Improvement for PR 7854: Avoid leaking of BCC header data

[friendica.git] / src / Protocol / ActivityPub / Transmitter.php

diff --git a/src/Protocol/ActivityPub/Transmitter.php b/src/Protocol/ActivityPub/Transmitter.php
index c5f3bae4700dc90d62e6a09e171c3764c987da13..b9a00c48172320090df81f40821898b975095de5 100644 (file)
--- a/src/Protocol/ActivityPub/Transmitter.php
+++ b/src/Protocol/ActivityPub/Transmitter.php
@@ -19,6 +19,7 @@ use Friendica\Model\Contact;
 use Friendica\Model\Conversation;
 use Friendica\Model\Item;
 use Friendica\Model\Profile;
+use Friendica\Model\Photo;
 use Friendica\Model\Term;
 use Friendica\Model\User;
 use Friendica\Protocol\Activity;
@@ -652,6 +653,9 @@ class Transmitter
        public static function ItemArrayFromMail($mail_id)
        {
                $mail = DBA::selectFirst('mail', [], ['id' => $mail_id]);
+               if (!DBA::isResult($mail)) {
+                       return [];
+               }
 
                $reply = DBA::selectFirst('mail', ['uri'], ['parent-uri' => $mail['parent-uri'], 'reply' => false]);
 
@@ -695,11 +699,6 @@ class Transmitter
                $mail = self::ItemArrayFromMail($mail_id);
                $object = self::createNote($mail);
 
-               $object['to'] = $object['cc'];
-               unset($object['cc']);
-
-               $object['tag'] = [['type' => 'Mention', 'href' => $object['to'][0], 'name' => 'test']];
-
                if (!$object_mode) {
                        $data = ['@context' => ActivityPub::CONTEXT];
                } else {
@@ -725,6 +724,8 @@ class Transmitter
                unset($data['bcc']);
 
                $object['to'] = $data['to'];
+               $object['tag'] = [['type' => 'Mention', 'href' => $object['to'][0], 'name' => 'test']];
+
                unset($object['cc']);
                unset($object['bcc']);
 
@@ -1019,6 +1020,37 @@ class Transmitter
        {
                $attachments = [];
 
+               // Currently deactivated, since it creates side effects on Mastodon and Pleroma.
+               // It will be reactivated, once this cleared.
+               /*
+               $attach_data = BBCode::getAttachmentData($item['body']);
+               if (!empty($attach_data['url'])) {
+                       $attachment = ['type' => 'Page',
+                               'mediaType' => 'text/html',
+                               'url' => $attach_data['url']];
+
+                       if (!empty($attach_data['title'])) {
+                               $attachment['name'] = $attach_data['title'];
+                       }
+
+                       if (!empty($attach_data['description'])) {
+                               $attachment['summary'] = $attach_data['description'];
+                       }
+
+                       if (!empty($attach_data['image'])) {
+                               $imgdata = Images::getInfoFromURLCached($attach_data['image']);
+                               if ($imgdata) {
+                                       $attachment['icon'] = ['type' => 'Image',
+                                               'mediaType' => $imgdata['mime'],
+                                               'width' => $imgdata[0],
+                                               'height' => $imgdata[1],
+                                               'url' => $attach_data['image']];
+                               }
+                       }
+
+                       $attachments[] = $attachment;
+               }
+               */
                $arr = explode('[/attach],', $item['attach']);
                if (count($arr)) {
                        foreach ($arr as $r) {
@@ -1097,19 +1129,34 @@ class Transmitter
        }
 
        /**
-        * Remove image elements and replaces them with links to the image
+        * Remove image elements since they are added as attachment
         *
         * @param string $body
         *
-        * @return string with replaced elements
+        * @return string with removed images
         */
        private static function removePictures($body)
        {
                // Simplify image codes
                $body = preg_replace("/\[img\=([0-9]*)x([0-9]*)\](.*?)\[\/img\]/ism", '[img]$3[/img]', $body);
+               $body = preg_replace("/\[img\=(.*?)\](.*?)\[\/img\]/ism", '[img]$1[/img]', $body);
+
+               // Now remove local links
+               $body = preg_replace_callback(
+                       '/\[url=([^\[\]]*)\]\[img\](.*)\[\/img\]\[\/url\]/Usi',
+                       function ($match) {
+                               // We remove the link when it is a link to a local photo page
+                               if (Photo::isLocalPage($match[1])) {
+                                       return '';
+                               }
+                               // otherwise we just return the link
+                               return '[url]' . $match[1] . '[/url]';
+                       },
+                       $body
+               );
 
-               $body = preg_replace("/\[url=([^\[\]]*)\]\[img\](.*)\[\/img\]\[\/url\]/Usi", '[url]$1[/url]', $body);
-               $body = preg_replace("/\[img\]([^\[\]]*)\[\/img\]/Usi", '[url]$1[/url]', $body);
+               // Remove all pictures
+               $body = preg_replace("/\[img\]([^\[\]]*)\[\/img\]/Usi", '', $body);
 
                return $body;
        }
@@ -1187,6 +1234,10 @@ class Transmitter
         */
        public static function createNote($item)
        {
+               if (empty($item)) {
+                       return [];
+               }
+
                if ($item['event-type'] == 'event') {
                        $type = 'Event';
                } elseif (!empty($item['title'])) {
@@ -1254,6 +1305,13 @@ class Transmitter
                        $data['content'] = BBCode::convert($body, false, 9);
                }
 
+               $regexp = "/[@!]\[url\=([^\[\]]*)\].*?\[\/url\]/ism";
+               $richbody = preg_replace_callback($regexp, ['self', 'mentionCallback'], $item['body']);
+               $richbody = BBCode::removeAttachment($richbody);
+
+               $data['contentMap']['text/html'] = BBCode::convert($richbody, false);
+               $data['contentMap']['text/markdown'] = BBCode::toMarkdown($item["body"]);
+
                $data['source'] = ['content' => $item['body'], 'mediaType' => "text/bbcode"];
 
                if (!empty($item['signed_text']) && ($item['uri'] != $item['thr-parent'])) {