X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=mod%2Facl.php;h=03cb1ad63e294f2e58232079ea693d471e07e0eb;hb=40e9bbeb88961e494510a18f24d595abfb83f9f8;hp=7f171568967ef204746bb842aa90328a18ead336;hpb=5d2fce417d3a6646fcfe64450a247b2163e12336;p=friendica.git

diff --git a/mod/acl.php b/mod/acl.php
index 7f17156896..03cb1ad63e 100644
--- a/mod/acl.php
+++ b/mod/acl.php
@@ -5,13 +5,14 @@
 use Friendica\App;
 use Friendica\Content\Widget;
 use Friendica\Core\ACL;
-use Friendica\Core\Addon;
-use Friendica\Database\DBM;
+use Friendica\Core\Hook;
+use Friendica\Core\Logger;
+use Friendica\Core\Protocol;
+use Friendica\Database\DBA;
 use Friendica\Model\Contact;
 use Friendica\Model\Item;
-
-require_once 'include/dba.php';
-require_once 'mod/proxy.php';
+use Friendica\Util\Proxy as ProxyUtils;
+use Friendica\Util\Strings;
 
 function acl_content(App $a)
 {
@@ -33,11 +34,11 @@ function acl_content(App $a)
 		$search = $_REQUEST['query'];
 	}
 
-	logger("Searching for ".$search." - type ".$type." conversation ".$conv_id, LOGGER_DEBUG);
+	Logger::info('ACL {action} - {subaction}', ['module' => 'acl', 'action' => 'content', 'subaction' => 'search', 'search' => $search, 'type' => $type, 'conversation' => $conv_id]);
 
