X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=mod%2Fdfrn_confirm.php;h=9f9684e0936e9b40ede108ac7a00b7903d4d78c6;hb=7c87e83dcfae34c75eb8070f225edab670b81efb;hp=48ce3c6aa65684bfe6b47e7ba1794e8709327fb6;hpb=f303f9edf2dd9943d07e6507006f61ca2abadaa5;p=friendica.git

diff --git a/mod/dfrn_confirm.php b/mod/dfrn_confirm.php
index 48ce3c6aa6..9f9684e093 100644
--- a/mod/dfrn_confirm.php
+++ b/mod/dfrn_confirm.php
@@ -20,6 +20,7 @@
 use Friendica\App;
 use Friendica\Core\Config;
 use Friendica\Core\L10n;
+use Friendica\Core\Logger;
 use Friendica\Core\Protocol;
 use Friendica\Core\System;
 use Friendica\Database\DBA;
@@ -27,16 +28,12 @@ use Friendica\Model\Contact;
 use Friendica\Model\Group;
 use Friendica\Model\User;
 use Friendica\Network\Probe;
-use Friendica\Protocol\Diaspora;
-use Friendica\Protocol\ActivityPub;
 use Friendica\Util\Crypto;
 use Friendica\Util\DateTimeFormat;
 use Friendica\Util\Network;
+use Friendica\Util\Strings;
 use Friendica\Util\XML;
 
-require_once 'include/enotify.php';
-require_once 'include/items.php';
-
 function dfrn_confirm_post(App $a, $handsfree = null)
 {
 	$node = null;
@@ -61,7 +58,7 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 	 * this being a page type which supports automatic friend acceptance. That is also Scenario 1
 	 * since we are operating on behalf of our registered user to approve a friendship.
 	 */
-	if (!x($_POST, 'source_url')) {
+	if (empty($_POST['source_url'])) {
 		$uid = defaults($handsfree, 'uid', local_user());
 		if (!$uid) {
 			notice(L10n::t('Permission denied.') . EOL);
@@ -76,14 +73,14 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 
 		// These data elements may come from either the friend request notification form or $handsfree array.
 		if (is_array($handsfree)) {
-			logger('Confirm in handsfree mode');
+			Logger::log('Confirm in handsfree mode');
 			$dfrn_id  = $handsfree['dfrn_id'];
 			$intro_id = $handsfree['intro_id'];
 			$duplex   = $handsfree['duplex'];
 			$cid      = 0;
 			$hidden   = intval(defaults($handsfree, 'hidden'  , 0));
 		} else {
-			$dfrn_id  = notags(trim(defaults($_POST, 'dfrn_id'   , '')));
+			$dfrn_id  = Strings::escapeTags(trim(defaults($_POST, 'dfrn_id'   , '')));
 			$intro_id =      intval(defaults($_POST, 'intro_id'  , 0));
 			$duplex   =      intval(defaults($_POST, 'duplex'    , 0));
 			$cid      =      intval(defaults($_POST, 'contact_id', 0));
@@ -99,9 +96,9 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 			$cid = 0;
 		}
 
-		logger('Confirming request for dfrn_id (issued) ' . $dfrn_id);
+		Logger::log('Confirming request for dfrn_id (issued) ' . $dfrn_id);
 		if ($cid) {
-			logger('Confirming follower with contact_id: ' . $cid);
+			Logger::log('Confirming follower with contact_id: ' . $cid);
 		}
 
 		/*
@@ -124,7 +121,7 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 			intval($uid)
 		);
 		if (!DBA::isResult($r)) {
-			logger('Contact not found in DB.');
+			Logger::log('Contact not found in DB.');
 			notice(L10n::t('Contact not found.') . EOL);
 			notice(L10n::t('This may occasionally happen if contact was requested by both persons and it has already been approved.') . EOL);
 			return;
@@ -137,163 +134,153 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 		$site_pubkey  = $contact['site-pubkey'];
 		$dfrn_confirm = $contact['confirm'];
 		$aes_allow    = $contact['aes_allow'];
+		$protocol     = $contact['network'];
 
