]> git.mxchange.org Git - friendica.git/blobdiff - mod/acl.php
projects / friendica.git / blobdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | inline | side by side
Merge pull request #6434 from AndyHee/2019.01-rc
[friendica.git] / mod / acl.php
diff --git a/mod/acl.php b/mod/acl.php
index 5d155511dbb478dba8ac0f27b0d08baf62dfde05..9f93b76a9b5bd88686d267e7c590d081ffac8cae 100644 (file)
--- a/mod/acl.php
+++ b/mod/acl.php
@@ -6,12 +6,13 @@ use Friendica\App;
 use Friendica\Content\Widget;
 use Friendica\Core\ACL;
 use Friendica\Core\Addon;
+use Friendica\Core\Logger;
+use Friendica\Core\Protocol;
 use Friendica\Database\DBA;
 use Friendica\Model\Contact;
 use Friendica\Model\Item;
-
-require_once 'include/dba.php';
-require_once 'mod/proxy.php';
+use Friendica\Util\Proxy as ProxyUtils;
+use Friendica\Util\Strings;
 
 function acl_content(App $a)
 {
@@ -33,7 +34,7 @@ function acl_content(App $a)
                $search = $_REQUEST['query'];
        }
 
-       logger("Searching for ".$search." - type ".$type." conversation ".$conv_id, LOGGER_DEBUG);
+       Logger::log("Searching for ".$search." - type ".$type." conversation ".$conv_id, Logger::DEBUG);
 
        if ($search != '') {
                $sql_extra = "AND `name` LIKE '%%" . DBA::escape($search) . "%%'";
@@ -46,7 +47,7 @@ function acl_content(App $a)
        // count groups and contacts
        $group_count = 0;
        if ($type == '' || $type == 'g') {
-               $r = q("SELECT COUNT(*) AS g FROM `group` WHERE `deleted` = 0 AND `uid` = %d $sql_extra",
+               $r = q("SELECT COUNT(*) AS g FROM `group` WHERE NOT `deleted` AND `uid` = %d $sql_extra",
                        intval(local_user())
                );
                $group_count = (int) $r[0]['g'];
@@ -58,7 +59,7 @@ function acl_content(App $a)
        if ($type == '' || $type == 'c') {
                // autocomplete for editor mentions
                $r = q("SELECT COUNT(*) AS c FROM `contact`
-                               WHERE `uid` = %d AND NOT `self`
+                               WHERE `uid` = %d AND NOT `self` AND NOT `deleted`
                                AND NOT `blocked` AND NOT `pending` AND NOT `archive`
                                AND `success_update` >= `failure_update`
                                AND `notify` != '' $sql_extra2",
@@ -68,7 +69,7 @@ function acl_content(App $a)
        } elseif ($type == 'f') {
                // autocomplete for editor mentions of forums
                $r = q("SELECT COUNT(*) AS c FROM `contact`
-                               WHERE `uid` = %d AND NOT `self`
+                               WHERE `uid` = %d AND NOT `self` AND NOT `deleted`
                                AND NOT `blocked` AND NOT `pending` AND NOT `archive`
                                AND (`forum` OR `prv`)
                                AND `success_update` >= `failure_update`
@@ -79,20 +80,21 @@ function acl_content(App $a)
        } elseif ($type == 'm') {
                // autocomplete for Private Messages
                $r = q("SELECT COUNT(*) AS c FROM `contact`
-                               WHERE `uid` = %d AND NOT `self`
+                               WHERE `uid` = %d AND NOT `self` AND NOT `deleted`
                                AND NOT `blocked` AND NOT `pending` AND NOT `archive`
                                AND `success_update` >= `failure_update`
-                               AND `network` IN ('%s', '%s') $sql_extra2",
+                               AND `network` IN ('%s', '%s', '%s') $sql_extra2",
                        intval(local_user()),
-                       DBA::escape(NETWORK_DFRN),
-                       DBA::escape(NETWORK_DIASPORA)
+                       DBA::escape(Protocol::ACTIVITYPUB),
+                       DBA::escape(Protocol::DFRN),
+                       DBA::escape(Protocol::DIASPORA)
                );
                $contact_count = (int) $r[0]['c'];
        } elseif ($type == 'a') {
