]> git.mxchange.org Git - friendica.git/blob - mod/parse_url.php
Security issue: Encoding of GUID in itemcache to avoid directory bypassing with a...
[friendica.git] / mod / parse_url.php
1 <?php
2 /* To-Do
3 https://developers.google.com/+/plugins/snippet/
4
5 <meta itemprop="name" content="Toller Titel">
6 <meta itemprop="description" content="Eine tolle Beschreibung">
7 <meta itemprop="image" content="http://maple.libertreeproject.org/images/tree-icon.png">
8
9 <body itemscope itemtype="http://schema.org/Product">
10   <h1 itemprop="name">Shiny Trinket</h1>
11   <img itemprop="image" src="{image-url}" />
12   <p itemprop="description">Shiny trinkets are shiny.</p>
13 </body>
14 */
15
16 if(!function_exists('deletenode')) {
17         function deletenode(&$doc, $node)
18         {
19                 $xpath = new DomXPath($doc);
20                 $list = $xpath->query("//".$node);
21                 foreach ($list as $child)
22                         $child->parentNode->removeChild($child);
23         }
24 }
25
26 function completeurl($url, $scheme) {
27         $urlarr = parse_url($url);
28
29         if (isset($urlarr["scheme"]))
30                 return($url);
31
32         $schemearr = parse_url($scheme);
33
34         $complete = $schemearr["scheme"]."://".$schemearr["host"];
35
36         if (@$schemearr["port"] != "")
37                 $complete .= ":".$schemearr["port"];
38
39                 if(strpos($urlarr['path'],'/') !== 0)
40                         $complete .= '/';
41
42         $complete .= $urlarr["path"];
43
44         if (@$urlarr["query"] != "")
45                 $complete .= "?".$urlarr["query"];
46
47         if (@$urlarr["fragment"] != "")
48                 $complete .= "#".$urlarr["fragment"];
49
50         return($complete);
51 }
52
53 function parseurl_getsiteinfo($url, $no_guessing = false, $do_oembed = true, $count = 1) {
54
55         $a = get_app();
56
57         $siteinfo = array();
58
59         if ($count > 10) {
60                 logger("parseurl_getsiteinfo: Endless loop detected for ".$url, LOGGER_DEBUG);
61                 return($siteinfo);
62         }
63
64         $url = trim($url, "'");
65         $url = trim($url, '"');
66         $siteinfo["url"] = $url;
67         $siteinfo["type"] = "link";
68
69         $ch = curl_init();
70         curl_setopt($ch, CURLOPT_URL, $url);
71         curl_setopt($ch, CURLOPT_HEADER, 1);
72         curl_setopt($ch, CURLOPT_NOBODY, 0);
73         curl_setopt($ch, CURLOPT_TIMEOUT, 3);
74         curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
75         //curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
76         curl_setopt($ch, CURLOPT_USERAGENT, $a->get_useragent());
77
78         $header = curl_exec($ch);
79         $curl_info = @curl_getinfo($ch);
80         $http_code = $curl_info['http_code'];
81         curl_close($ch);
82
83         if ((($curl_info['http_code'] == "301") OR ($curl_info['http_code'] == "302") OR ($curl_info['http_code'] == "303") OR ($curl_info['http_code'] == "307"))
84                 AND (($curl_info['redirect_url'] != "") OR ($curl_info['location'] != ""))) {
85                 if ($curl_info['redirect_url'] != "")
86                         $siteinfo = parseurl_getsiteinfo($curl_info['redirect_url'], $no_guessing, $do_oembed, ++$count);
87                 else
88                         $siteinfo = parseurl_getsiteinfo($curl_info['location'], $no_guessing, $do_oembed, ++$count);
89                 return($siteinfo);
90         }
91
92         if ($do_oembed) {
93                 require_once("include/oembed.php");
94
95                 $oembed_data = oembed_fetch_url($url);
96
97                 if ($oembed_data->type != "error")
98                         $siteinfo["type"] = $oembed_data->type;
99         }
100
101         // Fetch the first mentioned charset. Can be in body or header
102         $charset = "";
103         if (preg_match('/charset=(.*?)['."'".'"\s\n]/', $header, $matches))
104                 $charset = trim(trim(trim(array_pop($matches)), ';,'));
105
106         if ($charset == "")
107                 $charset = "utf-8";
108
109         $pos = strpos($header, "\r\n\r\n");
110
111         if ($pos)
112                 $body = trim(substr($header, $pos));
113         else
114                 $body = $header;
115
116         if (($charset != '') AND (strtoupper($charset) != "UTF-8")) {
117                 logger("parseurl_getsiteinfo: detected charset ".$charset, LOGGER_DEBUG);
118                 //$body = mb_convert_encoding($body, "UTF-8", $charset);
119                 $body = iconv($charset, "UTF-8//TRANSLIT", $body);
120         }
121
122         $body = mb_convert_encoding($body, 'HTML-ENTITIES', "UTF-8");
123
124         $doc = new DOMDocument();
125         @$doc->loadHTML($body);
126
127         deletenode($doc, 'style');
128         deletenode($doc, 'script');
129         deletenode($doc, 'option');
