X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=lib%2Futil.php;h=a1ea1f24dd88ab6220328bd1578c5f191b232599;hb=76f3dc32e0e1aa933931b7cc59030ae20bb4f89b;hp=9f62097d544a28acf4a53f50633bc2a7a867b212;hpb=cd29d3d646379aa9a1352035973c8e379cc7f42b;p=quix0rs-gnu-social.git

diff --git a/lib/util.php b/lib/util.php
index 9f62097d54..a1ea1f24dd 100644
--- a/lib/util.php
+++ b/lib/util.php
@@ -19,15 +19,18 @@
 
 /* XXX: break up into separate modules (HTTP, user, files) */
 
-// Show a server error
-
+/**
+ * Show a server error.
+ */
 function common_server_error($msg, $code=500)
 {
     $err = new ServerErrorAction($msg, $code);
     $err->showPage();
 }
 
-// Show a user error
+/**
+ * Show a user error.
+ */
 function common_user_error($msg, $code=400)
 {
     $err = new ClientErrorAction($msg, $code);
@@ -37,7 +40,7 @@ function common_user_error($msg, $code=400)
 /**
  * This should only be used at setup; processes switching languages
  * to send text to other users should use common_switch_locale().
- * 
+ *
  * @param string $language Locale language code (optional; empty uses
  *                         current user's preference or site default)
  * @return mixed success
@@ -61,10 +64,10 @@ function common_init_locale($language=null)
 /**
  * Initialize locale and charset settings and gettext with our message catalog,
  * using the current user's language preference or the site default.
- * 
+ *
  * This should generally only be run at framework initialization; code switching
  * languages at runtime should call common_switch_language().
- * 
+ *
  * @access private
  */
 function common_init_language()
@@ -142,7 +145,6 @@ function common_switch_locale($language=null)
     textdomain("statusnet");
 }
 
-
 function common_timezone()
 {
     if (common_logged_in()) {
@@ -157,7 +159,6 @@ function common_timezone()
 
 function common_language()
 {
-
     // If there is a user logged in and they've set a language preference
     // then return that one...
     if (_have_config() && common_logged_in()) {
@@ -189,8 +190,10 @@ function common_language()
     // Finally, if none of the above worked, use the site's default...
     return common_config('site', 'language');
 }
-// salted, hashed passwords are stored in the DB
 
+/**
+ * Salted, hashed passwords are stored in the DB.
+ */
 function common_munge_password($password, $id)
 {
     if (is_object($id) || is_object($password)) {
@@ -201,8 +204,9 @@ function common_munge_password($password, $id)
     return md5($password . $id);
 }
 
-// check if a username exists and has matching password
-
+/**
+ * Check if a username exists and has matching password.
+ */
 function common_check_user($nickname, $password)
 {
     // empty nickname always unacceptable
@@ -229,7 +233,9 @@ function common_check_user($nickname, $password)
     return $authenticatedUser;
 }
 
-// is the current user logged in?
+/**
+ * Is the current user logged in?
+ */
 function common_logged_in()
 {
     return (!is_null(common_current_user()));
@@ -275,12 +281,10 @@ function common_ensure_session()
 // 3) null to clear
 
 // Initialize to false; set to null if none found
-
 $_cur = false;
 
 function common_set_user($user)
 {
-
     global $_cur;
 
     if (is_null($user) && common_have_session()) {
@@ -322,7 +326,8 @@ function common_set_cookie($key, $value, $expiration=0)
                      $value,
                      $expiration,
                      $cookiepath,
-                     $server);
+                     $server,
+                     common_config('site', 'ssl')=='always');
 }
 
 define('REMEMBERME', 'rememberme');
@@ -366,7 +371,6 @@ function common_rememberme($user=null)
 
 function common_remembered_user()
 {
-
     $user = null;
 
     $packed = isset($_COOKIE[REMEMBERME]) ? $_COOKIE[REMEMBERME] : null;
@@ -428,14 +432,17 @@ function common_remembered_user()
     return $user;
 }
 
-// must be called with a valid user!
-
+/**
+ * must be called with a valid user!
+ */
 function common_forgetme()
 {
     common_set_cookie(REMEMBERME, '', 0);
 }
 
