X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;ds=sidebyside;f=mod%2Fdfrn_confirm.php;h=944ba98be2fffb4bff09bb99b6ccf9a1c80bb8ec;hb=2db6171641bd3cd468b965470d9da56e82512e00;hp=8c897c76d643ffd626ee612f8750cc93385d7ebb;hpb=14fde5dc9b1915392601fb94efc6224c01f2b216;p=friendica.git

diff --git a/mod/dfrn_confirm.php b/mod/dfrn_confirm.php
index 8c897c76d6..944ba98be2 100644
--- a/mod/dfrn_confirm.php
+++ b/mod/dfrn_confirm.php
@@ -28,16 +28,12 @@ use Friendica\Model\Contact;
 use Friendica\Model\Group;
 use Friendica\Model\User;
 use Friendica\Network\Probe;
-use Friendica\Protocol\Diaspora;
-use Friendica\Protocol\ActivityPub;
 use Friendica\Util\Crypto;
 use Friendica\Util\DateTimeFormat;
 use Friendica\Util\Network;
+use Friendica\Util\Strings;
 use Friendica\Util\XML;
 
-require_once 'include/enotify.php';
-require_once 'include/items.php';
-
 function dfrn_confirm_post(App $a, $handsfree = null)
 {
 	$node = null;
@@ -62,8 +58,8 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 	 * this being a page type which supports automatic friend acceptance. That is also Scenario 1
 	 * since we are operating on behalf of our registered user to approve a friendship.
 	 */
-	if (!x($_POST, 'source_url')) {
-		$uid = defaults($handsfree, 'uid', local_user());
+	if (empty($_POST['source_url'])) {
+		$uid = ($handsfree['uid'] ?? 0) ?: local_user();
 		if (!$uid) {
 			notice(L10n::t('Permission denied.') . EOL);
 			return;
@@ -82,13 +78,13 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 			$intro_id = $handsfree['intro_id'];
 			$duplex   = $handsfree['duplex'];
 			$cid      = 0;
-			$hidden   = intval(defaults($handsfree, 'hidden'  , 0));
+			$hidden   = intval($handsfree['hidden'] ?? 0);
 		} else {
-			$dfrn_id  = notags(trim(defaults($_POST, 'dfrn_id'   , '')));
-			$intro_id =      intval(defaults($_POST, 'intro_id'  , 0));
-			$duplex   =      intval(defaults($_POST, 'duplex'    , 0));
-			$cid      =      intval(defaults($_POST, 'contact_id', 0));
-			$hidden   =      intval(defaults($_POST, 'hidden'    , 0));
+			$dfrn_id  = Strings::escapeTags(trim($_POST['dfrn_id'] ?? ''));
+			$intro_id = intval($_POST['intro_id']   ?? 0);
+			$duplex   = intval($_POST['duplex']     ?? 0);
+			$cid      = intval($_POST['contact_id'] ?? 0);
+			$hidden   = intval($_POST['hidden']     ?? 0);
 		}
 
 		/*
@@ -138,163 +134,153 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 		$site_pubkey  = $contact['site-pubkey'];
 		$dfrn_confirm = $contact['confirm'];
 		$aes_allow    = $contact['aes_allow'];
+		$protocol     = $contact['network'];
 
-		$network = ((strlen($contact['issued-id'])) ? Protocol::DFRN : Protocol::OSTATUS);
-
-		if ($contact['network']) {
-			$network = $contact['network'];
-		}
+		/*
+		 * Generate a key pair for all further communications with this person.
+		 * We have a keypair for every contact, and a site key for unknown people.
+		 * This provides a means to carry on relationships with other people if
+		 * any single key is compromised. It is a robust key. We're much more
+		 * worried about key leakage than anybody cracking it.
+		 */
+		$res = Crypto::newKeypair(4096);
 
-		if ($network === Protocol::DFRN) {
-			/*
-			 * Generate a key pair for all further communications with this person.
-			 * We have a keypair for every contact, and a site key for unknown people.
-			 * This provides a means to carry on relationships with other people if
-			 * any single key is compromised. It is a robust key. We're much more
-			 * worried about key leakage than anybody cracking it.
-			 */
-			$res = Crypto::newKeypair(4096);
+		$private_key = $res['prvkey'];
+		$public_key  = $res['pubkey'];
 
