5 function dfrn_confirm_post(&$a) {
10 if(x($_POST,'source_url')) {
12 // We are processing an external confirmation to an introduction created by our user.
14 $public_key = $_POST['public_key'];
15 $dfrn_id = $_POST['dfrn_id'];
16 $source_url = $_POST['source_url'];
17 $aes_key = $_POST['aes_key'];
19 // Find our user's account
21 $r = q("SELECT * FROM `user` WHERE `nickname` = '%s' LIMIT 1",
25 xml_status(3); // failure
28 $my_prvkey = $r[0]['prvkey'];
29 $local_uid = $r[0]['uid'];
31 $decrypted_source_url = "";
35 openssl_private_decrypt($source_url,$decrypted_source_url,$my_prvkey);
38 $ret = q("SELECT * FROM `contact` WHERE `url` = '%s' AND `uid` = %d LIMIT 1",
39 dbesc($decrypted_source_url),
43 // this is either a bogus confirmation or we deleted the original introduction.
47 // Decrypt all this stuff we just received
49 $foreign_pubkey = $ret[0]['site-pubkey'];
50 $dfrn_record = $ret[0]['id'];
51 $decrypted_dfrn_id = "";
52 openssl_public_decrypt($dfrn_id,$decrypted_dfrn_id,$foreign_pubkey);
54 if(strlen($aes_key)) {
55 $decrypted_aes_key = "";
56 openssl_private_decrypt($aes_key,$decrypted_aes_key,$my_prvkey);
57 $dfrn_pubkey = openssl_decrypt($public_key,'AES-256-CBC',$decrypted_aes_key);
60 $dfrn_pubkey = $public_key;
63 $r = q("SELECT * FROM `contact` WHERE `dfrn-id` = '%s' LIMIT 1",
64 dbesc($decrypted_dfrn_id),
67 xml_status(1); // Birthday paradox - duplicate dfrn-id
69 $r = q("UPDATE `contact` SET `dfrn-id` = '%s', `pubkey` = '%s' WHERE `id` = %d LIMIT 1",
70 dbesc($decrypted_dfrn_id),
72 intval($dfrn_record));
75 // We're good but now we have to scrape the profile photo and send notifications.
77 require_once("Photo.php");
79 $photo_failure = false;
81 $r = q("SELECT `photo` FROM `contact` WHERE `id` = %d LIMIT 1",
82 intval($dfrn_record));
85 $filename = basename($r[0]['photo']);
86 $img_str = fetch_url($r[0]['photo'],true);
87 $img = new Photo($img_str);
90 $img->scaleImageSquare(175);
92 $hash = hash('md5',uniqid(mt_rand(),true));
94 $r = q("INSERT INTO `photo` ( `uid`, `contact-id`, `resource-id`, `created`, `edited`, `filename`, `album`, `height`, `width`, `data`, `scale` )
95 VALUES ( %d, %d, '%s', '%s', '%s', '%s', '%s', %d, %d, '%s', 4 )",
101 dbesc(basename($r[0]['photo'])),
102 dbesc( t('Contact Photos') ),
103 intval($img->getHeight()),
104 intval($img->getWidth()),
105 dbesc($img->imageString())
108 $photo_failure = true;
110 $img->scaleImage(80);
111 $r = q("INSERT INTO `photo` ( `uid`, `contact-id`, `resource-id`, `created`, `edited`, `filename`, `album`, `height`, `width`, `data`, `scale` )
112 VALUES ( %d, %d, '%s', '%s', '%s', '%s', '%s', %d, %d, '%s', 5 )",
114 intval($dfrn_record),
118 dbesc(basename($r[0]['photo'])),
119 dbesc( t('Contact Photos')),
120 intval($img->getHeight()),
121 intval($img->getWidth()),
122 dbesc($img->imageString())
125 $photo_failure = true;
127 $photo = $a->get_baseurl() . '/photo/' . $hash . '-4.jpg';
128 $thumb = $a->get_baseurl() . '/photo/' . $hash . '-5.jpg';
131 $photo_failure = true;
134 $photo_failure = true;
137 $photo = $a->get_baseurl() . '/images/default-profile.jpg';
138 $thumb = $a->get_baseurl() . '/images/default-profile-sm.jpg';
141 $r = q("UPDATE `contact` SET `photo` = '%s', `thumb` = '%s', `blocked` = 0, `pending` = 0 WHERE `id` = %d LIMIT 1",
147 notice( t("Unable to set contact photo info.") . EOL);
149 // Otherwise everything seems to have worked and we are almost done. Yay!
150 // Send an email notification
152 $r = q("SELECT * FROM `contact` LEFT JOIN `user` ON `contact`.`uid` = `user`.`uid`
153 WHERE `contact`.`id` = %d LIMIT 1",
154 intval($dfrn_record));
155 if((count($r)) && ($r[0]['notify-flags'] & NOTIFY_CONFIRM)) {
157 $tpl = file_get_contents('view/intro_complete_eml.tpl');
159 $email_tpl = replace_macros($tpl, array(
160 '$sitename' => $a->config['sitename'],
161 '$siteurl' => $a->get_baseurl(),
162 '$username' => $r[0]['username'],
163 '$email' => $r[0]['email'],
164 '$fn' => $r[0]['name'],
165 '$dfrn_url' => $r[0]['url'],
169 $res = mail($r[0]['email'], t("Introduction accepted at ") . $a->config['sitename'],
170 $email_tpl,t("From: Administrator@") . $_SERVER[SERVER_NAME] );
172 notice( t("Email notification failed.") . EOL );
175 xml_status(0); // Success
177 return; // NOTREACHED
180 xml_status(2); // Hopefully temporary problem that can be retried.
