don't accept pubsub from diaspora

[friendica.git] / mod / pubsub.php

diff --git a/mod/pubsub.php b/mod/pubsub.php
index b0157fbc35ded3b3ffdac9faa4f53ae93a1adf17..4dff5d531ab27a9450ebe2b37c6c37a7645ad0e1 100644 (file)
--- a/mod/pubsub.php
+++ b/mod/pubsub.php
@@ -29,20 +29,18 @@ function hub_post_return() {
 function pubsub_init(&$a) {
 
        $nick       = (($a->argc > 1) ? notags(trim($a->argv[1])) : '');
-       $contact_id = (($a->argc > 2) ? intval($a->argv[2]) : 0);
+       $contact_id = (($a->argc > 2) ? intval($a->argv[2])       : 0 );
 
        if($_SERVER['REQUEST_METHOD'] === 'GET') {
 
-               $hub_mode = notags(trim($_GET['hub_mode']));
-               $hub_topic = notags(trim($_GET['hub_topic']));
-               $hub_challenge = notags(trim($_GET['hub_challenge']));
-               $hub_lease = notags(trim($_GET['hub_lease_seconds']));
-               $hub_verify = notags(trim($_GET['hub_verify_token']));
+               $hub_mode      = ((x($_GET,'hub_mode'))          ? notags(trim($_GET['hub_mode']))          : '');
+               $hub_topic     = ((x($_GET,'hub_topic'))         ? notags(trim($_GET['hub_topic']))         : '');
+               $hub_challenge = ((x($_GET,'hub_challenge'))     ? notags(trim($_GET['hub_challenge']))     : '');
+               $hub_lease     = ((x($_GET,'hub_lease_seconds')) ? notags(trim($_GET['hub_lease_seconds'])) : '');
+               $hub_verify    = ((x($_GET,'hub_verify_token'))  ? notags(trim($_GET['hub_verify_token']))  : '');
 
-               $debugging = get_config('system','debugging');
-               if($debugging) {
-                       file_put_contents('pubsub.out', 'Pubsubhubbub subscription called from ' . $_SERVER['REMOTE_ADDR'] . ' at ' . datetime_convert() . "\n" . print_r($_GET,true), FILE_APPEND);
-               }
+               logger('pubsub: Subscription from ' . $_SERVER['REMOTE_ADDR']);
+               logger('pubsub: data: ' . print_r($_GET,true), LOGGER_DATA);
 
                $subscribe = (($hub_mode === 'subscribe') ? 1 : 0);
 
@@ -57,7 +55,8 @@ function pubsub_init(&$a) {
 
                $sql_extra = ((strlen($hub_verify)) ? sprintf(" AND `hub-verify` = '%s' ", dbesc($hub_verify)) : '');
 
-               $r = q("SELECT * FROM `contact` WHERE `poll` = '%s' AND `id` = %d AND `uid` = %d AND `blocked` = 0 $sql_extra LIMIT 1",
+               $r = q("SELECT * FROM `contact` WHERE `poll` = '%s' AND `id` = %d AND `uid` = %d 
+                       AND `blocked` = 0 AND `pending` = 0 $sql_extra LIMIT 1",
                        dbesc($hub_topic),
                        intval($contact_id),
                        intval($owner['uid'])
@@ -78,23 +77,27 @@ function pubsub_init(&$a) {
                        intval($contact['id'])
                );
 
-               hub_return(true, $hub_challenge);
-               
+               hub_return(true, $hub_challenge);               
        }
 }
 
+require_once('include/security.php');
 
 function pubsub_post(&$a) {
 
        $xml = file_get_contents('php://input');
 
-       $debugging = get_config('system','debugging');
-       $remote_host = 'Pubsub feed arrived from ' . $_SERVER['REMOTE_ADDR'] . ' at ' . datetime_convert() . ' for ' .  $a->cmd . "\n\n";
-       if($debugging)
-               file_put_contents('pubsub.out', $remote_host . $xml, FILE_APPEND);
+       logger('pubsub: feed arrived from ' . $_SERVER['REMOTE_ADDR'] . ' for ' .  $a->cmd );
+       logger('pubsub: user-agent: ' . $_SERVER['HTTP_USER_AGENT'] );
+       logger('pubsub: data: ' . $xml, LOGGER_DATA);
+
+//     if(! stristr($xml,'<?xml')) {
+//             logger('pubsub_post: bad xml');
+//             hub_post_return();
+//     }
 
        $nick       = (($a->argc > 1) ? notags(trim($a->argv[1])) : '');
-       $contact_id = (($a->argc > 2) ? intval($a->argv[2]) : 0);
+       $contact_id = (($a->argc > 2) ? intval($a->argv[2])       : 0 );
 
        $r = q("SELECT * FROM `user` WHERE `nickname` = '%s' LIMIT 1",
                dbesc($nick)
@@ -104,20 +107,36 @@ function pubsub_post(&$a) {
 
        $importer = $r[0];
 
-       $r = q("SELECT * FROM `contact` WHERE `subhub` = 1 AND `id` = %d AND `uid` = %d AND `blocked` = 0 LIMIT 1",
+       $r = q("SELECT * FROM `contact` WHERE `subhub` = 1 AND `id` = %d AND `uid` = %d 
+               AND ( `rel` = %d OR `rel` = %d ) AND `blocked` = 0 AND `readonly` = 0 LIMIT 1",
                intval($contact_id),
-               intval($importer['uid'])
+               intval($importer['uid']),
+               intval(CONTACT_IS_SHARING),
+               intval(CONTACT_IS_FRIEND)       
        );
-       if(! count($r))
+
+       if(! count($r)) {
+               logger('pubsub: no contact record - ignored');
                hub_post_return();
+       }
 
        $contact = $r[0];
 
+       // we have no way to match Diaspora guid's with atom post id's and could get duplicates.
+       // we'll assume that direct delivery is robust (and this is a bad assumption, but the duplicates are messy).
+
+       if($r[0]['network'] === NETWORK_DIASPORA)
+               hub_post_return();
+
        $feedhub = '';
 
        require_once('include/items.php');
 
-       consume_feed($xml,$importer,$contact,$feedhub);
+       consume_feed($xml,$importer,$contact,$feedhub,1);
+
+       // do it a second time so that any children find their parents.
+
+       consume_feed($xml,$importer,$contact,$feedhub,1);
 
        hub_post_return();