130         deletenode($doc, 'h1');
131         deletenode($doc, 'h2');
132         deletenode($doc, 'h3');
133         deletenode($doc, 'h4');
134         deletenode($doc, 'h5');
135         deletenode($doc, 'h6');
136         deletenode($doc, 'ol');
137         deletenode($doc, 'ul');
138
139         $xpath = new DomXPath($doc);
140
141         $list = $xpath->query("//meta[@content]");
142         foreach ($list as $node) {
143                 $attr = array();
144                 if ($node->attributes->length)
145                         foreach ($node->attributes as $attribute)
146                                 $attr[$attribute->name] = $attribute->value;
147
148                 if (@$attr["http-equiv"] == 'refresh') {
149                         $path = $attr["content"];
150                         $pathinfo = explode(";", $path);
151                         $content = "";
152                         foreach ($pathinfo AS $value) {
153                                 if (substr(strtolower($value), 0, 4) == "url=")
154                                         $content = substr($value, 4);
155                         }
156                         if ($content != "") {
157                                 $siteinfo = parseurl_getsiteinfo($content, $no_guessing, $do_oembed, ++$count);
158                                 return($siteinfo);
159                         }
160                 }
161         }
162
163         //$list = $xpath->query("head/title");
164         $list = $xpath->query("//title");
165         foreach ($list as $node)
166                 $siteinfo["title"] =  html_entity_decode($node->nodeValue, ENT_QUOTES, "UTF-8");
167
168         //$list = $xpath->query("head/meta[@name]");
169         $list = $xpath->query("//meta[@name]");
170         foreach ($list as $node) {
171                 $attr = array();
172                 if ($node->attributes->length)
173                         foreach ($node->attributes as $attribute)
174                                 $attr[$attribute->name] = $attribute->value;
175
176                 $attr["content"] = trim(html_entity_decode($attr["content"], ENT_QUOTES, "UTF-8"));
177
178                 if ($attr["content"] != "")
179                         switch (strtolower($attr["name"])) {
180                                 case "fulltitle":
181                                         $siteinfo["title"] = $attr["content"];
182                                         break;
183                                 case "description":
184                                         $siteinfo["text"] = $attr["content"];
185                                         break;
186                                 case "twitter:image":
187                                         $siteinfo["image"] = $attr["content"];
188                                         break;
189                                 case "twitter:image:src":
190                                         $siteinfo["image"] = $attr["content"];
191                                         break;
192                                 case "twitter:card":
193                                         if (($siteinfo["type"] == "") OR ($attr["content"] == "photo"))
194                                                 $siteinfo["type"] = $attr["content"];
195                                         break;
196                                 case "twitter:description":
197                                         $siteinfo["text"] = $attr["content"];
198                                         break;
199                                 case "twitter:title":
200                                         $siteinfo["title"] = $attr["content"];
201                                         break;
202                                 case "dc.title":
203                                         $siteinfo["title"] = $attr["content"];
204                                         break;
205                                 case "dc.description":
206                                         $siteinfo["text"] = $attr["content"];
207                                         break;
208                         }
209                 if ($siteinfo["type"] == "summary")
210                         $siteinfo["type"] = "link";
211         }
212
213         //$list = $xpath->query("head/meta[@property]");
214         $list = $xpath->query("//meta[@property]");
215         foreach ($list as $node) {
216                 $attr = array();
217                 if ($node->attributes->length)
218                         foreach ($node->attributes as $attribute)
219                                 $attr[$attribute->name] = $attribute->value;
220
221                 $attr["content"] = trim(html_entity_decode($attr["content"], ENT_QUOTES, "UTF-8"));
222
223                 if ($attr["content"] != "")
224                         switch (strtolower($attr["property"])) {
225                                 case "og:image":
