]> git.mxchange.org Git - friendica.git/blobdiff - include/items.php
block injection vector
[friendica.git] / include / items.php
index 377912684018a81a44ed50ee87c4add1f1cea981..b7be27932f6a1c215b136356bdf8977b63cdec66 100755 (executable)
@@ -7,6 +7,8 @@ require_once('include/crypto.php');
 require_once('include/Photo.php');
 require_once('include/tags.php');
 require_once('include/text.php');
+require_once('include/email.php');
+require_once('include/ostatus_conversation.php');
 
 function get_feed_for(&$a, $dfrn_id, $owner_nick, $last_update, $direction = 0) {
 
@@ -830,15 +832,30 @@ function get_atom_elements($feed,$item) {
                }
        }
 
+       // Search for ostatus conversation url
+       $links = $item->feed->data["child"][SIMPLEPIE_NAMESPACE_ATOM_10]["feed"][0]["child"][SIMPLEPIE_NAMESPACE_ATOM_10]["entry"][0]["child"]["http://www.w3.org/2005/Atom"]["link"];
+
+       if (is_array($links)) {
+               foreach ($links as $link) {
+                       $conversation = array_shift($link["attribs"]);
+
+                       if ($conversation["rel"] == "ostatus:conversation") {
+                               $res["ostatus_conversation"] = $conversation["href"];
+                               logger('get_atom_elements: found conversation url '.$res["ostatus_conversation"]);
+                       }
+               };
+       }
+
        $arr = array('feed' => $feed, 'item' => $item, 'result' => $res);
 
        call_hooks('parse_atom', $arr);
 
        //if (($res["title"] != "") or (strpos($res["body"], "RT @") > 0)) {
        //if (strpos($res["body"], "RT @") !== false) {
-       //      $debugfile = tempnam("/home/ike/log", "item-res2-");
-       //      file_put_contents($debugfile, serialize($arr));
-       //}
+       /*if (strpos($res["body"], "@") !== false) {
+               $debugfile = tempnam("/var/www/virtual/pirati.ca/phptmp/", "item-res2-");
+               file_put_contents($debugfile, serialize($arr));
+       }*/
 
        return $res;
 }
@@ -877,6 +894,15 @@ function item_store($arr,$force_parent = false) {
                unset($arr['dsprsig']);
        }
 
+       // if an OStatus conversation url was passed in, it is stored and then
+       // removed from the array.
+       $ostatus_conversation = null;
+
+       if (isset($arr["ostatus_conversation"])) {
+               $ostatus_conversation = $arr["ostatus_conversation"];
+               unset($arr["ostatus_conversation"]);
+       }
+
        if(x($arr, 'gravity'))
                $arr['gravity'] = intval($arr['gravity']);
        elseif($arr['parent-uri'] === $arr['uri'])
@@ -968,9 +994,9 @@ function item_store($arr,$force_parent = false) {
                $deny_cid  = $arr['deny_cid'];
                $deny_gid  = $arr['deny_gid'];
        }
-       else { 
+       else {
 
-               // find the parent and snarf the item id and ACL's
+               // find the parent and snarf the item id and ACLs
                // and anything else we need to inherit
 
                $r = q("SELECT * FROM `item` WHERE `uri` = '%s' AND `uid` = %d ORDER BY `id` ASC LIMIT 1",
@@ -1111,6 +1137,10 @@ function item_store($arr,$force_parent = false) {
        );
        create_tags_from_item($current_post);
 
+       // Complete ostatus threads
+       if ($ostatus_conversation)
+               complete_conversation($current_post, $ostatus_conversation);
+
         $arr['id'] = $current_post;
         $arr['parent'] = $parent_id;
         $arr['allow_cid'] = $allow_cid;
@@ -1158,7 +1188,10 @@ function item_store($arr,$force_parent = false) {
 
        if (($cachefile != '') AND !file_exists($cachefile)) {
                $s = prepare_text($arr['body']);
+               $a = get_app();
+               $stamp1 = microtime(true);
                file_put_contents($cachefile, $s);
+               $a->save_timestamp($stamp1, "file");
                logger('item_store: put item '.$current_post.' into cachefile '.$cachefile);
        }
 
