]> git.mxchange.org Git - friendica.git/blob - src/Module/Settings/UserExport.php
Merge pull request #10113 from MrPetovan/bug/10110-userexport-security
[friendica.git] / src / Module / Settings / UserExport.php
1 <?php
2 /**
3  * @copyright Copyright (C) 2010-2021, the Friendica project
4  *
5  * @license   GNU AGPL version 3 or any later version
6  *
7  * This program is free software: you can redistribute it and/or modify
8  * it under the terms of the GNU Affero General Public License as
9  * published by the Free Software Foundation, either version 3 of the
10  * License, or (at your option) any later version.
11  *
12  * This program is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15  * GNU Affero General Public License for more details.
16  *
17  * You should have received a copy of the GNU Affero General Public License
18  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
19  *
20  */
21
22 namespace Friendica\Module\Settings;
23
24 use Friendica\App;
25 use Friendica\Core\Hook;
26 use Friendica\Core\Renderer;
27 use Friendica\Database\DBA;
28 use Friendica\Database\DBStructure;
29 use Friendica\DI;
30 use Friendica\Model\Item;
31 use Friendica\Model\Post;
32 use Friendica\Module\BaseSettings;
33 use Friendica\Network\HTTPException;
34
35 /**
36  * Module to export user data
37  **/
38 class UserExport extends BaseSettings
39 {
40         /**
41          * Handle the request to export data.
42          * At the moment one can export three different data set
43          * 1. The profile data that can be used by uimport to resettle
44          *    to a different Friendica instance
45          * 2. The entire data-set, profile plus postings
46          * 3. A list of contacts as CSV file similar to the export of Mastodon
47          *
48          * If there is an action required through the URL / path, react
49          * accordingly and export the requested data.
50          *
51          * @param array $parameters Router-supplied parameters
52          * @return string
53          * @throws HTTPException\ForbiddenException
54          * @throws HTTPException\InternalServerErrorException
55          */
56         public static function content(array $parameters = [])
57         {
58                 if (!local_user()) {
59                         throw new HTTPException\ForbiddenException(DI::l10n()->t('Permission denied.'));
60                 }
61
62                 parent::content($parameters);
63
64                 /**
65                  * options shown on "Export personal data" page
66                  * list of array( 'link url', 'link text', 'help text' )
67                  */
68                 $options = [
69                         ['settings/userexport/account', DI::l10n()->t('Export account'), DI::l10n()->t('Export your account info and contacts. Use this to make a backup of your account and/or to move it to another server.')],
70                         ['settings/userexport/backup', DI::l10n()->t('Export all'), DI::l10n()->t("Export your account info, contacts and all your items as json. Could be a very big file, and could take a lot of time. Use this to make a full backup of your account \x28photos are not exported\x29")],
71                         ['settings/userexport/contact', DI::l10n()->t('Export Contacts to CSV'), DI::l10n()->t("Export the list of the accounts you are following as CSV file. Compatible to e.g. Mastodon.")],
72                 ];
73                 Hook::callAll('uexport_options', $options);
74
75                 $tpl = Renderer::getMarkupTemplate("settings/userexport.tpl");
76                 return Renderer::replaceMacros($tpl, [
77                         '$title' => DI::l10n()->t('Export personal data'),
78                         '$options' => $options
79                 ]);
80         }
81
82         /**
83          * raw content generated for the different choices made
84          * by the user. At the moment this returns a JSON file
85          * to the browser which then offers a save / open dialog
86          * to the user.
87          *
88          * @param array $parameters Router-supplied parameters
89          * @throws HTTPException\ForbiddenException
90          */
91         public static function rawContent(array $parameters = [])
92         {
93                 if (!local_user() || !empty(DI::app()->user['uid']) && DI::app()->user['uid'] != local_user()) {
94                         throw new HTTPException\ForbiddenException(DI::l10n()->t('Permission denied.'));
95                 }
96
97                 $args = DI::args();
98                 if ($args->getArgc() == 3) {
99                         // @TODO Replace with router-provided arguments
100                         $action = $args->get(2);
101                         $user = DI::app()->user;
102                         switch ($action) {
103                                 case "backup":
104                                         header("Content-type: application/json");
105                                         header('Content-Disposition: attachment; filename="' . $user['nickname'] . '.' . $action . '"');
106                                         self::exportAll(local_user());
107                                         break;
108                                 case "account":
109                                         header("Content-type: application/json");
110                                         header('Content-Disposition: attachment; filename="' . $user['nickname'] . '.' . $action . '"');
111                                         self::exportAccount(local_user());
112                                         break;
113                                 case "contact":
114                                         header("Content-type: application/csv");
115                                         header('Content-Disposition: attachment; filename="' . $user['nickname'] . '-contacts.csv' . '"');
116                                         self::exportContactsAsCSV(local_user());
117                                         break;
118                         }
119
120                         exit();
121                 }
122         }
123
124         /**
125          * @param string $query
126          * @return array
127          * @throws \Exception
128          */
129         private static function exportMultiRow(string $query)
130         {
131                 $dbStructure = DBStructure::definition(DI::app()->getBasePath(), false);
132
133                 preg_match("/\s+from\s+`?([a-z\d_]+)`?/i", $query, $match);
134                 $table = $match[1];
135
136                 $result = [];
137                 $rows = DBA::p($query);
138                 while ($row = DBA::fetch($rows)) {
139                         $p = [];
140                         foreach ($dbStructure[$table]['fields'] as $column => $field) {
141                                 if (!isset($row[$column])) {
142                                         continue;
143                                 }
144                                 if ($field['type'] == 'datetime') {
145                                         $p[$column] = $row[$column] ?? DBA::NULL_DATETIME;
146                                 } else {
147                                         $p[$column] = $row[$column];
148                                 }
149                         }
150                         $result[] = $p;
151                 }
152                 DBA::close($rows);
153                 return $result;
154         }
155
156         /**
157          * @param string $query
158          * @return array
159          * @throws \Exception
160          */
161         private static function exportRow(string $query)
162         {
163                 $dbStructure = DBStructure::definition(DI::app()->getBasePath(), false);
164
165                 preg_match("/\s+from\s+`?([a-z\d_]+)`?/i", $query, $match);
166                 $table = $match[1];
167
168                 $result = [];
169                 $r = q($query);
170                 if (DBA::isResult($r)) {
171                         foreach ($r as $rr) {
172                                 foreach ($rr as $k => $v) {
173                                         if (empty($dbStructure[$table]['fields'][$k])) {
174                                                 continue;
175                                         }
176
177                                         switch ($dbStructure[$table]['fields'][$k]['type']) {
178                                                 case 'datetime':
179                                                         $result[$k] = $v ?? DBA::NULL_DATETIME;
180                                                         break;
181                                                 default:
182                                                         $result[$k] = $v;
183                                                         break;
184                                         }
185                                 }
186                         }
187                 }
188
189                 return $result;
190         }
191
192         /**
193          * Export a list of the contacts as CSV file as e.g. Mastodon and Pleroma are doing.