226                                         $siteinfo["image"] = $attr["content"];
227                                         break;
228                                 case "og:title":
229                                         $siteinfo["title"] = $attr["content"];
230                                         break;
231                                 case "og:description":
232                                         $siteinfo["text"] = $attr["content"];
233                                         break;
234                         }
235         }
236
237         if (isset($oembed_data) AND ($oembed_data->type == "link") AND ($siteinfo["type"] != "photo")) {
238                 if (isset($oembed_data->title) AND (trim($oembed_data->title) != ""))
239                         $siteinfo["title"] = $oembed_data->title;
240                 if (isset($oembed_data->description) AND (trim($oembed_data->description) != ""))
241                         $siteinfo["text"] = trim($oembed_data->description);
242                 if (isset($oembed_data->thumbnail_url) AND (trim($oembed_data->thumbnail_url) != ""))
243                         $siteinfo["image"] = $oembed_data->thumbnail_url;
244         }
245
246         if ((@$siteinfo["image"] == "") AND !$no_guessing) {
247             $list = $xpath->query("//img[@src]");
248             foreach ($list as $node) {
249                 $attr = array();
250                 if ($node->attributes->length)
251                     foreach ($node->attributes as $attribute)
252                         $attr[$attribute->name] = $attribute->value;
253
254                         $src = completeurl($attr["src"], $url);
255                         $photodata = @getimagesize($src);
256
257                         if (($photodata) && ($photodata[0] > 150) and ($photodata[1] > 150)) {
258                                 if ($photodata[0] > 300) {
259                                         $photodata[1] = round($photodata[1] * (300 / $photodata[0]));
260                                         $photodata[0] = 300;
261                                 }
262                                 if ($photodata[1] > 300) {
263                                         $photodata[0] = round($photodata[0] * (300 / $photodata[1]));
264                                         $photodata[1] = 300;
265                                 }
266                                 $siteinfo["images"][] = array("src"=>$src,
267                                                                 "width"=>$photodata[0],
268                                                                 "height"=>$photodata[1]);
269                         }
270
271                 }
272     } else {
273                 $src = completeurl($siteinfo["image"], $url);
274
275                 unset($siteinfo["image"]);
276
277                 $photodata = @getimagesize($src);
278
279                 if (($photodata) && ($photodata[0] > 10) and ($photodata[1] > 10))
280                         $siteinfo["images"][] = array("src"=>$src,
281                                                         "width"=>$photodata[0],
282                                                         "height"=>$photodata[1]);
283         }
284
285         if ((@$siteinfo["text"] == "") AND (@$siteinfo["title"] != "") AND !$no_guessing) {
286                 $text = "";
287
288                 $list = $xpath->query("//div[@class='article']");
289                 foreach ($list as $node)
290                         if (strlen($node->nodeValue) > 40)
291                                 $text .= " ".trim($node->nodeValue);
292
293                 if ($text == "") {
294                         $list = $xpath->query("//div[@class='content']");
295                         foreach ($list as $node)
296                                 if (strlen($node->nodeValue) > 40)
297                                         $text .= " ".trim($node->nodeValue);
298                 }
299
300                 // If none text was found then take the paragraph content
301                 if ($text == "") {
302                         $list = $xpath->query("//p");
303                         foreach ($list as $node)
304                                 if (strlen($node->nodeValue) > 40)
305                                         $text .= " ".trim($node->nodeValue);
306                 }
307
308                 if ($text != "") {
309                         $text = trim(str_replace(array("\n", "\r"), array(" ", " "), $text));
310
311                         while (strpos($text, "  "))
312                                 $text = trim(str_replace("  ", " ", $text));
313
314                         $siteinfo["text"] = trim(html_entity_decode(substr($text,0,350), ENT_QUOTES, "UTF-8").'...');
315                 }
316         }
317
318         logger("parseurl_getsiteinfo: Siteinfo for ".$url." ".print_r($siteinfo, true), LOGGER_DEBUG);
319
320         return($siteinfo);
