5 function dfrn_confirm_post(&$a) {
10 if(x($_POST,'source_url')) {
12 // We are processing an external confirmation to an introduction created by our user.
14 $public_key = $_POST['public_key'];
15 $dfrn_id = $_POST['dfrn_id'];
16 $source_url = $_POST['source_url'];
17 $aes_key = $_POST['aes_key'];
19 // Find our user's account
21 $r = q("SELECT * FROM `user` WHERE `nickname` = '%s' LIMIT 1",
25 xml_status(3); // failure
28 $my_prvkey = $r[0]['prvkey'];
29 $local_uid = $r[0]['uid'];
31 $decrypted_source_url = "";
35 openssl_private_decrypt($source_url,$decrypted_source_url,$my_prvkey);
38 $ret = q("SELECT * FROM `contact` WHERE `url` = '%s' AND `uid` = %d LIMIT 1",
39 dbesc($decrypted_source_url),
43 // this is either a bogus confirmation or we deleted the original introduction.
47 // Decrypt all this stuff we just received
49 $foreign_pubkey = $ret[0]['site-pubkey'];
50 $dfrn_record = $ret[0]['id'];
51 $decrypted_dfrn_id = "";
52 openssl_public_decrypt($dfrn_id,$decrypted_dfrn_id,$foreign_pubkey);
54 if(strlen($aes_key)) {
55 $decrypted_aes_key = "";
56 openssl_private_decrypt($aes_key,$decrypted_aes_key,$my_prvkey);
57 $dfrn_pubkey = openssl_decrypt($public_key,'AES-256-CBC',$decrypted_aes_key);
60 $dfrn_pubkey = $public_key;
63 $r = q("SELECT * FROM `contact` WHERE `dfrn-id` = '%s' LIMIT 1",
64 dbesc($decrypted_dfrn_id),
67 xml_status(1); // Birthday paradox - duplicate dfrn-id
69 $r = q("UPDATE `contact` SET `dfrn-id` = '%s', `pubkey` = '%s' WHERE `id` = %d LIMIT 1",
70 dbesc($decrypted_dfrn_id),
72 intval($dfrn_record));
75 // We're good but now we have to scrape the profile photo and send notifications.
77 require_once("Photo.php");
79 $photo_failure = false;
81 $r = q("SELECT `photo` FROM `contact` WHERE `id` = %d LIMIT 1",
82 intval($dfrn_record));
85 $filename = basename($r[0]['photo']);
86 $img_str = fetch_url($r[0]['photo'],true);
87 $img = new Photo($img_str);
90 $img->scaleImageSquare(175);
92 $hash = hash('md5',uniqid(mt_rand(),true));
94 $r = $img->store($local_uid, $dfrn_record, $hash, $filename, t('Contact Photos') , 4);
97 $photo_failure = true;
100 $r = $img->store($local_uid, $dfrn_record, $hash, $filename, t('Contact Photos') , 5);
103 $photo_failure = true;
105 $photo = $a->get_baseurl() . '/photo/' . $hash . '-4.jpg';
106 $thumb = $a->get_baseurl() . '/photo/' . $hash . '-5.jpg';
109 $photo_failure = true;
112 $photo_failure = true;
115 $photo = $a->get_baseurl() . '/images/default-profile.jpg';
116 $thumb = $a->get_baseurl() . '/images/default-profile-sm.jpg';
119 $r = q("UPDATE `contact` SET `photo` = '%s', `thumb` = '%s', `name-date` = '%s', `uri-date` = '%s', `avatar-date` = '%s', `blocked` = 0, `pending` = 0 WHERE `id` = %d LIMIT 1",
122 dbesc(datetime_convert()),
123 dbesc(datetime_convert()),
124 dbesc(datetime_convert()),
128 notice( t("Unable to set contact photo info.") . EOL);
130 // Otherwise everything seems to have worked and we are almost done. Yay!
131 // Send an email notification
133 $r = q("SELECT * FROM `contact` LEFT JOIN `user` ON `contact`.`uid` = `user`.`uid`
134 WHERE `contact`.`id` = %d LIMIT 1",
135 intval($dfrn_record));
136 if((count($r)) && ($r[0]['notify-flags'] & NOTIFY_CONFIRM)) {
138 $tpl = file_get_contents('view/intro_complete_eml.tpl');
140 $email_tpl = replace_macros($tpl, array(
141 '$sitename' => $a->config['sitename'],
142 '$siteurl' => $a->get_baseurl(),
143 '$username' => $r[0]['username'],
144 '$email' => $r[0]['email'],
145 '$fn' => $r[0]['name'],
146 '$dfrn_url' => $r[0]['url'],
150 $res = mail($r[0]['email'], t("Introduction accepted at ") . $a->config['sitename'],
151 $email_tpl,t("From: Administrator@") . $_SERVER[SERVER_NAME] );
153 notice( t("Email notification failed.") . EOL );
156 xml_status(0); // Success
158 return; // NOTREACHED
161 xml_status(2); // Hopefully temporary problem that can be retried.
