5 function dfrn_confirm_post(&$a) {
10 if(x($_POST,'source_url')) {
12 // We are processing an external confirmation to an introduction created by our user.
14 $public_key = $_POST['public_key'];
15 $dfrn_id = $_POST['dfrn_id'];
16 $source_url = $_POST['source_url'];
17 $aes_key = $_POST['aes_key'];
19 // Find our user's account
21 $r = q("SELECT * FROM `user` WHERE `nickname` = '%s' LIMIT 1",
25 xml_status(3); // failure
28 $my_prvkey = $r[0]['prvkey'];
29 $local_uid = $r[0]['uid'];
31 $decrypted_source_url = "";
35 openssl_private_decrypt($source_url,$decrypted_source_url,$my_prvkey);
38 $ret = q("SELECT * FROM `contact` WHERE `url` = '%s' AND `uid` = %d LIMIT 1",
39 dbesc($decrypted_source_url),
43 // this is either a bogus confirmation or we deleted the original introduction.
47 // Decrypt all this stuff we just received
49 $foreign_pubkey = $ret[0]['site-pubkey'];
50 $dfrn_record = $ret[0]['id'];
51 $decrypted_dfrn_id = "";
52 openssl_public_decrypt($dfrn_id,$decrypted_dfrn_id,$foreign_pubkey);
54 if(strlen($aes_key)) {
55 $decrypted_aes_key = "";
56 openssl_private_decrypt($aes_key,$decrypted_aes_key,$my_prvkey);
57 $dfrn_pubkey = openssl_decrypt($public_key,'AES-256-CBC',$decrypted_aes_key);
60 $dfrn_pubkey = $public_key;
63 $r = q("SELECT * FROM `contact` WHERE `dfrn-id` = '%s' LIMIT 1",
64 dbesc($decrypted_dfrn_id),
67 xml_status(1); // Birthday paradox - duplicate dfrn-id
69 $r = q("UPDATE `contact` SET `dfrn-id` = '%s', `pubkey` = '%s' WHERE `id` = %d LIMIT 1",
70 dbesc($decrypted_dfrn_id),
72 intval($dfrn_record));
75 // We're good but now we have to scrape the profile photo and send notifications.
77 require_once("Photo.php");
79 $photo_failure = false;
81 $r = q("SELECT `photo` FROM `contact` WHERE `id` = %d LIMIT 1",
82 intval($dfrn_record));
85 $filename = basename($r[0]['photo']);
86 $img_str = fetch_url($r[0]['photo'],true);
87 $img = new Photo($img_str);
90 $img->scaleImageSquare(175);
92 $hash = hash('md5',uniqid(mt_rand(),true));
94 $r = q("INSERT INTO `photo` ( `uid`, `contact-id`, `resource-id`, `created`, `edited`, `filename`,
95 `height`, `width`, `data`, `scale` )
96 VALUES ( %d, %d, '%s', '%s', '%s', '%s', %d, %d, '%s', 4 )",
102 dbesc(basename($r[0]['photo'])),
103 intval($img->getHeight()),
104 intval($img->getWidth()),
105 dbesc($img->imageString())
108 $photo_failure = true;
110 $img->scaleImage(80);
111 $r = q("INSERT INTO `photo` ( `uid`, `contact-id`, `resource-id`, `created`, `edited`, `filename`,
112 `height`, `width`, `data`, `scale` )
113 VALUES ( %d, %d, '%s', '%s', '%s', '%s', %d, %d, '%s', 5 )",
115 intval($dfrn_record),
119 dbesc(basename($r[0]['photo'])),
120 intval($img->getHeight()),
121 intval($img->getWidth()),
122 dbesc($img->imageString())
125 $photo_failure = true;
127 $photo = $a->get_baseurl() . '/photo/' . $hash . '-4.jpg';
128 $thumb = $a->get_baseurl() . '/photo/' . $hash . '-5.jpg';
132 $photo_failure = true;
135 $photo_failure = true;
138 $photo = $a->get_baseurl() . '/images/default-profile.jpg';
139 $thumb = $a->get_baseurl() . '/images/default-profile-sm.jpg';
142 $r = q("UPDATE `contact` SET `photo` = '%s', `thumb` = '%s', `blocked` = 0, `pending` = 0 WHERE `id` = %d LIMIT 1",
148 notice( t("Unable to set contact photo info.") . EOL);
150 // Otherwise everything seems to have worked and we are almost done. Yay!
151 // Send an email notification
153 $r = q("SELECT * FROM `contact` LEFT JOIN `user` ON `contact`.`uid` = `user`.`uid`
154 WHERE `contact`.`id` = %d LIMIT 1",
155 intval($dfrn_record));
156 if((count($r)) && ($r[0]['notify-flags'] & NOTIFY_CONFIRM)) {
158 $tpl = file_get_contents('view/intro_complete_eml.tpl');
160 $email_tpl = replace_macros($tpl, array(
161 '$sitename' => $a->config['sitename'],
162 '$siteurl' => $a->get_baseurl(),
163 '$username' => $r[0]['username'],
164 '$email' => $r[0]['email'],
165 '$fn' => $r[0]['name'],
166 '$dfrn_url' => $r[0]['url'],
170 $res = mail($r[0]['email'], t("Introduction accepted at ") . $a->config['sitename'],
171 $email_tpl,t("From: Administrator@") . $_SERVER[SERVER_NAME] );
173 notice( t("Email notification failed.") . EOL );
176 xml_status(0); // Success
178 return; // NOTREACHED
181 xml_status(2); // Hopefully temporary problem that can be retried.
