mod/dfrn_confirm.php

   1 <?php
   2
   3
   4
   5 function dfrn_confirm_post(&$a) {
   6
   7         if($a->argc > 1)
   8                 $node = $a->argv[1];
   9
  10         if(x($_POST,'source_url')) {
  11
  12         // We are processing an external confirmation to an introduction created by our user.
  13
  14                 $public_key = $_POST['public_key'];
  15                 $dfrn_id = $_POST['dfrn_id'];
  16                 $source_url = $_POST['source_url'];
  17                 $aes_key = $_POST['aes_key'];
  18
  19                 if(intval($node))
  20                         $r = q("SELECT * FROM `user` WHERE `uid` = %d LIMIT 1",
  21                                 intval($node));
  22                 else
  23                         $r = q("SELECT * FROM `user` WHERE `nickname` = '%s' LIMIT 1",
  24                                 dbesc($node));
  25
  26                 if(! count($r)) {
  27                         xml_status(3); // failure
  28                 }
  29
  30                 $my_prvkey = $r[0]['prvkey'];
  31                 $local_uid = $r[0]['uid'];
  32
  33                 $decrypted_source_url = "";
  34
  35                 openssl_private_decrypt($source_url,$decrypted_source_url,$my_prvkey);
  36
  37
  38                 $ret = q("SELECT * FROM `contact` WHERE `url` = '%s' AND `uid` = %d LIMIT 1",
  39                         dbesc($decrypted_source_url),
  40                         intval($local_uid));
  41
  42                 if(! count($ret)) {
  43                         // this is either a bogus confirmation or we deleted the original introduction.
  44                         xml_status(3);
  45                 }
  46
  47                 // Decrypt all this stuff we just received
  48
  49                 $foreign_pubkey = $ret[0]['site-pubkey'];
  50                 $dfrn_record = $ret[0]['id'];
  51                 $decrypted_dfrn_id = "";
  52                 openssl_public_decrypt($dfrn_id,$decrypted_dfrn_id,$foreign_pubkey);
  53
  54                 if(strlen($aes_key)) {
  55                         $decrypted_aes_key = "";
  56                         openssl_private_decrypt($aes_key,$decrypted_aes_key,$my_prvkey);
  57                         $dfrn_pubkey = openssl_decrypt($public_key,'AES-256-CBC',$decrypted_aes_key);
  58                 }
  59                 else {
  60                         $dfrn_pubkey = $public_key;
  61                 }
  62
  63                 $r = q("SELECT * FROM `contact` WHERE `dfrn-id` = '%s' LIMIT 1",
  64                         dbesc($decrypted_dfrn_id),
  65                         intval($local_uid));
  66                 if(count($r))
  67                         xml_status(1); // Birthday paradox - duplicate dfrn-id
  68
  69                 $r = q("UPDATE `contact` SET `dfrn-id` = '%s', `pubkey` = '%s' WHERE `id` = %d LIMIT 1",
  70                         dbesc($decrypted_dfrn_id),
  71                         dbesc($dfrn_pubkey),
  72                         intval($dfrn_record));
  73                 if($r) {
  74
  75                         // We're good but now we have to scrape the profile photo and send notifications.