 	if ($search != '') {
-		$sql_extra = "AND `name` LIKE '%%" . dbesc($search) . "%%'";
-		$sql_extra2 = "AND (`attag` LIKE '%%" . dbesc($search) . "%%' OR `name` LIKE '%%" . dbesc($search) . "%%' OR `nick` LIKE '%%" . dbesc($search) . "%%')";
+		$sql_extra = "AND `name` LIKE '%%" . DBA::escape($search) . "%%'";
+		$sql_extra2 = "AND (`attag` LIKE '%%" . DBA::escape($search) . "%%' OR `name` LIKE '%%" . DBA::escape($search) . "%%' OR `nick` LIKE '%%" . DBA::escape($search) . "%%')";
 	} else {
 		/// @TODO Avoid these needless else blocks by putting variable-initialization atop of if()
 		$sql_extra = $sql_extra2 = '';
@@ -46,7 +47,7 @@ function acl_content(App $a)
 	// count groups and contacts
 	$group_count = 0;
 	if ($type == '' || $type == 'g') {
-		$r = q("SELECT COUNT(*) AS g FROM `group` WHERE `deleted` = 0 AND `uid` = %d $sql_extra",
+		$r = q("SELECT COUNT(*) AS g FROM `group` WHERE NOT `deleted` AND `uid` = %d $sql_extra",
 			intval(local_user())
 		);
 		$group_count = (int) $r[0]['g'];
@@ -58,7 +59,7 @@ function acl_content(App $a)
 	if ($type == '' || $type == 'c') {
 		// autocomplete for editor mentions
 		$r = q("SELECT COUNT(*) AS c FROM `contact`
-				WHERE `uid` = %d AND NOT `self`
+				WHERE `uid` = %d AND NOT `self` AND NOT `deleted`
 				AND NOT `blocked` AND NOT `pending` AND NOT `archive`
 				AND `success_update` >= `failure_update`
 				AND `notify` != '' $sql_extra2",
@@ -68,7 +69,7 @@ function acl_content(App $a)
 	} elseif ($type == 'f') {
 		// autocomplete for editor mentions of forums
 		$r = q("SELECT COUNT(*) AS c FROM `contact`
-				WHERE `uid` = %d AND NOT `self`
+				WHERE `uid` = %d AND NOT `self` AND NOT `deleted`
 				AND NOT `blocked` AND NOT `pending` AND NOT `archive`
 				AND (`forum` OR `prv`)
 				AND `success_update` >= `failure_update`
@@ -79,20 +80,21 @@ function acl_content(App $a)
 	} elseif ($type == 'm') {
 		// autocomplete for Private Messages
 		$r = q("SELECT COUNT(*) AS c FROM `contact`
-				WHERE `uid` = %d AND NOT `self`
+				WHERE `uid` = %d AND NOT `self` AND NOT `deleted`
 				AND NOT `blocked` AND NOT `pending` AND NOT `archive`
 				AND `success_update` >= `failure_update`
-				AND `network` IN ('%s', '%s') $sql_extra2",
+				AND `network` IN ('%s', '%s', '%s') $sql_extra2",
 			intval(local_user()),
-			dbesc(NETWORK_DFRN),
-			dbesc(NETWORK_DIASPORA)
+			DBA::escape(Protocol::ACTIVITYPUB),
+			DBA::escape(Protocol::DFRN),
+			DBA::escape(Protocol::DIASPORA)
 		);
 		$contact_count = (int) $r[0]['c'];
 	} elseif ($type == 'a') {
 		// autocomplete for Contacts
 		$r = q("SELECT COUNT(*) AS c FROM `contact`
 				WHERE `uid` = %d AND NOT `self`
-				AND NOT `pending` $sql_extra2",
+				AND NOT `pending` AND NOT `deleted` $sql_extra2",
 			intval(local_user())
 		);
 		$contact_count = (int) $r[0]['c'];
@@ -123,7 +125,7 @@ function acl_content(App $a)
 			$groups[] = [
 				'type'  => 'g',
 				'photo' => 'images/twopeople.png',
-				'name'  => htmlentities($g['name']),
+				'name'  => htmlspecialchars($g['name']),
 				'id'    => intval($g['id']),
 				'uids'  => array_map('intval', explode(',', $g['uids'])),
 				'link'  => '',
@@ -138,53 +140,54 @@ function acl_content(App $a)
 	$r = [];
 	if ($type == '') {
 		$r = q("SELECT `id`, `name`, `nick`, `micro`, `network`, `url`, `attag`, `addr`, `forum`, `prv`, (`prv` OR `forum`) AS `frm` FROM `contact`
-				WHERE `uid` = %d AND NOT `self` AND NOT `blocked` AND NOT `pending` AND NOT `archive` AND `notify` != ''
+				WHERE `uid` = %d AND NOT `self` AND NOT `deleted` AND NOT `blocked` AND NOT `pending` AND NOT `archive` AND `notify` != ''
 				AND `success_update` >= `failure_update` AND NOT (`network` IN ('%s', '%s'))
 				$sql_extra2
 				ORDER BY `name` ASC ",
 			intval(local_user()),
-			dbesc(NETWORK_OSTATUS),
-			dbesc(NETWORK_STATUSNET)
+			DBA::escape(Protocol::OSTATUS),
+			DBA::escape(Protocol::STATUSNET)
 		);
 	} elseif ($type == 'c') {
 		$r = q("SELECT `id`, `name`, `nick`, `micro`, `network`, `url`, `attag`, `addr`, `forum`, `prv` FROM `contact`
-				WHERE `uid` = %d AND NOT `self` AND NOT `blocked` AND NOT `pending` AND NOT `archive` AND `notify` != ''
+				WHERE `uid` = %d AND NOT `self` AND NOT `deleted` AND NOT `blocked` AND NOT `pending` AND NOT `archive` AND `notify` != ''
 				AND `success_update` >= `failure_update` AND NOT (`network` IN ('%s'))
 				$sql_extra2
 				ORDER BY `name` ASC ",
 			intval(local_user()),
-			dbesc(NETWORK_STATUSNET)
+			DBA::escape(Protocol::STATUSNET)
 		);
 	} elseif ($type == 'f') {
 		$r = q("SELECT `id`, `name`, `nick`, `micro`, `network`, `url`, `attag`, `addr`, `forum`, `prv` FROM `contact`
-				WHERE `uid` = %d AND NOT `self` AND NOT `blocked` AND NOT `pending` AND NOT `archive` AND `notify` != ''
+				WHERE `uid` = %d AND NOT `self` AND NOT `deleted` AND NOT `blocked` AND NOT `pending` AND NOT `archive` AND `notify` != ''
 				AND `success_update` >= `failure_update` AND NOT (`network` IN ('%s'))
 				AND (`forum` OR `prv`)
 				$sql_extra2
 				ORDER BY `name` ASC ",
 			intval(local_user()),
-			dbesc(NETWORK_STATUSNET)
+			DBA::escape(Protocol::STATUSNET)
 		);
 	} elseif ($type == 'm') {
 		$r = q("SELECT `id`, `name`, `nick`, `micro`, `network`, `url`, `attag`, `addr` FROM `contact`
-				WHERE `uid` = %d AND NOT `self` AND NOT `blocked` AND NOT `pending` AND NOT `archive`
-				AND `success_update` >= `failure_update` AND `network` IN ('%s', '%s')
+				WHERE `uid` = %d AND NOT `self` AND NOT `deleted` AND NOT `blocked` AND NOT `pending` AND NOT `archive`
+				AND `success_update` >= `failure_update` AND `network` IN ('%s', '%s', '%s')
 				$sql_extra2
 				ORDER BY `name` ASC ",
 			intval(local_user()),
-			dbesc(NETWORK_DFRN),
-			dbesc(NETWORK_DIASPORA)
+			DBA::escape(Protocol::ACTIVITYPUB),
+			DBA::escape(Protocol::DFRN),
+			DBA::escape(Protocol::DIASPORA)
 		);
 	} elseif ($type == 'a') {
 		$r = q("SELECT `id`, `name`, `nick`, `micro`, `network`, `url`, `attag`, `addr`, `forum`, `prv` FROM `contact`
-				WHERE `uid` = %d AND `pending` = 0 AND `success_update` >= `failure_update`
+				WHERE `uid` = %d AND NOT `deleted` AND NOT `pending` AND `success_update` >= `failure_update`
 				$sql_extra2
 				ORDER BY `name` ASC ",
 			intval(local_user())
 		);
 	} elseif ($type == 'x') {
 		// autocomplete for global contact search (e.g. navbar search)
-		$search = notags(trim($_REQUEST['search']));
+		$search = Strings::escapeTags(trim($_REQUEST['search']));
 		$mode = $_REQUEST['smode'];
 
