]> git.mxchange.org Git - friendica.git/blobdiff - mod/dfrn_confirm.php
Avoid beeing flooded by invalid requests
[friendica.git] / mod / dfrn_confirm.php
index 317eb9e2e7bceb3b8c606271e1582e910df7bdd6..d3fa45d361219a1ce9632e209ca18cd8ca06ec2b 100644 (file)
 use Friendica\App;
 use Friendica\Core\Config;
 use Friendica\Core\L10n;
+use Friendica\Core\Protocol;
 use Friendica\Core\System;
 use Friendica\Database\DBA;
-use Friendica\Database\DBM;
 use Friendica\Model\Contact;
 use Friendica\Model\Group;
 use Friendica\Model\User;
 use Friendica\Network\Probe;
 use Friendica\Protocol\Diaspora;
+use Friendica\Protocol\ActivityPub;
 use Friendica\Util\Crypto;
 use Friendica\Util\DateTimeFormat;
 use Friendica\Util\Network;
@@ -68,7 +69,7 @@ function dfrn_confirm_post(App $a, $handsfree = null)
                }
 
                $user = DBA::selectFirst('user', [], ['uid' => $uid]);
-               if (!DBM::is_result($user)) {
+               if (!DBA::isResult($user)) {
                        notice(L10n::t('Profile not found.') . EOL);
                        return;
                }
@@ -118,11 +119,11 @@ function dfrn_confirm_post(App $a, $handsfree = null)
                        AND `uid` = %d
                        AND `duplex` = 0
                        LIMIT 1",
-                       dbesc($dfrn_id),
+                       DBA::escape($dfrn_id),
                        intval($cid),
                        intval($uid)
                );
-               if (!DBM::is_result($r)) {
+               if (!DBA::isResult($r)) {
                        logger('Contact not found in DB.');
                        notice(L10n::t('Contact not found.') . EOL);
                        notice(L10n::t('This may occasionally happen if contact was requested by both persons and it has already been approved.') . EOL);
@@ -137,13 +138,13 @@ function dfrn_confirm_post(App $a, $handsfree = null)
                $dfrn_confirm = $contact['confirm'];
                $aes_allow    = $contact['aes_allow'];
 
-               $network = ((strlen($contact['issued-id'])) ? NETWORK_DFRN : NETWORK_OSTATUS);
+               $network = ((strlen($contact['issued-id'])) ? Protocol::DFRN : Protocol::OSTATUS);
 
                if ($contact['network']) {
                        $network = $contact['network'];
                }
 
-               if ($network === NETWORK_DFRN) {
+               if ($network === Protocol::DFRN) {
                        /*
                         * Generate a key pair for all further communications with this person.
                         * We have a keypair for every contact, and a site key for unknown people.
@@ -158,7 +159,7 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 
                        // Save the private key. Send them the public key.
                        q("UPDATE `contact` SET `prvkey` = '%s' WHERE `id` = %d AND `uid` = %d",
-                               dbesc($private_key),
+                               DBA::escape($private_key),
                                intval($contact_id),
                                intval($uid)
                        );
@@ -202,11 +203,11 @@ function dfrn_confirm_post(App $a, $handsfree = null)
                                $params['duplex'] = 1;
                        }
 
-                       if ($user['page-flags'] == PAGE_COMMUNITY) {
+                       if ($user['page-flags'] == Contact::PAGE_COMMUNITY) {
                                $params['page'] = 1;
                        }
 
-                       if ($user['page-flags'] == PAGE_PRVGROUP) {
+                       if ($user['page-flags'] == Contact::PAGE_PRVGROUP) {
                                $params['page'] = 2;
                        }
 
@@ -247,6 +248,7 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 
                        if (stristr($res, "<status") === false) {
                                // wrong xml! stop here!
+                               logger('Unexpected response posting to ' . $dfrn_confirm);
                                notice(L10n::t('Unexpected response from remote site: ') . EOL . htmlspecialchars($res) . EOL);
                                return;
                        }
@@ -262,7 +264,7 @@ function dfrn_confirm_post(App $a, $handsfree = null)
                                        // birthday paradox - generate new dfrn-id and fall through.
                                        $new_dfrn_id = random_string();
                                        q("UPDATE contact SET `issued-id` = '%s' WHERE `id` = %d AND `uid` = %d",
-                                               dbesc($new_dfrn_id),
+                                               DBA::escape($new_dfrn_id),
                                                intval($contact_id),
                                                intval($uid)
                                        );
@@ -281,7 +283,7 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 
                        if (($status == 0) && $intro_id) {
                                $intro = DBA::selectFirst('intro', ['note'], ['id' => $intro_id]);
-                               if (DBM::is_result($intro)) {
+                               if (DBA::isResult($intro)) {
                                        DBA::update('contact', ['reason' => $intro['note']], ['id' => $contact_id]);
                                }
 
@@ -305,13 +307,14 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 
                logger('dfrn_confirm: confirm - imported photos');
 
