]> git.mxchange.org Git - quix0rs-gnu-social.git/blobdiff - lib/util.php
CSRF Protection for login and new notice. Ticket #503
[quix0rs-gnu-social.git] / lib / util.php
index b0edb8ef041cf2f92760ab86b0563ca6bbac2643..a5eeab0566f319ac6066535b70df44fc65fa8661 100644 (file)
@@ -146,6 +146,9 @@ function common_init_language() {
        bind_textdomain_codeset("laconica", "UTF-8");
        textdomain("laconica");
        setlocale(LC_CTYPE, 'C');
+       if(!$locale_set) {
+               common_log(LOG_INFO,'Language requested:'.$language.' - locale could not be set:',__FILE__);
+       }
 }
 
 define('PAGE_TYPE_PREFS', 'text/html,application/xhtml+xml,application/xml;q=0.3,text/xml;q=0.2');
@@ -178,7 +181,7 @@ function common_show_header($pagetitle, $callable=NULL, $data=NULL, $headercall=
                                                                   'src' => common_path('js/jquery.form.js')),
                                   ' ');
        common_element('script', array('type' => 'text/javascript',
-                                                                  'src' => common_path('js/util.js')),
+                                                                  'src' => common_path('js/util.js?version='.LACONICA_VERSION)),
                                   ' ');
        common_element('link', array('rel' => 'search', 'type' => 'application/opensearchdescription+xml',
                                         'href' =>  common_local_url('opensearch', array('type' => 'people')),
@@ -483,25 +486,27 @@ function common_timezone() {
 }
 
 function common_language() {
-       $httplang = isset($_SERVER['HTTP_ACCEPT_LANGUAGE']) ? $_SERVER['HTTP_ACCEPT_LANGUAGE'] : NULL;
-        $language = array();
-        $user_language = FALSE;
 
+       // If there is a user logged in and they've set a language preference
+       // then return that one...
         if (common_logged_in()) {
                 $user = common_current_user();
                 $user_language = $user->language;
+               if ($user_language)
+                       return $user_language;
         }
 
-        if ($user_language) {
-                return $user_language;
-        } else if (!empty($httplang)) {
-                $language = client_prefered_language($httplang);
-                if ($language) {
-                    return $language;
-                }
-        } else {
-                return common_config('site', 'language');
-        }
+       // Otherwise, find the best match for the languages requested by the
+       // user's browser...
+       $httplang = isset($_SERVER['HTTP_ACCEPT_LANGUAGE']) ? $_SERVER['HTTP_ACCEPT_LANGUAGE'] : NULL;
+       if (!empty($httplang)) {
+               $language = client_prefered_language($httplang);
+               if ($language)
+                       return $language;
+       }
+
+       // Finally, if none of the above worked, use the site's default...
+       return common_config('site', 'language');
 }
 # salted, hashed passwords are stored in the DB
 
@@ -708,12 +713,47 @@ function common_render_text($text) {
        $r = htmlspecialchars($text);
 
        $r = preg_replace('/[\x{0}-\x{8}\x{b}-\x{c}\x{e}-\x{19}]/', '', $r);
-       $r = preg_replace('@https?://[^)\]>\s]+@', '<a href="\0" class="extlink">\0</a>', $r);
+       $r = preg_replace_callback('@https?://[^\]>\s]+@', 'common_render_uri_thingy', $r);
        $r = preg_replace('/(^|\s+)#([A-Za-z0-9_\-\.]{1,64})/e', "'\\1#'.common_tag_link('\\2')", $r);
        # XXX: machine tags
        return $r;
 }
 
+function common_render_uri_thingy($matches) {
+       $uri = $matches[0];
+       $trailer = '';
+
+       # Some heuristics for extracting URIs from surrounding punctuation
+       # Strip from trailing text...
+       if (preg_match('/^(.*)([,.:"\']+)$/', $uri, $matches)) {
+               $uri = $matches[1];
+               $trailer = $matches[2];
+       }
+
+       $pairs = array(
+               ']' => '[', # technically disallowed in URIs, but used in Java docs
+               ')' => '(', # far too frequent in Wikipedia and MSDN
+       );
+       $final = substr($uri, -1, 1);
+       if (isset($pairs[$final])) {
+               $openers = substr_count($uri, $pairs[$final]);
+               $closers = substr_count($uri, $final);
+               if ($closers > $openers) {
+                       // Assume the paren was opened outside the URI
+                       $uri = substr($uri, 0, -1);
+                       $trailer = $final . $trailer;
+               }
+       }
+       return '<a href="' . $uri . '" class="extlink">' . $uri . '</a>' . $trailer;
+}
+
+function common_xml_safe_str($str) {
+       $xmlStr = htmlentities(iconv('UTF-8', 'UTF-8//IGNORE', $str), ENT_NOQUOTES, 'UTF-8');
+       
+       // Replace control, formatting, and surrogate characters with '*', ala Twitter
+       return preg_replace('/[\p{Cc}\p{Cf}\p{Cs}]/u', '*', $str);
+}
+
 function common_tag_link($tag) {
        $canonical = common_canonical_tag($tag);
        $url = common_local_url('tag', array('tag' => $canonical));
@@ -806,13 +846,17 @@ function common_default_avatar($size) {
        return theme_path('default-avatar-'.$sizenames[$size].'.png');
 }
 
