]> git.mxchange.org Git - friendica.git/blob - mod/item.php
"profile locator/address" is now called "Identity Address" to reduce confusion
[friendica.git] / mod / item.php
1 <?php
2
3 /**
4  *
5  * This is the POST destination for most all locally posted
6  * text stuff. This function handles status, wall-to-wall status, 
7  * local comments, and remote coments - that are posted on this site 
8  * (as opposed to being delivered in a feed).
9  * All of these become an "item" which is our basic unit of 
10  * information.
11  * Posts that originate externally or do not fall into the above 
12  * posting categories go through item_store() instead of this function. 
13  *
14  */  
15
16 function item_post(&$a) {
17
18         if((! local_user()) && (! remote_user()))
19                 return;
20
21         require_once('include/security.php');
22
23         $uid = local_user();
24
25         call_hooks('post_local_start', $_POST);
26
27         $parent = ((x($_POST,'parent')) ? intval($_POST['parent']) : 0);
28
29         $parent_item = null;
30         $parent_contact = null;
31
32         if($parent) {
33                 $r = q("SELECT * FROM `item` WHERE `id` = %d LIMIT 1",
34                         intval($parent)
35                 );
36                 if(! count($r)) {
37                         notice( t('Unable to locate original post.') . EOL);
38                         if(x($_POST,'return')) 
39                                 goaway($a->get_baseurl() . "/" . $_POST['return'] );
40                         killme();
41                 }
42                 $parent_item = $r[0];
43                 if($parent_item['contact-id'] && $uid) {
44                         $r = q("SELECT * FROM `contact` WHERE `id` = %d AND `uid` = %d LIMIT 1",
45                                 intval($parent_item['contact-id']),
46                                 intval($uid)
47                         );
48                         if(count($r))
49                                 $parent_contact = $r[0];
50                 }
51         }
52
53         $profile_uid = ((x($_POST,'profile_uid')) ? intval($_POST['profile_uid']) : 0);
54         $post_id     = ((x($_POST['post_id']))    ? intval($_POST['post_id'])     : 0);
55
56         if(! can_write_wall($a,$profile_uid)) {
57                 notice( t('Permission denied.') . EOL) ;
58                 if(x($_POST,'return')) 
59                         goaway($a->get_baseurl() . "/" . $_POST['return'] );
60                 killme();
61         }
62
63
64         // is this an edited post?
65
66         $orig_post = null;
67
68         if($post_id) {
69                 $i = q("SELECT * FROM `item` WHERE `uid` = %d AND `id` = %d LIMIT 1",
70                         intval($profile_uid),
71                         intval($post_id)
72                 );
73                 if(! count($i))
74                         killme();
75                 $orig_post = $i[0];
76         }
77
78         $user = null;
79
80         $r = q("SELECT * FROM `user` WHERE `uid` = %d LIMIT 1",
81                 intval($profile_uid)
82         );
83         if(count($r))
84                 $user = $r[0];
85         
86         if($orig_post) {
87                 $str_group_allow   = $orig_post['allow_gid'];
88                 $str_contact_allow = $orig_post['allow_cid'];
89                 $str_group_deny    = $orig_post['deny_gid'];
90                 $str_contact_deny  = $orig_post['deny_cid'];
91                 $title             = $orig_post['title'];
92                 $location          = $orig_post['location'];
93                 $coord             = $orig_post['coord'];
94                 $verb              = $orig_post['verb'];
95                 $emailcc           = $orig_post['emailcc'];
96
97                 $body              = escape_tags(trim($_POST['body']));
98                 $private           = $orig_post['private'];
99         }
100         else {
101                 $str_group_allow   = perms2str($_POST['group_allow']);
102                 $str_contact_allow = perms2str($_POST['contact_allow']);