-// who is the current user?
+/**
+ * Who is the current user?
+ */
 function common_current_user()
 {
     global $_cur;
@@ -471,10 +478,11 @@ function common_current_user()
     return $_cur;
 }
 
-// Logins that are 'remembered' aren't 'real' -- they're subject to
-// cookie-stealing. So, we don't let them do certain things. New reg,
-// OpenID, and password logins _are_ real.
-
+/**
+ * Logins that are 'remembered' aren't 'real' -- they're subject to
+ * cookie-stealing. So, we don't let them do certain things. New reg,
+ * OpenID, and password logins _are_ real.
+ */
 function common_real_login($real=true)
 {
     common_ensure_session();
@@ -486,6 +494,29 @@ function common_is_real_login()
     return common_logged_in() && $_SESSION['real_login'];
 }
 
+/**
+ * Get a hash portion for HTTP caching Etags and such including
+ * info on the current user's session. If login/logout state changes,
+ * or we've changed accounts, or we've renamed the current user,
+ * we'll get a new hash value.
+ *
+ * This should not be considered secure information.
+ *
+ * @param User $user (optional; uses common_current_user() if left out)
+ * @return string
+ */
+function common_user_cache_hash($user=false)
+{
+    if ($user === false) {
+        $user = common_current_user();
+    }
+    if ($user) {
+        return crc32($user->id . ':' . $user->nickname);
+    } else {
+        return '0';
+    }
+}
+
 // get canonical version of nickname for comparison
 function common_canonical_nickname($nickname)
 {
@@ -577,9 +608,7 @@ function common_find_mentions($text, $notice)
     }
 
     if (Event::handle('StartFindMentions', array($sender, $text, &$mentions))) {
-
         // Get the context of the original notice, if any
-
         $originalAuthor   = null;
         $originalNotice   = null;
         $originalMentions = array();
@@ -615,7 +644,6 @@ function common_find_mentions($text, $notice)
         $matches = array_merge($tmatches[1], $atmatches[1]);
 
         foreach ($matches as $match) {
-
             $nickname = common_canonical_nickname($match[0]);
 
             // Try to get a profile for this nickname.
@@ -623,19 +651,15 @@ function common_find_mentions($text, $notice)
             // sender context.
 
             if (!empty($originalAuthor) && $originalAuthor->nickname == $nickname) {
-
                 $mentioned = $originalAuthor;
-
             } else if (!empty($originalMentions) &&
                        array_key_exists($nickname, $originalMentions)) {
-
                 $mentioned = $originalMentions[$nickname];
             } else {
                 $mentioned = common_relative_profile($sender, $nickname);
             }
 
             if (!empty($mentioned)) {
-
                 $user = User::staticGet('id', $mentioned->id);
 
                 if ($user) {
@@ -830,10 +854,14 @@ function common_linkify($url) {
         } elseif (is_string($longurl_data)) {
             $longurl = $longurl_data;
         } else {
-            throw new ServerException("Can't linkify url '$url'");
+            // Unable to reach the server to verify contents, etc
+            // Just pass the link on through for now.
+            common_log(LOG_ERR, "Can't linkify url '$url'");
+            $longurl = $url;
         }
     }
-    $attrs = array('href' => $canon, 'title' => $longurl, 'rel' => 'external');
+
+    $attrs = array('href' => $canon, 'title' => $longurl);
 
     $is_attachment = false;
     $attachment_id = null;
@@ -869,6 +897,16 @@ function common_linkify($url) {
         $attrs['id'] = "attachment-{$attachment_id}";
     }
 
+    // Whether to nofollow
+
+    $nf = common_config('nofollow', 'external');
+
+    if ($nf == 'never') {
+        $attrs['rel'] = 'external';
+    } else {
+        $attrs['rel'] = 'nofollow external';
+    }
+
     return XMLStringer::estring('a', $attrs, $url);
 }
 
@@ -879,6 +917,33 @@ function common_shorten_links($text, $always = false)
     return common_replace_urls_callback($text, array('File_redirection', 'makeShort'));
 }
 