@@ -3410,9 +3443,9 @@ function new_follower($importer,$contact,$datarray,$item,$sharing = false) {
                                        '$sitename' => $a->config['sitename']
                                ));
                                $res = mail($r[0]['email'], 
-                                       (($sharing) ? t('A new person is sharing with you at ') : t("You have a new follower at ")) . $a->config['sitename'],
+                                       email_header_encode((($sharing) ? t('A new person is sharing with you at ') : t("You have a new follower at ")) . $a->config['sitename'],'UTF-8'),
                                        $email,
-                                       'From: ' . t('Administrator') . '@' . $_SERVER['SERVER_NAME'] . "\n"
+                                       'From: ' . 'Administrator' . '@' . $_SERVER['SERVER_NAME'] . "\n"
                                        . 'Content-type: text/plain; charset=UTF-8' . "\n"
                                        . 'Content-transfer-encoding: 8bit' );
 
@@ -3634,7 +3667,7 @@ function fix_private_photos($s, $uid, $item = null, $cid = 0) {
                        // Only embed locally hosted photos
                        $replace = false;
                        $i = basename($image);
-                       $i = str_replace(array('.jpg','.png'),array('',''),$i);
+                       $i = str_replace(array('.jpg','.png','.gif'),array('','',''),$i);
                        $x = strpos($i,'-');
 
                        if($x) {
@@ -3645,7 +3678,7 @@ function fix_private_photos($s, $uid, $item = null, $cid = 0) {
                                        intval($res),
                                        intval($uid)
                                );
-                               if(count($r)) {
+                               if($r) {
 
                                        // Check to see if we should replace this photo link with an embedded image
                                        // 1. No need to do so if the photo is public
@@ -3772,11 +3805,11 @@ function item_getfeedtags($item) {
 
 function item_getfeedattach($item) {
        $ret = '';
-       $arr = explode(',',$item['attach']);
+       $arr = explode('[/attach],',$item['attach']);
        if(count($arr)) {
                foreach($arr as $r) {
                        $matches = false;
-                       $cnt = preg_match('|\[attach\]href=\"(.*?)\" length=\"(.*?)\" type=\"(.*?)\" title=\"(.*?)\"\[\/attach\]|',$r,$matches);
+                       $cnt = preg_match('|\[attach\]href=\"(.*?)\" length=\"(.*?)\" type=\"(.*?)\" title=\"(.*?)\"|',$r,$matches);
                        if($cnt) {
                                $ret .= '<link rel="enclosure" href="' . xmlify($matches[1]) . '" type="' . xmlify($matches[3]) . '" ';
                                if(intval($matches[2]))
@@ -3914,6 +3947,34 @@ function drop_item($id,$interactive = true) {
 
        if((local_user() == $item['uid']) || ($cid) || (! $interactive)) {
 
+               // Check if we should do HTML-based delete confirmation
+               if($_REQUEST['confirm']) {
+                       // <form> can't take arguments in its "action" parameter
+                       // so add any arguments as hidden inputs
+                       $query = explode_querystring($a->query_string);
+                       $inputs = array();
+                       foreach($query['args'] as $arg) {
+                               if(strpos($arg, 'confirm=') === false) {
+                                       $arg_parts = explode('=', $arg);
+                                       $inputs[] = array('name' => $arg_parts[0], 'value' => $arg_parts[1]);
+                               }
+                       }
+
+                       return replace_macros(get_markup_template('confirm.tpl'), array(
+                               '$method' => 'get',
+                               '$message' => t('Do you really want to delete this item?'),
+                               '$extra_inputs' => $inputs,
+                               '$confirm' => t('Yes'),
+                               '$confirm_url' => $query['base'],
+                               '$confirm_name' => 'confirmed',
+                               '$cancel' => t('Cancel'),
+                       ));
+               }
+               // Now check how the user responded to the confirmation query
+               if($_REQUEST['canceled']) {
+                       goaway($a->get_baseurl() . '/' . $_SESSION['return_url']);
+               }
+
                logger('delete item: ' . $item['id'], LOGGER_DEBUG);
                // delete the item