X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=actions%2Ffinishremotesubscribe.php;h=d54c29a60365df22235bc0db9286a79b53becb00;hb=05b04b7970d1b0f1e35a64a5537ad61e2fb8db1c;hp=c9bdf26da871bdf4cf48dcb6cb125b7731340dda;hpb=3fda5a684fcc6b718a8e5e908cd17477335ea071;p=quix0rs-gnu-social.git

diff --git a/actions/finishremotesubscribe.php b/actions/finishremotesubscribe.php
index c9bdf26da8..d54c29a603 100644
--- a/actions/finishremotesubscribe.php
+++ b/actions/finishremotesubscribe.php
@@ -21,231 +21,279 @@ if (!defined('LACONICA')) { exit(1); }
 
 require_once(INSTALLDIR.'/lib/omb.php');
 
-class FinishremotesubscribeAction extends Action {
+class FinishremotesubscribeAction extends Action
+{
 
-	function handle($args) {
+    function handle($args)
+    {
 
-		parent::handle($args);
+        parent::handle($args);
 
-		if (common_logged_in()) {
-			common_user_error(_('You can use the local subscription!'));
-		    return;
-		}
+        if (common_logged_in()) {
+            $this->clientError(_('You can use the local subscription!'));
+            return;
+        }
 
-		$omb = $_SESSION['oauth_authorization_request'];
+        $omb = $_SESSION['oauth_authorization_request'];
 
-		if (!$omb) {
-			common_user_error(_('Not expecting this response!'));
-			return;
-		}
+        if (!$omb) {
+            $this->clientError(_('Not expecting this response!'));
+            return;
+        }
 