163 return; // NOTREACHED
165 ////////////////////// End of this scenario ///////////////////////////////////////////////
169 // We are processing a local confirmation initiated on this system by our user to an external introduction.
171 $uid = $_SESSION['uid'];
174 notice( t("Permission denied.") . EOL );
178 $dfrn_id = ((x($_POST,'dfrn_id')) ? notags(trim($_POST['dfrn_id'])) : "");
179 $intro_id = intval($_POST['intro_id']);
181 $r = q("SELECT * FROM `contact` WHERE `issued-id` = '%s' AND `uid` = %d LIMIT 1",
186 if((! $r) || (! count($r))) {
187 notice( t('Node does not exist.') . EOL );
191 $contact_id = $r[0]['id'];
192 $site_pubkey = $r[0]['site-pubkey'];
193 $dfrn_confirm = $r[0]['confirm'];
194 $aes_allow = $r[0]['aes_allow'];
196 $res=openssl_pkey_new(array(
197 'digest_alg' => 'whirlpool',
198 'private_key_bits' => 4096,
199 'encrypt_key' => false ));
204 openssl_pkey_export($res, $private_key);
207 $pubkey = openssl_pkey_get_details($res);
208 $public_key = $pubkey["key"];
210 $r = q("UPDATE `contact` SET `issued-pubkey` = '%s', `prvkey` = '%s' WHERE `id` = %d AND `uid` = %d LIMIT 1",
220 $src_aes_key = random_string();
223 openssl_private_encrypt($dfrn_id,$result,$a->user['prvkey']);
225 $params['dfrn_id'] = $result;
226 $params['public_key'] = $public_key;
229 openssl_public_encrypt($_SESSION['my_url'], $params['source_url'], $site_pubkey);
231 if($aes_allow && function_exists('openssl_encrypt')) {
232 openssl_public_encrypt($src_aes_key, $params['aes_key'], $site_pubkey);
233 $params['public_key'] = openssl_encrypt($public_key,'AES-256-CBC',$src_aes_key);
236 $res = post_url($dfrn_confirm,$params);
238 // uncomment the following two lines and comment the following xml/status lines
239 // to debug the remote confirmation section (when both confirmations
240 // and responses originate on this system)
245 $xml = simplexml_load_string($res);
246 $status = (int) $xml->status;
249 notice( t("Confirmation completed successfully") . EOL);
253 // birthday paradox - generate new dfrn-id and fall through.
255 $new_dfrn_id = random_string();
256 $r = q("UPDATE contact SET `issued-id` = '%s' WHERE `id` = %d AND `uid` = %d LIMIT 1",
263 notice( t("Temporary failure. Please wait and try again.") . EOL);
268 notice( t("Introduction failed or was revoked. Cannot complete.") . EOL);
272 if(($status == 0 || $status == 3) && ($intro_id)) {
274 //delete the notification
276 $r = q("DELETE FROM `intro` WHERE `id` = %d AND `uid` = %d LIMIT 1",
286 require_once("Photo.php");
288 $photo_failure = false;
290 $r = q("SELECT `photo` FROM `contact` WHERE `id` = %d LIMIT 1",
291 intval($contact_id));
294 $filename = basename($r[0]['photo']);
295 $img_str = fetch_url($r[0]['photo'],true);
296 $img = new Photo($img_str);
299 $img->scaleImageSquare(175);
301 $hash = hash('md5',uniqid(mt_rand(),true));
303 $r = $img->store($uid, $contact_id, $hash, $filename, t('Contact Photos'), 4 );
306 $photo_failure = true;
307 $img->scaleImage(80);
309 $r = $img->store($uid, $contact_id, $hash, $filename, t('Contact Photos'), 5 );
312 $photo_failure = true;
314 $photo = $a->get_baseurl() . '/photo/' . $hash . '-4.jpg';
315 $thumb = $a->get_baseurl() . '/photo/' . $hash . '-5.jpg';
318 $photo_failure = true;
321 $photo_failure = true;
324 $photo = $a->get_baseurl() . '/images/default-profile.jpg';
325 $thumb = $a->get_baseurl() . '/images/default-profile-sm.jpg';
328 $r = q("UPDATE `contact` SET `photo` = '%s', `thumb` = '%s', `name-date` = '%s', `uri-date` = '%s', `avatar-date` = '%s', `blocked` = 0, `pending` = 0 WHERE `id` = %d LIMIT 1",
331 dbesc(datetime_convert()),
332 dbesc(datetime_convert()),
333 dbesc(datetime_convert()),
337 notice( t('Unable to set contact photo.') . EOL);
339 goaway($a->get_baseurl() . '/contacts/' . intval($contact_id));