Merge pull request #5830 from nupplaphil/update_from_boot

[friendica.git] / mod / cal.php

diff --git a/mod/cal.php b/mod/cal.php
index a4c26eed3a6f1511eb33e12042150c665dd5b147..6f483acc163478853847b72c36b343bccb0117d4 100644 (file)
--- a/mod/cal.php
+++ b/mod/cal.php
@@ -17,10 +17,12 @@ use Friendica\Database\DBA;
 use Friendica\Model\Contact;
 use Friendica\Model\Event;
 use Friendica\Model\Group;
+use Friendica\Model\Item;
 use Friendica\Model\Profile;
 use Friendica\Protocol\DFRN;
 use Friendica\Util\DateTimeFormat;
 use Friendica\Util\Temporal;
+use Friendica\Util\Security;
 
 function cal_init(App $a)
 {
@@ -28,52 +30,54 @@ function cal_init(App $a)
                DFRN::autoRedir($a, $a->argv[1]);
        }
 
-       if ((Config::get('system', 'block_public')) && (!local_user()) && (!remote_user())) {
-               return;
+       if (Config::get('system', 'block_public') && !local_user() && !remote_user()) {
+               System::httpExit(403, ['title' => L10n::t('Access denied.')]);
        }
 
-       Nav::setSelected('events');
+       if ($a->argc < 2) {
+               System::httpExit(403, ['title' => L10n::t('Access denied.')]);
+       }
 
-       if ($a->argc > 1) {
-               $nick = $a->argv[1];
-               $user = DBA::selectFirst('user', [], ['nickname' => $nick, 'blocked' => false]);
-               if (!DBA::isResult($user)) {
-                       return;
-               }
+       Nav::setSelected('events');
 
-               $a->data['user'] = $user;
-               $a->profile_uid = $user['uid'];
+       $nick = $a->argv[1];
+       $user = DBA::selectFirst('user', [], ['nickname' => $nick, 'blocked' => false]);
+       if (!DBA::isResult($user)) {
+               System::httpExit(404, ['title' => L10n::t('Page not found.')]);
+       }
 
-               // if it's a json request abort here becaus we don't
-               // need the widget data
-               if ($a->argv[2] === 'json') {
-                       return;
-               }
+       $a->data['user'] = $user;
+       $a->profile_uid = $user['uid'];
 
-               $profile = Profile::getByNickname($nick, $a->profile_uid);
+       // if it's a json request abort here becaus we don't
+       // need the widget data
+       if (!empty($a->argv[2]) && ($a->argv[2] === 'json')) {
+               return;
+       }
 
-               $account_type = Contact::getAccountType($profile);
+       $profile = Profile::getByNickname($nick, $a->profile_uid);
 
-               $tpl = get_markup_template("vcard-widget.tpl");
+       $account_type = Contact::getAccountType($profile);
 
-               $vcard_widget = replace_macros($tpl, [
-                       '$name' => $profile['name'],
-                       '$photo' => $profile['photo'],
-                       '$addr' => (($profile['addr'] != "") ? $profile['addr'] : ""),
-                       '$account_type' => $account_type,
-                       '$pdesc' => (($profile['pdesc'] != "") ? $profile['pdesc'] : ""),
-               ]);
+       $tpl = get_markup_template("vcard-widget.tpl");
 
-               $cal_widget = Widget\CalendarExport::getHTML();
+       $vcard_widget = replace_macros($tpl, [
+               '$name' => $profile['name'],
+               '$photo' => $profile['photo'],
+               '$addr' => (($profile['addr'] != "") ? $profile['addr'] : ""),
+               '$account_type' => $account_type,
+               '$pdesc' => (($profile['pdesc'] != "") ? $profile['pdesc'] : ""),
+       ]);
 
-               if (!x($a->page, 'aside')) {
-                       $a->page['aside'] = '';
-               }
+       $cal_widget = Widget\CalendarExport::getHTML();
 