-		common_debug('stored request: '.print_r($omb,true), __FILE__);
-
-		$req = OAuthRequest::from_request();
-
-		$token = $req->get_parameter('oauth_token');
-
-		# I think this is the success metric
-
-		if ($token != $omb['token']) {
-			common_user_error(_('Not authorized.'));
-			return;
-		}
-
-		$version = $req->get_parameter('omb_version');
-
-		if ($version != OMB_VERSION_01) {
-			common_user_error(_('Unknown version of OMB protocol.'));
-			return;
-		}
-
-		$nickname = $req->get_parameter('omb_listener_nickname');
-
-		if (!$nickname) {
-			common_user_error(_('No nickname provided by remote server.'));
-			return;
-		}
-
-		$profile_url = $req->get_parameter('omb_listener_profile');
-
-		if (!$profile_url) {
-			common_user_error(_('No profile URL returned by server.'));
-			return;
-		}
-
-		if (!Validate::uri($profile_url, array('allowed_schemes' => array('http', 'https')))) {
-			common_user_error(_('Invalid profile URL returned by server.'));
-			return;
-		}
-
-		common_debug('listenee: "'.$omb['listenee'].'"', __FILE__);
-
-		$user = User::staticGet('nickname', $omb['listenee']);
-
-		if (!$user) {
-			common_user_error(_('User being listened to doesn\'t exist.'));
-			return;
-		}
-
-		$fullname = $req->get_parameter('omb_listener_fullname');
-		$homepage = $req->get_parameter('omb_listener_homepage');
-		$bio = $req->get_parameter('omb_listener_bio');
-		$location = $req->get_parameter('omb_listener_location');
-		$avatar_url = $req->get_parameter('omb_listener_avatar');
-
-		list($newtok, $newsecret) = $this->access_token($omb);
-
-		if (!$newtok || !$newsecret) {
-			common_user_error(_('Couldn\'t convert request tokens to access tokens.'));
-			return;
-		}
-
-		# XXX: possible attack point; subscribe and return someone else's profile URI
-
-		$remote = Remote_profile::staticGet('uri', $omb['listener']);
-
-		if ($remote) {
-			$exists = true;
-			$profile = Profile::staticGet($remote->id);
-			$orig_remote = clone($remote);
-			$orig_profile = clone($profile);
-			# XXX: compare current postNotice and updateProfile URLs to the ones
-			# stored in the DB to avoid (possibly...) above attack
-		} else {
-			$exists = false;
-			$remote = new Remote_profile();
-			$remote->uri = $omb['listener'];
-			$profile = new Profile();
-		}
-
-		$profile->nickname = $nickname;
-		$profile->profileurl = $profile_url;
-
-		if ($fullname) {
-			$profile->fullname = $fullname;
-		}
-		if ($homepage) {
-			$profile->homepage = $homepage;
-		}
-		if ($bio) {
-			$profile->bio = $bio;
-		}
-		if ($location) {
-			$profile->location = $location;
-		}
-
-		if ($exists) {
-			$profile->update($orig_profile);
-		} else {
-			$profile->created = DB_DataObject_Cast::dateTime(); # current time
-			$id = $profile->insert();
-			if (!$id) {
-				common_server_error(_('Error inserting new profile'));
-				return;
-			}
-			$remote->id = $id;
-		}
-
-		if ($avatar_url) {
-			if (!$this->add_avatar($profile, $avatar_url)) {
-				common_server_error(_('Error inserting avatar'));
-				return;
-			}
-		}
-
-		$remote->postnoticeurl = $omb['post_notice_url'];
-		$remote->updateprofileurl = $omb['update_profile_url'];
-
-		if ($exists) {
-			if (!$remote->update($orig_remote)) {
-				common_server_error(_('Error updating remote profile'));
-				return;
-			}
-		} else {
-			$remote->created = DB_DataObject_Cast::dateTime(); # current time
-			if (!$remote->insert()) {
-				common_server_error(_('Error inserting remote profile'));
-				return;
-			}
-		}
-
-		$sub = new Subscription();
-		$sub->subscriber = $remote->id;
-		$sub->subscribed = $user->id;
-		$sub->token = $newtok;
-		$sub->secret = $newsecret;
-		$sub->created = DB_DataObject_Cast::dateTime(); # current time
-
-		if (!$sub->insert()) {
-			common_user_error(_('Couldn\'t insert new subscription.'));
-			return;
-		}
-
-		# Notify user, if necessary
-		
-		mail_subscribe_notify_profile($user, $profile);
-		
-		# Clear the data
-		unset($_SESSION['oauth_authorization_request']);
-
-		# If we show subscriptions in reverse chron order, this should
-		# show up close to the top of the page
-
-		common_redirect(common_local_url('subscribers', array('nickname' =>
-															 $user->nickname)));
-	}
-
-	function add_avatar($profile, $url) {
-		$temp_filename = tempnam(sys_get_temp_dir(), 'listener_avatar');
-		copy($url, $temp_filename);
-		return $profile->setOriginal($temp_filename);
-	}
-
-	function access_token($omb) {
-
-		common_debug('starting request for access token', __FILE__);
-
-		$con = omb_oauth_consumer();
-		$tok = new OAuthToken($omb['token'], $omb['secret']);
-
-		common_debug('using request token "'.$tok.'"', __FILE__);
-
-		$url = $omb['access_token_url'];
-
-		common_debug('using access token url "'.$url.'"', __FILE__);
-
-		# XXX: Is this the right thing to do? Strip off GET params and make them
-		# POST params? Seems wrong to me.
-
-		$parsed = parse_url($url);
-		$params = array();
-		parse_str($parsed['query'], $params);
-
-		$req = OAuthRequest::from_consumer_and_token($con, $tok, "POST", $url, $params);
-
-		$req->set_parameter('omb_version', OMB_VERSION_01);
-
-		# XXX: test to see if endpoint accepts this signature method
-
-		$req->sign_request(omb_hmac_sha1(), $con, $tok);
-
-		# We re-use this tool's fetcher, since it's pretty good
+        common_debug('stored request: '.print_r($omb,true), __FILE__);
 
-		common_debug('posting to access token url "'.$req->get_normalized_http_url().'"', __FILE__);
-		common_debug('posting request data "'.$req->to_postdata().'"', __FILE__);
+        common_remove_magic_from_request();
+        $req = OAuthRequest::from_request();
 
-		$fetcher = Auth_Yadis_Yadis::getHTTPFetcher();
-		$result = $fetcher->post($req->get_normalized_http_url(),
-								 $req->to_postdata());
+        $token = $req->get_parameter('oauth_token');
 