-		$network = ((strlen($contact['issued-id'])) ? Protocol::DFRN : Protocol::OSTATUS);
-
-		if ($contact['network']) {
-			$network = $contact['network'];
-		}
+		/*
+		 * Generate a key pair for all further communications with this person.
+		 * We have a keypair for every contact, and a site key for unknown people.
+		 * This provides a means to carry on relationships with other people if
+		 * any single key is compromised. It is a robust key. We're much more
+		 * worried about key leakage than anybody cracking it.
+		 */
+		$res = Crypto::newKeypair(4096);
 
-		if ($network === Protocol::DFRN) {
-			/*
-			 * Generate a key pair for all further communications with this person.
-			 * We have a keypair for every contact, and a site key for unknown people.
-			 * This provides a means to carry on relationships with other people if
-			 * any single key is compromised. It is a robust key. We're much more
-			 * worried about key leakage than anybody cracking it.
-			 */
-			$res = Crypto::newKeypair(4096);
+		$private_key = $res['prvkey'];
+		$public_key  = $res['pubkey'];
 
-			$private_key = $res['prvkey'];
-			$public_key  = $res['pubkey'];
+		// Save the private key. Send them the public key.
+		$fields = ['prvkey' => $private_key, 'protocol' => Protocol::DFRN];
+		DBA::update('contact', $fields, ['id' => $contact_id]);
 
-			// Save the private key. Send them the public key.
-			q("UPDATE `contact` SET `prvkey` = '%s' WHERE `id` = %d AND `uid` = %d",
-				DBA::escape($private_key),
-				intval($contact_id),
-				intval($uid)
-			);
+		$params = [];
 
-			$params = [];
+		/*
+		 * Per the DFRN protocol, we will verify both ends by encrypting the dfrn_id with our
+		 * site private key (person on the other end can decrypt it with our site public key).
+		 * Then encrypt our profile URL with the other person's site public key. They can decrypt
+		 * it with their site private key. If the decryption on the other end fails for either
+		 * item, it indicates tampering or key failure on at least one site and we will not be
+		 * able to provide a secure communication pathway.
+		 *
+		 * If other site is willing to accept full encryption, (aes_allow is 1 AND we have php5.3
+		 * or later) then we encrypt the personal public key we send them using AES-256-CBC and a
+		 * random key which is encrypted with their site public key.
+		 */
 
-			/*
-			 * Per the DFRN protocol, we will verify both ends by encrypting the dfrn_id with our
-			 * site private key (person on the other end can decrypt it with our site public key).
-			 * Then encrypt our profile URL with the other person's site public key. They can decrypt
-			 * it with their site private key. If the decryption on the other end fails for either
-			 * item, it indicates tampering or key failure on at least one site and we will not be
-			 * able to provide a secure communication pathway.
-			 *
-			 * If other site is willing to accept full encryption, (aes_allow is 1 AND we have php5.3
-			 * or later) then we encrypt the personal public key we send them using AES-256-CBC and a
-			 * random key which is encrypted with their site public key.
-			 */
+		$src_aes_key = openssl_random_pseudo_bytes(64);
 
-			$src_aes_key = openssl_random_pseudo_bytes(64);
+		$result = '';
+		openssl_private_encrypt($dfrn_id, $result, $user['prvkey']);
 
-			$result = '';
-			openssl_private_encrypt($dfrn_id, $result, $user['prvkey']);
+		$params['dfrn_id'] = bin2hex($result);
+		$params['public_key'] = $public_key;
 
-			$params['dfrn_id'] = bin2hex($result);
-			$params['public_key'] = $public_key;
+		$my_url = System::baseUrl() . '/profile/' . $user['nickname'];
 
-			$my_url = System::baseUrl() . '/profile/' . $user['nickname'];
+		openssl_public_encrypt($my_url, $params['source_url'], $site_pubkey);
+		$params['source_url'] = bin2hex($params['source_url']);
 
-			openssl_public_encrypt($my_url, $params['source_url'], $site_pubkey);
-			$params['source_url'] = bin2hex($params['source_url']);
+		if ($aes_allow && function_exists('openssl_encrypt')) {
+			openssl_public_encrypt($src_aes_key, $params['aes_key'], $site_pubkey);
+			$params['aes_key'] = bin2hex($params['aes_key']);
+			$params['public_key'] = bin2hex(openssl_encrypt($public_key, 'AES-256-CBC', $src_aes_key));
+		}
 
