Merge branch 'master', remote-tracking branch 'remotes/upstream/master'

[friendica.git] / mod / photo.php

diff --git a/mod/photo.php b/mod/photo.php
index 3a702512005789bd187440d8cba585114b565641..3cd8250a9e7bd727cfbe5666c6b96e58da09f5fb 100644 (file)
--- a/mod/photo.php
+++ b/mod/photo.php
@@ -4,6 +4,32 @@ require_once('include/security.php');
 
 function photo_init(&$a) {
 
+       // To-Do:
+       // - checking with realpath
+       // - checking permissions
+       /*
+       $cache = get_config('system','itemcache');
+        if (($cache != '') and is_dir($cache)) {
+               $cachefile = $cache."/".$a->argc."-".$a->argv[1]."-".$a->argv[2]."-".$a->argv[3];
+               if (file_exists($cachefile)) {
+                       $data = file_get_contents($cachefile);
+
+                       if(function_exists('header_remove')) {
+                               header_remove('Pragma');
+                               header_remove('pragma');
+                       }
+
+                       header("Content-type: image/jpeg");
+                       header("Expires: " . gmdate("D, d M Y H:i:s", time() + (3600*24)) . " GMT");
+                       header("Cache-Control: max-age=" . (3600*24));
+                       echo $data;
+                       killme();
+                       // NOTREACHED
+               }
+       }*/
+
+       $prvcachecontrol = false;
+
        switch($a->argc) {
                case 4:
                        $person = $a->argv[3];
@@ -27,6 +53,7 @@ function photo_init(&$a) {
 
        if(isset($type)) {
 
+
                /**
                 * Profile photos
                 */
@@ -109,6 +136,7 @@ function photo_init(&$a) {
                                );
                                if(count($r)) {
                                        $data = file_get_contents('images/nosign.jpg');
+                                       $prvcachecontrol = true;
                                }
                        }
                }
@@ -144,14 +172,32 @@ function photo_init(&$a) {
                }
        }
 
+       // Writing in cachefile
+       if (isset($cachefile) && $cachefile != '')
+               file_put_contents($cachefile, $data);
+
        if(function_exists('header_remove')) {
                header_remove('Pragma');
                header_remove('pragma');
        }
 
        header("Content-type: image/jpeg");
-       header("Expires: " . gmdate("D, d M Y H:i:s", time() + (3600*24)) . " GMT");
-       header("Cache-Control: max-age=" . (3600*24));
+
+       if($prvcachecontrol) {
+
+               // it is a private photo that they have no permission to view.
+               // tell the browser not to cache it, in case they authenticate
+               // and subsequently have permission to see it
+
+               header("Cache-Control: no-store, no-cache, must-revalidate");
+
+       }
+       else {
+
+               header("Expires: " . gmdate("D, d M Y H:i:s", time() + (3600*24)) . " GMT");
+               header("Cache-Control: max-age=" . (3600*24));
+
+       }
        echo $data;
        killme();
        // NOTREACHED