-		common_debug('got result: "'.print_r($result,TRUE).'"', __FILE__);
+        # I think this is the success metric
 
-		if ($result->status != 200) {
-			return NULL;
-		}
+        if ($token != $omb['token']) {
+            $this->clientError(_('Not authorized.'));
+            return;
+        }
+
+        $version = $req->get_parameter('omb_version');
+
+        if ($version != OMB_VERSION_01) {
+            $this->clientError(_('Unknown version of OMB protocol.'));
+            return;
+        }
+
+        $nickname = $req->get_parameter('omb_listener_nickname');
+
+        if (!$nickname) {
+            $this->clientError(_('No nickname provided by remote server.'));
+            return;
+        }
+
+        $profile_url = $req->get_parameter('omb_listener_profile');
+
+        if (!$profile_url) {
+            $this->clientError(_('No profile URL returned by server.'));
+            return;
+        }
+
+        if (!Validate::uri($profile_url, array('allowed_schemes' => array('http', 'https')))) {
+            $this->clientError(_('Invalid profile URL returned by server.'));
+            return;
+        }
+
+        if ($profile_url == common_local_url('showstream', array('nickname' => $nickname))) {
+            $this->clientError(_('You can use the local subscription!'));
+            return;
+        }
+
+        common_debug('listenee: "'.$omb['listenee'].'"', __FILE__);
+
+        $user = User::staticGet('nickname', $omb['listenee']);
+
+        if (!$user) {
+            $this->clientError(_('User being listened to doesn\'t exist.'));
+            return;
+        }
+
+        $other = User::staticGet('uri', $omb['listener']);
+
+        if ($other) {
+            $this->clientError(_('You can use the local subscription!'));
+            return;
+        }
+
+        $fullname = $req->get_parameter('omb_listener_fullname');
+        $homepage = $req->get_parameter('omb_listener_homepage');
+        $bio = $req->get_parameter('omb_listener_bio');
+        $location = $req->get_parameter('omb_listener_location');
+        $avatar_url = $req->get_parameter('omb_listener_avatar');
+
+        list($newtok, $newsecret) = $this->access_token($omb);
+
+        if (!$newtok || !$newsecret) {
+            $this->clientError(_('Couldn\'t convert request tokens to access tokens.'));
+            return;
+        }
+
+        # XXX: possible attack point; subscribe and return someone else's profile URI
+
+        $remote = Remote_profile::staticGet('uri', $omb['listener']);
+
+        if ($remote) {
+            $exists = true;
+            $profile = Profile::staticGet($remote->id);
+            $orig_remote = clone($remote);
+            $orig_profile = clone($profile);
+            # XXX: compare current postNotice and updateProfile URLs to the ones
+            # stored in the DB to avoid (possibly...) above attack
+        } else {
+            $exists = false;
+            $remote = new Remote_profile();
+            $remote->uri = $omb['listener'];
+            $profile = new Profile();
+        }
+
+        $profile->nickname = $nickname;
+        $profile->profileurl = $profile_url;
+
+        if (!is_null($fullname)) {
+            $profile->fullname = $fullname;
+        }
+        if (!is_null($homepage)) {
+            $profile->homepage = $homepage;
+        }
+        if (!is_null($bio)) {
+            $profile->bio = $bio;
+        }
+        if (!is_null($location)) {
+            $profile->location = $location;
+        }
+
+        if ($exists) {
+            $profile->update($orig_profile);
+        } else {
+            $profile->created = DB_DataObject_Cast::dateTime(); # current time
+            $id = $profile->insert();
+            if (!$id) {
+                $this->serverError(_('Error inserting new profile'));
+                return;
+            }
+            $remote->id = $id;
+        }
+
+        if ($avatar_url) {
+            if (!$this->add_avatar($profile, $avatar_url)) {
+                $this->serverError(_('Error inserting avatar'));
+                return;
+            }
+        }
+
+        $remote->postnoticeurl = $omb['post_notice_url'];
+        $remote->updateprofileurl = $omb['update_profile_url'];
+
+        if ($exists) {
+            if (!$remote->update($orig_remote)) {
+                $this->serverError(_('Error updating remote profile'));
+                return;
+            }
+        } else {
+            $remote->created = DB_DataObject_Cast::dateTime(); # current time
+            if (!$remote->insert()) {
+                $this->serverError(_('Error inserting remote profile'));
+                return;
+            }
+        }
+
+        if ($user->hasBlocked($profile)) {
+            $this->clientError(_('That user has blocked you from subscribing.'));
+            return;
+        }
+
+        $sub = new Subscription();
+
+        $sub->subscriber = $remote->id;
+        $sub->subscribed = $user->id;
+
+        $sub_exists = false;
+
+        if ($sub->find(true)) {
+            $sub_exists = true;
+            $orig_sub = clone($sub);
+        } else {
+            $sub_exists = false;
+            $sub->created = DB_DataObject_Cast::dateTime(); # current time
+        }
+
+        $sub->token = $newtok;
+        $sub->secret = $newsecret;
+
+        if ($sub_exists) {
+            $result = $sub->update($orig_sub);
+        } else {
+            $result = $sub->insert();
+        }
+
+        if (!$result) {
+            common_log_db_error($sub, ($sub_exists) ? 'UPDATE' : 'INSERT', __FILE__);
+            $this->clientError(_('Couldn\'t insert new subscription.'));
+            return;
+        }
+
+        # Notify user, if necessary
+
+        mail_subscribe_notify_profile($user, $profile);
+
+        # Clear the data
+        unset($_SESSION['oauth_authorization_request']);
+
+        # If we show subscriptions in reverse chron order, this should
+        # show up close to the top of the page
+
+        common_redirect(common_local_url('subscribers', array('nickname' =>
+                                                             $user->nickname)),
+                        303);
+    }
+
+    function add_avatar($profile, $url)
+    {
+        $temp_filename = tempnam(sys_get_temp_dir(), 'listener_avatar');
+        copy($url, $temp_filename);
+        $imagefile = new ImageFile($profile->id, $temp_filename);
+        $filename = Avatar::filename($profile->id,
+                                     image_type_to_extension($imagefile->type),
+                                     null,
+                                     common_timestamp());
+        rename($temp_filename, Avatar::path($filename));
+        return $profile->setOriginal($filename);
+    }
 
