]> git.mxchange.org Git - friendica.git/blobdiff - src/Protocol/DFRN.php
Merge pull request #7260 from annando/sanitize-input
[friendica.git] / src / Protocol / DFRN.php
index e83732ffe2b57c219362995cee2b58136be3aa2a..ec4557e8221a70f833b090d2da98f32f8cb78b2b 100644 (file)
@@ -1229,7 +1229,6 @@ class DFRN
                $curlResult = Network::curl($url);
 
                if ($curlResult->isTimeout()) {
-                       Contact::markForArchival($contact);
                        return -2; // timed out
                }
 
@@ -1237,29 +1236,24 @@ class DFRN
 
                $curl_stat = $curlResult->getReturnCode();
                if (empty($curl_stat)) {
-                       Contact::markForArchival($contact);
                        return -3; // timed out
                }
 
                Logger::log('dfrn_deliver: ' . $xml, Logger::DATA);
 
                if (empty($xml)) {
-                       Contact::markForArchival($contact);
                        return 3;
                }
 
                if (strpos($xml, '<?xml') === false) {
                        Logger::log('dfrn_deliver: no valid XML returned');
                        Logger::log('dfrn_deliver: returned XML: ' . $xml, Logger::DATA);
-                       Contact::markForArchival($contact);
                        return 3;
                }
 
                $res = XML::parseString($xml);
 
                if (!is_object($res) || (intval($res->status) != 0) || !strlen($res->challenge) || !strlen($res->dfrn_id)) {
-                       Contact::markForArchival($contact);
-
                        if (empty($res->status)) {
                                $status = 3;
                        } else {
@@ -1315,7 +1309,6 @@ class DFRN
                if ($final_dfrn_id != $orig_id) {
                        Logger::log('dfrn_deliver: wrong dfrn_id.');
                        // did not decode properly - cannot trust this site
-                       Contact::markForArchival($contact);
                        return 3;
                }
 
@@ -1351,7 +1344,6 @@ class DFRN
 
                                default:
                                        Logger::log("rino: invalid requested version '$rino_remote_version'");
-                                       Contact::markForArchival($contact);
                                        return -8;
                        }
 
@@ -1391,26 +1383,22 @@ class DFRN
 
                $curl_stat = $postResult->getReturnCode();
                if (empty($curl_stat) || empty($xml)) {
-                       Contact::markForArchival($contact);
                        return -9; // timed out
                }
 
                if (($curl_stat == 503) && stristr($postResult->getHeader(), 'retry-after')) {
-                       Contact::markForArchival($contact);
                        return -10;
                }
 
                if (strpos($xml, '<?xml') === false) {
                        Logger::log('dfrn_deliver: phase 2: no valid XML returned');
                        Logger::log('dfrn_deliver: phase 2: returned XML: ' . $xml, Logger::DATA);
-                       Contact::markForArchival($contact);
                        return 3;
                }
 
                $res = XML::parseString($xml);
 
                if (!isset($res->status)) {
-                       Contact::markForArchival($contact);
                        return -11;
                }
 
@@ -1423,10 +1411,6 @@ class DFRN
                        Logger::log('Delivery returned status '.$res->status.' - '.$res->message, Logger::DEBUG);
                }
 
-               if (($res->status >= 200) && ($res->status <= 299)) {
-                       Contact::unmarkForArchival($contact);
-               }
-
                return intval($res->status);
        }
 
@@ -1454,7 +1438,6 @@ class DFRN
 
                                if (empty($contact['addr'])) {
                                        Logger::log('Unable to find contact handle for ' . $contact['id'] . ' - ' . $contact['url']);
-                                       Contact::markForArchival($contact);
                                        return -21;
                                }
                        }
@@ -1462,7 +1445,6 @@ class DFRN
                        $fcontact = Diaspora::personByHandle($contact['addr']);
                        if (empty($fcontact)) {
                                Logger::log('Unable to find contact details for ' . $contact['id'] . ' - ' . $contact['addr']);
-                               Contact::markForArchival($contact);
                                return -22;
                        }
                        $pubkey = $fcontact['pubkey'];
@@ -1491,26 +1473,22 @@ class DFRN
                $curl_stat = $postResult->getReturnCode();
                if (empty($curl_stat) || empty($xml)) {
                        Logger::log('Empty answer from ' . $contact['id'] . ' - ' . $dest_url);
-                       Contact::markForArchival($contact);
                        return -9; // timed out
                }
 
                if (($curl_stat == 503) && (stristr($postResult->getHeader(), 'retry-after'))) {
-                       Contact::markForArchival($contact);
                        return -10;
                }
 
                if (strpos($xml, '<?xml') === false) {
                        Logger::log('No valid XML returned from ' . $contact['id'] . ' - ' . $dest_url);
                        Logger::log('Returned XML: ' . $xml, Logger::DATA);
-                       Contact::markForArchival($contact);
                        return 3;
                }
 
