mod/photo.php

   1 <?php
   2
   3 require_once('include/security.php');
   4
   5 function photo_init(&$a) {
   6
   7         switch($a->argc) {
   8                 case 3:
   9                         $person = $a->argv[2];
  10                         $type = $a->argv[1];
  11                         break;
  12                 case 2:
  13                         $photo = $a->argv[1];
  14                         break;
  15                 case 1:
  16                 default:
  17                         killme();
  18                         // NOTREACHED
  19         }
  20
  21         $default = 'images/default-profile.jpg';
  22
  23         if(isset($type)) {
  24
  25                 /**
  26                  * Profile photos
  27                  */
  28
  29                 switch($type) {
  30
  31                         case 'profile':
  32                                 $resolution = 4;
  33                                 break;
  34                         case 'micro':
  35                                 $resolution = 6;
  36                                 $default = 'images/default-profile-mm.jpg';
  37                                 break;
  38                         case 'avatar':
  39                         default:
  40                                 $resolution = 5;
  41                                 $default = 'images/default-profile-sm.jpg';
  42                                 break;
  43                 }
  44
  45                 $uid = str_replace('.jpg', '', $person);
  46
  47                 $r = q("SELECT * FROM `photo` WHERE `scale` = %d AND `uid` = %d AND `profile` = 1 LIMIT 1",
  48                         intval($resolution),
  49                         intval($uid)
  50                 );
  51                 if(count($r)) {
  52                         $data = $r[0]['data'];
  53                 }
  54                 if(! isset($data)) {
  55                         $data = file_get_contents($default);
  56                 }
  57         }
  58         else {
  59
  60                 /**
  61                  * Other photos
  62                  */
  63
  64                 $resolution = 0;
  65                 $photo = str_replace('.jpg','',$photo);
  66
  67                 if(substr($photo,-2,1) == '-') {
  68                         $resolution = intval(substr($photo,-1,1));
  69                         $photo = substr($photo,0,-2);
  70                 }
  71
  72                 $r = q("SELECT `uid` FROM `photo` WHERE `resource-id` = '%s' AND `scale` = %d LIMIT 1",
  73                         dbesc($photo),
  74                         intval($resolution)
  75                 );
  76                 if(count($r)) {
  77
  78                         $sql_extra = permissions_sql($r[0]['uid']);
  79
  80                         // Now we'll see if we can access the photo
  81
  82                         $r = q("SELECT * FROM `photo` WHERE `resource-id` = '%s' AND `scale` = %d $sql_extra LIMIT 1",
  83                                 dbesc($photo),
  84                                 intval($resolution)
  85                         );
  86
  87                         if(count($r)) {
  88                                 $data = $r[0]['data'];
  89                         }
  90                         else {
  91
  92                                 // Does the picture exist? It may be a remote person with no credentials,
  93                                 // but who should otherwise be able to view it. Show a default image to let
  94                                 // them know permissions was denied. It may be possible to view the image
  95                                 // through an authenticated profile visit.
  96                                 // There won't be many completely unauthorised people seeing this because
  97                                 // they won't have the photo link, so there's a reasonable chance that the person
  98                                 // might be able to obtain permission to view it.
  99
 100                                 $r = q("SELECT * FROM `photo` WHERE `resource-id` = '%s' AND `scale` = %d LIMIT 1",
 101                                         dbesc($photo),
 102                                         intval($resolution)
 103                                 );
 104                                 if(count($r)) {
 105                                         $data = file_get_contents('images/nosign.jpg');
 106                                 }
 107                         }
 108                 }
 109         }
 110
 111         if(! isset($data)) {
 112                 killme();
 113                 // NOTREACHED
 114         }
 115
 116         header("Content-type: image/jpeg");
 117         echo $data;
 118         killme();
 119         // NOTREACHED
 120 }