-               $a->page['aside'] .= $vcard_widget;
-               $a->page['aside'] .= $cal_widget;
+       if (!x($a->page, 'aside')) {
+               $a->page['aside'] = '';
        }
 
+       $a->page['aside'] .= $vcard_widget;
+       $a->page['aside'] .= $cal_widget;
+
        return;
 }
 
@@ -92,15 +96,10 @@ function cal_content(App $a)
                '$i18n' => $i18n,
        ]);
 
-       $etpl = get_markup_template('event_end.tpl');
-       $a->page['end'] .= replace_macros($etpl, [
-               '$baseurl' => System::baseUrl(),
-       ]);
-
        $mode = 'view';
        $y = 0;
        $m = 0;
-       $ignored = ((x($_REQUEST, 'ignored')) ? intval($_REQUEST['ignored']) : 0);
+       $ignored = (x($_REQUEST, 'ignored') ? intval($_REQUEST['ignored']) : 0);
 
        $format = 'ical';
        if ($a->argc == 4 && $a->argv[2] == 'export') {
@@ -138,13 +137,13 @@ function cal_content(App $a)
 
        $is_owner = local_user() == $a->profile['profile_uid'];
 
-       if ($a->profile['hidewall'] && (!$is_owner) && (!$remote_contact)) {
+       if ($a->profile['hidewall'] && !$is_owner && !$remote_contact) {
                notice(L10n::t('Access to this profile has been restricted.') . EOL);
                return;
        }
 
        // get the permissions
-       $sql_perms = item_permissions_sql($owner_uid, $remote_contact, $groups);
+       $sql_perms = Item::getPermissionsSQLByUserId($owner_uid, $remote_contact, $groups);
        // we only want to have the events of the profile owner
        $sql_extra = " AND `event`.`cid` = 0 " . $sql_perms;
 
@@ -194,7 +193,7 @@ function cal_content(App $a)
                $finish = sprintf('%d-%d-%d %d:%d:%d', $y, $m, $dim, 23, 59, 59);
 
 
-               if ($a->argv[2] === 'json') {
+               if (!empty($a->argv[2]) && ($a->argv[2] === 'json')) {
                        if (x($_GET, 'start')) {
                                $start = $_GET['start'];
                        }
@@ -222,7 +221,7 @@ function cal_content(App $a)
 
                // get events by id or by date
                if ($event_params['event_id']) {
-                       $r = Event::getListById($owner_uid, $event_params['event-id'], $sql_extra);
+                       $r = Event::getListById($owner_uid, $event_params['event_id'], $sql_extra);
                } else {
                        $r = Event::getListByDate($owner_uid, $event_params, $sql_extra);
                }
@@ -242,7 +241,7 @@ function cal_content(App $a)
                // transform the event in a usable array
                $events = Event::prepareListForTemplate($r);
 
-               if ($a->argv[2] === 'json') {
+               if (!empty($a->argv[2]) && ($a->argv[2] === 'json')) {
                        echo json_encode($events);
                        killme();
                }
@@ -293,16 +292,16 @@ function cal_content(App $a)
        }
 
        if ($mode == 'export') {
-               if (!(intval($owner_uid))) {
+               if (!intval($owner_uid)) {
                        notice(L10n::t('User not found'));
                        return;
                }
 
                // Test permissions
                // Respect the export feature setting for all other /cal pages if it's not the own profile
-               if (((local_user() !== intval($owner_uid))) && !Feature::isEnabled($owner_uid, "export_calendar")) {
+               if ((local_user() !== intval($owner_uid)) && !Feature::isEnabled($owner_uid, "export_calendar")) {
                        notice(L10n::t('Permission denied.') . EOL);
-                       goaway('cal/' . $nick);
+                       $a->internalRedirect('cal/' . $nick);
                }
 
                // Get the export data by uid
@@ -323,7 +322,7 @@ function cal_content(App $a)
                                $return_path = "cal/" . $nick;
                        }
 
-                       goaway($return_path);
+                       $a->internalRedirect($return_path);
                }
 
                // If nothing went wrong we can echo the export content