103                 $str_group_deny    = perms2str($_POST['group_deny']);
104                 $str_contact_deny  = perms2str($_POST['contact_deny']);
105                 $title             = notags(trim($_POST['title']));
106                 $location          = notags(trim($_POST['location']));
107                 $coord             = notags(trim($_POST['coord']));
108                 $verb              = notags(trim($_POST['verb']));
109                 $emailcc           = notags(trim($_POST['emailcc']));
110
111                 $body              = escape_tags(trim($_POST['body']));
112                 $private = ((strlen($str_group_allow) || strlen($str_contact_allow) || strlen($str_group_deny) || strlen($str_contact_deny)) ? 1 : 0);
113
114                 if(($parent_item) && 
115                         (($parent_item['private']) 
116                                 || strlen($parent_item['allow_cid']) 
117                                 || strlen($parent_item['allow_gid']) 
118                                 || strlen($parent_item['deny_cid']) 
119                                 || strlen($parent_item['deny_gid'])
120                         )) {
121                         $private = 1;
122                 }
123         
124
125                 if(! strlen($body)) {
126                         notice( t('Empty post discarded.') . EOL );
127                         if(x($_POST,'return')) 
128                                 goaway($a->get_baseurl() . "/" . $_POST['return'] );
129                         killme();
130                 }
131         }
132
133         // get contact info for poster
134
135         $author = null;
136         $self   = false;
137
138         if(($_SESSION['uid']) && ($_SESSION['uid'] == $profile_uid)) {
139                 $self = true;
140                 $r = q("SELECT * FROM `contact` WHERE `uid` = %d AND `self` = 1 LIMIT 1",
141                         intval($_SESSION['uid'])
142                 );
143         }
144         else {
145                 if((x($_SESSION,'visitor_id')) && (intval($_SESSION['visitor_id']))) {
146                         $r = q("SELECT * FROM `contact` WHERE `id` = %d LIMIT 1",
147                                 intval($_SESSION['visitor_id'])
148                         );
149                 }
150         }
151
152         if(count($r)) {
153                 $author = $r[0];
154                 $contact_id = $author['id'];
155         }
156
157         // get contact info for owner
158         
159         if($profile_uid == $_SESSION['uid']) {
160                 $contact_record = $author;
161         }
162         else {
163                 $r = q("SELECT * FROM `contact` WHERE `uid` = %d AND `self` = 1 LIMIT 1",
164                         intval($profile_uid)
165                 );
166                 if(count($r))
167                         $contact_record = $r[0];
168         }
169
170         $post_type = notags(trim($_POST['type']));
171
172         if($post_type === 'net-comment') {
173                 if($parent_item !== null) {
174                         if($parent_item['type'] === 'remote') {
175                                 $post_type = 'remote-comment';
176                         } 
177                         else {          
178                                 $post_type = 'wall-comment';
179                         }
180                 }
181         }
182
183         /**
184          *
185          * When a photo was uploaded into the message using the (profile wall) ajax 
186          * uploader, The permissions are initially set to disallow anybody but the
187          * owner from seeing it. This is because the permissions may not yet have been
188          * set for the post. If it's private, the photo permissions should be set
189          * appropriately. But we didn't know the final permissions on the post until
190          * now. So now we'll look for links of uploaded messages that are in the
191          * post and set them to the same permissions as the post itself.