                // autocomplete for Contacts
                $r = q("SELECT COUNT(*) AS c FROM `contact`
                                WHERE `uid` = %d AND NOT `self`
-                               AND NOT `pending` $sql_extra2",
+                               AND NOT `pending` AND NOT `deleted` $sql_extra2",
                        intval(local_user())
                );
                $contact_count = (int) $r[0]['c'];
@@ -123,7 +125,7 @@ function acl_content(App $a)
                        $groups[] = [
                                'type'  => 'g',
                                'photo' => 'images/twopeople.png',
-                               'name'  => htmlentities($g['name']),
+                               'name'  => htmlspecialchars($g['name']),
                                'id'    => intval($g['id']),
                                'uids'  => array_map('intval', explode(',', $g['uids'])),
                                'link'  => '',
@@ -138,53 +140,54 @@ function acl_content(App $a)
        $r = [];
        if ($type == '') {
                $r = q("SELECT `id`, `name`, `nick`, `micro`, `network`, `url`, `attag`, `addr`, `forum`, `prv`, (`prv` OR `forum`) AS `frm` FROM `contact`
-                               WHERE `uid` = %d AND NOT `self` AND NOT `blocked` AND NOT `pending` AND NOT `archive` AND `notify` != ''
+                               WHERE `uid` = %d AND NOT `self` AND NOT `deleted` AND NOT `blocked` AND NOT `pending` AND NOT `archive` AND `notify` != ''
                                AND `success_update` >= `failure_update` AND NOT (`network` IN ('%s', '%s'))
                                $sql_extra2
                                ORDER BY `name` ASC ",
                        intval(local_user()),
-                       DBA::escape(NETWORK_OSTATUS),
-                       DBA::escape(NETWORK_STATUSNET)
+                       DBA::escape(Protocol::OSTATUS),
+                       DBA::escape(Protocol::STATUSNET)
                );
        } elseif ($type == 'c') {
                $r = q("SELECT `id`, `name`, `nick`, `micro`, `network`, `url`, `attag`, `addr`, `forum`, `prv` FROM `contact`
-                               WHERE `uid` = %d AND NOT `self` AND NOT `blocked` AND NOT `pending` AND NOT `archive` AND `notify` != ''
+                               WHERE `uid` = %d AND NOT `self` AND NOT `deleted` AND NOT `blocked` AND NOT `pending` AND NOT `archive` AND `notify` != ''
                                AND `success_update` >= `failure_update` AND NOT (`network` IN ('%s'))
                                $sql_extra2
                                ORDER BY `name` ASC ",
                        intval(local_user()),
-                       DBA::escape(NETWORK_STATUSNET)
+                       DBA::escape(Protocol::STATUSNET)
                );
        } elseif ($type == 'f') {
                $r = q("SELECT `id`, `name`, `nick`, `micro`, `network`, `url`, `attag`, `addr`, `forum`, `prv` FROM `contact`
-                               WHERE `uid` = %d AND NOT `self` AND NOT `blocked` AND NOT `pending` AND NOT `archive` AND `notify` != ''
+                               WHERE `uid` = %d AND NOT `self` AND NOT `deleted` AND NOT `blocked` AND NOT `pending` AND NOT `archive` AND `notify` != ''
                                AND `success_update` >= `failure_update` AND NOT (`network` IN ('%s'))
                                AND (`forum` OR `prv`)
                                $sql_extra2
                                ORDER BY `name` ASC ",
                        intval(local_user()),
-                       DBA::escape(NETWORK_STATUSNET)
+                       DBA::escape(Protocol::STATUSNET)
                );
        } elseif ($type == 'm') {
                $r = q("SELECT `id`, `name`, `nick`, `micro`, `network`, `url`, `attag`, `addr` FROM `contact`
-                               WHERE `uid` = %d AND NOT `self` AND NOT `blocked` AND NOT `pending` AND NOT `archive`
