$expiration,
$cookiepath,
$server,
- common_config('site', 'ssl')=='always');
+ GNUsocial::useHTTPS());
}
define('REMEMBERME', 'rememberme');
function common_purify($html)
{
- require_once INSTALLDIR.'/extlib/htmLawed/htmLawed.php';
+ require_once INSTALLDIR.'/extlib/HTMLPurifier/HTMLPurifier.auto.php';
- $config = array('safe' => 1, // means that elements=* means elements=*-applet-embed-iframe-object-script or so
- 'elements' => '*',
- 'deny_attribute' => 'id,style,on*');
+ $cfg = HTMLPurifier_Config::createDefault();
+ $cfg->set('Attr.AllowedRel', ['bookmark', 'directory', 'enclosure', 'home', 'license', 'nofollow', 'payment', 'tag']); // http://microformats.org/wiki/rel
+ $cfg->set('HTML.ForbiddenAttributes', array('style')); // id, on* etc. are already filtered by default
+ $cfg->set('URI.AllowedSchemes', array_fill_keys(common_url_schemes(), true));
- // Remove more elements than what the 'safe' filter gives (elements must be '*' before this)
- // http://www.bioinformatics.org/phplabware/internal_utilities/htmLawed/htmLawed_README.htm#s3.6
+ // Remove more elements than what the default filter removes, default in GNU social are remotely
+ // linked resources such as img, video, audio
+ $forbiddenElements = array();
foreach (common_config('htmlfilter') as $tag=>$filter) {
if ($filter === true) {
- $config['elements'] .= "-{$tag}";
+ $forbiddenElements[] = $tag;
}
}
+ $cfg->set('HTML.ForbiddenElements', $forbiddenElements);
$html = common_remove_unicode_formatting($html);
- return htmLawed($html, $config);
+ $purifier = new HTMLPurifier($cfg);
+ $purified = $purifier->purify($html);
+ Event::handle('EndCommonPurify', array(&$purified, $html));
+
+ return $purified;
}
function common_remove_unicode_formatting($text)
/**
* Partial notice markup rendering step: build links to !group references.
*
- * @param string $text partially rendered HTML
- * @param Notice $notice in whose context we're working
+ * @param string $text partially rendered HTML
+ * @param Profile $author the Profile that is composing the current notice
+ * @param Notice $parent the Notice this is sent in reply to, if any
* @return string partially rendered HTML
*/
-function common_render_content($text, Notice $notice)
+function common_render_content($text, Profile $author, Notice $parent=null)
{
$text = common_render_text($text);
- $text = common_linkify_mentions($text, $notice);
+ $text = common_linkify_mentions($text, $author, $parent);
return $text;
}
*
* Should generally not be called except from common_render_content().
*
- * @param string $text partially-rendered HTML
- * @param Notice $notice in-progress or complete Notice object for context
+ * @param string $text partially-rendered HTML
+ * @param Profile $author the Profile that is composing the current notice
+ * @param Notice $parent the Notice this is sent in reply to, if any
* @return string partially-rendered HTML
*/
-function common_linkify_mentions($text, Notice $notice)
+function common_linkify_mentions($text, Profile $author, Notice $parent=null)
{
- $mentions = common_find_mentions($text, $notice);
+ $mentions = common_find_mentions($text, $author, $parent);
// We need to go through in reverse order by position,
// so our positions stay valid despite our fudging with the
$linkText = common_linkify_mention($mention);
- $text = substr_replace($text, $linkText, $position, mb_strlen($mention['text']));
+ $text = substr_replace($text, $linkText, $position, $mention['length']);
}
return $text;
return $output;
}
+function common_get_attentions($text, Profile $sender, Notice $parent=null)
+{
+ $mentions = common_find_mentions($text, $sender, $parent);
+ $atts = array();
+ foreach ($mentions as $mention) {
+ foreach ($mention['mentioned'] as $mentioned) {
+ $atts[$mentioned->getUri()] = $mentioned->getObjectType();
+ }
+ }
+ if ($parent instanceof Notice) {
+ $parentAuthor = $parent->getProfile();
+ // afaik groups can't be authors
+ $atts[$parentAuthor->getUri()] = ActivityObject::PERSON;
+ }
+ return $atts;
+}
+
/**
* Find @-mentions in the given text, using the given notice object as context.
* References will be resolved with common_relative_profile() against the user
* Note the return data format is internal, to be used for building links and
* such. Should not be used directly; rather, call common_linkify_mentions().