 		$r = ACL::contactAutocomplete($search, $mode);
@@ -192,8 +195,8 @@ function acl_content(App $a)
 		$contacts = [];
 		foreach ($r as $g) {
 			$contacts[] = [
-				'photo'   => proxy_url($g['photo'], false, PROXY_SIZE_MICRO),
-				'name'    => $g['name'],
+				'photo'   => ProxyUtils::proxifyUrl($g['photo'], false, ProxyUtils::SIZE_MICRO),
+				'name'    => htmlspecialchars($g['name']),
 				'nick'    => defaults($g, 'addr', $g['url']),
 				'network' => $g['network'],
 				'link'    => $g['url'],
@@ -209,13 +212,13 @@ function acl_content(App $a)
 		exit;
 	}
 
-	if (DBM::is_result($r)) {
+	if (DBA::isResult($r)) {
 		$forums = [];
 		foreach ($r as $g) {
 			$entry = [
 				'type'    => 'c',
-				'photo'   => proxy_url($g['micro'], false, PROXY_SIZE_MICRO),
-				'name'    => htmlentities($g['name']),
+				'photo'   => ProxyUtils::proxifyUrl($g['micro'], false, ProxyUtils::SIZE_MICRO),
+				'name'    => htmlspecialchars($g['name']),
 				'id'      => intval($g['id']),
 				'network' => $g['network'],
 				'link'    => $g['url'],
@@ -241,8 +244,8 @@ function acl_content(App $a)
 
 	if ($conv_id) {
 		// In multi threaded posts the conv_id is not the parent of the whole thread
-		$parent_item = dba::selectFirst('item', ['parent'], ['id' => $conv_id]);
-		if (DBM::is_result($parent_item)) {
+		$parent_item = Item::selectFirst(['parent'], ['id' => $conv_id]);
+		if (DBA::isResult($parent_item)) {
 			$conv_id = $parent_item['parent'];
 		}
 
@@ -258,12 +261,12 @@ function acl_content(App $a)
 
 		$condition = ["`parent` = ?", $conv_id];
 		$params = ['order' => ['author-name' => true]];
-		$authors = Item::select(local_user(), ['author-link'], $condition, $params);
+		$authors = Item::selectForUser(local_user(), ['author-link'], $condition, $params);
 		$item_authors = [];
-		while ($author = dba::fetch($authors)) {
+		while ($author = Item::fetch($authors)) {
 			$item_authors[$author['author-link']] = $author['author-link'];
 		}
-		dba::close($authors);
+		DBA::close($authors);
 
 		foreach ($item_authors as $author) {
 			if (in_array($author, $known_contacts)) {
@@ -275,8 +278,8 @@ function acl_content(App $a)
 			if (count($contact) > 0) {
 				$unknown_contacts[] = [
 					'type'    => 'c',
-					'photo'   => proxy_url($contact['micro'], false, PROXY_SIZE_MICRO),
-					'name'    => htmlentities($contact['name']),
+					'photo'   => ProxyUtils::proxifyUrl($contact['micro'], false, ProxyUtils::SIZE_MICRO),
+					'name'    => htmlspecialchars($contact['name']),
 					'id'      => intval($contact['cid']),
 					'network' => $contact['network'],
 					'link'    => $contact['url'],
@@ -302,7 +305,7 @@ function acl_content(App $a)
 		'search'   => $search,
 	];
 
-	Addon::callHooks('acl_lookup_end', $results);
+	Hook::callAll('acl_lookup_end', $results);
 
 	$o = [
 		'tot'   => $results['tot'],