  76
  77                         require_once("Photo.php");
  78
  79                         $photo_failure = false;
  80
  81                         $r = q("SELECT `photo` FROM `contact` WHERE `id` = %d LIMIT 1",
  82                                 intval($dfrn_record));
  83                         if(count($r)) {
  84
  85                                 $filename = basename($r[0]['photo']);
  86                                 $img_str = fetch_url($r[0]['photo'],true);
  87                                 $img = new Photo($img_str);
  88                                 if($img) {
  89
  90                                         $img->scaleImageSquare(175);
  91
  92                                         $hash = hash('md5',uniqid(mt_rand(),true));
  93
  94                                         $r = q("INSERT INTO `photo` ( `uid`, `resource-id`, `created`, `edited`, `filename`,
  95                                                 `height`, `width`, `data`, `scale` )
  96                                                 VALUES ( %d, '%s', '%s', '%s', '%s', %d, %d, '%s', 4 )",
  97                                                 intval($local_uid),
  98                                                 dbesc($hash),
  99                                                 datetime_convert(),
 100                                                 datetime_convert(),
 101                                                 dbesc(basename($r[0]['photo'])),
 102                                                 intval($img->getHeight()),
 103                                                 intval($img->getWidth()),
 104                                                 dbesc($img->imageString())
 105                                         );
 106                                         if($r === false)
 107                                                 $photo_failure = true;
 108                                         $img->scaleImage(80);
 109                                         $r =  q("INSERT INTO `photo` ( `uid`, `resource-id`, `created`, `edited`, `filename`,
 110                                                 `height`, `width`, `data`, `scale` )
 111                                                 VALUES ( %d, '%s', '%s', '%s', '%s', %d, %d, '%s', 5 )",
 112                                                 intval($local_uid),
 113                                                 dbesc($hash),
 114                                                 datetime_convert(),
 115                                                 datetime_convert(),
 116                                                 dbesc(basename($r[0]['photo'])),
 117                                                 intval($img->getHeight()),
 118                                                 intval($img->getWidth()),
 119                                                 dbesc($img->imageString())
 120                                         );
 121                                         if($r === false)
 122                                                 $photo_failure = true;
 123
 124                                         $photo = $a->get_baseurl() . '/photo/' . $hash . '-4.jpg';
 125                                         $thumb = $a->get_baseurl() . '/photo/' . $hash . '-5.jpg';
 126
 127                                 }
 128                                 else
 129                                         $photo_failure = true;
 130                         }
 131                         else
 132                                 $photo_failure = true;
 133
 134                         if($photo_failure) {
 135                                 $photo = $a->get_baseurl() . '/images/default-profile.jpg';
 136                                 $thumb = $a->get_baseurl() . '/images/default-profile-sm.jpg';
 137                         }
 138
 139                         $r = q("UPDATE `contact` SET `photo` = '%s', `thumb` = '%s', `blocked` = 0, `pending` = 0 WHERE `id` = %d LIMIT 1",
 140                                 dbesc($photo),
 141                                 dbesc($thumb),
 142                                 intval($dfrn_record)
 143                         );
 144                         if($r === false)
 145                                 $_SESSION['sysmsg'] .= "Unable to set contact photo info." . EOL;
 146
 147                         // Otherwise everything seems to have worked and we are almost done. Yay!
 148                         // Send an email notification
 149
 150                         $r = q("SELECT * FROM `contact` LEFT JOIN `user` ON `contact`.`uid` = `user`.`uid`
 151                                 WHERE `contact`.`id` = %d LIMIT 1",
 152                                 intval($dfrn_record));
 153
 154                         $tpl = file_get_contents('view/intro_complete_eml.tpl');
 155
 156                         $email_tpl = replace_macros($tpl, array(
 157                                 '$sitename' => $a->config['sitename'],
 158                                 '$siteurl' =>  $a->get_baseurl(),
 159                                 '$username' => $r[0]['username'],
 160                                 '$email' => $r[0]['email'],
 161                                 '$fn' => $r[0]['name'],
 162                                 '$dfrn_url' => $r[0]['url'],
 163                                 '$uid' => $newuid ));
 164
 165
 166                         $res = mail($r[0]['email'],"Introduction accepted at {$a->config['sitename']}",
 167                                 $email_tpl,"From: Administrator@{$_SERVER[SERVER_NAME]}");
 168                         if(!$res) {
 169                                 notice( "Email notification failed." . EOL );
 170                         }
 171                         xml_status(0); // Success
 172
 173                         return; // NOTREACHED
 174
 175                 }
 176                 else
 177                         xml_status(2);  // Hopefully temporary problem that can be retried.