+/**
+ * Very basic stripping of invalid UTF-8 input text.
+ *
+ * @param string $str
+ * @return mixed string or null if invalid input
+ *
+ * @todo ideally we should drop bad chars, and maybe do some of the checks
+ *       from common_xml_safe_str. But we can't strip newlines, etc.
+ * @todo Unicode normalization might also be useful, but not needed now.
+ */
+function common_validate_utf8($str)
+{
+    // preg_replace will return NULL on invalid UTF-8 input.
+    //
+    // Note: empty regex //u also caused NULL return on some
+    // production machines, but none of our test machines.
+    //
+    // This should be replaced with a more reliable check.
+    return preg_replace('/\x00/u', '', $str);
+}
+
+/**
+ * Make sure an arbitrary string is safe for output in XML as a single line.
+ *
+ * @param string $str
+ * @return string
+ */
 function common_xml_safe_str($str)
 {
     // Replace common eol and extra whitespace input chars
@@ -910,8 +975,9 @@ function common_tag_link($tag)
     $canonical = common_canonical_tag($tag);
     if (common_config('singleuser', 'enabled')) {
         // regular TagAction isn't set up in 1user mode
+        $nickname = User::singleUserNickname();
         $url = common_local_url('showstream',
-                                array('nickname' => common_config('singleuser', 'nickname'),
+                                array('nickname' => $nickname,
                                       'tag' => $canonical));
     } else {
         $url = common_local_url('tag', array('tag' => $canonical));
@@ -1015,8 +1081,17 @@ function common_local_url($action, $args=null, $params=null, $fragment=null, $ad
 
 function common_is_sensitive($action)
 {
-    static $sensitive = array('login', 'register', 'passwordsettings',
-                              'twittersettings', 'api');
+    static $sensitive = array(
+        'login',
+        'register',
+        'passwordsettings',
+        'api',
+        'ApiOauthRequestToken',
+        'ApiOauthAccessToken',
+        'ApiOauthAuthorize',
+        'ApiOauthPin',
+        'showapplication'
+    );
     $ssl = null;
 
     if (Event::handle('SensitiveAction', array($action, &$ssl))) {
@@ -1102,30 +1177,30 @@ function common_date_string($dt)
         // TRANS: Used in notices to indicate when the notice was made compared to now.
         return _('about a minute ago');
     } else if ($diff < 3300) {
-        // XXX: should support plural.
+        $minutes = round($diff/60);
         // TRANS: Used in notices to indicate when the notice was made compared to now.
-        return sprintf(_('about %d minutes ago'), round($diff/60));
+        return sprintf( ngettext('about one minute ago', 'about %d minutes ago', $minutes), $minutes);
     } else if ($diff < 5400) {
         // TRANS: Used in notices to indicate when the notice was made compared to now.
         return _('about an hour ago');
     } else if ($diff < 22 * 3600) {
-        // XXX: should support plural.
+        $hours = round($diff/3600);
         // TRANS: Used in notices to indicate when the notice was made compared to now.
-        return sprintf(_('about %d hours ago'), round($diff/3600));
+        return sprintf( ngettext('about one hour ago', 'about %d hours ago', $hours), $hours);
     } else if ($diff < 37 * 3600) {
         // TRANS: Used in notices to indicate when the notice was made compared to now.
         return _('about a day ago');
     } else if ($diff < 24 * 24 * 3600) {
-        // XXX: should support plural.
+        $days = round($diff/(24*3600));
         // TRANS: Used in notices to indicate when the notice was made compared to now.
-        return sprintf(_('about %d days ago'), round($diff/(24*3600)));
+        return sprintf( ngettext('about one day ago', 'about %d days ago', $days), $days);
     } else if ($diff < 46 * 24 * 3600) {
         // TRANS: Used in notices to indicate when the notice was made compared to now.
         return _('about a month ago');
     } else if ($diff < 330 * 24 * 3600) {
-        // XXX: should support plural.
+        $months = round($diff/(30*24*3600));
         // TRANS: Used in notices to indicate when the notice was made compared to now.
-        return sprintf(_('about %d months ago'), round($diff/(30*24*3600)));
+        return sprintf( ngettext('about one month ago', 'about %d months ago',$months), $months);
     } else if ($diff < 480 * 24 * 3600) {
         // TRANS: Used in notices to indicate when the notice was made compared to now.
         return _('about a year ago');
@@ -1228,8 +1303,9 @@ function common_broadcast_notice($notice, $remote=false)
     // DO NOTHING!
 }
 