192          *
193          */
194
195         $match = null;
196
197         if(preg_match_all("/\[img\](.+?)\[\/img\]/",$body,$match)) {
198                 $images = $match[1];
199                 if(count($images)) {
200                         foreach($images as $image) {
201                                 if(! stristr($image,$a->get_baseurl() . '/photo/'))
202                                         continue;
203                                 $image_uri = substr($image,strrpos($image,'/') + 1);
204                                 $image_uri = substr($image_uri,0, strpos($image_uri,'-'));
205                                 $r = q("UPDATE `photo` SET `allow_cid` = '%s', `allow_gid` = '%s', `deny_cid` = '%s', `deny_gid` = '%s'
206                                         WHERE `resource-id` = '%s' AND `album` = '%s' ",
207                                         dbesc($str_contact_allow),
208                                         dbesc($str_group_allow),
209                                         dbesc($str_contact_deny),
210                                         dbesc($str_group_deny),
211                                         dbesc($image_uri),
212                                         dbesc( t('Wall Photos'))
213                                 );
214  
215                         }
216                 }
217         }
218
219         /**
220          * Fold multi-line [code] sequences
221          */
222
223         $body = preg_replace('/\[\/code\]\s*\[code\]/m',"\n",$body); 
224
225         /**
226          * Look for any tags and linkify them
227          */
228
229         $str_tags = '';
230         $inform   = '';
231
232
233         $tags = get_tags($body);
234
235         if(($parent_contact) && ($parent_contact['network'] === 'stat') && ($parent_contact['nick']) && (! in_array('@' . $parent_contact['nick'],$tags))) {
236                 $body = '@' . $parent_contact['nick'] . ' ' . $body;
237                 $tags[] = '@' . $parent_contact['nick'];
238         }               
239
240         if(count($tags)) {
241                 foreach($tags as $tag) {
242                         if(strpos($tag,'#') === 0) {
243                                 if(strpos($tag,'[url='))
244                                         continue;
245                                 $basetag = str_replace('_',' ',substr($tag,1));
246                                 $body = str_replace($tag,'#[url=' . $a->get_baseurl() . '/search?search=' . rawurlencode($basetag) . ']' . $basetag . '[/url]',$body);
247                                 if(strlen($str_tags))
248                                         $str_tags .= ',';
249                                 $str_tags .= '#[url=' . $a->get_baseurl() . '/search?search=' . rawurlencode($basetag) . ']' . $basetag . '[/url]';
250                                 continue;
251                         }
252                         if(strpos($tag,'@') === 0) {
253                                 if(strpos($tag,'[url='))
254                                         continue;
255                                 $stat = false;
256                                 $name = substr($tag,1);
257                                 if((strpos($name,'@')) || (strpos($name,'http://'))) {
258                                         $newname = $name;
259                                         $links = @lrdd($name);
260                                         if(count($links)) {
261                                                 foreach($links as $link) {
262                                                         if($link['@attributes']['rel'] === 'http://webfinger.net/rel/profile-page')
263                                         $profile = $link['@attributes']['href'];
264                                                         if($link['@attributes']['rel'] === 'salmon') {
265                                                                 if(strlen($inform))
266                                                                         $inform .= ',';
267                                         $inform .= 'url:' . str_replace(',','%2c',$link['@attributes']['href']);
268                                                         }
269                                                 }
270                                         }
271                                 }
272                                 else {
273                                         $newname = $name;
274                                         $alias = '';
275                                         if(strstr($name,'_')) {
276                                                 $newname = str_replace('_',' ',$name);
277                                                 $r = q("SELECT * FROM `contact` WHERE `name` = '%s' AND `uid` = %d LIMIT 1",
278                                                         dbesc($newname),
279                                                         intval($profile_uid)
280                                                 );
281                                         }
282                                         else {
283                                                 $r = q("SELECT * FROM `contact` WHERE `nick` = '%s' AND `uid` = %d LIMIT 1",
284                                                         dbesc($name),
285                                                         intval($profile_uid)
286                                                 );
287                                         }
288                                         if(count($r)) {
289                                                 $profile = $r[0]['url'];
290                                                 if($r[0]['network'] === 'stat') {
291                                                         $newname = $r[0]['nick'];
292                                                         $stat = true;
293                                                         if($r[0]['alias'])
294                                                                 $alias = $r[0]['alias'];
295                                                 }
296                                                 else
297                                                         $newname = $r[0]['name'];
298                                                 if(strlen($inform))
299                                                         $inform .= ',';
300                                                 $inform .= 'cid:' . $r[0]['id'];
301                                         }
302                                 }
303                                 if($profile) {
304                                         $body = str_replace('@' . $name, '@' . '[url=' . $profile . ']' . $newname      . '[/url]', $body);
305                                         $profile = str_replace(',','%2c',$profile);
306                                         if(strlen($str_tags))
307                                                 $str_tags .= ',';
308                                         $str_tags .= '@[url=' . $profile . ']' . $newname       . '[/url]';
309
310                                         // Status.Net seems to require the numeric ID URL in a mention if the person isn't 
311                                         // subscribed to you. But the nickname URL is OK if they are. Grrr. We'll tag both. 
