X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=include%2Fdiaspora.php;h=af9a91f02888c3496610167dc4dc82de66738911;hb=fc27edb6d76765cd9b85d29a3c41f23f17c6ca41;hp=7551ea9b3a0fe4ce0cca45ec65625198b297e163;hpb=854abcf61290e14acb148e719ff05e5460e79874;p=friendica.git diff --git a/include/diaspora.php b/include/diaspora.php index 7551ea9b3a..af9a91f028 100755 --- a/include/diaspora.php +++ b/include/diaspora.php @@ -61,10 +61,10 @@ function diaspora_dispatch($importer,$msg) { $ret = diaspora_request($importer,$xmlbase->request); } elseif($xmlbase->status_message) { - $ret = diaspora_post($importer,$xmlbase->status_message); + $ret = diaspora_post($importer,$xmlbase->status_message,$msg); } elseif($xmlbase->profile) { - $ret = diaspora_profile($importer,$xmlbase->profile); + $ret = diaspora_profile($importer,$xmlbase->profile,$msg); } elseif($xmlbase->comment) { $ret = diaspora_comment($importer,$xmlbase->comment,$msg); @@ -73,10 +73,10 @@ function diaspora_dispatch($importer,$msg) { $ret = diaspora_like($importer,$xmlbase->like,$msg); } elseif($xmlbase->asphoto) { - $ret = diaspora_asphoto($importer,$xmlbase->asphoto); + $ret = diaspora_asphoto($importer,$xmlbase->asphoto,$msg); } elseif($xmlbase->reshare) { - $ret = diaspora_reshare($importer,$xmlbase->reshare); + $ret = diaspora_reshare($importer,$xmlbase->reshare,$msg); } elseif($xmlbase->retraction) { $ret = diaspora_retraction($importer,$xmlbase->retraction,$msg); @@ -721,12 +721,17 @@ function diaspora_post_allow($importer,$contact) { } -function diaspora_post($importer,$xml) { +function diaspora_post($importer,$xml,$msg) { $a = get_app(); $guid = notags(unxmlify($xml->guid)); $diaspora_handle = notags(unxmlify($xml->diaspora_handle)); + if($diaspora_handle != $msg['author']) { + logger('diaspora_post: Potential forgery. Message handle is not the same as envelope sender.'); + return 202; + } + $contact = diaspora_get_contact_by_handle($importer['uid'],$diaspora_handle); if(! $contact) return; @@ -837,7 +842,7 @@ function diaspora_post($importer,$xml) { } -function diaspora_reshare($importer,$xml) { +function diaspora_reshare($importer,$xml,$msg) { logger('diaspora_reshare: init: ' . print_r($xml,true)); @@ -846,6 +851,11 @@ function diaspora_reshare($importer,$xml) { $diaspora_handle = notags(unxmlify($xml->diaspora_handle)); + if($diaspora_handle != $msg['author']) { + logger('diaspora_post: Potential forgery. Message handle is not the same as envelope sender.'); + return 202; + } + $contact = diaspora_get_contact_by_handle($importer['uid'],$diaspora_handle); if(! $contact) return; @@ -991,13 +1001,18 @@ function diaspora_reshare($importer,$xml) { } -function diaspora_asphoto($importer,$xml) { +function diaspora_asphoto($importer,$xml,$msg) { logger('diaspora_asphoto called'); $a = get_app(); $guid = notags(unxmlify($xml->guid)); $diaspora_handle = notags(unxmlify($xml->diaspora_handle)); + if($diaspora_handle != $msg['author']) { + logger('diaspora_post: Potential forgery. Message handle is not the same as envelope sender.'); + return 202; + } + $contact = diaspora_get_contact_by_handle($importer['uid'],$diaspora_handle); if(! $contact) return; @@ -1221,6 +1236,7 @@ function diaspora_comment($importer,$xml,$msg) { $datarray['uid'] = $importer['uid']; $datarray['contact-id'] = $contact['id']; + $datarray['type'] = 'remote-comment'; $datarray['wall'] = $parent_item['wall']; $datarray['gravity'] = GRAVITY_COMMENT; $datarray['guid'] = $guid; @@ -1257,7 +1273,7 @@ function diaspora_comment($importer,$xml,$msg) { if(($parent_item['origin']) && (! $parent_author_signature)) { q("insert into sign (`iid`,`signed_text`,`signature`,`signer`) values (%d,'%s','%s','%s') ", intval($message_id), - dbesc($author_signed_data), + dbesc($signed_data), dbesc(base64_encode($author_signature)), dbesc($diaspora_handle) ); @@ -1658,8 +1674,8 @@ function diaspora_like($importer,$xml,$msg) { // likes on comments not supported here and likes on photos not supported by Diaspora - if($target_type !