Move mod/home to src/Module/Home

[friendica.git] / mod / dfrn_confirm.php

diff --git a/mod/dfrn_confirm.php b/mod/dfrn_confirm.php
index 0f001b11a294e9069f562368b458d11976488b5d..97d19f1b71babd53956b24cb1d3917bdc32d2a46 100644 (file)
--- a/mod/dfrn_confirm.php
+++ b/mod/dfrn_confirm.php
@@ -24,6 +24,7 @@ use Friendica\Core\Logger;
 use Friendica\Core\Protocol;
 use Friendica\Core\System;
 use Friendica\Database\DBA;
+use Friendica\Model\APContact;
 use Friendica\Model\Contact;
 use Friendica\Model\Group;
 use Friendica\Model\User;
@@ -33,11 +34,9 @@ use Friendica\Protocol\ActivityPub;
 use Friendica\Util\Crypto;
 use Friendica\Util\DateTimeFormat;
 use Friendica\Util\Network;
+use Friendica\Util\Strings;
 use Friendica\Util\XML;
 
-require_once 'include/enotify.php';
-require_once 'include/items.php';
-
 function dfrn_confirm_post(App $a, $handsfree = null)
 {
        $node = null;
@@ -62,7 +61,7 @@ function dfrn_confirm_post(App $a, $handsfree = null)
         * this being a page type which supports automatic friend acceptance. That is also Scenario 1
         * since we are operating on behalf of our registered user to approve a friendship.
         */
-       if (!x($_POST, 'source_url')) {
+       if (empty($_POST['source_url'])) {
                $uid = defaults($handsfree, 'uid', local_user());
                if (!$uid) {
                        notice(L10n::t('Permission denied.') . EOL);
@@ -84,7 +83,7 @@ function dfrn_confirm_post(App $a, $handsfree = null)
                        $cid      = 0;
                        $hidden   = intval(defaults($handsfree, 'hidden'  , 0));
                } else {
-                       $dfrn_id  = notags(trim(defaults($_POST, 'dfrn_id'   , '')));
+                       $dfrn_id  = Strings::escapeTags(trim(defaults($_POST, 'dfrn_id'   , '')));
                        $intro_id =      intval(defaults($_POST, 'intro_id'  , 0));
                        $duplex   =      intval(defaults($_POST, 'duplex'    , 0));
                        $cid      =      intval(defaults($_POST, 'contact_id', 0));
@@ -145,6 +144,14 @@ function dfrn_confirm_post(App $a, $handsfree = null)
                        $network = $contact['network'];
                }
 
+               // an empty DFRN-ID tells us that it had been a request via AP from a Friendica contact
+               if (($network === Protocol::DFRN) && empty($dfrn_id) && !empty($contact['hub-verify'])) {
+                       $apcontact = APContact::getByURL($contact['url']);
+                       if (!empty($apcontact)) {
+                               $network = Protocol::ACTIVITYPUB;
+                       }
+               }
+
                if ($network === Protocol::DFRN) {
                        /*
                         * Generate a key pair for all further communications with this person.
@@ -204,11 +211,11 @@ function dfrn_confirm_post(App $a, $handsfree = null)
                                $params['duplex'] = 1;
                        }
 
-                       if ($user['page-flags'] == Contact::PAGE_COMMUNITY) {
+                       if ($user['page-flags'] == User::PAGE_FLAGS_COMMUNITY) {
                                $params['page'] = 1;
                        }
 
-                       if ($user['page-flags'] == Contact::PAGE_PRVGROUP) {
+                       if ($user['page-flags'] == User::PAGE_FLAGS_PRVGROUP) {
                                $params['page'] = 2;
                        }
 
@@ -263,7 +270,7 @@ function dfrn_confirm_post(App $a, $handsfree = null)
                                        break;
                                case 1:
                                        // birthday paradox - generate new dfrn-id and fall through.
-                                       $new_dfrn_id = random_string();
+                                       $new_dfrn_id = Strings::getRandomHex();
                                        q("UPDATE contact SET `issued-id` = '%s' WHERE `id` = %d AND `uid` = %d",
                                                DBA::escape($new_dfrn_id),
                                                intval($contact_id),
@@ -339,7 +346,12 @@ function dfrn_confirm_post(App $a, $handsfree = null)
                } else {
                        if ($network == Protocol::ACTIVITYPUB) {
                                ActivityPub\Transmitter::sendContactAccept($contact['url'], $contact['hub-verify'], $uid);
-                               $pending = true;
+                               // Setting "pending" to true on a bidirectional contact request could create a problem when it isn't accepted on the other side
+                               // Then we have got a situation where - although one direction is accepted - the contact still appears as pending.
+                               // Possibly we need two different "pending" fields, one for incoming, one for outgoing?
+                               // This has to be thought over, but for now this here is a better solution.
+                               // $pending = $duplex;
+                               $pending = false;
                        } else {
                                $pending = false;
                        }
@@ -416,7 +428,7 @@ function dfrn_confirm_post(App $a, $handsfree = null)
         * In the section above where the confirming party makes a POST and
         * retrieves xml status information, they are communicating with the following code.
         */
-       if (x($_POST, 'source_url')) {
+       if (!empty($_POST['source_url'])) {
                // We are processing an external confirmation to an introduction created by our user.
                $public_key =         defaults($_POST, 'public_key', '');
                $dfrn_id    = hex2bin(defaults($_POST, 'dfrn_id'   , ''));
@@ -434,7 +446,7 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 
                // If $aes_key is set, both of these items require unpacking from the hex transport encoding.
 
-               if (x($aes_key)) {
+               if (!empty($aes_key)) {
                        $aes_key = hex2bin($aes_key);
                        $public_key = hex2bin($public_key);
                }