312
313                                         if(strlen($alias)) {
314                                                 if(strlen($str_tags))
315                                                         $str_tags .= ',';
316                                                 $str_tags .= '@[url=' . $alias . ']' . $newname . '[/url]';
317                                         }
318                                 }
319                         }
320                 }
321         }
322
323         $wall = 0;
324
325         if($post_type === 'wall' || $post_type === 'wall-comment')
326                 $wall = 1;
327
328         if(! strlen($verb))
329                 $verb = ACTIVITY_POST ;
330
331         $gravity = (($parent) ? 6 : 0 );
332  
333         $notify_type = (($parent) ? 'comment-new' : 'wall-new' );
334
335         $uri = item_new_uri($a->get_hostname(),$profile_uid);
336
337         $datarray = array();
338         $datarray['uid']           = $profile_uid;
339         $datarray['type']          = $post_type;
340         $datarray['wall']          = $wall;
341         $datarray['gravity']       = $gravity;
342         $datarray['contact-id']    = $contact_id;
343         $datarray['owner-name']    = $contact_record['name'];
344         $datarray['owner-link']    = $contact_record['url'];
345         $datarray['owner-avatar']  = $contact_record['thumb'];
346         $datarray['author-name']   = $author['name'];
347         $datarray['author-link']   = $author['url'];
348         $datarray['author-avatar'] = $author['thumb'];
349         $datarray['created']       = datetime_convert();
350         $datarray['edited']        = datetime_convert();
351         $datarray['changed']       = datetime_convert();
352         $datarray['uri']           = $uri;
353         $datarray['title']         = $title;
354         $datarray['body']          = $body;
355         $datarray['location']      = $location;
356         $datarray['coord']         = $coord;
357         $datarray['tag']           = $str_tags;
358         $datarray['inform']        = $inform;
359         $datarray['verb']          = $verb;
360         $datarray['allow_cid']     = $str_contact_allow;
361         $datarray['allow_gid']     = $str_group_allow;
362         $datarray['deny_cid']      = $str_contact_deny;
363         $datarray['deny_gid']      = $str_group_deny;
364         $datarray['private']       = $private;
365
366         /**
367          * These fields are for the convenience of plugins...
368          * 'self' if true indicates the owner is posting on their own wall
369          * If parent is 0 it is a top-level post.
370          */
371
372         $datarray['parent']        = $parent;
373         $datarray['self']          = $self;
374
375         if($orig_post)
376                 $datarray['edit']      = true;
377
378         call_hooks('post_local',$datarray);
379
380
381         if($orig_post) {
382                 $r = q("UPDATE `item` SET `body` = '%s', `edited` = '%s' WHERE `id` = %d AND `uid` = %d LIMIT 1",
383                         dbesc($body),
384                         dbesc(datetime_convert()),
385                         intval($post_id),
386                         intval($profile_uid)
387                 );
388
389                 proc_run('php', "include/notifier.php", 'edit_post', "$post_id");
390                 if((x($_POST,'return')) && strlen($_POST['return'])) {
391                         logger('return: ' . $_POST['return']);
392                         goaway($a->get_baseurl() . "/" . $_POST['return'] );
393                 }
394                 killme();
395         }
396         else
397                 $post_id = 0;
398
399
400         $r = q("INSERT INTO `item` (`uid`,`type`,`wall`,`gravity`,`contact-id`,`owner-name`,`owner-link`,`owner-avatar`, 
401                 `author-name`, `author-link`, `author-avatar`, `created`, `edited`, `changed`, `uri`, `title`, `body`, `location`, `coord`, 
402                 `tag`, `inform`, `verb`, `allow_cid`, `allow_gid`, `deny_cid`, `deny_gid`, `private` )
403                 VALUES( %d, '%s', %d, %d, %d, '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', %d )",
404                 intval($datarray['uid']),
405                 dbesc($datarray['type']),
406                 intval($datarray['wall']),
407                 intval($datarray['gravity']),
408                 intval($datarray['contact-id']),
409                 dbesc($datarray['owner-name']),
410                 dbesc($datarray['owner-link']),
411                 dbesc($datarray['owner-avatar']),
412                 dbesc($datarray['author-name']),
413                 dbesc($datarray['author-link']),
414                 dbesc($datarray['author-avatar']),
415                 dbesc($datarray['created']),
416                 dbesc($datarray['edited']),
417                 dbesc($datarray['changed']),
418                 dbesc($datarray['uri']),
419                 dbesc($datarray['title']),
420                 dbesc($datarray['body']),
421                 dbesc($datarray['location']),
422                 dbesc($datarray['coord']),
423                 dbesc($datarray['tag']),
424                 dbesc($datarray['inform']),
425                 dbesc($datarray['verb']),
426                 dbesc($datarray['allow_cid']),
427                 dbesc($datarray['allow_gid']),
428                 dbesc($datarray['deny_cid']),
429                 dbesc($datarray['deny_gid']),
430                 intval($datarray['private'])
431         );
432
433         $r = q("SELECT `id` FROM `item` WHERE `uri` = '%s' LIMIT 1",