183 return; // NOTREACHED
185 ////////////////////// End of this scenario ///////////////////////////////////////////////
189 // We are processing a local confirmation initiated on this system by our user to an external introduction.
191 $uid = $_SESSION['uid'];
194 notice(t("Permission denied.") . EOL );
198 $dfrn_id = ((x($_POST,'dfrn_id')) ? notags(trim($_POST['dfrn_id'])) : "");
199 $intro_id = intval($_POST['intro_id']);
201 $r = q("SELECT * FROM `contact` WHERE `issued-id` = '%s' AND `uid` = %d LIMIT 1",
206 if((! $r) || (! count($r))) {
207 notice( t('Node does not exist.') . EOL );
211 $contact_id = $r[0]['id'];
212 $site_pubkey = $r[0]['site-pubkey'];
213 $dfrn_confirm = $r[0]['confirm'];
214 $aes_allow = $r[0]['aes_allow'];
216 $res=openssl_pkey_new(array(
217 'digest_alg' => 'whirlpool',
218 'private_key_bits' => 4096,
219 'encrypt_key' => false ));
224 openssl_pkey_export($res, $private_key);
227 $pubkey = openssl_pkey_get_details($res);
228 $public_key = $pubkey["key"];
230 $r = q("UPDATE `contact` SET `issued-pubkey` = '%s', `prvkey` = '%s' WHERE `id` = %d AND `uid` = %d LIMIT 1",
240 $src_aes_key = random_string();
243 openssl_private_encrypt($dfrn_id,$result,$a->user['prvkey']);
245 $params['dfrn_id'] = $result;
246 $params['public_key'] = $public_key;
249 openssl_public_encrypt($_SESSION['my_url'], $params['source_url'], $site_pubkey);
251 if($aes_allow && function_exists('openssl_encrypt')) {
252 openssl_public_encrypt($src_aes_key, $params['aes_key'], $site_pubkey);
253 $params['public_key'] = openssl_encrypt($public_key,'AES-256-CBC',$src_aes_key);
256 $res = post_url($dfrn_confirm,$params);
258 // uncomment the following two lines and comment the following xml/status lines
259 // to debug the remote confirmation section (when both confirmations
260 // and responses originate on this system)
265 $xml = simplexml_load_string($res);
266 $status = (int) $xml->status;
269 notice( t("Confirmation completed successfully") . EOL);
273 // birthday paradox - generate new dfrn-id and fall through.
275 $new_dfrn_id = random_string();
276 $r = q("UPDATE contact SET `issued-id` = '%s' WHERE `id` = %d AND `uid` = %d LIMIT 1",
283 notice( t("Temporary failure. Please wait and try again.") . EOL);
288 notice( t("Introduction failed or was revoked. Cannot complete.") . EOL);
292 if(($status == 0 || $status == 3) && ($intro_id)) {
294 //delete the notification
296 $r = q("DELETE FROM `intro` WHERE `id` = %d AND `uid` = %d LIMIT 1",
306 require_once("Photo.php");
308 $photo_failure = false;
310 $r = q("SELECT `photo` FROM `contact` WHERE `id` = %d LIMIT 1",
311 intval($contact_id));
314 $filename = basename($r[0]['photo']);
315 $img_str = fetch_url($r[0]['photo'],true);
316 $img = new Photo($img_str);
319 $img->scaleImageSquare(175);
321 $hash = hash('md5',uniqid(mt_rand(),true));
323 $r = q("INSERT INTO `photo` ( `uid`, `resource-id`, `created`, `edited`, `filename`,
324 `height`, `width`, `data`, `scale` )
325 VALUES ( %d, '%s', '%s', '%s', '%s', %d, %d, '%s', 4 )",
330 dbesc(basename($r[0]['photo'])),
331 intval($img->getHeight()),
332 intval($img->getWidth()),
333 dbesc($img->imageString())
336 $photo_failure = true;
337 $img->scaleImage(80);
338 $r = q("INSERT INTO `photo` ( `uid`, `resource-id`, `created`, `edited`, `filename`,
339 `height`, `width`, `data`, `scale` )
340 VALUES ( %d, '%s', '%s', '%s', '%s', %d, %d, '%s', 5 )",
345 dbesc(basename($r[0]['photo'])),
346 intval($img->getHeight()),
347 intval($img->getWidth()),
348 dbesc($img->imageString())
351 $photo_failure = true;
353 $photo = $a->get_baseurl() . '/photo/' . $hash . '-4.jpg';
354 $thumb = $a->get_baseurl() . '/photo/' . $hash . '-5.jpg';
358 $photo_failure = true;
361 $photo_failure = true;
364 $photo = $a->get_baseurl() . '/images/default-profile.jpg';
365 $thumb = $a->get_baseurl() . '/images/default-profile-sm.jpg';
368 $r = q("UPDATE `contact` SET `photo` = '%s', `thumb` = '%s', `blocked` = 0, `pending` = 0 WHERE `id` = %d LIMIT 1",
374 notice( t("Unable to set contact photo info.") . EOL);
376 goaway($a->get_baseurl() . '/contacts/' . intval($contact_id));