5 function dfrn_confirm_post(&$a) {
10 if(x($_POST,'source_url')) {
12 // We are processing an external confirmation to an introduction created by our user.
14 $public_key = $_POST['public_key'];
15 $dfrn_id = $_POST['dfrn_id'];
16 $source_url = $_POST['source_url'];
17 $aes_key = $_POST['aes_key'];
19 // Find our user's account
21 $r = q("SELECT * FROM `user` WHERE `nickname` = '%s' LIMIT 1",
25 xml_status(3); // failure
28 $my_prvkey = $r[0]['prvkey'];
29 $local_uid = $r[0]['uid'];
31 $decrypted_source_url = "";
35 openssl_private_decrypt($source_url,$decrypted_source_url,$my_prvkey);
38 $ret = q("SELECT * FROM `contact` WHERE `url` = '%s' AND `uid` = %d LIMIT 1",
39 dbesc($decrypted_source_url),
43 // this is either a bogus confirmation or we deleted the original introduction.
47 // Decrypt all this stuff we just received
49 $foreign_pubkey = $ret[0]['site-pubkey'];
50 $dfrn_record = $ret[0]['id'];
51 $decrypted_dfrn_id = "";
52 openssl_public_decrypt($dfrn_id,$decrypted_dfrn_id,$foreign_pubkey);
54 if(strlen($aes_key)) {
55 $decrypted_aes_key = "";
56 openssl_private_decrypt($aes_key,$decrypted_aes_key,$my_prvkey);
57 $dfrn_pubkey = openssl_decrypt($public_key,'AES-256-CBC',$decrypted_aes_key);
60 $dfrn_pubkey = $public_key;
63 $r = q("SELECT * FROM `contact` WHERE `dfrn-id` = '%s' LIMIT 1",
64 dbesc($decrypted_dfrn_id),
67 xml_status(1); // Birthday paradox - duplicate dfrn-id
69 $r = q("UPDATE `contact` SET `dfrn-id` = '%s', `pubkey` = '%s' WHERE `id` = %d LIMIT 1",
70 dbesc($decrypted_dfrn_id),
72 intval($dfrn_record));
75 // We're good but now we have to scrape the profile photo and send notifications.
77 require_once("Photo.php");
79 $photo_failure = false;
81 $r = q("SELECT `photo` FROM `contact` WHERE `id` = %d LIMIT 1",
82 intval($dfrn_record));
85 $filename = basename($r[0]['photo']);
86 $img_str = fetch_url($r[0]['photo'],true);
87 $img = new Photo($img_str);
90 $img->scaleImageSquare(175);
92 $hash = hash('md5',uniqid(mt_rand(),true));
94 $r = $img->store($local_uid, $dfrn_record, $hash, $filename, t('Contact Photos') , 4);
97 $photo_failure = true;
100 $r = $img->store($local_uid, $dfrn_record, $hash, $filename, t('Contact Photos') , 5);
103 $photo_failure = true;
105 $photo = $a->get_baseurl() . '/photo/' . $hash . '-4.jpg';
106 $thumb = $a->get_baseurl() . '/photo/' . $hash . '-5.jpg';
109 $photo_failure = true;
112 $photo_failure = true;
115 $photo = $a->get_baseurl() . '/images/default-profile.jpg';
116 $thumb = $a->get_baseurl() . '/images/default-profile-sm.jpg';
119 $r = q("UPDATE `contact` SET `photo` = '%s', `thumb` = '%s', `blocked` = 0, `pending` = 0 WHERE `id` = %d LIMIT 1",
125 notice( t("Unable to set contact photo info.") . EOL);
127 // Otherwise everything seems to have worked and we are almost done. Yay!
128 // Send an email notification
130 $r = q("SELECT * FROM `contact` LEFT JOIN `user` ON `contact`.`uid` = `user`.`uid`
131 WHERE `contact`.`id` = %d LIMIT 1",
132 intval($dfrn_record));
133 if((count($r)) && ($r[0]['notify-flags'] & NOTIFY_CONFIRM)) {
135 $tpl = file_get_contents('view/intro_complete_eml.tpl');
137 $email_tpl = replace_macros($tpl, array(
138 '$sitename' => $a->config['sitename'],
139 '$siteurl' => $a->get_baseurl(),
140 '$username' => $r[0]['username'],
141 '$email' => $r[0]['email'],
142 '$fn' => $r[0]['name'],
143 '$dfrn_url' => $r[0]['url'],
147 $res = mail($r[0]['email'], t("Introduction accepted at ") . $a->config['sitename'],
148 $email_tpl,t("From: Administrator@") . $_SERVER[SERVER_NAME] );
150 notice( t("Email notification failed.") . EOL );
153 xml_status(0); // Success
155 return; // NOTREACHED
158 xml_status(2); // Hopefully temporary problem that can be retried.