321 }
322
323 function arr_add_hashes(&$item,$k) {
324         $item = '#' . $item;
325 }
326
327 function parse_url_content(&$a) {
328
329         $text = null;
330         $str_tags = '';
331
332         $textmode = false;
333
334         if(local_user() && (! feature_enabled(local_user(),'richtext')))
335                 $textmode = true;
336
337         //if($textmode)
338         $br = (($textmode) ? "\n" : '<br />');
339
340         if(x($_GET,'binurl'))
341                 $url = trim(hex2bin($_GET['binurl']));
342         else
343                 $url = trim($_GET['url']);
344
345         if($_GET['title'])
346                 $title = strip_tags(trim($_GET['title']));
347
348         if($_GET['description'])
349                 $text = strip_tags(trim($_GET['description']));
350
351         if($_GET['tags']) {
352                 $arr_tags = str_getcsv($_GET['tags']);
353                 if(count($arr_tags)) {
354                         array_walk($arr_tags,'arr_add_hashes');
355                         $str_tags = $br . implode(' ',$arr_tags) . $br;
356                 }
357         }
358
359         logger('parse_url: ' . $url);
360
361         if($textmode)
362                 $template = '[bookmark=%s]%s[/bookmark]%s';
363         else
364                 $template = "<a class=\"bookmark\" href=\"%s\" >%s</a>%s";
365
366         $arr = array('url' => $url, 'text' => '');
367
368         call_hooks('parse_link', $arr);
369
370         if(strlen($arr['text'])) {
371                 echo $arr['text'];
372                 killme();
373         }
374
375
376         if($url && $title && $text) {
377
378                 $title = str_replace(array("\r","\n"),array('',''),$title);
379
380                 if($textmode)
381                         $text = '[quote]' . trim($text) . '[/quote]' . $br;
382                 else {
383                         $text = '<blockquote>' . htmlspecialchars(trim($text)) . '</blockquote><br />';
384                         $title = htmlspecialchars($title);
385                 }
386
387                 $result = sprintf($template,$url,($title) ? $title : $url,$text) . $str_tags;
388
389                 logger('parse_url (unparsed): returns: ' . $result);
390
391                 echo $result;
392                 killme();
393         }
394
395         $siteinfo = parseurl_getsiteinfo($url);
396
397         $url= $siteinfo["url"];
398
399         $sitedata = "";
400
401         if($siteinfo["title"] == "") {
402                 $sitedata .= sprintf($template,$url,$url,'') . $str_tags;
403                 killme();
404         } else {
405                 $text = $siteinfo["text"];
406                 $title = $siteinfo["title"];
407         }
408
409         $image = "";
410
411         if (($siteinfo["type"] != "video") AND (sizeof($siteinfo["images"]) > 0)){
412                 /* Execute below code only if image is present in siteinfo */
413
414                 $total_images = 0;
415                 $max_images = get_config('system','max_bookmark_images');
416                 if($max_images === false)
417                         $max_images = 2;
418                 else
419                         $max_images = intval($max_images);
420
421                 foreach ($siteinfo["images"] as $imagedata) {
422                         if($textmode)
423                                 $image .= '[img='.$imagedata["width"].'x'.$imagedata["height"].']'.$imagedata["src"].'[/img]' . "\n";
424                         else
425                                 $image .= '<img height="'.$imagedata["height"].'" width="'.$imagedata["width"].'" src="'.$imagedata["src"].'" alt="photo" /><br />';
426                         $total_images ++;
427                         if($max_images && $max_images >= $total_images)
428                                 break;
429                 }
430         }
431
432         if(strlen($text)) {
433                 if($textmode)
434                         $text = '[quote]'.trim($text).'[/quote]';
435                 else
436                         $text = '<blockquote>'.htmlspecialchars(trim($text)).'</blockquote>';
437         }
438
439         if($image)
440                 $text = $br.$br.$image.$text;
441         else
442                 $text = $br.$text;
443
444         $title = str_replace(array("\r","\n"),array('',''),$title);
445
446         $result = sprintf($template,$url,($title) ? $title : $url,$text) . $str_tags;
447
448         logger('parse_url: returns: ' . $result);
449
450         $sitedata .=  trim($result);
451
452         if (($siteinfo["type"] == "video") AND ($url != ""))
453                 echo "[class=type-video]".$sitedata."[/class]";
454         elseif (($siteinfo["type"] != "photo"))
455                 echo "[class=type-link]".$sitedata."[/class]";
456         else
457                 echo "[class=type-photo]".$title.$br.$image."[/class]";
458
459         killme();
460 }
461 ?>