-			$private_key = $res['prvkey'];
-			$public_key  = $res['pubkey'];
+		// Save the private key. Send them the public key.
+		$fields = ['prvkey' => $private_key, 'protocol' => Protocol::DFRN];
+		DBA::update('contact', $fields, ['id' => $contact_id]);
 
-			// Save the private key. Send them the public key.
-			q("UPDATE `contact` SET `prvkey` = '%s' WHERE `id` = %d AND `uid` = %d",
-				DBA::escape($private_key),
-				intval($contact_id),
-				intval($uid)
-			);
+		$params = [];
 
-			$params = [];
+		/*
+		 * Per the DFRN protocol, we will verify both ends by encrypting the dfrn_id with our
+		 * site private key (person on the other end can decrypt it with our site public key).
+		 * Then encrypt our profile URL with the other person's site public key. They can decrypt
+		 * it with their site private key. If the decryption on the other end fails for either
+		 * item, it indicates tampering or key failure on at least one site and we will not be
+		 * able to provide a secure communication pathway.
+		 *
+		 * If other site is willing to accept full encryption, (aes_allow is 1 AND we have php5.3
+		 * or later) then we encrypt the personal public key we send them using AES-256-CBC and a
+		 * random key which is encrypted with their site public key.
+		 */
 
-			/*
-			 * Per the DFRN protocol, we will verify both ends by encrypting the dfrn_id with our
-			 * site private key (person on the other end can decrypt it with our site public key).
-			 * Then encrypt our profile URL with the other person's site public key. They can decrypt
-			 * it with their site private key. If the decryption on the other end fails for either
-			 * item, it indicates tampering or key failure on at least one site and we will not be
-			 * able to provide a secure communication pathway.
-			 *
-			 * If other site is willing to accept full encryption, (aes_allow is 1 AND we have php5.3
-			 * or later) then we encrypt the personal public key we send them using AES-256-CBC and a
-			 * random key which is encrypted with their site public key.
-			 */
+		$src_aes_key = openssl_random_pseudo_bytes(64);
 
-			$src_aes_key = openssl_random_pseudo_bytes(64);
+		$result = '';
+		openssl_private_encrypt($dfrn_id, $result, $user['prvkey']);
 
-			$result = '';
-			openssl_private_encrypt($dfrn_id, $result, $user['prvkey']);
+		$params['dfrn_id'] = bin2hex($result);
+		$params['public_key'] = $public_key;
 
-			$params['dfrn_id'] = bin2hex($result);
-			$params['public_key'] = $public_key;
+		$my_url = System::baseUrl() . '/profile/' . $user['nickname'];
 
-			$my_url = System::baseUrl() . '/profile/' . $user['nickname'];
+		openssl_public_encrypt($my_url, $params['source_url'], $site_pubkey);
+		$params['source_url'] = bin2hex($params['source_url']);
 
-			openssl_public_encrypt($my_url, $params['source_url'], $site_pubkey);
-			$params['source_url'] = bin2hex($params['source_url']);
+		if ($aes_allow && function_exists('openssl_encrypt')) {
+			openssl_public_encrypt($src_aes_key, $params['aes_key'], $site_pubkey);
+			$params['aes_key'] = bin2hex($params['aes_key']);
+			$params['public_key'] = bin2hex(openssl_encrypt($public_key, 'AES-256-CBC', $src_aes_key));
+		}
 
-			if ($aes_allow && function_exists('openssl_encrypt')) {
-				openssl_public_encrypt($src_aes_key, $params['aes_key'], $site_pubkey);
-				$params['aes_key'] = bin2hex($params['aes_key']);
-				$params['public_key'] = bin2hex(openssl_encrypt($public_key, 'AES-256-CBC', $src_aes_key));
-			}
+		$params['dfrn_version'] = DFRN_PROTOCOL_VERSION;
+		if ($duplex == 1) {
+			$params['duplex'] = 1;
+		}
 
-			$params['dfrn_version'] = DFRN_PROTOCOL_VERSION;
-			if ($duplex == 1) {
-				$params['duplex'] = 1;
-			}
+		if ($user['page-flags'] == User::PAGE_FLAGS_COMMUNITY) {
+			$params['page'] = 1;
+		}
 
-			if ($user['page-flags'] == Contact::PAGE_COMMUNITY) {
-				$params['page'] = 1;
-			}
+		if ($user['page-flags'] == User::PAGE_FLAGS_PRVGROUP) {
+			$params['page'] = 2;
+		}
 