-			if ($aes_allow && function_exists('openssl_encrypt')) {
-				openssl_public_encrypt($src_aes_key, $params['aes_key'], $site_pubkey);
-				$params['aes_key'] = bin2hex($params['aes_key']);
-				$params['public_key'] = bin2hex(openssl_encrypt($public_key, 'AES-256-CBC', $src_aes_key));
-			}
+		$params['dfrn_version'] = DFRN_PROTOCOL_VERSION;
+		if ($duplex == 1) {
+			$params['duplex'] = 1;
+		}
 
-			$params['dfrn_version'] = DFRN_PROTOCOL_VERSION;
-			if ($duplex == 1) {
-				$params['duplex'] = 1;
-			}
+		if ($user['page-flags'] == User::PAGE_FLAGS_COMMUNITY) {
+			$params['page'] = 1;
+		}
 
-			if ($user['page-flags'] == Contact::PAGE_COMMUNITY) {
-				$params['page'] = 1;
-			}
+		if ($user['page-flags'] == User::PAGE_FLAGS_PRVGROUP) {
+			$params['page'] = 2;
+		}
 
-			if ($user['page-flags'] == Contact::PAGE_PRVGROUP) {
-				$params['page'] = 2;
-			}
+		Logger::log('Confirm: posting data to ' . $dfrn_confirm . ': ' . print_r($params, true), Logger::DATA);
 
-			logger('Confirm: posting data to ' . $dfrn_confirm . ': ' . print_r($params, true), LOGGER_DATA);
+		/*
+		 *
+		 * POST all this stuff to the other site.
+		 * Temporarily raise the network timeout to 120 seconds because the default 60
+		 * doesn't always give the other side quite enough time to decrypt everything.
+		 *
+		 */
 
-			/*
-			 *
-			 * POST all this stuff to the other site.
-			 * Temporarily raise the network timeout to 120 seconds because the default 60
-			 * doesn't always give the other side quite enough time to decrypt everything.
-			 *
-			 */
+		$res = Network::post($dfrn_confirm, $params, [], 120)->getBody();
 
-			$res = Network::post($dfrn_confirm, $params, null, $redirects, 120)->getBody();
+		Logger::log(' Confirm: received data: ' . $res, Logger::DATA);
 
-			logger(' Confirm: received data: ' . $res, LOGGER_DATA);
+		// Now figure out what they responded. Try to be robust if the remote site is
+		// having difficulty and throwing up errors of some kind.
 
-			// Now figure out what they responded. Try to be robust if the remote site is
-			// having difficulty and throwing up errors of some kind.
+		$leading_junk = substr($res, 0, strpos($res, '<?xml'));
 
-			$leading_junk = substr($res, 0, strpos($res, '<?xml'));
+		$res = substr($res, strpos($res, '<?xml'));
+		if (!strlen($res)) {
+			// No XML at all, this exchange is messed up really bad.
+			// We shouldn't proceed, because the xml parser might choke,
+			// and $status is going to be zero, which indicates success.
+			// We can hardly call this a success.
+			notice(L10n::t('Response from remote site was not understood.') . EOL);
+			return;
+		}
 
-			$res = substr($res, strpos($res, '<?xml'));
-			if (!strlen($res)) {
-				// No XML at all, this exchange is messed up really bad.
-				// We shouldn't proceed, because the xml parser might choke,
-				// and $status is going to be zero, which indicates success.
-				// We can hardly call this a success.
-				notice(L10n::t('Response from remote site was not understood.') . EOL);
-				return;
-			}
+		if (strlen($leading_junk) && Config::get('system', 'debugging')) {
+			// This might be more common. Mixed error text and some XML.
+			// If we're configured for debugging, show the text. Proceed in either case.
+			notice(L10n::t('Unexpected response from remote site: ') . EOL . $leading_junk . EOL);
+		}
 
-			if (strlen($leading_junk) && Config::get('system', 'debugging')) {
-				// This might be more common. Mixed error text and some XML.
-				// If we're configured for debugging, show the text. Proceed in either case.
-				notice(L10n::t('Unexpected response from remote site: ') . EOL . $leading_junk . EOL);
-			}
+		if (stristr($res, "<status") === false) {
+			// wrong xml! stop here!
+			Logger::log('Unexpected response posting to ' . $dfrn_confirm);
+			notice(L10n::t('Unexpected response from remote site: ') . EOL . htmlspecialchars($res) . EOL);
+			return;
+		}
 