*
- * @param string $text
- * @param Notice $notice notice in whose context we're building links
+ * @param string $text
+ * @param Profile $sender the Profile that is sending the current text
+ * @param Notice $parent the Notice this text is in reply to, if any
*
* @return array
*
* @access private
*/
-function common_find_mentions($text, Notice $notice)
+function common_find_mentions($text, Profile $sender, Notice $parent=null)
{
- // The getProfile call throws NoProfileException on failure
- $sender = $notice->getProfile();
-
$mentions = array();
if (Event::handle('StartFindMentions', array($sender, $text, &$mentions))) {
// Get the context of the original notice, if any
- $origAuthor = null;
- $origNotice = null;
$origMentions = array();
-
- // Is it a reply?
-
- try {
- $origNotice = $notice->getParent();
- $origAuthor = $origNotice->getProfile();
-
- $ids = $origNotice->getReplies();
-
- foreach ($ids as $id) {
- try {
- $repliedTo = Profile::getByID($id);
- $origMentions[$repliedTo->getNickname()] = $repliedTo;
- } catch (NoResultException $e) {
- // continue foreach
+ // Does it have a parent notice for context?
+ if ($parent instanceof Notice) {
+ foreach ($parent->getAttentionProfiles() as $repliedTo) {
+ if (!$repliedTo->isPerson()) {
+ continue;
}
+ $origMentions[$repliedTo->id] = $repliedTo;
}
- } catch (NoParentNoticeException $e) {
- // It wasn't a reply to anything, so we can't harvest nickname-relations.
- } catch (NoResultException $e) {
- // The parent notice was deleted.
}
$matches = common_find_mentions_raw($text);
continue;
}
+ // primarily mention the profiles mentioned in the parent
+ $mention_found_in_origMentions = false;
+ foreach($origMentions as $origMentionsId=>$origMention) {
+ if($origMention->getNickname() == $nickname) {
+ $mention_found_in_origMentions = $origMention;
+ // don't mention same twice! the parent might have mentioned
+ // two users with same nickname on different instances
+ unset($origMentions[$origMentionsId]);
+ break;
+ }
+ }
+
// Try to get a profile for this nickname.
- // Start with conversation context, then go to
- // sender context.
-
- if ($origAuthor instanceof Profile && $origAuthor->nickname == $nickname) {
- $mentioned = $origAuthor;
- } else if (!empty($origMentions) &&
- array_key_exists($nickname, $origMentions)) {
- $mentioned = $origMentions[$nickname];
+ // Start with parents mentions, then go to parents sender context
+ if ($mention_found_in_origMentions) {
+ $mentioned = $mention_found_in_origMentions;
+ } else if ($parent instanceof Notice && $parent->getProfile()->getNickname() === $nickname) {
+ $mentioned = $parent->getProfile();
} else {
+ // sets to null if no match
$mentioned = common_relative_profile($sender, $nickname);
}
if ($mentioned instanceof Profile) {
- $user = User::getKV('id', $mentioned->id);
-
- if ($user instanceof User) {
- $url = common_local_url('userbyid', array('id' => $user->id));
- } else {
- $url = $mentioned->profileurl;
+ try {
+ $url = $mentioned->getUri(); // prefer the URI as URL, if it is one.