                $res = XML::parseString($xml);
 
                if (empty($res->status)) {
-                       Contact::markForArchival($contact);
                        return -23;
                }
 
@@ -1518,10 +1496,6 @@ class DFRN
                        Logger::log('Transmit to ' . $dest_url . ' returned status '.$res->status.' - '.$res->message, Logger::DEBUG);
                }
 
-               if (($res->status >= 200) && ($res->status <= 299)) {
-                       Contact::unmarkForArchival($contact);
-               }
-
                return intval($res->status);
        }
 
@@ -1893,17 +1867,17 @@ class DFRN
         */
        private static function processSuggestion($xpath, $suggestion, $importer)
        {
-               Logger::log("Processing suggestions");
+               Logger::log('Processing suggestions');
 
                /// @TODO Rewrite this to one statement
                $suggest = [];
-               $suggest["uid"] = $importer["importer_uid"];
-               $suggest["cid"] = $importer["id"];
-               $suggest["url"] = $xpath->query("dfrn:url/text()", $suggestion)->item(0)->nodeValue;
-               $suggest["name"] = $xpath->query("dfrn:name/text()", $suggestion)->item(0)->nodeValue;
-               $suggest["photo"] = $xpath->query("dfrn:photo/text()", $suggestion)->item(0)->nodeValue;
-               $suggest["request"] = $xpath->query("dfrn:request/text()", $suggestion)->item(0)->nodeValue;
-               $suggest["body"] = $xpath->query("dfrn:note/text()", $suggestion)->item(0)->nodeValue;
+               $suggest['uid'] = $importer['importer_uid'];
+               $suggest['cid'] = $importer['id'];
+               $suggest['url'] = $xpath->query('dfrn:url/text()', $suggestion)->item(0)->nodeValue;
+               $suggest['name'] = $xpath->query('dfrn:name/text()', $suggestion)->item(0)->nodeValue;
+               $suggest['photo'] = $xpath->query('dfrn:photo/text()', $suggestion)->item(0)->nodeValue;
+               $suggest['request'] = $xpath->query('dfrn:request/text()', $suggestion)->item(0)->nodeValue;
+               $suggest['body'] = $xpath->query('dfrn:note/text()', $suggestion)->item(0)->nodeValue;
 
                // Does our member already have a friend matching this description?
 
@@ -1914,22 +1888,19 @@ class DFRN
                 *
                 * @see https://github.com/friendica/friendica/pull/3254#discussion_r107315246
                 */
-               $condition = ['name' => $suggest["name"], 'nurl' => Strings::normaliseLink($suggest["url"]),
-                       'uid' => $suggest["uid"]];
+               $condition = ['nurl' => Strings::normaliseLink($suggest['url']), 'uid' => $suggest['uid']];
                if (DBA::exists('contact', $condition)) {
                        return false;
                }
-
                // Do we already have an fcontact record for this person?
 
                $fid = 0;
-               $condition = ['url' => $suggest["url"], 'name' => $suggest["name"], 'request' => $suggest["request"]];
-               $fcontact = DBA::selectFirst('fcontact', ['id'], $condition);
+               $fcontact = DBA::selectFirst('fcontact', ['id'], ['url' => $suggest['url']]);
                if (DBA::isResult($fcontact)) {
-                       $fid = $fcontact["id"];
+                       $fid = $fcontact['id'];
 
                        // OK, we do. Do we already have an introduction for this person?
-                       if (DBA::exists('intro', ['uid' => $suggest["uid"], 'fid' => $fid])) {
+                       if (DBA::exists('intro', ['uid' => $suggest['uid'], 'fid' => $fid])) {
                                /*
                                 * The valid result means the friend we're about to send a friend
                                 * suggestion already has them in their contact, which means no further
@@ -1940,58 +1911,44 @@ class DFRN
                                return false;
                        }
                }
+
                if (!$fid) {
-                       $r = q(
-                               "INSERT INTO `fcontact` (`name`,`url`,`photo`,`request`) VALUES ('%s', '%s', '%s', '%s')",
-                               DBA::escape($suggest["name"]),
-                               DBA::escape($suggest["url"]),
-                               DBA::escape($suggest["photo"]),
-                               DBA::escape($suggest["request"])
-                       );
-                       $fid = $r[0]["id"];
+                       $fields = ['name' => $suggest['name'], 'url' => $suggest['url'],
+                               'photo' => $suggest['photo'], 'request' => $suggest['request']];
+                       DBA::insert('fcontact', $fields);
+                       $fid = DBA::lastInsertId();
                }
 