-function common_local_url($action, $args=NULL) {
-       global $config;
-       if ($config['site']['fancy']) {
-               return common_fancy_url($action, $args);
+function common_local_url($action, $args=NULL, $fragment=NULL) {
+       $url = NULL;
+       if (common_config('site','fancy')) {
+               $url = common_fancy_url($action, $args);
        } else {
-               return common_simple_url($action, $args);
+               $url = common_simple_url($action, $args);
        }
+       if (!is_null($fragment)) {
+               $url .= '#'.$fragment;
+       }
+       return $url;
 }
 
 function common_fancy_url($action, $args=NULL) {
@@ -945,10 +989,35 @@ function common_fancy_url($action, $args=NULL) {
                } else {
                        return common_path($args['nickname'].'/favorites');
                }
+        case 'favoritesrss':
+               return common_path($args['nickname'].'/favorites/rss');
         case 'showmessage':
                return common_path('message/' . $args['message']);
         case 'newmessage':
                return common_path('message/new' . (($args) ? ('?' . http_build_query($args)) : ''));
+        case 'api':
+               # XXX: do fancy URLs for all the API methods
+               switch (strtolower($args['apiaction'])) {
+                case 'statuses':
+                       switch (strtolower($args['method'])) {
+                        case 'user_timeline.rss':
+                               return common_path('api/statuses/user_timeline/'.$args['argument'].'.rss');
+                        case 'user_timeline.atom':                             
+                               return common_path('api/statuses/user_timeline/'.$args['argument'].'.rss');
+                        case 'user_timeline.rss':
+                               return common_path('api/statuses/user_timeline/'.$args['argument'].'.rss');
+                        case 'user_timeline.atom':                             
+                               return common_path('api/statuses/user_timeline/'.$args['argument'].'.rss');
+                        default: return common_simple_url($action, $args);
+                       }
+                default: return common_simple_url($action, $args);
+               }
+        case 'sup':
+               if ($args && isset($args['seconds'])) {
+                       return common_path('main/sup?seconds='.$args['seconds']);                       
+               } else {
+                       return common_path('main/sup');
+               }
         default:
                return common_simple_url($action, $args);
        }
@@ -1084,7 +1153,7 @@ function common_save_replies($notice) {
                if (!$recipient) {
                        continue;
                }
-               if ($i == 0 && ($recipient->id != $sender->id)) { # Don't save reply to self
+               if ($i == 0 && ($recipient->id != $sender->id) && !$notice->reply_to) { # Don't save reply to self
                        $reply_for = $recipient;
                        $recipient_notice = $reply_for->getCurrentNotice();
                        if ($recipient_notice) {
@@ -1107,16 +1176,24 @@ function common_save_replies($notice) {
 }
 
 function common_broadcast_notice($notice, $remote=false) {
-       
+
        // Check to see if notice should go to Twitter
        $flink = Foreign_link::getForeignLink($notice->profile_id, 1); // 1 == Twitter
-       
-       if ($flink->noticesync == 1) {
-               if (!common_twitter_broadcast($notice, $flink)) {
-                       common_debug('Unable to send notice: ' . $notice->id . ' to Twitter.', __FILE__);
+       if (($flink->noticesync & FOREIGN_NOTICE_SEND) == FOREIGN_NOTICE_SEND) {
+
+               // If it's not a Twitter-style reply, or if the user WANTS to send replies...
+
+               if (!preg_match('/^@[a-zA-Z0-9_]{1,15}\b/u', $notice->content) ||
+                       (($flink->noticesync & FOREIGN_NOTICE_SEND_REPLY) == FOREIGN_NOTICE_SEND_REPLY)) {
+
+                       $result = common_twitter_broadcast($notice, $flink);
+
+                       if (!$result) {
+                               common_debug('Unable to send notice: ' . $notice->id . ' to Twitter.', __FILE__);
+                       }
                }
        }
-       
+
        if (common_config('queue', 'enabled')) {
                # Do it later!
                return common_enqueue_notice($notice);
@@ -1125,17 +1202,17 @@ function common_broadcast_notice($notice, $remote=false) {
        }
 }
 