182 return; // NOTREACHED
184 ////////////////////// End of this scenario ///////////////////////////////////////////////
188 // We are processing a local confirmation initiated on this system by our user to an external introduction.
190 $uid = $_SESSION['uid'];
193 notice(t("Permission denied.") . EOL );
197 $dfrn_id = ((x($_POST,'dfrn_id')) ? notags(trim($_POST['dfrn_id'])) : "");
198 $intro_id = intval($_POST['intro_id']);
200 $r = q("SELECT * FROM `contact` WHERE `issued-id` = '%s' AND `uid` = %d LIMIT 1",
205 if((! $r) || (! count($r))) {
206 notice( t('Node does not exist.') . EOL );
210 $contact_id = $r[0]['id'];
211 $site_pubkey = $r[0]['site-pubkey'];
212 $dfrn_confirm = $r[0]['confirm'];
213 $aes_allow = $r[0]['aes_allow'];
215 $res=openssl_pkey_new(array(
216 'digest_alg' => 'whirlpool',
217 'private_key_bits' => 4096,
218 'encrypt_key' => false ));
223 openssl_pkey_export($res, $private_key);
226 $pubkey = openssl_pkey_get_details($res);
227 $public_key = $pubkey["key"];
229 $r = q("UPDATE `contact` SET `issued-pubkey` = '%s', `prvkey` = '%s' WHERE `id` = %d AND `uid` = %d LIMIT 1",
239 $src_aes_key = random_string();
242 openssl_private_encrypt($dfrn_id,$result,$a->user['prvkey']);
244 $params['dfrn_id'] = $result;
245 $params['public_key'] = $public_key;
248 openssl_public_encrypt($_SESSION['my_url'], $params['source_url'], $site_pubkey);
250 if($aes_allow && function_exists('openssl_encrypt')) {
251 openssl_public_encrypt($src_aes_key, $params['aes_key'], $site_pubkey);
252 $params['public_key'] = openssl_encrypt($public_key,'AES-256-CBC',$src_aes_key);
255 $res = post_url($dfrn_confirm,$params);
257 // uncomment the following two lines and comment the following xml/status lines
258 // to debug the remote confirmation section (when both confirmations
259 // and responses originate on this system)
264 $xml = simplexml_load_string($res);
265 $status = (int) $xml->status;
268 notice( t("Confirmation completed successfully") . EOL);
272 // birthday paradox - generate new dfrn-id and fall through.
274 $new_dfrn_id = random_string();
275 $r = q("UPDATE contact SET `issued-id` = '%s' WHERE `id` = %d AND `uid` = %d LIMIT 1",
282 notice( t("Temporary failure. Please wait and try again.") . EOL);
287 notice( t("Introduction failed or was revoked. Cannot complete.") . EOL);
291 if(($status == 0 || $status == 3) && ($intro_id)) {
293 //delete the notification
295 $r = q("DELETE FROM `intro` WHERE `id` = %d AND `uid` = %d LIMIT 1",
305 require_once("Photo.php");
307 $photo_failure = false;
309 $r = q("SELECT `photo` FROM `contact` WHERE `id` = %d LIMIT 1",
310 intval($contact_id));
313 $filename = basename($r[0]['photo']);
314 $img_str = fetch_url($r[0]['photo'],true);
315 $img = new Photo($img_str);
318 $img->scaleImageSquare(175);
320 $hash = hash('md5',uniqid(mt_rand(),true));
322 $r = q("INSERT INTO `photo` ( `uid`, `resource-id`, `created`, `edited`, `filename`, `album`, `height`, `width`, `data`, `scale` )
323 VALUES ( %d, '%s', '%s', '%s', '%s', '%s', %d, %d, '%s', 4 )",
328 dbesc(basename($r[0]['photo'])),
329 dbesc( t('Contact Photos') ),
330 intval($img->getHeight()),
331 intval($img->getWidth()),
332 dbesc($img->imageString())
335 $photo_failure = true;
336 $img->scaleImage(80);
337 $r = q("INSERT INTO `photo` ( `uid`, `resource-id`, `created`, `edited`, `filename`, `album`, `height`, `width`, `data`, `scale` )
338 VALUES ( %d, '%s', '%s', '%s', '%s', '%s', %d, %d, '%s', 5 )",
343 dbesc(basename($r[0]['photo'])),
344 dbesc( t('Contact Photos') ),
345 intval($img->getHeight()),
346 intval($img->getWidth()),
347 dbesc($img->imageString())
350 $photo_failure = true;
352 $photo = $a->get_baseurl() . '/photo/' . $hash . '-4.jpg';
353 $thumb = $a->get_baseurl() . '/photo/' . $hash . '-5.jpg';
356 $photo_failure = true;
359 $photo_failure = true;
362 $photo = $a->get_baseurl() . '/images/default-profile.jpg';
363 $thumb = $a->get_baseurl() . '/images/default-profile-sm.jpg';
366 $r = q("UPDATE `contact` SET `photo` = '%s', `thumb` = '%s', `blocked` = 0, `pending` = 0 WHERE `id` = %d LIMIT 1",
372 notice( t('Unable to set contact photo.') . EOL);
374 goaway($a->get_baseurl() . '/contacts/' . intval($contact_id));