]> git.mxchange.org Git - friendica.git/blobdiff - mod/item.php
Harden OEmbed link discovery
[friendica.git] / mod / item.php
index 68904d9ecbc6fa30647ccfbe17324d63506e2a53..0b0479017bc21c887107eb8e49a0ea78eac20271 100644 (file)
@@ -45,8 +45,7 @@ use Friendica\Model\Contact;
 use Friendica\Model\Conversation;
 use Friendica\Model\FileTag;
 use Friendica\Model\Item;
-use Friendica\Model\Notify;
-use Friendica\Model\Notify\Type;
+use Friendica\Model\Notification;
 use Friendica\Model\Photo;
 use Friendica\Model\Post;
 use Friendica\Model\Tag;
@@ -55,8 +54,8 @@ use Friendica\Network\HTTPException;
 use Friendica\Object\EMail\ItemCCEMail;
 use Friendica\Protocol\Activity;
 use Friendica\Protocol\Diaspora;
-use Friendica\Util\DateTimeFormat;
 use Friendica\Security\Security;
+use Friendica\Util\DateTimeFormat;
 use Friendica\Worker\Delivery;
 
 function item_post(App $a) {
@@ -252,7 +251,7 @@ function item_post(App $a) {
                $verb              = $orig_post['verb'];
                $objecttype        = $orig_post['object-type'];
                $app               = $orig_post['app'];
-               $categories        = $orig_post['file'] ?? '';
+               $categories        = Post\Category::getTextByURIId($orig_post['uri-id'], $orig_post['uid']);
                $title             = trim($_REQUEST['title'] ?? '');
                $body              = trim($body);
                $private           = $orig_post['private'];
@@ -344,10 +343,7 @@ function item_post(App $a) {
                $filedas = FileTag::fileToArray($categories);
        }
 
-       // save old and new categories, so we can determine what needs to be deleted from pconfig
-       $categories_old = $categories;
        $categories = FileTag::listToFile(trim($_REQUEST['category'] ?? ''), 'category');
-       $categories_new = $categories;
 
        if (!empty($filedas) && is_array($filedas)) {
                // append the fileas stuff to the new categories list
@@ -696,9 +692,6 @@ function item_post(App $a) {
 
                Item::update($fields, ['id' => $post_id]);
 
-               // update filetags in pconfig
-               FileTag::updatePconfig($uid, $categories_old, $categories_new, 'category');
-
                if ($return_path) {
                        DI::baseUrl()->redirect($return_path);
                }
@@ -745,15 +738,12 @@ function item_post(App $a) {
                Tag::createImplicitMentions($datarray['uri-id'], $datarray['thr-parent-id']);
        }
 
-       // update filetags in pconfig
-       FileTag::updatePconfig($uid, $categories_old, $categories_new, 'category');
-
        // These notifications are sent if someone else is commenting other your wall
        if ($contact_record != $author) {
                if ($toplevel_item_id) {
                        notification([
-                               'type'  => Type::COMMENT,
-                               'otype' => Notify\ObjectType::ITEM,
+                               'type'  => Notification\Type::COMMENT,
+                               'otype' => Notification\ObjectType::ITEM,
                                'verb'  => Activity::POST,
                                'uid'   => $profile_uid,
                                'cid'   => $datarray['author-id'],
@@ -762,8 +752,8 @@ function item_post(App $a) {
                        ]);
                } elseif (empty($forum_contact)) {
                        notification([
-                               'type'  => Type::WALL,
-                               'otype' => Notify\ObjectType::ITEM,
+                               'type'  => Notification\Type::WALL,
+                               'otype' => Notification\ObjectType::ITEM,
                                'verb'  => Activity::POST,
                                'uid'   => $profile_uid,
                                'cid'   => $datarray['author-id'],
@@ -828,24 +818,50 @@ function item_post_return($baseurl, $api_source, $return_path)
 function item_content(App $a)
 {
        if (!Session::isAuthenticated()) {
-               return;
+               throw new HTTPException\UnauthorizedException();
+       }
+
+       $args = DI::args();
+
+       if (!$args->has(3)) {
+               throw new HTTPException\BadRequestException();
        }
 