-			if (stristr($res, "<status") === false) {
-				// wrong xml! stop here!
-				logger('Unexpected response posting to ' . $dfrn_confirm);
-				notice(L10n::t('Unexpected response from remote site: ') . EOL . htmlspecialchars($res) . EOL);
-				return;
-			}
+		$xml = XML::parseString($res);
+		$status = (int) $xml->status;
+		$message = XML::unescape($xml->message);   // human readable text of what may have gone wrong.
+		switch ($status) {
+			case 0:
+				info(L10n::t("Confirmation completed successfully.") . EOL);
+				break;
+			case 1:
+				// birthday paradox - generate new dfrn-id and fall through.
+				$new_dfrn_id = Strings::getRandomHex();
+				q("UPDATE contact SET `issued-id` = '%s' WHERE `id` = %d AND `uid` = %d",
+					DBA::escape($new_dfrn_id),
+					intval($contact_id),
+					intval($uid)
+				);
+
+			case 2:
+				notice(L10n::t("Temporary failure. Please wait and try again.") . EOL);
+				break;
+			case 3:
+				notice(L10n::t("Introduction failed or was revoked.") . EOL);
+				break;
+		}
 
-			$xml = XML::parseString($res);
-			$status = (int) $xml->status;
-			$message = unxmlify($xml->message);   // human readable text of what may have gone wrong.
-			switch ($status) {
-				case 0:
-					info(L10n::t("Confirmation completed successfully.") . EOL);
-					break;
-				case 1:
-					// birthday paradox - generate new dfrn-id and fall through.
-					$new_dfrn_id = random_string();
-					q("UPDATE contact SET `issued-id` = '%s' WHERE `id` = %d AND `uid` = %d",
-						DBA::escape($new_dfrn_id),
-						intval($contact_id),
-						intval($uid)
-					);
-
-				case 2:
-					notice(L10n::t("Temporary failure. Please wait and try again.") . EOL);
-					break;
-				case 3:
-					notice(L10n::t("Introduction failed or was revoked.") . EOL);
-					break;
-			}
+		if (strlen($message)) {
+			notice(L10n::t('Remote site reported: ') . $message . EOL);
+		}
 
-			if (strlen($message)) {
-				notice(L10n::t('Remote site reported: ') . $message . EOL);
+		if (($status == 0) && $intro_id) {
+			$intro = DBA::selectFirst('intro', ['note'], ['id' => $intro_id]);
+			if (DBA::isResult($intro)) {
+				DBA::update('contact', ['reason' => $intro['note']], ['id' => $contact_id]);
 			}
 
-			if (($status == 0) && $intro_id) {
-				$intro = DBA::selectFirst('intro', ['note'], ['id' => $intro_id]);
-				if (DBA::isResult($intro)) {
-					DBA::update('contact', ['reason' => $intro['note']], ['id' => $contact_id]);
-				}
-
-				// Success. Delete the notification.
-				DBA::delete('intro', ['id' => $intro_id]);
-			}
+			// Success. Delete the notification.
+			DBA::delete('intro', ['id' => $intro_id]);
+		}
 
-			if ($status != 0) {
-				return;
-			}
+		if ($status != 0) {
+			return;
 		}
 
 		/*
@@ -305,102 +292,45 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 		 */
 		Contact::updateAvatar($contact['photo'], $uid, $contact_id);
 
-		logger('dfrn_confirm: confirm - imported photos');
-
-		if ($network === Protocol::DFRN) {
-			$new_relation = Contact::FOLLOWER;
+		Logger::log('dfrn_confirm: confirm - imported photos');
 
