_url'] = $a->get_baseurl() . '/' . $a->cmd;
99
100         if(! local_user()) {
101                 notice( t('Permission denied.') . EOL);
102                 return;
103         }
104
105         if($a->argc == 3) {
106
107                 $contact_id = intval($a->argv[1]);
108                 if(! $contact_id)
109                         return;
110
111                 $cmd = $a->argv[2];
112
113                 $orig_record = q("SELECT * FROM `contact` WHERE `id` = %d AND `uid` = %d LIMIT 1",
114                         intval($contact_id),
115                         intval(local_user())
116                 );
117
118                 if(! count($orig_record)) {
119                         notice( t('Could not access contact record.') . EOL);
120                         goaway($a->get_baseurl() . '/contacts');
121                         return; // NOTREACHED
122                 }
123
124                 if($cmd === 'update') {
125
126                         // pull feed and consume it, which should subscribe to the hub.
127
128                         $php_path = ((x($a->config,'php_path') && strlen($a->config['php_path'])) ? $a->config['php_path'] : 'php');
129                         proc_run($php_path,"include/poller.php","$contact_id");
130                         goaway($a->get_baseurl() . '/contacts/' . $contact_id);
131                         // NOTREACHED
132                 }
133
134                 if($cmd === 'block') {
135                         $blocked = (($orig_record[0]['blocked']) ? 0 : 1);
136                         $r = q("UPDATE `contact` SET `blocked` = %d WHERE `id` = %d AND `uid` = %d LIMIT 1",
137                                         intval($blocked),
138                                         intval($contact_id),
139                                         intval(local_user())
140                         );
141                         if($r) {
142                                 notice( t('Contact has been ') . (($blocked) ? t('blocked') : t('unblocked')) . EOL );
143                         }
144                         goaway($a->get_baseurl() . '/contacts/' . $contact_id);
145                         return; // NOTREACHED
146                 }
147
148                 if($cmd === 'ignore') {
149                         $readonly = (($orig_record[0]['readonly']) ? 0 : 1);
150                         $r = q("UPDATE `contact` SET `readonly` = %d WHERE `id` = %d AND `uid` = %d LIMIT 1",
151                                         intval($readonly),
152                                         intval($contact_id),
153                                         intval(local_user())
154                         );
155                         if($r) {
156                                 notice( t('Contact has been ') . (($readonly) ? t('ignored') : t('unignored')) . EOL );
157                         }
158                         goaway($a->get_baseurl() . '/contacts/' . $contact_id);
159                         return; // NOTREACHED
160                 }
161
162                 if($cmd === 'drop') {
163
164                         // create an unfollow slap
165
166                         if($orig_record[0]['network'] === 'stat') {
167                                 $tpl = load_view_file('view/follow_slap.tpl');
168                                 $slap = replace_macros($tpl, array(
169                                         '$name' => $a->user['username'],
170                                         '$profile_page' => $a->get_baseurl() . '/profile/' . $a->user['nickname'],
171                                         '$photo' => $a->contact['photo'],
172                                         '$thumb' => $a->contact['thumb'],
173                                         '$published' => datetime_convert('UTC','UTC', 'now', ATOM_TIME),
174                                         '$item_id' => 'urn:X-dfrn:' . $a->get_hostname() . ':unfollow:' . random_string(),
175                                         '$title' => '',
176                                         '$type' => 'text',
177                                         '$content' => t('stopped following'),
178                                         '$nick' => $a->user['nickname'],
179                                         '$verb' => ACTIVITY_UNFOLLOW,
180                                         '$ostat_follow' => '<as:verb>http://ostatus.org/schema/1.0/unfollow</as:verb>' . "\r\n"
181                                 ));
182
183                                 if((x($orig_record[0],'notify')) && (strlen($orig_record[0]['notify']))) {
184                                         require_once('include/salmon.php');
185                                         slapper($a->user,$orig_record[0]['notify'],$slap);
186                                 }
187                         }
188