+ if (!common_valid_http_url($url)) {
+ $url = $mentioned->getUrl();
+ }
+ } catch (InvalidUrlException $e) {
+ $url = common_local_url('userbyid', array('id' => $mentioned->getID()));
}
$mention = array('mentioned' => array($mentioned),
'type' => 'mention',
'text' => $match[0],
'position' => $match[1],
+ 'length' => mb_strlen($match[0]),
+ 'title' => $mentioned->getFullname(),
'url' => $url);
- if (!empty($mentioned->fullname)) {
- $mention['title'] = $mentioned->fullname;
- }
-
$mentions[] = $mention;
}
}
$text, $hmatches, PREG_OFFSET_CAPTURE);
foreach ($hmatches[1] as $hmatch) {
$tag = common_canonical_tag($hmatch[0]);
- $plist = Profile_list::getByTaggerAndTag($sender->id, $tag);
+ $plist = Profile_list::getByTaggerAndTag($sender->getID(), $tag);
if (!$plist instanceof Profile_list || $plist->private) {
continue;
}
'type' => 'list',
'text' => $hmatch[0],
'position' => $hmatch[1],
+ 'length' => mb_strlen($hmatch[0]),
'url' => $url);
}
'type' => 'group',
'text' => $hmatch[0],
'position' => $hmatch[1],
+ 'length' => mb_strlen($hmatch[0]),
'url' => $group->permalink(),
'title' => $group->getFancyName());
}
PREG_OFFSET_CAPTURE);
$atmatches = array();
- preg_match_all('/(?:^|\s+)@(' . Nickname::DISPLAY_FMT . ')\b/',
+ // the regexp's "(?!\@)" makes sure it doesn't matches the single "@remote" in "@remote@server.com"
+ preg_match_all('/(?:^|\s+)@(' . Nickname::DISPLAY_FMT . ')\b(?!\@)/',
$text,
$atmatches,
PREG_OFFSET_CAPTURE);
return $text;
}
+define('_URL_SCHEME_COLON_DOUBLE_SLASH', 1);
+define('_URL_SCHEME_SINGLE_COLON', 2);
+define('_URL_SCHEME_NO_DOMAIN', 4);
+define('_URL_SCHEME_COLON_COORDINATES', 8);
+
+function common_url_schemes($filter=null)
+{
+ // TODO: move these to $config
+ $schemes = [
+ 'http' => _URL_SCHEME_COLON_DOUBLE_SLASH,
+ 'https' => _URL_SCHEME_COLON_DOUBLE_SLASH,
+ 'ftp' => _URL_SCHEME_COLON_DOUBLE_SLASH,
+ 'ftps' => _URL_SCHEME_COLON_DOUBLE_SLASH,
+ 'mms' => _URL_SCHEME_COLON_DOUBLE_SLASH,
+ 'rtsp' => _URL_SCHEME_COLON_DOUBLE_SLASH,
+ 'gopher' => _URL_SCHEME_COLON_DOUBLE_SLASH,
+ 'news' => _URL_SCHEME_COLON_DOUBLE_SLASH,
+ 'nntp' => _URL_SCHEME_COLON_DOUBLE_SLASH,
+ 'telnet' => _URL_SCHEME_COLON_DOUBLE_SLASH,
+ 'wais' => _URL_SCHEME_COLON_DOUBLE_SLASH,
+ 'file' => _URL_SCHEME_COLON_DOUBLE_SLASH,
+ 'prospero' => _URL_SCHEME_COLON_DOUBLE_SLASH,
+ 'webcal' => _URL_SCHEME_COLON_DOUBLE_SLASH,
+ 'irc' => _URL_SCHEME_COLON_DOUBLE_SLASH,
+ 'ircs' => _URL_SCHEME_COLON_DOUBLE_SLASH,
+ 'aim' => _URL_SCHEME_SINGLE_COLON,
+ 'bitcoin' => _URL_SCHEME_SINGLE_COLON,
+ 'fax' => _URL_SCHEME_SINGLE_COLON,
+ 'jabber' => _URL_SCHEME_SINGLE_COLON,
+ 'mailto' => _URL_SCHEME_SINGLE_COLON,
+ 'tel' => _URL_SCHEME_SINGLE_COLON,
+ 'xmpp' => _URL_SCHEME_SINGLE_COLON,
+ 'magnet' => _URL_SCHEME_NO_DOMAIN,
+ 'geo' => _URL_SCHEME_COLON_COORDINATES,
+ ];
+
+ return array_keys(
+ array_filter($schemes,
+ function ($scheme) use ($filter) {
+ return is_null($filter) || ($scheme & $filter);
+ })
+ );
+}
+
/**
* Find links in the given text and pass them to the given callback function.
*
* @param mixed $arg: optional argument will be passed on to the callback
*/
function common_replace_urls_callback($text, $callback, $arg = null) {
+ $geouri_labeltext_regex = '\pN\pL\-';
+ $geouri_mark_regex = '\-\_\.\!\~\*\\\'\(\)'; // the \\\' is really pretty
+ $geouri_unreserved_regex = '\pN\pL' . $geouri_mark_regex;
+ $geouri_punreserved_regex = '\[\]\:\&\+\$';
+ $geouri_pctencoded_regex = '(?:\%[0-9a-fA-F][0-9a-fA-F])';
+ $geouri_paramchar_regex = $geouri_unreserved_regex . $geouri_punreserved_regex; //FIXME: add $geouri_pctencoded_regex here so it works
+
// Start off with a regex
$regex = '#'.
'(?:^|[\s\<\>\(\)\[\]\{\}\\\'\\\";]+)(?![\@\!\#])'.
'(?:'.
'(?:'. //Known protocols
'(?:'.
- '(?:(?:https?|ftps?|mms|rtsp|gopher|news|nntp|telnet|wais|file|prospero|webcal|irc)://)'.