-// Stick the notice on the queue
-
+/**
+ * Stick the notice on the queue.
+ */
 function common_enqueue_notice($notice)
 {
     static $localTransports = array('omb',
@@ -1291,8 +1367,9 @@ function common_profile_url($nickname)
                             null, null, false);
 }
 
-// Should make up a reasonable root URL
-
+/**
+ * Should make up a reasonable root URL
+ */
 function common_root_url($ssl=false)
 {
     $url = common_path('', $ssl, false);
@@ -1303,9 +1380,10 @@ function common_root_url($ssl=false)
     return $url;
 }
 
-// returns $bytes bytes of random data as a hexadecimal string
-// "good" here is a goal and not a guarantee
-
+/**
+ * returns $bytes bytes of random data as a hexadecimal string
+ * "good" here is a goal and not a guarantee
+ */
 function common_good_rand($bytes)
 {
     // XXX: use random.org...?
@@ -1341,13 +1419,13 @@ function common_mtrand($bytes)
 /**
  * Record the given URL as the return destination for a future
  * form submission, to be read by common_get_returnto().
- * 
+ *
  * @param string $url
- * 
+ *
  * @fixme as a session-global setting, this can allow multiple forms
  * to conflict and overwrite each others' returnto destinations if
  * the user has multiple tabs or windows open.
- * 
+ *
  * Should refactor to index with a token or otherwise only pass the
  * data along its intended path.
  */
@@ -1360,13 +1438,13 @@ function common_set_returnto($url)
 /**
  * Fetch a return-destination URL previously recorded by
  * common_set_returnto().
- * 
+ *
  * @return mixed URL string or null
- * 
+ *
  * @fixme as a session-global setting, this can allow multiple forms
  * to conflict and overwrite each others' returnto destinations if
  * the user has multiple tabs or windows open.
- * 
+ *
  * Should refactor to index with a token or otherwise only pass the
  * data along its intended path.
  */
@@ -1451,7 +1529,12 @@ function common_log_db_error(&$object, $verb, $filename=null)
 {
     $objstr = common_log_objstring($object);
     $last_error = &PEAR::getStaticProperty('DB_DataObject','lastError');
-    common_log(LOG_ERR, $last_error->message . '(' . $verb . ' on ' . $objstr . ')', $filename);
+    if (is_object($last_error)) {
+        $msg = $last_error->message;
+    } else {
+        $msg = 'Unknown error (' . var_export($last_error, true) . ')';
+    }
+    common_log(LOG_ERR, $msg . '(' . $verb . ' on ' . $objstr . ')', $filename);
 }
 
 function common_log_objstring(&$object)
@@ -1493,7 +1576,7 @@ function common_valid_tag($tag)
  * Determine if given domain or address literal is valid
  * eg for use in JIDs and URLs. Does not check if the domain
  * exists!
- * 
+ *
  * @param string $domain
  * @return boolean valid or not
  */
@@ -1629,19 +1712,25 @@ function common_config($main, $sub)
             array_key_exists($sub, $config[$main])) ? $config[$main][$sub] : false;
 }
 
+/**
+ * Pull arguments from a GET/POST/REQUEST array with first-level input checks:
+ * strips "magic quotes" slashes if necessary, and kills invalid UTF-8 strings.
+ *
+ * @param array $from
+ * @return array
+ */
 function common_copy_args($from)
 {
     $to = array();
     $strip = get_magic_quotes_gpc();
     foreach ($from as $k => $v) {
-        if($strip) {
-            if(is_array($v)) {
-                $to[$k] = common_copy_args($v);
-            } else {
-                $to[$k] = stripslashes($v);
-            }
+        if(is_array($v)) {
+            $to[$k] = common_copy_args($v);
         } else {
-            $to[$k] = $v;
+            if ($strip) {
+                $v = stripslashes($v);
+            }
+            $to[$k] = strval(common_validate_utf8($v));
         }
     }
     return $to;
@@ -1824,7 +1913,6 @@ function common_compatible_license($from, $to)
  */
 function common_database_tablename($tablename)
 {
-
   if(common_config('db','quote_identifiers')) {
       $tablename = '"'. $tablename .'"';
   }