-function common_twitter_broadcast($notice, $flink) {   
+function common_twitter_broadcast($notice, $flink) {
        global $config;
        $success = true;
        $fuser = $flink->getForeignUser();
        $twitter_user = $fuser->nickname;
        $twitter_password = $flink->credentials;
        $uri = 'http://www.twitter.com/statuses/update.json';
-       
+
        // XXX: Hack to get around PHP cURL's use of @ being a a meta character
        $statustxt = preg_replace('/^@/', ' @', $notice->content);
-       
+
        $options = array(
                CURLOPT_USERPWD                 => "$twitter_user:$twitter_password",
                CURLOPT_POST                    => true,
@@ -1151,27 +1228,27 @@ function common_twitter_broadcast($notice, $flink) {
                CURLOPT_CONNECTTIMEOUT  => 120,  // XXX: Scary!!!! How long should this be?
                CURLOPT_TIMEOUT                 => 120
        );
-       
+
        $ch = curl_init($uri);
     curl_setopt_array($ch, $options);
     $data = curl_exec($ch);
     $errmsg = curl_error($ch);
 
        if ($errmsg) {
-               common_debug("cURL error: $errmsg - trying to send notice for $twitter_user.", 
+               common_debug("cURL error: $errmsg - trying to send notice for $twitter_user.",
                        __FILE__);
                $success = false;
        }
 
        curl_close($ch);
-       
+
        if (!$data) {
                common_debug("No data returned by Twitter's API trying to send update for $twitter_user",
                        __FILE__);
                $success = false;
        }
 
-       // Twitter should return a status       
+       // Twitter should return a status
        $status = json_decode($data);
 
        if (!$status->id) {
@@ -1179,8 +1256,8 @@ function common_twitter_broadcast($notice, $flink) {
                        __FILE__);
                $success = false;
        }
-       
-       return $status;
+
+       return $success;
 }
 
 # Stick the notice on the queue
@@ -1276,15 +1353,18 @@ function common_notice_form($action=NULL, $content=NULL) {
        common_element('label', array('for' => 'status_textarea',
                                                                  'id' => 'status_label'),
                                   sprintf(_('What\'s up, %s?'), $user->nickname));
-        common_element('span', array('id' => 'counter', 'class' => 'counter'), '140');
+    common_element('span', array('id' => 'counter', 'class' => 'counter'), '140');
        common_element('textarea', array('id' => 'status_textarea',
                                                                         'cols' => 60,
                                                                         'rows' => 3,
                                                                         'name' => 'status_textarea'),
                                   ($content) ? $content : '');
+       common_hidden('token', common_session_token());
        if ($action) {
                common_hidden('returnto', $action);
        }
+       # set by JavaScript
+       common_hidden('inreplyto', 'false');
        common_element('input', array('id' => 'status_submit',
                                                                  'name' => 'status_submit',
                                                                  'type' => 'submit',
@@ -1680,3 +1760,63 @@ function common_keyize($str) {
        $str = preg_replace('/\s/', '_', $str);
        return $str;
 }
+
+function common_message_form($content, $user, $to) {
+       
+       common_element_start('form', array('id' => 'message_form',
+                                                                          'method' => 'post',
+                                                                          'action' => common_local_url('newmessage')));
+       
+       $mutual_users = $user->mutuallySubscribedUsers();
+       
+       $mutual = array();
+       
+       while ($mutual_users->fetch()) {
+               if ($mutual_users->id != $user->id) {
+                       $mutual[$mutual_users->id] = $mutual_users->nickname;
+               }
+       }
+       
+       $mutual_users->free();
+       unset($mutual_users);
+       
+       common_dropdown('to', _('To'), $mutual, NULL, FALSE, $to->id);
+       
+       common_element_start('p');
+       
+       common_element('textarea', array('id' => 'message_content',
+                                                                        'cols' => 60,
+                                                                        'rows' => 3,
+                                                                        'name' => 'content'),
+                                  ($content) ? $content : '');
+       
+       common_element('input', array('id' => 'message_send',
+                                                                 'name' => 'message_send',
+                                                                 'type' => 'submit',
+                                                                 'value' => _('Send')));
+       
+       common_hidden('token', common_session_token());
+       
+       common_element_end('p');
+       common_element_end('form');
+}
+
+function common_memcache() {
+       static $cache = NULL;
+       if (!common_config('memcached', 'enabled')) {
+               return NULL;
+       } else {
+               if (!$cache) {
+                       $cache = new Memcache();
+                       $servers = common_config('memcached', 'server');
+                       if (is_array($servers)) {
+                               foreach($servers as $server) {
+                                       $cache->addServer($server);
+                               }
+                       } else {
+                               $cache->addServer($servers);
+                       }
+               }
+               return $cache;
+       }
+}