+ if(($type === 'profile') && (strlen($sec))) {
+ // URL reply
+
+ $s = fetch_url($r[0]['poll']
+ . '?dfrn_id=' . $encrypted_id
+ . '&type=profile-check'
+ . '&dfrn_version=' . DFRN_PROTOCOL_VERSION
+ . '&challenge=' . $challenge
+ . '&sec=' . $sec
+ );
+
+ logger("dfrn_poll: sec profile: " . $s, LOGGER_DATA);
+
+ if(strlen($s) && strstr($s,'<?xml')) {
+
+ $xml = simplexml_load_string($s);
+
+ logger('dfrn_poll: profile: parsed xml: ' . print_r($xml,true), LOGGER_DATA);
+
+ logger('dfrn_poll: secure profile: challenge: ' . $xml->challenge . ' expecting ' . $hash);
+ logger('dfrn_poll: secure profile: sec: ' . $xml->sec . ' expecting ' . $sec);
+
+
+ if(((int) $xml->status == 0) && ($xml->challenge == $hash) && ($xml->sec == $sec)) {
+ $_SESSION['authenticated'] = 1;
+ $_SESSION['visitor_id'] = $r[0]['id'];
+ $_SESSION['visitor_home'] = $r[0]['url'];
+ notice( $r[0]['username'] . t(' welcomes ') . $r[0]['name'] . EOL);
+ // Visitors get 1 day session.
+ $session_id = session_id();
+ $expire = time() + 86400;
+ q("UPDATE `session` SET `expire` = '%s' WHERE `sid` = '%s' LIMIT 1",
+ dbesc($expire),
+ dbesc($session_id)
+ );
+ }
+ $profile = $r[0]['nickname'];
+ goaway((strlen($destination_url)) ? $destination_url : $a->get_baseurl() . '/profile/' . $profile);
+ }
+ goaway($a->get_baseurl());
+ // NOTREACHED
+
+ }
+ else {
+ // XML reply
+ header("Content-type: text/xml");
+ echo '<?xml version="1.0" encoding="UTF-8"?>' . "\r\n"
+ . '<dfrn_poll>' . "\r\n"
+ . "\t" . '<status>' . $status . '</status>' . "\r\n"
+ . "\t" . '<dfrn_version>' . DFRN_PROTOCOL_VERSION . '</dfrn_version>' . "\r\n"
+ . "\t" . '<dfrn_id>' . $encrypted_id . '</dfrn_id>' . "\r\n"
+ . "\t" . '<challenge>' . $challenge . '</challenge>' . "\r\n"
+ . '</dfrn_poll>' . "\r\n" ;
+ killme();
+ // NOTREACHED
+ }