]> git.mxchange.org Git - friendica.git/blob - mod/follow.php
sanitise all incoming url's - also stop them from getting mangled by simplepie
[friendica.git] / mod / follow.php
1 <?php
2
3 require_once('Scrape.php');
4
5 function follow_post(&$a) {
6
7         if(! local_user()) {
8                 notice( t('Permission denied.') . EOL);
9                 goaway($_SESSION['return_url']);
10                 // NOTREACHED
11         }
12
13         $url = $orig_url = notags(trim($_POST['url']));
14         
15         $email_conversant = false;
16
17         if($url) {
18                 $links = @lrdd($url);
19                 if(count($links)) {
20                         foreach($links as $link) {
21                                 if($link['@attributes']['rel'] === NAMESPACE_DFRN)
22                                         $dfrn = unamp($link['@attributes']['href']);
23                                 if($link['@attributes']['rel'] === 'salmon')
24                                         $notify = unamp($link['@attributes']['href']);
25                                 if($link['@attributes']['rel'] === NAMESPACE_FEED)
26                                         $poll = unamp($link['@attributes']['href']);
27                                 if($link['@attributes']['rel'] === 'http://microformats.org/profile/hcard')
28                                         $hcard = unamp($link['@attributes']['href']);
29                                 if($link['@attributes']['rel'] === 'http://webfinger.net/rel/profile-page')
30                                         $profile = unamp($link['@attributes']['href']);
31
32                         }
33
34                         // Status.Net can have more than one profile URL. We need to match the profile URL
35                         // to a contact on incoming messages to prevent spam, and we won't know which one
36                         // to match. So in case of two, one of them is stored as an alias. Only store URL's
37                         // and not webfinger user@host aliases. If they've got more than two non-email style
38                         // aliases, let's hope we're lucky and get one that matches the feed author-uri because 
39                         // otherwise we're screwed.
40
41                         foreach($links as $link) {
42                                 if($link['@attributes']['rel'] === 'alias') {
43                                         if(strpos($link['@attributes']['href'],'@') === false) {
44                                                 if(isset($profile)) {
45                                                         if($link['@attributes']['href'] !== $profile)
46                                                                 $alias = unamp($link['@attributes']['href']);
47                                                 }
48                                                 else
49                                                         $profile = unamp($link['@attributes']['href']);
50                                         }
51                                 }
52                         }
53                 }
54                 else {
55                         if((strpos($orig_url,'@')) && validate_email($orig_url)) {
56                                 $email_conversant = true;
57                         }
58                 }
59         }       
60
61         // If we find a DFRN site, send our subscriber to the other person's
62         // dfrn_request page and all the other details will get sorted.
63
64         if(strlen($dfrn)) {
65                 $ret = scrape_dfrn($dfrn);
66                 if(is_array($ret) && x($ret,'dfrn-request')) {
67                         if(strlen($a->path))
68                                 $myaddr = bin2hex($a->get_baseurl() . '/profile/' . $a->user['nickname']);
69                         else
70                                 $myaddr = bin2hex($a->user['nickname'] . '@' . $a->get_hostname());
71  
72                         goaway($ret['dfrn-request'] . "&addr=$myaddr");
73                 
74                         // NOTREACHED
75                 }
76         }
77
78         $network  = 'stat';
79         $priority = 0;
80
81         if($hcard) {
82                 $vcard = scrape_vcard($hcard);