-			if ($user['page-flags'] == Contact::PAGE_PRVGROUP) {
-				$params['page'] = 2;
-			}
+		Logger::log('Confirm: posting data to ' . $dfrn_confirm . ': ' . print_r($params, true), Logger::DATA);
 
-			Logger::log('Confirm: posting data to ' . $dfrn_confirm . ': ' . print_r($params, true), LOGGER_DATA);
+		/*
+		 *
+		 * POST all this stuff to the other site.
+		 * Temporarily raise the network timeout to 120 seconds because the default 60
+		 * doesn't always give the other side quite enough time to decrypt everything.
+		 *
+		 */
 
-			/*
-			 *
-			 * POST all this stuff to the other site.
-			 * Temporarily raise the network timeout to 120 seconds because the default 60
-			 * doesn't always give the other side quite enough time to decrypt everything.
-			 *
-			 */
+		$res = Network::post($dfrn_confirm, $params, [], 120)->getBody();
 
-			$res = Network::post($dfrn_confirm, $params, null, $redirects, 120)->getBody();
+		Logger::log(' Confirm: received data: ' . $res, Logger::DATA);
 
-			Logger::log(' Confirm: received data: ' . $res, LOGGER_DATA);
+		// Now figure out what they responded. Try to be robust if the remote site is
+		// having difficulty and throwing up errors of some kind.
 
-			// Now figure out what they responded. Try to be robust if the remote site is
-			// having difficulty and throwing up errors of some kind.
+		$leading_junk = substr($res, 0, strpos($res, '<?xml'));
 
-			$leading_junk = substr($res, 0, strpos($res, '<?xml'));
+		$res = substr($res, strpos($res, '<?xml'));
+		if (!strlen($res)) {
+			// No XML at all, this exchange is messed up really bad.
+			// We shouldn't proceed, because the xml parser might choke,
+			// and $status is going to be zero, which indicates success.
+			// We can hardly call this a success.
+			notice(L10n::t('Response from remote site was not understood.') . EOL);
+			return;
+		}
 
-			$res = substr($res, strpos($res, '<?xml'));
-			if (!strlen($res)) {
-				// No XML at all, this exchange is messed up really bad.
-				// We shouldn't proceed, because the xml parser might choke,
-				// and $status is going to be zero, which indicates success.
-				// We can hardly call this a success.
-				notice(L10n::t('Response from remote site was not understood.') . EOL);
-				return;
-			}
+		if (strlen($leading_junk) && Config::get('system', 'debugging')) {
+			// This might be more common. Mixed error text and some XML.
+			// If we're configured for debugging, show the text. Proceed in either case.
+			notice(L10n::t('Unexpected response from remote site: ') . EOL . $leading_junk . EOL);
+		}
 
-			if (strlen($leading_junk) && Config::get('system', 'debugging')) {
-				// This might be more common. Mixed error text and some XML.
-				// If we're configured for debugging, show the text. Proceed in either case.
-				notice(L10n::t('Unexpected response from remote site: ') . EOL . $leading_junk . EOL);
-			}
+		if (stristr($res, "<status") === false) {
+			// wrong xml! stop here!
+			Logger::log('Unexpected response posting to ' . $dfrn_confirm);
+			notice(L10n::t('Unexpected response from remote site: ') . EOL . htmlspecialchars($res) . EOL);
+			return;
+		}
 
-			if (stristr($res, "<status") === false) {
-				// wrong xml! stop here!
-				Logger::log('Unexpected response posting to ' . $dfrn_confirm);
-				notice(L10n::t('Unexpected response from remote site: ') . EOL . htmlspecialchars($res) . EOL);
-				return;
-			}
+		$xml = XML::parseString($res);
+		$status = (int) $xml->status;
+		$message = XML::unescape($xml->message);   // human readable text of what may have gone wrong.
+		switch ($status) {
+			case 0:
+				info(L10n::t("Confirmation completed successfully.") . EOL);
+				break;
+			case 1:
+				// birthday paradox - generate new dfrn-id and fall through.
+				$new_dfrn_id = Strings::getRandomHex();
+				q("UPDATE contact SET `issued-id` = '%s' WHERE `id` = %d AND `uid` = %d",
+					DBA::escape($new_dfrn_id),
+					intval($contact_id),
+					intval($uid)
+				);
+
+			case 2:
+				notice(L10n::t("Temporary failure. Please wait and try again.") . EOL);
+				break;
+			case 3:
+				notice(L10n::t("Introduction failed or was revoked.") . EOL);
+				break;
+		}
 