 178
 179                 return; // NOTREACHED
 180
 181         ////////////////////// End of this scenario ///////////////////////////////////////////////
 182         }
 183         else {
 184
 185                 // We are processing a local confirmation initiated on this system by our user to an external introduction.
 186
 187                 $uid = $_SESSION['uid'];
 188
 189                 if(! $uid) {
 190                         notice("Permission denied." . EOL );
 191                         return;
 192                 }
 193
 194                 $dfrn_id = ((x($_POST,'dfrn_id')) ? notags(trim($_POST['dfrn_id'])) : "");
 195                 $intro_id = intval($_POST['intro_id']);
 196
 197                 $r = q("SELECT * FROM `contact` WHERE `issued-id` = '%s' AND `uid` = %d LIMIT 1",
 198                                 dbesc($dfrn_id),
 199                                 intval($uid)
 200                                 );
 201
 202                 if((! $r) || (! count($r))) {
 203                         $_SESSION['sysmsg'] = 'Node does not exist.' . EOL ;
 204                         return;
 205                 }
 206
 207                 $contact_id = $r[0]['id'];
 208                 $site_pubkey = $r[0]['site-pubkey'];
 209                 $dfrn_confirm = $r[0]['confirm'];
 210                 $aes_allow = $r[0]['aes_allow'];
 211
 212                 $res=openssl_pkey_new(array(
 213                         'digest_alg' => 'whirlpool',
 214                         'private_key_bits' => 4096,
 215                         'encrypt_key' => false ));
 216
 217
 218                 $private_key = '';
 219
 220                 openssl_pkey_export($res, $private_key);
 221
 222
 223                 $pubkey = openssl_pkey_get_details($res);
 224                 $public_key = $pubkey["key"];
 225
 226                 $r = q("UPDATE `contact` SET `issued-pubkey` = '%s', `prvkey` = '%s' WHERE `id` = %d AND `uid` = %d LIMIT 1",
 227                         dbesc($public_key),
 228                         dbesc($private_key),
 229                         intval($contact_id),
 230                         intval($uid)
 231                         );
 232
 233
 234                 $params = array();
 235
 236                 $src_aes_key = random_string();
 237                 $result = "";
 238
 239                 openssl_private_encrypt($dfrn_id,$result,$a->user['prvkey']);
 240
 241                 $params['dfrn_id'] = $result;
 242                 $params['public_key'] = $public_key;
 243
 244
 245                 openssl_public_encrypt($_SESSION['my_url'], $params['source_url'], $site_pubkey);
 246
 247                 if($aes_allow && function_exists('openssl_encrypt')) {
 248                         openssl_public_encrypt($src_aes_key, $params['aes_key'], $site_pubkey);
 249                         $params['public_key'] = openssl_encrypt($public_key,'AES-256-CBC',$src_aes_key);
 250                 }
 251
 252                 $res = post_url($dfrn_confirm,$params);
 253
 254 // uncomment the following two lines and comment the following xml/status lines
 255 // to debug the remote confirmation section (when both confirmations
 256 // and responses originate on this system)
 257
 258 // echo $res;
 259 // $status = 0;
 260
 261                 $xml = simplexml_load_string($res);
 262                 $status = (int) $xml->status;
 263                 switch($status) {
 264                         case 0:
 265                                 $_SESSION['sysmsg'] .= "Confirmation completed successfully" . EOL;
 266                                 break;
 267                         case 1:
 268
 269                                 // birthday paradox - generate new dfrn-id and fall through.