434                 dbesc($datarray['uri']));
435         if(count($r)) {
436                 $post_id = $r[0]['id'];
437                 logger('mod_item: saved item ' . $post_id);
438
439                 if($parent) {
440
441                         // This item is the last leaf and gets the comment box, clear any ancestors
442                         $r = q("UPDATE `item` SET `last-child` = 0, `changed` = '%s' WHERE `parent` = %d ",
443                                 dbesc(datetime_convert()),
444                                 intval($parent)
445                         );
446
447                         // Inherit ACL's from the parent item.
448
449                         $r = q("UPDATE `item` SET `allow_cid` = '%s', `allow_gid` = '%s', `deny_cid` = '%s', `deny_gid` = '%s', `private` = %d
450                                 WHERE `id` = %d LIMIT 1",
451                                 dbesc($parent_item['allow_cid']),
452                                 dbesc($parent_item['allow_gid']),
453                                 dbesc($parent_item['deny_cid']),
454                                 dbesc($parent_item['deny_gid']),
455                                 intval($parent_item['private']),
456                                 intval($post_id)
457                         );
458
459                         // Send a notification email to the conversation owner, unless the owner is me and I wrote this item
460                         if(($user['notify-flags'] & NOTIFY_COMMENT) && ($contact_record != $author)) {
461                                 require_once('bbcode.php');
462                                 $from = $author['name'];
463                                 $tpl = load_view_file('view/cmnt_received_eml.tpl');                    
464                                 $email_tpl = replace_macros($tpl, array(
465                                         '$sitename' => $a->config['sitename'],
466                                         '$siteurl' =>  $a->get_baseurl(),
467                                         '$username' => $user['username'],
468                                         '$email' => $user['email'],
469                                         '$from' => $from,
470                                         '$display' => $a->get_baseurl() . '/display/' . $user['nickname'] . '/' . $post_id,
471                                         '$body' => strip_tags(bbcode($datarray['body']))
472                                 ));
473
474                                 $res = mail($user['email'], sprintf( t("%s commented on your item at %s") ,$from,$a->config['sitename']),
475                                         $email_tpl,
476                                         'From: ' . t('Administrator') . '@' . $_SERVER['SERVER_NAME'] . "\n"
477                                         . 'Content-type: text/plain; charset=UTF-8' . "\n"
478                                         . 'Content-transfer-encoding: 8bit' );
479                         }
480                 }
481                 else {
482                         $parent = $post_id;
483
484                         // let me know if somebody did a wall-to-wall post on my profile
485
486                         if(($user['notify-flags'] & NOTIFY_WALL) && ($contact_record != $author)) {
487                                 require_once('bbcode.php');
488                                 $from = $author['name'];
489                                 $tpl = load_view_file('view/wall_received_eml.tpl');                    
490                                 $email_tpl = replace_macros($tpl, array(
491                                         '$sitename' => $a->config['sitename'],
492                                         '$siteurl' =>  $a->get_baseurl(),
493                                         '$username' => $user['username'],
494                                         '$email' => $user['email'],
495                                         '$from' => $from,
496                                         '$display' => $a->get_baseurl() . '/display/' . $user['nickname'] . '/' . $post_id,
497                                         '$body' => strip_tags(bbcode($datarray['body']))
498                                 ));
499
500                                 $res = mail($user['email'], sprintf( t("%s posted on your profile wall at %s") ,$from, $a->config['sitename']),
501                                         $email_tpl,
502                                         'From: ' . t('Administrator') . '@' . $_SERVER['SERVER_NAME'] . "\n"
503                                         . 'Content-type: text/plain; charset=UTF-8' . "\n"
504                                         . 'Content-transfer-encoding: 8bit' );
505
506                         }
507                 }
508
509                 $r = q("UPDATE `item` SET `parent` = %d, `parent-uri` = '%s', `plink` = '%s', `changed` = '%s', `last-child` = 1, `visible` = 1
510                         WHERE `id` = %d LIMIT 1",
511                         intval($parent),
512                         dbesc(($parent == $post_id) ? $uri : $parent_item['uri']),
513                         dbesc($a->get_baseurl() . '/display/' . $user['nickname'] . '/' . $post_id),
514                         dbesc(datetime_convert()),
515                         intval($post_id)
516                 );
517
518                 // photo comments turn the corresponding item visible to the profile wall
519                 // This way we don't see every picture in your new photo album posted to your wall at once.