194          *
195          * @param int $user_id
196          * @throws \Exception
197          */
198         private static function exportContactsAsCSV(int $user_id)
199         {
200                 if (!$user_id) {
201                         throw new \RuntimeException(DI::l10n()->t('Permission denied.'));
202                 }
203
204                 // write the table header (like Mastodon)
205                 echo "Account address, Show boosts\n";
206                 // get all the contacts
207                 $contacts = DBA::select('contact', ['addr', 'url'], ['uid' => $user_id, 'self' => false, 'rel' => [1, 3], 'deleted' => false]);
208                 while ($contact = DBA::fetch($contacts)) {
209                         echo ($contact['addr'] ?: $contact['url']) . ", true\n";
210                 }
211                 DBA::close($contacts);
212         }
213
214         /**
215          * @param int $user_id
216          * @throws \Exception
217          */
218         private static function exportAccount(int $user_id)
219         {
220                 if (!$user_id) {
221                         throw new \RuntimeException(DI::l10n()->t('Permission denied.'));
222                 }
223
224                 $user = self::exportRow(
225                         sprintf("SELECT * FROM `user` WHERE `uid` = %d LIMIT 1", $user_id)
226                 );
227
228                 $contact = self::exportMultiRow(
229                         sprintf("SELECT * FROM `contact` WHERE `uid` = %d ", $user_id)
230                 );
231
232
233                 $profile = self::exportMultiRow(
234                         sprintf("SELECT *, 'default' AS `profile_name`, 1 AS `is-default` FROM `profile` WHERE `uid` = %d ", $user_id)
235                 );
236
237                 $profile_fields = self::exportMultiRow(
238                         sprintf("SELECT * FROM `profile_field` WHERE `uid` = %d ", $user_id)
239                 );
240
241                 $photo = self::exportMultiRow(
242                         sprintf("SELECT * FROM `photo` WHERE uid = %d AND profile = 1", $user_id)
243                 );
244                 foreach ($photo as &$p) {
245                         $p['data'] = bin2hex($p['data']);
246                 }
247
248                 $pconfig = self::exportMultiRow(
249                         sprintf("SELECT * FROM `pconfig` WHERE uid = %d", $user_id)
250                 );
251
252                 $group = self::exportMultiRow(
253                         sprintf("SELECT * FROM `group` WHERE uid = %d", $user_id)
254                 );
255
256                 $group_member = self::exportMultiRow(
257                         sprintf("SELECT `group_member`.`gid`, `group_member`.`contact-id` FROM `group_member` INNER JOIN `group` ON `group`.`id` = `group_member`.`gid` WHERE `group`.`uid` = %d", $user_id)
258                 );
259
260                 $output = [
261                         'version' => FRIENDICA_VERSION,
262                         'schema' => DB_UPDATE_VERSION,
263                         'baseurl' => DI::baseUrl(),
264                         'user' => $user,
265                         'contact' => $contact,
266                         'profile' => $profile,
267                         'profile_fields' => $profile_fields,
268                         'photo' => $photo,
269                         'pconfig' => $pconfig,
270                         'group' => $group,
271                         'group_member' => $group_member,
272                 ];
273
274                 echo json_encode($output, JSON_PARTIAL_OUTPUT_ON_ERROR);
275         }
276
277         /**
278          * echoes account data and items as separated json, one per line
279          *
280          * @param int $user_id
281          * @throws \Exception
282          */
283         private static function exportAll(int $user_id)
284         {
285                 if (!$user_id) {
286                         throw new \RuntimeException(DI::l10n()->t('Permission denied.'));
287                 }
288
289                 self::exportAccount($user_id);
290                 echo "\n";
291
292                 $total = Post::count(['uid' => $user_id]);
293                 // chunk the output to avoid exhausting memory
294
295                 for ($x = 0; $x < $total; $x += 500) {
296                         $items = Post::selectToArray(Item::ITEM_FIELDLIST, ['uid' => $user_id], ['limit' => [$x, 500]]);
297                         $output = ['item' => $items];
298                         echo json_encode($output, JSON_PARTIAL_OUTPUT_ON_ERROR) . "\n";
299                 }
300         }
301 }