== 'Post') - return; +// if($target_type !== 'Post') +// return; $contact = diaspora_get_contact_by_handle($importer['uid'],$msg['author']); if(! $contact) { @@ -1840,7 +1856,7 @@ EOT; if(! $parent_author_signature) { q("insert into sign (`iid`,`signed_text`,`signature`,`signer`) values (%d,'%s','%s','%s') ", intval($message_id), - dbesc($author_signed_data), + dbesc($signed_data), dbesc(base64_encode($author_signature)), dbesc($diaspora_handle) ); @@ -1990,11 +2006,17 @@ function diaspora_signed_retraction($importer,$xml,$msg) { // NOTREACHED } -function diaspora_profile($importer,$xml) { +function diaspora_profile($importer,$xml,$msg) { $a = get_app(); $diaspora_handle = notags(unxmlify($xml->diaspora_handle)); + + if($diaspora_handle != $msg['author']) { + logger('diaspora_post: Potential forgery. Message handle is not the same as envelope sender.'); + return 202; + } + $contact = diaspora_get_contact_by_handle($importer['uid'],$diaspora_handle); if(! $contact) return; @@ -2232,22 +2254,30 @@ function diaspora_send_followup($item,$owner,$contact,$public_batch = false) { $myaddr = $owner['nickname'] . '@' . substr($a->get_baseurl(), strpos($a->get_baseurl(),'://') + 3); // $theiraddr = $contact['addr']; - // The first item in the `item` table with the parent id is the parent. However, MySQL doesn't always - // return the items ordered by `item`.`id`, in which case the wrong item is chosen as the parent. - // The only item with `parent` and `id` as the parent id is the parent item. - $p = q("select guid from item where parent = %d and id = %d limit 1", - intval($item['parent']), - intval($item['parent']) - ); + if($item['thr-parent']) { + $p = q("select guid, type, uri, `parent-uri` from item where uri = '%s' limit 1", + dbesc($item['thr-parent']) + ); + } + else { + // The first item in the `item` table with the parent id is the parent. However, MySQL doesn't always + // return the items ordered by `item`.`id`, in which case the wrong item is chosen as the parent. + // The only item with `parent` and `id` as the parent id is the parent item. + $p = q("select guid, type, uri, `parent-uri` from item where parent = %d and id = %d limit 1", + intval($item['parent']), + intval($item['parent']) + ); + } if(count($p)) - $parent_guid = $p[0]['guid']; + $parent = $p[0]; else return; if($item['verb'] === ACTIVITY_LIKE) { $tpl = get_markup_template('diaspora_like.tpl'); $like = true; - $target_type = 'Post'; + $target_type = ( $parent['uri'] === $parent['parent-uri'] ? 'Post' : 'Comment'); +// $target_type = (strpos($parent['type'], 'comment') ? 'Comment' : 'Post'); // $positive = (($item['deleted']) ? 'false' : 'true'); $positive = 'true'; @@ -2264,15 +2294,15 @@ function diaspora_send_followup($item,$owner,$contact,$public_batch = false) { // sign it if($like) - $signed_text = $item['guid'] . ';' . $target_type . ';' . $parent_guid . ';' . $positive . ';' . $myaddr; + $signed_text = $item['guid'] . ';' . $target_type . ';' . $parent['guid'] . ';' . $positive . ';' . $myaddr; else - $signed_text = $item['guid'] . ';' . $parent_guid . ';' . $text . ';' . $myaddr; + $signed_text = $item['guid'] . ';' . $parent['guid'] . ';' . $text . ';' . $myaddr; $authorsig = base64_encode(rsa_sign($signed_text,$owner['uprvkey'],'sha256')); $msg = replace_macros($tpl,array( '$guid' => xmlify($item['guid']), - '$parent_guid' => xmlify($parent_guid), + '$parent_guid' => xmlify($parent['guid']), '$target_type' =>xmlify($target_type), '$authorsig' => xmlify($authorsig), '$body' => xmlify($text), @@ -2300,15 +2330,22 @@ function diaspora_send_relay($item,$owner,$contact,$public_batch = false) { $text = html_entity_decode(bb2diaspora($body)); - // The first item in the `item` table with the parent id is the parent. However, MySQL doesn't always - // return the items ordered by `item`.`id`, in which case the wrong item is chosen as the parent. - // The only item with `parent` and `id` as the parent id is the parent item. - $p = q("select guid from item where parent = %d and id = %d limit 1", - intval($item['parent']), - intval($item['parent']) - ); + if($item['thr-parent']) { + $p = q("select guid, type, uri, `parent-uri` from item where uri = '%s' limit 1", + dbesc($item['thr-parent']) + ); + } + else { + // The first item in the `item` table with the parent id is the parent. However, MySQL doesn't always + // return the items ordered by `item`.`id`, in which case the wrong item is chosen as the parent. + // The only item with `parent` and `id` as the parent id is the parent item. + $p = q("select guid, type, uri, `parent-uri` from item where parent = %d and id = %d limit 1", + intval($item['parent']), + intval($item['parent']) + ); + } if(count($p)) - $parent_guid = $p[0]['guid']; + $parent = $p[0]; else return; @@ -2326,7 +2363,8 @@ function diaspora_send_relay($item,$owner,$contact,$public_batch = false) { elseif($item['verb'] === ACTIVITY_LIKE) { $like = true; - $target_type = 'Post'; + $target_type = ( $parent['uri'] === $parent['parent-uri'] ? 'Post' : 'Comment'); +// $target_type = (strpos($parent['type'], 'comment') ? 'Comment' : 'Post'); // $positive = (($item['deleted']) ? 'false' : 'true'); $positive = 'true'; @@ -2361,9 +2399,9 @@ function diaspora_send_relay($item,$owner,$contact,$public_batch = false) { if($relay_retract) $sender_signed_text = $item['guid'] . ';' . $target_type; elseif($like) - $sender_signed_text = $item['guid'] . ';' . $target_type . ';' . $parent_guid . ';' . $positive . ';' . $handle; + $sender_signed_text = $item['guid'] . ';' . $target_type . ';' . $parent['guid'] . ';' . $positive . ';' . $handle; else - $sender_signed_text = $item['guid'] . ';' . $parent_guid . ';' . $text . ';' . $handle; + $sender_signed_text = $item['guid'] . ';' . $parent['guid'] . ';' . $text . ';' . $handle; // Sign the relayable with the top-level owner's signature // @@ -2380,7 +2418,7 @@ function diaspora_send_relay($item,$owner,$contact,$public_batch = false) { $msg = replace_macros($tpl,array( '$guid' => xmlify($item['guid']), - '$parent_guid' => xmlify($parent_guid), + '$parent_guid' => xmlify($parent['guid']), '$target_type' =>xmlify($target_type), '$authorsig' => xmlify($authorsig), '$parentsig' => xmlify($parentauthorsig), @@ -2496,7 +2534,7 @@ function diaspora_send_mail($item,$owner,$contact) { } -function diaspora_transmit($owner,$contact,$slap,$public_batch) { +function diaspora_transmit($owner,$contact,$slap,$public_batch,$queue_run=false) { $enabled = intval(get_config('system','diaspora_enabled')); if(! $enabled) { @@ -2513,7 +2551,7 @@ function diaspora_transmit($owner,$contact,$slap,$public_batch) { logger('diaspora_transmit: ' . $logid . ' ' . $dest_url); - if(was_recently_delayed($contact['id'])) { + if( (! $queue_run) && (was_recently_delayed($contact['id'])) ) { $return_code = 0; } else {