520                 // They will show up as people comment on them.
521
522                 if(! $parent_item['visible']) {
523                         $r = q("UPDATE `item` SET `visible` = 1 WHERE `id` = %d LIMIT 1",
524                                 intval($parent_item['id'])
525                         );
526                 }
527         }
528         else {
529                 logger('mod_item: unable to retrieve post that was just stored.');
530                 notify( t('System error. Post not saved.'));
531                 goaway($a->get_baseurl() . "/" . $_POST['return'] );
532                 // NOTREACHED
533         }
534
535         proc_run('php', "include/notifier.php", $notify_type, "$post_id");
536
537         $datarray['id'] = $post_id;
538
539         call_hooks('post_local_end', $datarray);
540
541         if(strlen($emailcc) && $profile_uid == local_user()) {
542                 $erecips = explode(',', $emailcc);
543                 if(count($erecips)) {
544                         foreach($erecips as $recip) {
545                                 $addr = trim($recip);
546                                 if(! strlen($addr))
547                                         continue;
548                                 $disclaimer = '<hr />' . sprintf(t('This message was sent to you by %s, a member of the Friendika social network.'),$a->user['username']) 
549                                         . '<br />';
550                                 $disclaimer .= t('You may visit them online at') . ' ' 
551                                         . $a->get_baseurl() . '/profile/' . $a->user['nickname'] . '<br />';
552                                 $disclaimer .= t('Please contact the sender by replying to this post if you do not wish to receive these messages.') . '<br />'; 
553
554                                 $subject  = '[Friendika]' . ' ' . sprintf( t('%s posted an update.'),$a->user['username']);
555                                 $headers  = 'From: ' . $a->user['username'] . ' <' . $a->user['email'] . '>' . "\n";
556                                 $headers .= 'MIME-Version: 1.0' . "\n";
557                                 $headers .= 'Content-Type: text/html; charset=UTF-8' . "\n";
558                                 $headers .= 'Content-Transfer-Encoding: 8bit' . "\n\n";
559                                 $link = '<a href="' . $a->get_baseurl() . '/profile/' . $a->user['nickname'] . '"><img src="' . $author['thumb'] . '" alt="' . $a->user['username'] . '" /></a><br /><br />';
560                                 $html    = prepare_body($datarray);
561                                 $message = '<html><body>' . $link . $html . $disclaimer . '</body></html>';
562                                 @mail($addr, $subject, $message, $headers);
563                         }
564                 }
565         }
566
567         logger('post_complete');
568         if((x($_POST,'return')) && strlen($_POST['return'])) {
569                 logger('return: ' . $_POST['return']);
570                 goaway($a->get_baseurl() . "/" . $_POST['return'] );
571         }
572         $json = array('success' => 1);
573         if(x($_POST,'jsreload') && strlen($_POST['jsreload']))
574                 $json['reload'] = $a->get_baseurl() . '/' . $_POST['jsreload'];
575
576         logger('post_json: ' . print_r($json,true), LOGGER_DEBUG);
577
578         echo json_encode($json);
579         killme();
580         // NOTREACHED
581 }
582
583
584
585
586
587 function item_content(&$a) {
588
589         if((! local_user()) && (! remote_user()))
590                 return;
591
592         require_once('include/security.php');
593
594         $uid = local_user();
595
596         if(($a->argc == 3) && ($a->argv[1] === 'drop') && intval($a->argv[2])) {
597
598                 // locate item to be deleted
599
600                 $r = q("SELECT * FROM `item` WHERE `id` = %d LIMIT 1",
601                         intval($a->argv[2])
602                 );
603
604                 if(! count($r)) {
605                         notice( t('Item not found.') . EOL);
606                         goaway($a->get_baseurl() . '/' . $_SESSION['return_url']);
607                 }
608                 $item = $r[0];