-               if ($network === NETWORK_DFRN) {
-                       $new_relation = CONTACT_IS_FOLLOWER;
-                       if (($relation == CONTACT_IS_SHARING) || ($duplex)) {
-                               $new_relation = CONTACT_IS_FRIEND;
+               if ($network === Protocol::DFRN) {
+                       $new_relation = Contact::FOLLOWER;
+
+                       if (($relation == Contact::SHARING) || ($duplex)) {
+                               $new_relation = Contact::FRIEND;
                        }
 
-                       if (($relation == CONTACT_IS_SHARING) && ($duplex)) {
+                       if (($relation == Contact::SHARING) && ($duplex)) {
                                $duplex = 0;
                        }
 
@@ -325,18 +328,25 @@ function dfrn_confirm_post(App $a, $handsfree = null)
                                `network` = '%s' WHERE `id` = %d
                        ",
                                intval($new_relation),
-                               dbesc(DateTimeFormat::utcNow()),
-                               dbesc(DateTimeFormat::utcNow()),
+                               DBA::escape(DateTimeFormat::utcNow()),
+                               DBA::escape(DateTimeFormat::utcNow()),
                                intval($duplex),
                                intval($hidden),
-                               dbesc(NETWORK_DFRN),
+                               DBA::escape(Protocol::DFRN),
                                intval($contact_id)
                        );
                } else {
-                       // $network !== NETWORK_DFRN
-                       $network = defaults($contact, 'network', NETWORK_OSTATUS);
+                       if ($network == Protocol::ACTIVITYPUB) {
+                               ActivityPub\Transmitter::sendContactAccept($contact['url'], $contact['hub-verify'], $uid);
+                               $pending = true;
+                       } else {
+                               $pending = false;
+                       }
+
+                       // $network !== Protocol::DFRN
+                       $network = defaults($contact, 'network', Protocol::OSTATUS);
 
-                       $arr = Probe::uri($contact['url']);
+                       $arr = Probe::uri($contact['url'], $network);
 
                        $notify  = defaults($contact, 'notify' , $arr['notify']);
                        $poll    = defaults($contact, 'poll'   , $arr['poll']);
@@ -346,54 +356,36 @@ function dfrn_confirm_post(App $a, $handsfree = null)
                        $new_relation = $contact['rel'];
                        $writable = $contact['writable'];
 
-                       if ($network === NETWORK_DIASPORA) {
+                       if (in_array($network, [Protocol::DIASPORA, Protocol::ACTIVITYPUB])) {
                                if ($duplex) {
-                                       $new_relation = CONTACT_IS_FRIEND;
+                                       $new_relation = Contact::FRIEND;
                                } else {
-                                       $new_relation = CONTACT_IS_FOLLOWER;
+                                       $new_relation = Contact::FOLLOWER;
                                }
 
-                               if ($new_relation != CONTACT_IS_FOLLOWER) {
+                               if ($new_relation != Contact::FOLLOWER) {
                                        $writable = 1;
                                }
                        }
 
                        DBA::delete('intro', ['id' => $intro_id]);
 
-                       $r = q("UPDATE `contact` SET `name-date` = '%s',
-                               `uri-date` = '%s',
-                               `addr` = '%s',
-                               `notify` = '%s',
-                               `poll` = '%s',
-                               `blocked` = 0,
-                               `pending` = 0,
-                               `network` = '%s',
-                               `writable` = %d,
-                               `hidden` = %d,
-                               `rel` = %d
-                               WHERE `id` = %d
-                       ",
-                               dbesc(DateTimeFormat::utcNow()),
-                               dbesc(DateTimeFormat::utcNow()),
-                               dbesc($addr),
-                               dbesc($notify),
-                               dbesc($poll),
-                               dbesc($network),
-                               intval($writable),
-                               intval($hidden),
-                               intval($new_relation),
-                               intval($contact_id)
-                       );
+                       $fields = ['name-date' => DateTimeFormat::utcNow(),
+                               'uri-date' => DateTimeFormat::utcNow(), 'addr' => $addr,
+                               'notify' => $notify, 'poll' => $poll, 'blocked' => false,
+                               'pending' => $pending, 'network' => $network,
+                               'writable' => $writable, 'hidden' => $hidden, 'rel' => $new_relation];
+                       DBA::update('contact', $fields, ['id' => $contact_id]);
                }
 
-               if (!DBM::is_result($r)) {
+               if (!DBA::isResult($r)) {
                        notice(L10n::t('Unable to set contact photo.') . EOL);
                }
 
                // reload contact info
                $contact = DBA::selectFirst('contact', [], ['id' => $contact_id]);
-               if ((isset($new_relation) && $new_relation == CONTACT_IS_FRIEND)) {
-                       if (DBM::is_result($contact) && ($contact['network'] === NETWORK_DIASPORA)) {
+               if ((isset($new_relation) && $new_relation == Contact::FRIEND)) {
+                       if (DBA::isResult($contact) && ($contact['network'] === Protocol::DIASPORA)) {
                                $ret = Diaspora::sendShare($user, $contact);
                                logger('share returns: ' . $ret);
                        }
@@ -401,6 +393,10 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 
                Group::addMember(User::getDefaultGroup($uid, $contact["network"]), $contact['id']);
 