-			$xml = XML::parseString($res);
-			$status = (int) $xml->status;
-			$message = unxmlify($xml->message);   // human readable text of what may have gone wrong.
-			switch ($status) {
-				case 0:
-					info(L10n::t("Confirmation completed successfully.") . EOL);
-					break;
-				case 1:
-					// birthday paradox - generate new dfrn-id and fall through.
-					$new_dfrn_id = random_string();
-					q("UPDATE contact SET `issued-id` = '%s' WHERE `id` = %d AND `uid` = %d",
-						DBA::escape($new_dfrn_id),
-						intval($contact_id),
-						intval($uid)
-					);
-
-				case 2:
-					notice(L10n::t("Temporary failure. Please wait and try again.") . EOL);
-					break;
-				case 3:
-					notice(L10n::t("Introduction failed or was revoked.") . EOL);
-					break;
-			}
+		if (strlen($message)) {
+			notice(L10n::t('Remote site reported: ') . $message . EOL);
+		}
 
-			if (strlen($message)) {
-				notice(L10n::t('Remote site reported: ') . $message . EOL);
+		if (($status == 0) && $intro_id) {
+			$intro = DBA::selectFirst('intro', ['note'], ['id' => $intro_id]);
+			if (DBA::isResult($intro)) {
+				DBA::update('contact', ['reason' => $intro['note']], ['id' => $contact_id]);
 			}
 
-			if (($status == 0) && $intro_id) {
-				$intro = DBA::selectFirst('intro', ['note'], ['id' => $intro_id]);
-				if (DBA::isResult($intro)) {
-					DBA::update('contact', ['reason' => $intro['note']], ['id' => $contact_id]);
-				}
-
-				// Success. Delete the notification.
-				DBA::delete('intro', ['id' => $intro_id]);
-			}
+			// Success. Delete the notification.
+			DBA::delete('intro', ['id' => $intro_id]);
+		}
 
-			if ($status != 0) {
-				return;
-			}
+		if ($status != 0) {
+			return;
 		}
 
 		/*
@@ -308,96 +294,39 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 
 		Logger::log('dfrn_confirm: confirm - imported photos');
 
-		if ($network === Protocol::DFRN) {
-			$new_relation = Contact::FOLLOWER;
-
-			if (($relation == Contact::SHARING) || ($duplex)) {
-				$new_relation = Contact::FRIEND;
-			}
-
-			if (($relation == Contact::SHARING) && ($duplex)) {
-				$duplex = 0;
-			}
-
-			$r = q("UPDATE `contact` SET `rel` = %d,
-				`name-date` = '%s',
-				`uri-date` = '%s',
-				`blocked` = 0,
-				`pending` = 0,
-				`duplex` = %d,
-				`hidden` = %d,
-				`network` = '%s' WHERE `id` = %d
-			",
-				intval($new_relation),
-				DBA::escape(DateTimeFormat::utcNow()),
-				DBA::escape(DateTimeFormat::utcNow()),
-				intval($duplex),
-				intval($hidden),
-				DBA::escape(Protocol::DFRN),
-				intval($contact_id)
-			);
-		} else {
-			if ($network == Protocol::ACTIVITYPUB) {
-				ActivityPub\Transmitter::sendContactAccept($contact['url'], $contact['hub-verify'], $uid);
-				$pending = true;
-			} else {
-				$pending = false;
-			}
-
-			// $network !== Protocol::DFRN
-			$network = defaults($contact, 'network', Protocol::OSTATUS);
-
-			$arr = Probe::uri($contact['url'], $network);
+		$new_relation = Contact::FOLLOWER;
 