83
84                 // Google doesn't use absolute url in profile photos
85
86                 if((x($vcard,'photo')) && substr($vcard['photo'],0,1) == '/') {
87                         $h = parse_url($hcard);
88                         if($h)
89                                 $vcard['photo'] = $h['scheme'] . '://' . $h['host'] . $vcard['photo'];
90                 }
91         }
92
93         if(! $profile)
94                 $profile = $url;
95
96
97         if(! x($vcard,'fn'))
98                 if(x($vcard,'nick'))
99                         $vcard['fn'] = $vcard['nick'];
100
101         if((! isset($vcard)) && (! $poll)) {
102
103                 $ret = scrape_feed($url);
104
105                 if(count($ret) && ($ret['feed_atom'] || $ret['feed_rss'])) {
106                         $poll = ((x($ret,'feed_atom')) ? unamp($ret['feed_atom']) : unamp($ret['feed_rss']));
107                         $vcard = array();
108                         require_once('simplepie/simplepie.inc');
109                     $feed = new SimplePie();
110                         $xml = fetch_url($poll);
111
112                 $feed->set_raw_data($xml);
113
114                     $feed->init();
115
116                         $vcard['photo'] = $feed->get_image_url();
117                         $author = $feed->get_author();
118                         if($author) {                   
119                                 $vcard['fn'] = unxmlify(trim($author->get_name()));
120                                 $vcard['nick'] = strtolower(notags(unxmlify($vcard['fn'])));
121                                 if(strpos($vcard['nick'],' '))
122                                         $vcard['nick'] = trim(substr($vcard['nick'],0,strpos($vcard['nick'],' ')));
123                                 $email = unxmlify($author->get_email());
124                         }
125                         else {
126                                 $item = $feed->get_item(0);
127                                 if($item) {
128                                         $author = $item->get_author();
129                                         if($author) {                   
130                                                 $vcard['fn'] = trim(unxmlify($author->get_name()));
131                                                 if(! $vcard['fn'])
132                                                         $vcard['fn'] = trim(unxmlify($author->get_email()));
133                                                 if(strpos($vcard['fn'],'@') !== false)
134                                                         $vcard['fn'] = substr($vcard['fn'],0,strpos($vcard['fn'],'@'));
135                                                 $vcard['nick'] = strtolower(unxmlify($vcard['fn']));
136                                                 if(strpos($vcard['nick'],' '))
137                                                         $vcard['nick'] = trim(substr($vcard['nick'],0,strpos($vcard['nick'],' ')));
138                                                 $email = unxmlify($author->get_email());
139                                         }
140                                         if(! $vcard['photo']) {
141                                                 $rawmedia = $item->get_item_tags('http://search.yahoo.com/mrss/','thumbnail');
142                                                 if($rawmedia && $rawmedia[0]['attribs']['']['url'])
143                                                         $vcard['photo'] = unxmlify($rawmedia[0]['attribs']['']['url']);
144                                         }
145                                 }
146                         }
147                         if((! $vcard['photo']) && strlen($email))
148                                 $vcard['photo'] = gravatar_img($email);
149                         
150                         $network = 'feed';
151                         $priority = 2;
152                 }
153         }
154
155         logger('follow: poll=' . $poll . ' notify=' . $notify . ' profile=' . $profile . ' vcard=' . print_r($vcard,true));
156
157         $vcard['fn'] = notags($vcard['fn']);
158         $vcard['nick'] = notags($vcard['nick']);
159
160         // do we have enough information?