 270
 271                                 $new_dfrn_id = random_string();
 272                                 $r = q("UPDATE contact SET `issued-id` = '%s' WHERE `id` = %d AND `uid` = %d LIMIT 1",
 273                                         dbesc($new_dfrn_id),
 274                                         intval($contact_id),
 275                                         intval($uid)
 276                                 );
 277
 278                         case 2:
 279                                 $_SESSION['sysmsg'] .= "Temporary failure. Please wait and try again." . EOL;
 280                                 break;
 281
 282
 283                         case 3:
 284                                 $_SESSION['sysmsg'] .= "Introduction failed or was revoked. Cannot complete." . EOL;
 285                                 break;
 286                 }
 287
 288                 if(($status == 0 || $status == 3) && ($intro_id)) {
 289
 290                         //delete the notification
 291
 292                         $r = q("DELETE FROM `intro` WHERE `id` = %d AND `uid` = %d LIMIT 1",
 293                                 intval($intro_id),
 294                                 intval($uid)
 295                         );
 296
 297                 }
 298                 if($status != 0)
 299                         return;
 300
 301
 302                 require_once("Photo.php");
 303
 304                 $photo_failure = false;
 305
 306                 $r = q("SELECT `photo` FROM `contact` WHERE `id` = %d LIMIT 1",
 307                         intval($contact_id));
 308                 if(count($r)) {
 309
 310                         $filename = basename($r[0]['photo']);
 311                         $img_str = fetch_url($r[0]['photo'],true);
 312                         $img = new Photo($img_str);
 313                         if($img) {
 314
 315                                 $img->scaleImageSquare(175);
 316
 317                                 $hash = hash('md5',uniqid(mt_rand(),true));
 318
 319                                 $r = q("INSERT INTO `photo` ( `uid`, `resource-id`, `created`, `edited`, `filename`,
 320                                         `height`, `width`, `data`, `scale` )
 321                                         VALUES ( %d, '%s', '%s', '%s', '%s', %d, %d, '%s', 4 )",
 322                                         intval($local_uid),
 323                                         dbesc($hash),
 324                                         datetime_convert(),
 325                                         datetime_convert(),
 326                                         dbesc(basename($r[0]['photo'])),
 327                                         intval($img->getHeight()),
 328                                         intval($img->getWidth()),
 329                                         dbesc($img->imageString())
 330                                 );
 331                                 if($r === false)
 332                                         $photo_failure = true;
 333                                 $img->scaleImage(80);
 334                                 $r =  q("INSERT INTO `photo` ( `uid`, `resource-id`, `created`, `edited`, `filename`,
 335                                         `height`, `width`, `data`, `scale` )
 336                                          VALUES ( %d, '%s', '%s', '%s', '%s', %d, %d, '%s', 5 )",
 337                                          intval($local_uid),
 338                                          dbesc($hash),
 339                                          datetime_convert(),
 340                                          datetime_convert(),
 341                                          dbesc(basename($r[0]['photo'])),
 342                                          intval($img->getHeight()),
 343                                          intval($img->getWidth()),
 344                                          dbesc($img->imageString())
 345                                 );
 346                                 if($r === false)
 347                                         $photo_failure = true;
 348
 349                                 $photo = $a->get_baseurl() . '/photo/' . $hash . '-4.jpg';
 350                                 $thumb = $a->get_baseurl() . '/photo/' . $hash . '-5.jpg';
 351
 352                         }
 353                         else
 354                                 $photo_failure = true;
 355                 }
 356                 else
 357                         $photo_failure = true;
 358
 359                 if($photo_failure) {
 360                         $photo = $a->get_baseurl() . '/images/default-profile.jpg';
 361                         $thumb = $a->get_baseurl() . '/images/default-profile-sm.jpg';
 362                 }
 363
 364                 $r = q("UPDATE `contact` SET `photo` = '%s', `thumb` = '%s', `blocked` = 0, `pending` = 0 WHERE `id` = %d LIMIT 1",
 365                         dbesc($photo),
 366                         dbesc($thumb),
 367                         intval($contact_id)
 368                 );
 369                 if($r === false)
 370                         $_SESSION['sysmsg'] .= "Unable to set contact photo info." . EOL;
 371         }
 372
 373         goaway($a->get_baseurl() . '/contacts/' . intval($contact_id));
 374         return;  //NOTREACHED
 375 }