-			$notify  = defaults($contact, 'notify' , $arr['notify']);
-			$poll    = defaults($contact, 'poll'   , $arr['poll']);
-
-			$addr = $arr['addr'];
-
-			$new_relation = $contact['rel'];
-			$writable = $contact['writable'];
-
-			if (in_array($network, [Protocol::DIASPORA, Protocol::ACTIVITYPUB])) {
-				if ($duplex) {
-					$new_relation = Contact::FRIEND;
-				} else {
-					$new_relation = Contact::FOLLOWER;
-				}
-
-				if ($new_relation != Contact::FOLLOWER) {
-					$writable = 1;
-				}
-			}
-
-			DBA::delete('intro', ['id' => $intro_id]);
-
-			$fields = ['name-date' => DateTimeFormat::utcNow(),
-				'uri-date' => DateTimeFormat::utcNow(), 'addr' => $addr,
-				'notify' => $notify, 'poll' => $poll, 'blocked' => false,
-				'pending' => $pending, 'network' => $network,
-				'writable' => $writable, 'hidden' => $hidden, 'rel' => $new_relation];
-			DBA::update('contact', $fields, ['id' => $contact_id]);
+		if (($relation == Contact::SHARING) || ($duplex)) {
+			$new_relation = Contact::FRIEND;
 		}
 
-		if (!DBA::isResult($r)) {
-			notice(L10n::t('Unable to set contact photo.') . EOL);
+		if (($relation == Contact::SHARING) && ($duplex)) {
+			$duplex = 0;
 		}
 
+		$r = q("UPDATE `contact` SET `rel` = %d,
+			`name-date` = '%s',
+			`uri-date` = '%s',
+			`blocked` = 0,
+			`pending` = 0,
+			`duplex` = %d,
+			`hidden` = %d,
+			`network` = '%s' WHERE `id` = %d
+		",
+			intval($new_relation),
+			DBA::escape(DateTimeFormat::utcNow()),
+			DBA::escape(DateTimeFormat::utcNow()),
+			intval($duplex),
+			intval($hidden),
+			DBA::escape(Protocol::DFRN),
+			intval($contact_id)
+		);
+
 		// reload contact info
 		$contact = DBA::selectFirst('contact', [], ['id' => $contact_id]);
-		if ((isset($new_relation) && $new_relation == Contact::FRIEND)) {
-			if (DBA::isResult($contact) && ($contact['network'] === Protocol::DIASPORA)) {
-				$ret = Diaspora::sendShare($user, $contact);
-				Logger::log('share returns: ' . $ret);
-			}
-		}
 
 		Group::addMember(User::getDefaultGroup($uid, $contact["network"]), $contact['id']);
 
-		if ($network == Protocol::ACTIVITYPUB && $duplex) {
-			ActivityPub\Transmitter::sendActivity('Follow', $contact['url'], $uid);
-		}
-
 		// Let's send our user to the contact editor in case they want to
 		// do anything special with this new friend.
 		if ($handsfree === null) {
@@ -416,25 +345,25 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 	 * In the section above where the confirming party makes a POST and
 	 * retrieves xml status information, they are communicating with the following code.
 	 */
-	if (x($_POST, 'source_url')) {
+	if (!empty($_POST['source_url'])) {
 		// We are processing an external confirmation to an introduction created by our user.
-		$public_key =         defaults($_POST, 'public_key', '');
-		$dfrn_id    = hex2bin(defaults($_POST, 'dfrn_id'   , ''));
-		$source_url = hex2bin(defaults($_POST, 'source_url', ''));
-		$aes_key    =         defaults($_POST, 'aes_key'   , '');
-		$duplex     =  intval(defaults($_POST, 'duplex'    , 0));
-		$page       =  intval(defaults($_POST, 'page'      , 0));
+		$public_key =         $_POST['public_key'] ?? '';
+		$dfrn_id    = hex2bin($_POST['dfrn_id']    ?? '');
+		$source_url = hex2bin($_POST['source_url'] ?? '');
+		$aes_key    =         $_POST['aes_key']    ?? '';
+		$duplex     =  intval($_POST['duplex']     ?? 0);
+		$page       =  intval($_POST['page']       ?? 0);
 
 		$forum = (($page == 1) ? 1 : 0);
 		$prv   = (($page == 2) ? 1 : 0);
 
 		Logger::log('dfrn_confirm: requestee contacted: ' . $node);
 
-		Logger::log('dfrn_confirm: request: POST=' . print_r($_POST, true), LOGGER_DATA);
+		Logger::log('dfrn_confirm: request: POST=' . print_r($_POST, true), Logger::DATA);
 
 		// If $aes_key is set, both of these items require unpacking from the hex transport encoding.
 
-		if (x($aes_key)) {
+		if (!empty($aes_key)) {
 			$aes_key = hex2bin($aes_key);
 			$public_key = hex2bin($public_key);
 		}