+               if ($network == Protocol::ACTIVITYPUB && $duplex) {
+                       ActivityPub\Transmitter::sendActivity('Follow', $contact['url'], $uid);
+               }
+
                // Let's send our user to the contact editor in case they want to
                // do anything special with this new friend.
                if ($handsfree === null) {
@@ -444,7 +440,7 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 
                // Find our user's account
                $user = DBA::selectFirst('user', [], ['nickname' => $node]);
-               if (!DBM::is_result($user)) {
+               if (!DBA::isResult($user)) {
                        $message = L10n::t('No user record found for \'%s\' ', $node);
                        System::xmlExit(3, $message); // failure
                        // NOTREACHED
@@ -472,7 +468,7 @@ function dfrn_confirm_post(App $a, $handsfree = null)
                }
 
                $contact = DBA::selectFirst('contact', [], ['url' => $decrypted_source_url, 'uid' => $local_uid]);
-               if (!DBM::is_result($contact)) {
+               if (!DBA::isResult($contact)) {
                        if (strstr($decrypted_source_url, 'http:')) {
                                $newurl = str_replace('http:', 'https:', $decrypted_source_url);
                        } else {
@@ -480,7 +476,7 @@ function dfrn_confirm_post(App $a, $handsfree = null)
                        }
 
                        $contact = DBA::selectFirst('contact', [], ['url' => $newurl, 'uid' => $local_uid]);
-                       if (!DBM::is_result($contact)) {
+                       if (!DBA::isResult($contact)) {
                                // this is either a bogus confirmation (?) or we deleted the original introduction.
                                $message = L10n::t('Contact record was not found for you on our site.');
                                System::xmlExit(3, $message);
@@ -518,11 +514,11 @@ function dfrn_confirm_post(App $a, $handsfree = null)
                }
 
                $r = q("UPDATE `contact` SET `dfrn-id` = '%s', `pubkey` = '%s' WHERE `id` = %d",
-                       dbesc($decrypted_dfrn_id),
-                       dbesc($dfrn_pubkey),
+                       DBA::escape($decrypted_dfrn_id),
+                       DBA::escape($dfrn_pubkey),
                        intval($dfrn_record)
                );
-               if (!DBM::is_result($r)) {
+               if (!DBA::isResult($r)) {
                        $message = L10n::t('Unable to set your contact credentials on our system.');
                        System::xmlExit(3, $message);
                }
@@ -538,7 +534,7 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 
                // We're good but now we have to scrape the profile photo and send notifications.
                $contact = DBA::selectFirst('contact', ['photo'], ['id' => $dfrn_record]);
-               if (DBM::is_result($contact)) {
+               if (DBA::isResult($contact)) {
                        $photo = $contact['photo'];
                } else {
                        $photo = System::baseUrl() . '/images/person-175.jpg';
@@ -548,12 +544,13 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 
                logger('dfrn_confirm: request - photos imported');
 
-               $new_relation = CONTACT_IS_SHARING;
-               if (($relation == CONTACT_IS_FOLLOWER) || ($duplex)) {
-                       $new_relation = CONTACT_IS_FRIEND;
+               $new_relation = Contact::SHARING;
+
+               if (($relation == Contact::FOLLOWER) || ($duplex)) {
+                       $new_relation = Contact::FRIEND;
                }
 
-               if (($relation == CONTACT_IS_FOLLOWER) && ($duplex)) {
+               if (($relation == Contact::FOLLOWER) && ($duplex)) {
                        $duplex = 0;
                }
 
@@ -569,15 +566,15 @@ function dfrn_confirm_post(App $a, $handsfree = null)
                        `network` = '%s' WHERE `id` = %d
                ",
                        intval($new_relation),
-                       dbesc(DateTimeFormat::utcNow()),
-                       dbesc(DateTimeFormat::utcNow()),
+                       DBA::escape(DateTimeFormat::utcNow()),
+                       DBA::escape(DateTimeFormat::utcNow()),
                        intval($duplex),
                        intval($forum),
                        intval($prv),
-                       dbesc(NETWORK_DFRN),
+                       DBA::escape(Protocol::DFRN),
                        intval($dfrn_record)
                );
-               if (!DBM::is_result($r)) {      // indicates schema is messed up or total db failure
+               if (!DBA::isResult($r)) {       // indicates schema is messed up or total db failure
                        $message = L10n::t('Unable to update your contact profile details on our system');
                        System::xmlExit(3, $message);
                }
@@ -595,11 +592,11 @@ function dfrn_confirm_post(App $a, $handsfree = null)
                        LIMIT 1",
                        intval($dfrn_record)
                );
-               if (DBM::is_result($r)) {
+               if (DBA::isResult($r)) {
                        $combined = $r[0];
 
                        if ($combined['notify-flags'] & NOTIFY_CONFIRM) {
-                               $mutual = ($new_relation == CONTACT_IS_FRIEND);
+                               $mutual = ($new_relation == Contact::FRIEND);
                                notification([
                                        'type'         => NOTIFY_CONFIRM,
                                        'notify_flags' => $combined['notify-flags'],