port hubzillas OpenWebAuth - remote authentification

[friendica.git] / index.php

diff --git a/index.php b/index.php
index aeda999825bb3569b34186c08dc59fac678e43d4..c0290dff4dc9b992dbe0eb58d09f0efd118166f0 100644 (file)
--- a/index.php
+++ b/index.php
@@ -121,25 +121,35 @@ if ((x($_SESSION, 'language')) && ($_SESSION['language'] !== $lang)) {
        L10n::loadTranslationTable($lang);
 }
 
-if ((x($_GET, 'zrl')) && $a->mode == App::MODE_NORMAL) {
-       // Only continue when the given profile link seems valid
-       // Valid profile links contain a path with "/profile/" and no query parameters
-       if ((parse_url($_GET['zrl'], PHP_URL_QUERY) == "")
-               && strstr(parse_url($_GET['zrl'], PHP_URL_PATH), "/profile/")
-       ) {
-               $_SESSION['my_url'] = $_GET['zrl'];
-               $a->query_string = preg_replace('/[\?&]zrl=(.*?)([\?&]|$)/is', '', $a->query_string);
-               Profile::zrlInit($a);
-       } else {
-               // Someone came with an invalid parameter, maybe as a DDoS attempt
-               // We simply stop processing here
-               logger("Invalid ZRL parameter ".$_GET['zrl'], LOGGER_DEBUG);
-               header('HTTP/1.1 403 Forbidden');
-               echo "<h1>403 Forbidden</h1>";
-               killme();
+if ((x($_GET,'zrl')) && $a->mode == App::MODE_NORMAL) {
+       $a->query_string = Profile::stripZrls($a->query_string);
+       if (!local_user()) {
+               // Only continue when the given profile link seems valid
+               // Valid profile links contain a path with "/profile/" and no query parameters
+               if ((parse_url($_GET['zrl'], PHP_URL_QUERY) == "") &&
+                       strstr(parse_url($_GET['zrl'], PHP_URL_PATH), "/profile/")) {
+                       if ($_SESSION["visitor_home"] != $_GET["zrl"]) {
+                               $_SESSION['my_url'] = $_GET['zrl'];
+                               $_SESSION['authenticated'] = 0;
+                       }
+                       Profile::zrlInit($a);
+               } else {
+                       // Someone came with an invalid parameter, maybe as a DDoS attempt
+                       // We simply stop processing here
+                       logger("Invalid ZRL parameter " . $_GET['zrl'], LOGGER_DEBUG);
+                       header('HTTP/1.1 403 Forbidden');
+                       echo "<h1>403 Forbidden</h1>";
+                       killme();
+               }
        }
 }
 
+if ((x($_GET,'owt')) && $a->mode == App::MODE_NORMAL) {
+       $token = $_GET['owt'];
+       $a->query_string = Profile::stripQueryParam($a->query_string, 'owt');
+       Profile::owtInit($token);
+}
+
 /**
  * For Mozilla auth manager - still needs sorting, and this might conflict with LRDD header.
  * Apache/PHP lumps the Link: headers into one - and other services might not be able to parse it