+ '(?:(?:' . implode('|', common_url_schemes(_URL_SCHEME_COLON_DOUBLE_SLASH)) . ')://)'.
'|'.
- '(?:(?:mailto|aim|tel|xmpp):)'.
+ '(?:(?:' . implode('|', common_url_schemes(_URL_SCHEME_SINGLE_COLON)) . '):)'.
')'.
'(?:[\pN\pL\-\_\+\%\~]+(?::[\pN\pL\-\_\+\%\~]+)?\@)?'. //user:pass@
'(?:'.
')'.
')'.
')'.
- '|(?:(?:magnet):)'. // URLs without domain name
- '|(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)'. //IPv4
- '|(?:'. //IPv6
- '\[?(?:(?:(?:[0-9A-Fa-f]{1,4}:){7}(?:(?:[0-9A-Fa-f]{1,4})|:))|(?:(?:[0-9A-Fa-f]{1,4}:){6}(?::|(?:(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})(?:\.(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})|(?::[0-9A-Fa-f]{1,4})))|(?:(?:[0-9A-Fa-f]{1,4}:){5}(?:(?::(?:(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})(?:\.(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|(?:(?::[0-9A-Fa-f]{1,4}){1,2})))|(?:(?:[0-9A-Fa-f]{1,4}:){4}(?::[0-9A-Fa-f]{1,4}){0,1}(?:(?::(?:(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})(?:\.(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|(?:(?::[0-9A-Fa-f]{1,4}){1,2})))|(?:(?:[0-9A-Fa-f]{1,4}:){3}(?::[0-9A-Fa-f]{1,4}){0,2}(?:(?::(?:(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})(?:\.(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|(?:(?::[0-9A-Fa-f]{1,4}){1,2})))|(?:(?:[0-9A-Fa-f]{1,4}:){2}(?::[0-9A-Fa-f]{1,4}){0,3}(?:(?::(?:(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})(?:\.(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|(?:(?::[0-9A-Fa-f]{1,4}){1,2})))|(?:(?:[0-9A-Fa-f]{1,4}:)(?::[0-9A-Fa-f]{1,4}){0,4}(?:(?::(?:(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})(?:\.(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|(?:(?::[0-9A-Fa-f]{1,4}){1,2})))|(?::(?::[0-9A-Fa-f]{1,4}){0,5}(?:(?::(?:(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})(?:\.(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|(?:(?::[0-9A-Fa-f]{1,4}){1,2})))|(?:(?:(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})(?:\.(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})))\]?(?<!:)'.
+ '|(?:'.
+ '(?:' . implode('|', common_url_schemes(_URL_SCHEME_COLON_COORDINATES)) . '):'.
+ // There's an order that must be followed here too, if ;crs= is used, it must precede ;u=
+ // Also 'crsp' (;crs=$crsp) must match $geouri_labeltext_regex
+ // Also 'uval' (;u=$uval) must be a pnum: \-?[0-9]+
+ '(?:'.
+ '(?:[0-9]+(?:\.[0-9]+)?(?:\,[0-9]+(?:\.[0-9]+)?){1,2})'. // 1(.23)?(,4(.56)){1,2}
+ '(?:\;(?:['.$geouri_labeltext_regex.']+)(?:\=['.$geouri_paramchar_regex.']+)*)*'.
+ ')'.
')'.
+ // URLs without domain name, like magnet:?xt=...
+ '|(?:(?:' . implode('|', common_url_schemes(_URL_SCHEME_NO_DOMAIN)) . '):(?=\?))'. // zero-length lookahead requires ? after :
+ (common_config('linkify', 'bare_ipv4') // Convert IPv4 addresses to hyperlinks
+ ? '|(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)'
+ : '').