189                         if($orig_record[0]['network'] === 'dfrn') {
190                                 require_once('include/items.php');
191                                 dfrn_deliver($a->user,$orig_record[0],'placeholder', 1);
192                         }
193
194
195                         contact_remove($contact_id);
196                         notice( t('Contact has been removed.') . EOL );
197                         goaway($a->get_baseurl() . '/contacts');
198                         return; // NOTREACHED
199                 }
200         }
201
202         if(($a->argc == 2) && intval($a->argv[1])) {
203
204                 $contact_id = intval($a->argv[1]);
205                 $r = q("SELECT * FROM `contact` WHERE `uid` = %d and `id` = %d LIMIT 1",
206                         intval(local_user()),
207                         intval($contact_id)
208                 );
209                 if(! count($r)) {
210                         notice( t('Contact not found.') . EOL);
211                         return;
212                 }
213
214                 $tpl = load_view_file('view/contact_head.tpl');
215                 $a->page['htmlhead'] .= replace_macros($tpl, array('$baseurl' => $a->get_baseurl()));
216
217                 require_once('include/contact_selectors.php');
218
219                 $tpl = load_view_file("view/contact_edit.tpl");
220
221                 switch($r[0]['rel']) {
222                         case REL_BUD:
223                                 $dir_icon = 'images/lrarrow.gif';
224                                 $alt_text = t('Mutual Friendship');
225                                 break;
226                         case REL_VIP;
227                                 $dir_icon = 'images/larrow.gif';
228                                 $alt_text = t('is a fan of yours');
229                                 break;
230         
231                         case REL_FAN;
232                                 $dir_icon = 'images/rarrow.gif';
233                                 $alt_text = t('you are a fan of');
234                                 break;
235                         default:
236                                 break;
237                 }
238
239                 if(($r[0]['network'] === 'dfrn') && ($r[0]['rel'])) {
240                         $url = "redir/{$r[0]['id']}";
241                         $sparkle = ' class="sparkle" ';
242                 }
243                 else { 
244                         $url = $r[0]['url'];
245                         $sparkle = '';
246                 }
247
248                 $last_update = (($r[0]['last-update'] == '0000-00-00 00:00:00') 
249                                 ? t('Never') 
250                                 : datetime_convert('UTC',date_default_timezone_get(),$r[0]['last-update'],'D, j M Y, g:i A'));
251
252                 if($r[0]['last-update'] !== '0000-00-00 00:00:00')
253                         $last_update .= ' ' . (($r[0]['last-update'] == $r[0]['success_update']) ? t("\x28Update was successful\x29") : t("\x28Update was not successful\x29"));
254
255                 $o .= replace_macros($tpl,array(
256                         '$header' => t('Contact Editor'),
257                         '$visit' => t('Visit $name\'s profile'),
258                         '$blockunblock' => t('Block/Unblock contact'),
259                         '$ignorecont' => t('Ignore contact'),
260                         '$delete' => t('Delete contact'),
261                         '$poll_interval' => contact_poll_interval($r[0]['priority']),
262                         '$lastupdtext' => t('Last updated: '),
263                         '$updpub' => t('Update public posts: '),
264                         '$last_update' => $last_update,
265                         '$udnow' => t('Update now'),
266                         '$profile_select' => contact_profile_assign($r[0]['profile-id'],(($r[0]['network'] !== 'dfrn') ? true : false)),
267                         '$contact_id' => $r[0]['id'],
268                         '$block_text' => (($r[0]['blocked']) ? t('Unblock this contact') : t('Block this contact') ),
269                         '$ignore_text' => (($r[0]['readonly']) ? t('Unignore this contact') : t('Ignore this contact') ),
270                         '$insecure' => (($r[0]['network'] === 'stat') ? load_view_file('view/insecure_net.tpl') : ''),
271                         '$info' => $r[0]['info'],
272                         '$blocked' => (($r[0]['blocked']) ? '<div id="block-message">' . t('Currently blocked') . '</div>' : ''),
273                         '$ignored' => (($r[0]['readonly']) ? '<div id="ignore-message">' . t('Currently ignored') . '</div>' : ''),
274                         '$rating' => contact_reputation($r[0]['rating']),
275                         '$reason' => $r[0]['reason'],