-               $condition = ['url' => $suggest["url"], 'name' => $suggest["name"], 'request' => $suggest["request"]];
-               $fcontact = DBA::selectFirst('fcontact', ['id'], $condition);
-
                /*
                 * If no record in fcontact is found, below INSERT statement will not
                 * link an introduction to it.
                 */
-               if (!DBA::isResult($fcontact)) {
+               if (empty($fid)) {
                        // Database record did not get created. Quietly give up.
                        exit();
                }
 
                $hash = Strings::getRandomHex();
 
-               q(
-                       "INSERT INTO `intro` (`uid`, `fid`, `contact-id`, `note`, `hash`, `datetime`, `blocked`)
-                       VALUES(%d, %d, %d, '%s', '%s', '%s', %d)",
-                       intval($suggest["uid"]),
-                       intval($fid),
-                       intval($suggest["cid"]),
-                       DBA::escape($suggest["body"]),
-                       DBA::escape($hash),
-                       DBA::escape(DateTimeFormat::utcNow()),
-                       intval(0)
-               );
+               $fields = ['uid' => $suggest['uid'], 'fid' => $fid, 'contact-id' => $suggest['cid'],
+                       'note' => $suggest['body'], 'hash' => $hash, 'datetime' => DateTimeFormat::utcNow(), 'blocked' => false];
+               DBA::insert('intro', $fields);
 
                notification(
                        [
-                               "type"         => NOTIFY_SUGGEST,
-                               "notify_flags" => $importer["notify-flags"],
-                               "language"     => $importer["language"],
-                               "to_name"      => $importer["username"],
-                               "to_email"     => $importer["email"],
-                               "uid"          => $importer["importer_uid"],
-                               "item"         => $suggest,
-                               "link"         => System::baseUrl()."/notifications/intros",
-                               "source_name"  => $importer["name"],
-                               "source_link"  => $importer["url"],
-                               "source_photo" => $importer["photo"],
-                               "verb"         => ACTIVITY_REQ_FRIEND,
-                               "otype"        => "intro"]
+                               'type'         => NOTIFY_SUGGEST,
+                               'notify_flags' => $importer['notify-flags'],
+                               'language'     => $importer['language'],
+                               'to_name'      => $importer['username'],
+                               'to_email'     => $importer['email'],
+                               'uid'          => $importer['importer_uid'],
+                               'item'         => $suggest,
+                               'link'         => System::baseUrl().'/notifications/intros',
+                               'source_name'  => $importer['name'],
+                               'source_link'  => $importer['url'],
+                               'source_photo' => $importer['photo'],
+                               'verb'         => ACTIVITY_REQ_FRIEND,
+                               'otype'        => 'intro']
                );
 
                return true;
@@ -2259,18 +2216,16 @@ class DFRN
        {
                Logger::log("Process verb ".$item["verb"]." and object-type ".$item["object-type"]." for entrytype ".$entrytype, Logger::DEBUG);
 
-               if (($entrytype == DFRN::TOP_LEVEL)) {
+               if (($entrytype == DFRN::TOP_LEVEL) && !empty($importer['id'])) {
                        // The filling of the the "contact" variable is done for legcy reasons
                        // The functions below are partly used by ostatus.php as well - where we have this variable
-                       $r = q("SELECT * FROM `contact` WHERE `id` = %d", intval($importer["id"]));
-                       $contact = $r[0];
-                       $nickname = $contact["nick"];
+                       $contact = Contact::select([], ['id' => $importer['id']]);
 
                        // Big question: Do we need these functions? They were part of the "consume_feed" function.
                        // This function once was responsible for DFRN and OStatus.
                        if (activity_match($item["verb"], ACTIVITY_FOLLOW)) {
                                Logger::log("New follower");
-                               Contact::addRelationship($importer, $contact, $item, $nickname);
+                               Contact::addRelationship($importer, $contact, $item);
                                return false;
                        }
                        if (activity_match($item["verb"], ACTIVITY_UNFOLLOW)) {
@@ -2280,7 +2235,7 @@ class DFRN
                        }
                        if (activity_match($item["verb"], ACTIVITY_REQ_FRIEND)) {
                                Logger::log("New friend request");
-                               Contact::addRelationship($importer, $contact, $item, $nickname, true);
+                               Contact::addRelationship($importer, $contact, $item, true);
                                return false;
                        }
                        if (activity_match($item["verb"], ACTIVITY_UNFRIEND)) {