        $o = '';
+       switch ($args->get(1)) {
+               case 'drop':
+                       if (DI::mode()->isAjax()) {
+                               Item::deleteForUser(['id' => $args->get(2)], local_user());
+                               // ajax return: [<item id>, 0 (no perm) | <owner id>]
+                               System::jsonExit([intval($args->get(2)), local_user()]);
+                       } else {
+                               if (!empty($args->get(3))) {
+                                       $o = drop_item($args->get(2), $args->get(3));
+                               } else {
+                                       $o = drop_item($args->get(2));
+                               }
+                       }
+                       break;
+               case 'block':
+                       $item = Post::selectFirstForUser(local_user(), ['guid', 'author-id', 'parent', 'gravity'], ['id' => $args->get(2)]);
+                       if (empty($item['author-id'])) {
+                               throw new HTTPException\NotFoundException('Item not found');
+                       }
 
-       if (($a->argc >= 3) && ($a->argv[1] === 'drop') && intval($a->argv[2])) {
-               if (DI::mode()->isAjax()) {
-                       Item::deleteForUser(['id' => $a->argv[2]], local_user());
-                       // ajax return: [<item id>, 0 (no perm) | <owner id>]
-                       System::jsonExit([intval($a->argv[2]), local_user()]);
-               } else {
-                       if (!empty($a->argv[3])) {
-                               $o = drop_item($a->argv[2], $a->argv[3]);
+                       $cdata = Contact::getPublicAndUserContacID($item['author-id'], local_user());
+                       if (empty($cdata['user'])) {
+                               throw new HTTPException\NotFoundException('Contact not found');
                        }
-                       else {
-                               $o = drop_item($a->argv[2]);
+
+                       Contact::block($cdata['user'], DI::l10n()->t('Blocked on item with guid %s', $item['guid']));
+
+                       if (DI::mode()->isAjax()) {
+                               // ajax return: [<item id>, 0 (no perm) | <owner id>]
+                               System::jsonExit([intval($args->get(2)), local_user()]);
+                       } else {
+                               item_redirect_after_action($item, $args->get(3));
                        }
-               }
+                       break;
        }
 
        return $o;
@@ -880,39 +896,10 @@ function drop_item(int $id, string $return = '')
        }
 
        if ((local_user() == $item['uid']) || $contact_id) {
-               if (!empty($item['parent'])) {
-                       $parentitem = Post::selectFirstForUser(local_user(), ['guid'], ['id' => $item['parent']]);
-               }
-
                // delete the item
                Item::deleteForUser(['id' => $item['id']], local_user());
 
-               $return_url = hex2bin($return);
-
-               // removes update_* from return_url to ignore Ajax refresh
-               $return_url = str_replace("update_", "", $return_url);
-
-               // Check if delete a comment
-               if ($item['gravity'] == GRAVITY_COMMENT) {
-                       // Return to parent guid
-                       if (!empty($parentitem)) {
-                               DI::baseUrl()->redirect('display/' . $parentitem['guid']);
-                               //NOTREACHED
-                       } // In case something goes wrong
-                       else {
-                               DI::baseUrl()->redirect('network');
-                               //NOTREACHED
-                       }
-               } else {
-                       // if unknown location or deleting top level post called from display
-                       if (empty($return_url) || strpos($return_url, 'display') !== false) {
-                               DI::baseUrl()->redirect('network');
-                               //NOTREACHED
-                       } else {
-                               DI::baseUrl()->redirect($return_url);
-                               //NOTREACHED
-                       }
-               }
+               item_redirect_after_action($item, $return);
        } else {
                notice(DI::l10n()->t('Permission denied.'));
                DI::baseUrl()->redirect('display/' . $item['guid']);
@@ -921,3 +908,37 @@ function drop_item(int $id, string $return = '')
 
        return '';
 }
+
+function item_redirect_after_action($item, $returnUrlHex)
+{
+       $return_url = hex2bin($returnUrlHex);
+
+       // removes update_* from return_url to ignore Ajax refresh
+       $return_url = str_replace("update_", "", $return_url);
+
+       // Check if delete a comment
+       if ($item['gravity'] == GRAVITY_COMMENT) {
+               if (!empty($item['parent'])) {
+                       $parentitem = Post::selectFirstForUser(local_user(), ['guid'], ['id' => $item['parent']]);
+               }
+
+               // Return to parent guid
+               if (!empty($parentitem)) {
+                       DI::baseUrl()->redirect('display/' . $parentitem['guid']);
+                       //NOTREACHED
+               } // In case something goes wrong
+               else {
+                       DI::baseUrl()->redirect('network');
+                       //NOTREACHED
+               }
+       } else {
+               // if unknown location or deleting top level post called from display
+               if (empty($return_url) || strpos($return_url, 'display') !== false) {
+                       DI::baseUrl()->redirect('network');
+                       //NOTREACHED
+               } else {
+                       DI::baseUrl()->redirect($return_url);
+                       //NOTREACHED
+               }
+       }
+}