Prevent template generation in media/photo/upload output

[friendica.git] / src / Module / Contact / Hovercard.php

diff --git a/src/Module/Contact/Hovercard.php b/src/Module/Contact/Hovercard.php
index 655fc9e2d50dd03aa89bed911b1113af61efec49..4d58d994c283a4a473afea3c3fe5f408e920c4d6 100644 (file)
--- a/src/Module/Contact/Hovercard.php
+++ b/src/Module/Contact/Hovercard.php
@@ -1,6 +1,6 @@
 <?php
 /**
- * @copyright Copyright (C) 2020, Friendica
+ * @copyright Copyright (C) 2010-2023, the Friendica project
  *
  * @license GNU AGPL version 3 or any later version
  *
@@ -21,51 +21,65 @@
 
 namespace Friendica\Module\Contact;
 
+use Friendica\App;
 use Friendica\BaseModule;
+use Friendica\Core\Config\Capability\IManageConfigValues;
+use Friendica\Core\L10n;
 use Friendica\Core\Renderer;
-use Friendica\Core\Session;
+use Friendica\Core\Session\Capability\IHandleUserSessions;
+use Friendica\Core\System;
 use Friendica\Database\DBA;
-use Friendica\DI;
 use Friendica\Model\Contact;
-use Friendica\Model\GContact;
+use Friendica\Module\Response;
 use Friendica\Network\HTTPException;
+use Friendica\Util\Profiler;
 use Friendica\Util\Strings;
-use Friendica\Util\Proxy;
+use Psr\Log\LoggerInterface;
 
 /**
  * Asynchronous HTML fragment provider for frio contact hovercards
  */
 class Hovercard extends BaseModule
 {
-       public static function rawContent(array $parameters = [])
+       /** @var IManageConfigValues */
+       private $config;
+       /** @var IHandleUserSessions */
+       private $userSession;
+
+       public function __construct(IHandleUserSessions $userSession, IManageConfigValues $config, L10n $l10n, App\BaseURL $baseUrl, App\Arguments $args, LoggerInterface $logger, Profiler $profiler, Response $response, array $server, array $parameters = [])
+       {
+               parent::__construct($l10n, $baseUrl, $args, $logger, $profiler, $response, $server, $parameters);
+
+               $this->config      = $config;
+               $this->userSession = $userSession;
+       }
+
+       protected function rawContent(array $request = [])
        {
-               $contact_url = $_REQUEST['url'] ?? '';
+               $contact_url = $request['url'] ?? '';
 
                // Get out if the system doesn't have public access allowed
-               if (DI::config()->get('system', 'block_public') && !Session::isAuthenticated()) {
+               if ($this->config->get('system', 'block_public') && !$this->userSession->isAuthenticated()) {
                        throw new HTTPException\ForbiddenException();
                }
 
-               // If a contact is connected the url is internally changed to 'redir/CID'. We need the pure url to search for
-               // the contact. So we strip out the contact id from the internal url and look in the contact table for
-               // the real url (nurl)
-               if (strpos($contact_url, 'redir/') === 0) {
-                       $cid = intval(substr($contact_url, 6));
-                       $remote_contact = Contact::selectFirst(['nurl'], ['id' => $cid]);
-                       $contact_url = $remote_contact['nurl'] ?? '';
+               /* Possible formats for relative URLs that need to be converted to the absolute contact URL:
+                * - contact/redir/123456
+                * - contact/123456/conversations
+                */
+               if (strpos($contact_url, 'contact/') === 0 && preg_match('/(\d+)/', $contact_url, $matches)) {
+                       $remote_contact = Contact::selectFirst(['nurl'], ['id' => $matches[1]]);
+                       $contact_url    = $remote_contact['nurl'] ?? '';
                }
 
-               $contact = [];
-
-               // if it's the url containing https it should be converted to http
                if (!$contact_url) {
                        throw new HTTPException\BadRequestException();
                }
 
                // Search for contact data
                // Look if the local user has got the contact
-               if (Session::isAuthenticated()) {
-                       $contact = Contact::getByURLForUser($contact_url, local_user(), [], false);
+               if ($this->userSession->isAuthenticated()) {
+                       $contact = Contact::getByURLForUser($contact_url, $this->userSession->getLocalUserId());
                } else {
                        $contact = Contact::getByURL($contact_url, false);
                }
@@ -75,33 +89,32 @@ class Hovercard extends BaseModule
                }
 
                // Get the photo_menu - the menu if possible contact actions
-               if (Session::isAuthenticated()) {
-                       $actions = Contact::photoMenu($contact);
+               if ($this->userSession->isAuthenticated()) {
+                       $actions = Contact::photoMenu($contact, $this->userSession->getLocalUserId());
                } else {
                        $actions = [];
                }
 
                // Move the contact data to the profile array so we can deliver it to
                $tpl = Renderer::getMarkupTemplate('hovercard.tpl');
-               $o = Renderer::replaceMacros($tpl, [
+               $o   = Renderer::replaceMacros($tpl, [
                        '$profile' => [
                                'name'         => $contact['name'],
                                'nick'         => $contact['nick'],
                                'addr'         => $contact['addr'] ?: $contact['url'],
-                               'thumb'        => Proxy::proxifyUrl($contact['thumb'], false, Proxy::SIZE_THUMB),
-                               'url'          => Contact::magicLink($contact['url']),
+                               'thumb'        => Contact::getThumb($contact),
+                               'url'          => Contact::magicLinkByContact($contact),
                                'nurl'         => $contact['nurl'],
                                'location'     => $contact['location'],
                                'about'        => $contact['about'],
                                'network_link' => Strings::formatNetworkName($contact['network'], $contact['url']),
                                'tags'         => $contact['keywords'],
                                'bd'           => $contact['bd'] <= DBA::NULL_DATE ? '' : $contact['bd'],
-                               'account_type' => Contact::getAccountType($contact),
+                               'account_type' => Contact::getAccountType($contact['contact-type']),
                                'actions'      => $actions,
                        ],
                ]);
 
-               echo $o;
-               exit();
+               System::httpExit($o);
        }
 }