+ (common_config('linkify', 'bare_ipv6') // Convert IPv6 addresses to hyperlinks
+ ? '|(?:'. //IPv6
+ '\[?(?:(?:(?:[0-9A-Fa-f]{1,4}:){7}(?:(?:[0-9A-Fa-f]{1,4})|:))|(?:(?:[0-9A-Fa-f]{1,4}:){6}(?::|(?:(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})(?:\.(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})|(?::[0-9A-Fa-f]{1,4})))|(?:(?:[0-9A-Fa-f]{1,4}:){5}(?:(?::(?:(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})(?:\.(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|(?:(?::[0-9A-Fa-f]{1,4}){1,2})))|(?:(?:[0-9A-Fa-f]{1,4}:){4}(?::[0-9A-Fa-f]{1,4}){0,1}(?:(?::(?:(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})(?:\.(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|(?:(?::[0-9A-Fa-f]{1,4}){1,2})))|(?:(?:[0-9A-Fa-f]{1,4}:){3}(?::[0-9A-Fa-f]{1,4}){0,2}(?:(?::(?:(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})(?:\.(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|(?:(?::[0-9A-Fa-f]{1,4}){1,2})))|(?:(?:[0-9A-Fa-f]{1,4}:){2}(?::[0-9A-Fa-f]{1,4}){0,3}(?:(?::(?:(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})(?:\.(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|(?:(?::[0-9A-Fa-f]{1,4}){1,2})))|(?:(?:[0-9A-Fa-f]{1,4}:)(?::[0-9A-Fa-f]{1,4}){0,4}(?:(?::(?:(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})(?:\.(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|(?:(?::[0-9A-Fa-f]{1,4}){1,2})))|(?::(?::[0-9A-Fa-f]{1,4}){0,5}(?:(?::(?:(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})(?:\.(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|(?:(?::[0-9A-Fa-f]{1,4}){1,2})))|(?:(?:(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})(?:\.(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})))\]?(?<!:)'.
+ ')'
+ : '').
(common_config('linkify', 'bare_domains')
? '|(?:'. //DNS
'(?:[\pN\pL\-\_\+\%\~]+(?:\:[\pN\pL\-\_\+\%\~]+)?\@)?'. //user:pass@
} else {
$canon = File_redirection::_canonUrl($url);
$longurl_data = File_redirection::where($canon, common_config('attachments', 'process_links'));
- $longurl = $longurl_data->url;
+
+ if(isset($longurl_data->redir_url)) {
+ $longurl = $longurl_data->redir_url;
+ } else {
+ // e.g. local files
+ $longurl = $longurl_data->url;
+ }
}
-
- $attrs = array('href' => $canon, 'title' => $longurl);
+
+ $attrs = array('href' => $longurl, 'title' => $longurl);
$is_attachment = false;
$attachment_id = null;
// Check to see whether this is a known "attachment" URL.
- $f = File::getKV('url', $longurl);
-
- if (!$f instanceof File) {
+ try {
+ $f = File::getByUrl($longurl);
+ } catch (NoResultException $e) {
if (common_config('attachments', 'process_links')) {
// XXX: this writes to the database. :<
try {
$r = Router::get();
$path = $r->build($action, $args, $params, $fragment);
- $ssl = common_config('site', 'ssl') === 'always'
- || GNUsocial::isHTTPS()
- || common_is_sensitive($action);
+ $ssl = GNUsocial::useHTTPS();
if (common_config('site','fancy')) {
$url = common_path($path, $ssl, $addSession);
return $url;
}
-function common_is_sensitive($action)
-{
- static $sensitive = array(
- 'login',
- 'register',
- 'passwordsettings',
- 'api',
- 'ApiOAuthRequestToken',
- 'ApiOAuthAccessToken',
- 'ApiOAuthAuthorize',
- 'ApiOAuthPin',
- 'showapplication'
- );
- $ssl = null;
-
- if (Event::handle('SensitiveAction', array($action, &$ssl))) {
- $ssl = in_array($action, $sensitive);
- }
-
- return $ssl;
-}
-
function common_path($relative, $ssl=false, $addSession=true)
{
$pathpart = (common_config('site', 'path')) ? common_config('site', 'path')."/" : '';
- if (($ssl && (common_config('site', 'ssl') === 'sometimes'))
- || GNUsocial::isHTTPS()
- || common_config('site', 'ssl') === 'always') {
+ if ($ssl && GNUsocial::useHTTPS()) {
$proto = 'https';
if (is_string(common_config('site', 'sslserver')) &&
mb_strlen(common_config('site', 'sslserver')) > 0) {
}
$supported = common_config('attachments', 'supported');
+ if ($supported === true) {
+ throw new ServerException('Supported extension but unknown mimetype relation.');
+ }
foreach($supported as $type => $ext) {
if ($ext === $fileext) {
return $type;
function common_supported_mime_to_ext($mimetype)
{
$supported = common_config('attachments', 'supported');
+ if ($supported === true) {
+ throw new ServerException('Supported mimetype but unknown extension relation.');
+ }
foreach($supported as $type => $ext) {
if ($mimetype === $type) {
return $ext;
}
return call_user_func_array('sprintf', $args);
}
+
+function _ve($var)
+{
+ return var_export($var, true);
+}
projects / quix0rs-gnu-social.git / blobdiff