276                         '$groups' => '', // group_selector(),
277                         '$photo' => $r[0]['photo'],
278                         '$name' => $r[0]['name'],
279                         '$dir_icon' => $dir_icon,
280                         '$alt_text' => $alt_text,
281                         '$sparkle' => $sparkle,
282                         '$url' => $url
283
284                 ));
285
286                 $arr = array('contact' => $r[0],'output' => $o);
287
288                 call_hooks('contact_edit', $arr);
289
290                 return $arr['output'];
291
292         }
293
294
295         if(($a->argc == 2) && ($a->argv[1] === 'all'))
296                 $sql_extra = '';
297         else
298                 $sql_extra = " AND `blocked` = 0 ";
299
300         $search = ((x($_GET,'search')) ? notags(trim($_GET['search'])) : '');
301
302         $tpl = load_view_file("view/contacts-top.tpl");
303         $o .= replace_macros($tpl,array(
304                 '$header' => t('Contacts'),
305                 '$hide_url' => ((strlen($sql_extra)) ? 'contacts/all' : 'contacts' ),
306                 '$hide_text' => ((strlen($sql_extra)) ? t('Show Blocked Connections') : t('Hide Blocked Connections')),
307                 '$search' => $search,
308                 '$finding' => (strlen($search) ? '<h4>' . t('Finding: ') . "'" . $search . "'" . '</h4>' : ""),
309                 '$submit' => t('Find'),
310                 '$cmd' => $a->cmd
311
312
313         )); 
314
315         if($search)
316                 $search = dbesc($search.'*');
317         $sql_extra .= ((strlen($search)) ? " AND MATCH `name` AGAINST ('$search' IN BOOLEAN MODE) " : "");
318
319         $sql_extra2 = ((($sort_type > 0) && ($sort_type <= REL_BUD)) ? sprintf(" AND `rel` = %d ",intval($sort_type)) : ''); 
320
321         
322         $r = q("SELECT COUNT(*) AS `total` FROM `contact` 
323                 WHERE `uid` = %d AND `pending` = 0 $sql_extra $sql_extra2 ",
324                 intval($_SESSION['uid']));
325         if(count($r))
326                 $a->set_pager_total($r[0]['total']);
327
328         $r = q("SELECT * FROM `contact` WHERE `uid` = %d AND `pending` = 0 $sql_extra $sql_extra2 ORDER BY `name` ASC LIMIT %d , %d ",
329                 intval($_SESSION['uid']),
330                 intval($a->pager['start']),
331                 intval($a->pager['itemspage'])
332         );
333
334         if(count($r)) {
335
336                 $tpl = load_view_file("view/contact_template.tpl");
337
338                 foreach($r as $rr) {
339                         if($rr['self'])
340                                 continue;
341
342                         switch($rr['rel']) {
343                                 case REL_BUD:
344                                         $dir_icon = 'images/lrarrow.gif';
345                                         $alt_text = t('Mutual Friendship');
346                                         break;
347                                 case  REL_VIP;
348                                         $dir_icon = 'images/larrow.gif';
349                                         $alt_text = t('is a fan of yours');
350                                         break;
351                                 case REL_FAN;
352                                         $dir_icon = 'images/rarrow.gif';
353                                         $alt_text = t('you are a fan of');
354                                         break;
355                                 default:
356                                         break;
357                         }
358                         if(($rr['network'] === 'dfrn') && ($rr['rel'])) {
359                                 $url = "redir/{$rr['id']}";
360                                 $sparkle = ' class="sparkle" ';
361                         }
362                         else { 
363                                 $url = $rr['url'];
364                                 $sparkle = '';
365                         }
366
367
368                         $o .= replace_macros($tpl, array(
369                                 '$img_hover' => t('Visit ') . $rr['name'] . t('\'s profile'),
370                                 '$edit_hover' => t('Edit contact'),
371                                 '$id' => $rr['id'],
372                                 '$alt_text' => $alt_text,
373                                 '$dir_icon' => $dir_icon,
374                                 '$thumb' => $rr['thumb'], 
375                                 '$name' => substr($rr['name'],0,20),
376                                 '$sparkle' => $sparkle,
377                                 '$url' => $url
378                         ));
379                 }
380
381                 $o .= '<div id="contact-edit-end"></div>';
382
383         }
384         $o .= paginate($a);
385         return $o;
386 }