X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=mod%2Fdfrn_confirm.php;h=302cb370ea4af5aaa700176d6439779e4a106d41;hb=b6000b3395167283fddee3fe9286f99c73f629d1;hp=8d4594c152cae6fbe8eb3887e84ec6c0aa1d644a;hpb=991f259ecb58720c0993718bc944bc60e83226b4;p=friendica.git

diff --git a/mod/dfrn_confirm.php b/mod/dfrn_confirm.php
index 8d4594c152..302cb370ea 100644
--- a/mod/dfrn_confirm.php
+++ b/mod/dfrn_confirm.php
@@ -36,9 +36,6 @@ use Friendica\Util\Network;
 use Friendica\Util\Strings;
 use Friendica\Util\XML;
 
-require_once 'include/enotify.php';
-require_once 'include/items.php';
-
 function dfrn_confirm_post(App $a, $handsfree = null)
 {
 	$node = null;
@@ -63,7 +60,7 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 	 * this being a page type which supports automatic friend acceptance. That is also Scenario 1
 	 * since we are operating on behalf of our registered user to approve a friendship.
 	 */
-	if (!x($_POST, 'source_url')) {
+	if (empty($_POST['source_url'])) {
 		$uid = defaults($handsfree, 'uid', local_user());
 		if (!$uid) {
 			notice(L10n::t('Permission denied.') . EOL);
@@ -85,7 +82,7 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 			$cid      = 0;
 			$hidden   = intval(defaults($handsfree, 'hidden'  , 0));
 		} else {
-			$dfrn_id  = notags(trim(defaults($_POST, 'dfrn_id'   , '')));
+			$dfrn_id  = Strings::escapeTags(trim(defaults($_POST, 'dfrn_id'   , '')));
 			$intro_id =      intval(defaults($_POST, 'intro_id'  , 0));
 			$duplex   =      intval(defaults($_POST, 'duplex'    , 0));
 			$cid      =      intval(defaults($_POST, 'contact_id', 0));
@@ -146,6 +143,11 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 			$network = $contact['network'];
 		}
 
+		// an empty DFRN-ID tells us that it had been a request via AP from a Friendica contact
+		if (($network === Protocol::DFRN) && empty($dfrn_id)) {
+			$network = Contact::getProtocol($contact['url'], $contact['network']);
+		}
+
 		if ($network === Protocol::DFRN) {
 			/*
 			 * Generate a key pair for all further communications with this person.
@@ -160,11 +162,8 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 			$public_key  = $res['pubkey'];
 
 			// Save the private key. Send them the public key.
-			q("UPDATE `contact` SET `prvkey` = '%s' WHERE `id` = %d AND `uid` = %d",
-				DBA::escape($private_key),
-				intval($contact_id),
-				intval($uid)
-			);
+			$fields = ['prvkey' => $private_key, 'protocol' => Protocol::DFRN];
+			DBA::update('contact', $fields, ['id' => $contact_id]);
 
 			$params = [];
 
@@ -205,11 +204,11 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 				$params['duplex'] = 1;
 			}
 
-			if ($user['page-flags'] == Contact::PAGE_COMMUNITY) {
+			if ($user['page-flags'] == User::PAGE_FLAGS_COMMUNITY) {
 				$params['page'] = 1;
 			}
 
-			if ($user['page-flags'] == Contact::PAGE_PRVGROUP) {
+			if ($user['page-flags'] == User::PAGE_FLAGS_PRVGROUP) {
 				$params['page'] = 2;
 			}
 
@@ -296,6 +295,8 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 			if ($status != 0) {
 				return;
 			}
+		} else {
+			DBA::update('contact', ['protocol' => $network], ['id' => $contact_id]);
 		}
 
 		/*
@@ -340,7 +341,12 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 		} else {
 			if ($network == Protocol::ACTIVITYPUB) {
 				ActivityPub\Transmitter::sendContactAccept($contact['url'], $contact['hub-verify'], $uid);
-				$pending = true;
+				// Setting "pending" to true on a bidirectional contact request could create a problem when it isn't accepted on the other side
+				// Then we have got a situation where - although one direction is accepted - the contact still appears as pending.
+				// Possibly we need two different "pending" fields, one for incoming, one for outgoing?
+				// This has to be thought over, but for now this here is a better solution.
+				// $pending = $duplex;
+				$pending = false;
 			} else {
 				$pending = false;
 			}
@@ -417,7 +423,7 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 	 * In the section above where the confirming party makes a POST and
 	 * retrieves xml status information, they are communicating with the following code.
 	 */
-	if (x($_POST, 'source_url')) {
+	if (!empty($_POST['source_url'])) {
 		// We are processing an external confirmation to an introduction created by our user.
 		$public_key =         defaults($_POST, 'public_key', '');
 		$dfrn_id    = hex2bin(defaults($_POST, 'dfrn_id'   , ''));
@@ -435,7 +441,7 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 
 		// If $aes_key is set, both of these items require unpacking from the hex transport encoding.
 
-		if (x($aes_key)) {
+		if (!empty($aes_key)) {
 			$aes_key = hex2bin($aes_key);
 			$public_key = hex2bin($public_key);
 		}