609
610                 // check if logged in user is either the author or owner of this item
611
612                 if(($_SESSION['visitor_id'] == $item['contact-id']) || ($_SESSION['uid'] == $item['uid'])) {
613
614                         // delete the item
615
616                         $r = q("UPDATE `item` SET `deleted` = 1, `body` = '', `edited` = '%s', `changed` = '%s' WHERE `id` = %d LIMIT 1",
617                                 dbesc(datetime_convert()),
618                                 dbesc(datetime_convert()),
619                                 intval($item['id'])
620                         );
621
622                         // If item is a link to a photo resource, nuke all the associated photos 
623                         // (visitors will not have photo resources)
624                         // This only applies to photos uploaded from the photos page. Photos inserted into a post do not
625                         // generate a resource-id and therefore aren't intimately linked to the item. 
626
627                         if(strlen($item['resource-id'])) {
628                                 q("DELETE FROM `photo` WHERE `resource-id` = '%s' AND `uid` = %d ",
629                                         dbesc($item['resource-id']),
630                                         intval($item['uid'])
631                                 );
632                                 // ignore the result
633                         }
634
635                         // If it's the parent of a comment thread, kill all the kids
636
637                         if($item['uri'] == $item['parent-uri']) {
638                                 $r = q("UPDATE `item` SET `deleted` = 1, `edited` = '%s', `changed` = '%s', `body` = '' 
639                                         WHERE `parent-uri` = '%s' AND `uid` = %d ",
640                                         dbesc(datetime_convert()),
641                                         dbesc(datetime_convert()),
642                                         dbesc($item['parent-uri']),
643                                         intval($item['uid'])
644                                 );
645                                 // ignore the result
646                         }
647                         else {
648                                 // ensure that last-child is set in case the comment that had it just got wiped.
649                                 q("UPDATE `item` SET `last-child` = 0, `changed` = '%s' WHERE `parent-uri` = '%s' AND `uid` = %d ",
650                                         dbesc(datetime_convert()),
651                                         dbesc($item['parent-uri']),
652                                         intval($item['uid'])
653                                 );
654                                 // who is the last child now? 
655                                 $r = q("SELECT `id` FROM `item` WHERE `parent-uri` = '%s' AND `type` != 'activity' AND `deleted` = 0 AND `uid` = %d ORDER BY `edited` DESC LIMIT 1",
656                                         dbesc($item['parent-uri']),
657                                         intval($item['uid'])
658                                 );
659                                 if(count($r)) {
660                                         q("UPDATE `item` SET `last-child` = 1 WHERE `id` = %d LIMIT 1",
661                                                 intval($r[0]['id'])
662                                         );
663                                 }       
664                         }
665                         $drop_id = intval($item['id']);
666                         
667                         // send the notification upstream/downstream as the case may be
668
669                         proc_run('php',"include/notifier.php","drop","$drop_id");
670
671                         goaway($a->get_baseurl() . '/' . $_SESSION['return_url']);
672                         //NOTREACHED
673                 }
674                 else {
675                         notice( t('Permission denied.') . EOL);
676                         goaway($a->get_baseurl() . '/' . $_SESSION['return_url']);
677                         //NOTREACHED
678                 }
679         }
680 }