160 return; // NOTREACHED
162 ////////////////////// End of this scenario ///////////////////////////////////////////////
166 // We are processing a local confirmation initiated on this system by our user to an external introduction.
168 $uid = $_SESSION['uid'];
171 notice( t("Permission denied.") . EOL );
175 $dfrn_id = ((x($_POST,'dfrn_id')) ? notags(trim($_POST['dfrn_id'])) : "");
176 $intro_id = intval($_POST['intro_id']);
178 $r = q("SELECT * FROM `contact` WHERE `issued-id` = '%s' AND `uid` = %d LIMIT 1",
183 if((! $r) || (! count($r))) {
184 notice( t('Node does not exist.') . EOL );
188 $contact_id = $r[0]['id'];
189 $site_pubkey = $r[0]['site-pubkey'];
190 $dfrn_confirm = $r[0]['confirm'];
191 $aes_allow = $r[0]['aes_allow'];
193 $res=openssl_pkey_new(array(
194 'digest_alg' => 'whirlpool',
195 'private_key_bits' => 4096,
196 'encrypt_key' => false ));
201 openssl_pkey_export($res, $private_key);
204 $pubkey = openssl_pkey_get_details($res);
205 $public_key = $pubkey["key"];
207 $r = q("UPDATE `contact` SET `issued-pubkey` = '%s', `prvkey` = '%s' WHERE `id` = %d AND `uid` = %d LIMIT 1",
217 $src_aes_key = random_string();
220 openssl_private_encrypt($dfrn_id,$result,$a->user['prvkey']);
222 $params['dfrn_id'] = $result;
223 $params['public_key'] = $public_key;
226 openssl_public_encrypt($_SESSION['my_url'], $params['source_url'], $site_pubkey);
228 if($aes_allow && function_exists('openssl_encrypt')) {
229 openssl_public_encrypt($src_aes_key, $params['aes_key'], $site_pubkey);
230 $params['public_key'] = openssl_encrypt($public_key,'AES-256-CBC',$src_aes_key);
233 $res = post_url($dfrn_confirm,$params);
235 // uncomment the following two lines and comment the following xml/status lines
236 // to debug the remote confirmation section (when both confirmations
237 // and responses originate on this system)
242 $xml = simplexml_load_string($res);
243 $status = (int) $xml->status;
246 notice( t("Confirmation completed successfully") . EOL);
250 // birthday paradox - generate new dfrn-id and fall through.
252 $new_dfrn_id = random_string();
253 $r = q("UPDATE contact SET `issued-id` = '%s' WHERE `id` = %d AND `uid` = %d LIMIT 1",
260 notice( t("Temporary failure. Please wait and try again.") . EOL);
265 notice( t("Introduction failed or was revoked. Cannot complete.") . EOL);
269 if(($status == 0 || $status == 3) && ($intro_id)) {
271 //delete the notification
273 $r = q("DELETE FROM `intro` WHERE `id` = %d AND `uid` = %d LIMIT 1",
283 require_once("Photo.php");
285 $photo_failure = false;
287 $r = q("SELECT `photo` FROM `contact` WHERE `id` = %d LIMIT 1",
288 intval($contact_id));
291 $filename = basename($r[0]['photo']);
292 $img_str = fetch_url($r[0]['photo'],true);
293 $img = new Photo($img_str);
296 $img->scaleImageSquare(175);
298 $hash = hash('md5',uniqid(mt_rand(),true));
300 $r = $img->store($local_uid, $contact_id, $hash, $filename, t('Contact Photos'), 4 );
303 $photo_failure = true;
304 $img->scaleImage(80);
306 $r = $img->store($local_uid, $contact_id, $hash, $filename, t('Contact Photos'), 5 );
309 $photo_failure = true;
311 $photo = $a->get_baseurl() . '/photo/' . $hash . '-4.jpg';
312 $thumb = $a->get_baseurl() . '/photo/' . $hash . '-5.jpg';
315 $photo_failure = true;
318 $photo_failure = true;
321 $photo = $a->get_baseurl() . '/images/default-profile.jpg';
322 $thumb = $a->get_baseurl() . '/images/default-profile-sm.jpg';
325 $r = q("UPDATE `contact` SET `photo` = '%s', `thumb` = '%s', `blocked` = 0, `pending` = 0 WHERE `id` = %d LIMIT 1",
331 notice( t('Unable to set contact photo.') . EOL);
333 goaway($a->get_baseurl() . '/contacts/' . intval($contact_id));