-		parse_str($result->body, $return);
+    function access_token($omb)
+    {
+
+        common_debug('starting request for access token', __FILE__);
 
-		return array($return['oauth_token'], $return['oauth_token_secret']);
-	}
-}
\ No newline at end of file
+        $con = omb_oauth_consumer();
+        $tok = new OAuthToken($omb['token'], $omb['secret']);
+
+        common_debug('using request token "'.$tok.'"', __FILE__);
+
+        $url = $omb['access_token_url'];
+
+        common_debug('using access token url "'.$url.'"', __FILE__);
+
+        # XXX: Is this the right thing to do? Strip off GET params and make them
+        # POST params? Seems wrong to me.
+
+        $parsed = parse_url($url);
+        $params = array();
+        parse_str($parsed['query'], $params);
+
+        $req = OAuthRequest::from_consumer_and_token($con, $tok, "POST", $url, $params);
+
+        $req->set_parameter('omb_version', OMB_VERSION_01);
+
+        # XXX: test to see if endpoint accepts this signature method
+
+        $req->sign_request(omb_hmac_sha1(), $con, $tok);
+
+        # We re-use this tool's fetcher, since it's pretty good
+
+        common_debug('posting to access token url "'.$req->get_normalized_http_url().'"', __FILE__);
+        common_debug('posting request data "'.$req->to_postdata().'"', __FILE__);
+
+        $fetcher = Auth_Yadis_Yadis::getHTTPFetcher();
+        $result = $fetcher->post($req->get_normalized_http_url(),
+                                 $req->to_postdata(),
+                                 array('User-Agent: Laconica/' . LACONICA_VERSION));
+
+        common_debug('got result: "'.print_r($result,true).'"', __FILE__);
+
+        if ($result->status != 200) {
+            return null;
+        }
+
+        parse_str($result->body, $return);
+
+        return array($return['oauth_token'], $return['oauth_token_secret']);
+    }
+}