-                               AND `success_update` >= `failure_update` AND `network` IN ('%s', '%s')
+                               WHERE `uid` = %d AND NOT `self` AND NOT `deleted` AND NOT `blocked` AND NOT `pending` AND NOT `archive`
+                               AND `success_update` >= `failure_update` AND `network` IN ('%s', '%s', '%s')
                                $sql_extra2
                                ORDER BY `name` ASC ",
                        intval(local_user()),
-                       DBA::escape(NETWORK_DFRN),
-                       DBA::escape(NETWORK_DIASPORA)
+                       DBA::escape(Protocol::ACTIVITYPUB),
+                       DBA::escape(Protocol::DFRN),
+                       DBA::escape(Protocol::DIASPORA)
                );
        } elseif ($type == 'a') {
                $r = q("SELECT `id`, `name`, `nick`, `micro`, `network`, `url`, `attag`, `addr`, `forum`, `prv` FROM `contact`
-                               WHERE `uid` = %d AND `pending` = 0 AND `success_update` >= `failure_update`
+                               WHERE `uid` = %d AND NOT `deleted` AND NOT `pending` AND `success_update` >= `failure_update`
                                $sql_extra2
                                ORDER BY `name` ASC ",
                        intval(local_user())
                );
        } elseif ($type == 'x') {
                // autocomplete for global contact search (e.g. navbar search)
-               $search = notags(trim($_REQUEST['search']));
+               $search = Strings::escapeTags(trim($_REQUEST['search']));
                $mode = $_REQUEST['smode'];
 
                $r = ACL::contactAutocomplete($search, $mode);
@@ -192,8 +195,8 @@ function acl_content(App $a)
                $contacts = [];
                foreach ($r as $g) {
                        $contacts[] = [
-                               'photo'   => proxy_url($g['photo'], false, PROXY_SIZE_MICRO),
-                               'name'    => $g['name'],
+                               'photo'   => ProxyUtils::proxifyUrl($g['photo'], false, ProxyUtils::SIZE_MICRO),
+                               'name'    => htmlspecialchars($g['name']),
                                'nick'    => defaults($g, 'addr', $g['url']),
                                'network' => $g['network'],
                                'link'    => $g['url'],
@@ -214,8 +217,8 @@ function acl_content(App $a)
                foreach ($r as $g) {
                        $entry = [
                                'type'    => 'c',
-                               'photo'   => proxy_url($g['micro'], false, PROXY_SIZE_MICRO),
-                               'name'    => htmlentities($g['name']),
+                               'photo'   => ProxyUtils::proxifyUrl($g['micro'], false, ProxyUtils::SIZE_MICRO),
+                               'name'    => htmlspecialchars($g['name']),
                                'id'      => intval($g['id']),
                                'network' => $g['network'],
                                'link'    => $g['url'],
@@ -275,8 +278,8 @@ function acl_content(App $a)
                        if (count($contact) > 0) {
                                $unknown_contacts[] = [
                                        'type'    => 'c',
-                                       'photo'   => proxy_url($contact['micro'], false, PROXY_SIZE_MICRO),
-                                       'name'    => htmlentities($contact['name']),
+                                       'photo'   => ProxyUtils::proxifyUrl($contact['micro'], false, ProxyUtils::SIZE_MICRO),
+                                       'name'    => htmlspecialchars($contact['name']),
                                        'id'      => intval($contact['cid']),
                                        'network' => $contact['network'],
                                        'link'    => $contact['url'],
Unnamed repository; edit this file 'description' to name the repository.