161         
162         if(! ((x($vcard['fn'])) && ($poll) && ($profile))) {
163                 notice( t('The profile address specified does not provide adequate information.') . EOL);
164                 goaway($_SESSION['return_url']);
165         }
166
167
168         if(! $notify) {
169                 notice( t('Limited profile. This person will be unable to receive direct/personal notifications from you.') . EOL);
170         }
171
172         if(! x($vcard,'photo'))
173                 $vcard['photo'] = $a->get_baseurl() . '/images/default-profile.jpg' ; 
174
175         // check if we already have a contact
176         // the poll url is more reliable than the profile url, as we may have
177         // indirect links or webfinger links
178
179         $r = q("SELECT * FROM `contact` WHERE `uid` = %d AND `poll` = '%s' LIMIT 1",
180                 intval(local_user()),
181                 dbesc($poll)
182         );                      
183
184         if(count($r)) {
185                 // update contact
186                 if($r[0]['rel'] == REL_VIP) {
187                         q("UPDATE `contact` SET `rel` = %d , `readonly` = 0 WHERE `id` = %d AND `uid` = %d LIMIT 1",
188                                 intval(REL_BUD),
189                                 intval($r[0]['id']),
190                                 intval(local_user())
191                         );
192                 }
193         }
194         else {
195                 // create contact record 
196                 $r = q("INSERT INTO `contact` ( `uid`, `created`, `url`, `alias`, `notify`, `poll`, `name`, `nick`, `photo`, `network`, `rel`, `priority`,
197                         `blocked`, `readonly`, `pending` )
198                         VALUES ( %d, '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', %d, %d, 0, 0, 0 ) ",
199                         intval(local_user()),
200                         dbesc(datetime_convert()),
201                         dbesc($profile),
202                         dbesc($alias),
203                         dbesc($notify),
204                         dbesc($poll),
205                         dbesc($vcard['fn']),
206                         dbesc($vcard['nick']),
207                         dbesc($vcard['photo']),
208                         dbesc($network),
209                         intval(REL_FAN),
210                         intval($priority)
211                 );
212         }
213
214         $r = q("SELECT * FROM `contact` WHERE `url` = '%s' AND `uid` = %d LIMIT 1",
215                 dbesc($profile),
216                 intval(local_user())
217         );
218
219         if(! count($r)) {
220                 notice( t('Unable to retrieve contact information.') . EOL);
221                 goaway($_SESSION['return_url']);
222                 // NOTREACHED
223         }
224
225         $contact = $r[0];
226         $contact_id  = $r[0]['id'];
227
228         require_once("Photo.php");
229
230         $photos = import_profile_photo($vcard['photo'],local_user(),$contact_id);
231
232         $r = q("UPDATE `contact` SET `photo` = '%s', 
233                         `thumb` = '%s',
234                         `micro` = '%s', 
235                         `name-date` = '%s', 
236                         `uri-date` = '%s', 
237                         `avatar-date` = '%s'
238                         WHERE `id` = %d LIMIT 1
239                 ",
240                         dbesc($photos[0]),
241                         dbesc($photos[1]),
242                         dbesc($photos[2]),
243                         dbesc(datetime_convert()),
244                         dbesc(datetime_convert()),
245                         dbesc(datetime_convert()),
246                         intval($contact_id)
247                 );                      
248
249
250         // pull feed and consume it, which should subscribe to the hub.
251
252         $php_path = ((x($a->config,'php_path') && strlen($a->config['php_path'])) ? $a->config['php_path'] : 'php');
253         //proc_close(proc_open("\"$php_path\" \"include/poller.php\" \"$contact_id\" &", array(), $foo));
254         proc_run($php_path,"include/poller.php","$contact_id");
255
256         // create a follow slap
257
258         $tpl = load_view_file('view/follow_slap.tpl');
259         $slap = replace_macros($tpl, array(
260                 '$name' => $a->user['username'],
261                 '$profile_page' => $a->get_baseurl() . '/profile/' . $a->user['nickname'],
262                 '$photo' => $a->contact['photo'],
263                 '$thumb' => $a->contact['thumb'],
264                 '$published' => datetime_convert('UTC','UTC', 'now', ATOM_TIME),
265                 '$item_id' => 'urn:X-dfrn:' . $a->get_hostname() . ':follow:' . random_string(),
266                 '$title' => '',
267                 '$type' => 'text',
268                 '$content' => t('following'),
269                 '$nick' => $a->user['nickname'],
270                 '$verb' => ACTIVITY_FOLLOW,
271                 '$ostat_follow' => ''
272         ));
273
274         $r = q("SELECT `contact`.*, `user`.* FROM `contact` LEFT JOIN `user` ON `contact`.`uid` = `user`.`uid` 
275                         WHERE `user`.`uid` = %d AND `contact`.`self` = 1 LIMIT 1",
276                         intval(local_user())
277         );
278
279
280         if((count($r)) && (x($contact,'notify')) && (strlen($contact['notify']))) {
281                 require_once('include/salmon.php');
282                 slapper($r[0],$contact['notify'],$slap);
283         }
284
285         goaway($_SESSION['return_url']);
286         // NOTREACHED
287 }