-			if (($relation == Contact::SHARING) || ($duplex)) {
-				$new_relation = Contact::FRIEND;
-			}
-
-			if (($relation == Contact::SHARING) && ($duplex)) {
-				$duplex = 0;
-			}
-
-			$r = q("UPDATE `contact` SET `rel` = %d,
-				`name-date` = '%s',
-				`uri-date` = '%s',
-				`blocked` = 0,
-				`pending` = 0,
-				`duplex` = %d,
-				`hidden` = %d,
-				`network` = '%s' WHERE `id` = %d
-			",
-				intval($new_relation),
-				DBA::escape(DateTimeFormat::utcNow()),
-				DBA::escape(DateTimeFormat::utcNow()),
-				intval($duplex),
-				intval($hidden),
-				DBA::escape(Protocol::DFRN),
-				intval($contact_id)
-			);
-		} else {
-			if ($network == Protocol::ACTIVITYPUB) {
-				ActivityPub\Transmitter::sendContactAccept($contact['url'], $contact['hub-verify'], $uid);
-				$pending = true;
-			} else {
-				$pending = false;
-			}
-
-			// $network !== Protocol::DFRN
-			$network = defaults($contact, 'network', Protocol::OSTATUS);
-
-			$arr = Probe::uri($contact['url'], $network);
+		$new_relation = Contact::FOLLOWER;
 
-			$notify  = defaults($contact, 'notify' , $arr['notify']);
-			$poll    = defaults($contact, 'poll'   , $arr['poll']);
-
-			$addr = $arr['addr'];
-
-			$new_relation = $contact['rel'];
-			$writable = $contact['writable'];
-
-			if (in_array($network, [Protocol::DIASPORA, Protocol::ACTIVITYPUB])) {
-				if ($duplex) {
-					$new_relation = Contact::FRIEND;
-				} else {
-					$new_relation = Contact::FOLLOWER;
-				}
-
-				if ($new_relation != Contact::FOLLOWER) {
-					$writable = 1;
-				}
-			}
-
-			DBA::delete('intro', ['id' => $intro_id]);
-
-			$fields = ['name-date' => DateTimeFormat::utcNow(),
-				'uri-date' => DateTimeFormat::utcNow(), 'addr' => $addr,
-				'notify' => $notify, 'poll' => $poll, 'blocked' => false,
-				'pending' => $pending, 'network' => $network,
-				'writable' => $writable, 'hidden' => $hidden, 'rel' => $new_relation];
-			DBA::update('contact', $fields, ['id' => $contact_id]);
+		if (($relation == Contact::SHARING) || ($duplex)) {
+			$new_relation = Contact::FRIEND;
 		}
 
-		if (!DBA::isResult($r)) {
-			notice(L10n::t('Unable to set contact photo.') . EOL);
+		if (($relation == Contact::SHARING) && ($duplex)) {
+			$duplex = 0;
 		}
 
+		$r = q("UPDATE `contact` SET `rel` = %d,
+			`name-date` = '%s',
+			`uri-date` = '%s',
+			`blocked` = 0,
+			`pending` = 0,
+			`duplex` = %d,
+			`hidden` = %d,
+			`network` = '%s' WHERE `id` = %d
+		",
+			intval($new_relation),
+			DBA::escape(DateTimeFormat::utcNow()),
+			DBA::escape(DateTimeFormat::utcNow()),
+			intval($duplex),
+			intval($hidden),
+			DBA::escape(Protocol::DFRN),
+			intval($contact_id)
+		);
+
 		// reload contact info
 		$contact = DBA::selectFirst('contact', [], ['id' => $contact_id]);
-		if ((isset($new_relation) && $new_relation == Contact::FRIEND)) {
-			if (DBA::isResult($contact) && ($contact['network'] === Protocol::DIASPORA)) {
-				$ret = Diaspora::sendShare($user, $contact);
-				logger('share returns: ' . $ret);
-			}
-		}
 
 		Group::addMember(User::getDefaultGroup($uid, $contact["network"]), $contact['id']);
 
-		if ($network == Protocol::ACTIVITYPUB && $duplex) {
-			ActivityPub\Transmitter::sendActivity('Follow', $contact['url'], $uid);
-		}
-
 		// Let's send our user to the contact editor in case they want to
 		// do anything special with this new friend.
 		if ($handsfree === null) {
-			goaway(System::baseUrl() . '/contact/' . intval($contact_id));
+			$a->internalRedirect('contact/' . intval($contact_id));
 		} else {
 			return;
 		}
@@ -415,7 +345,7 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 	 * In the section above where the confirming party makes a POST and
 	 * retrieves xml status information, they are communicating with the following code.
 	 */
-	if (x($_POST, 'source_url')) {
+	if (!empty($_POST['source_url'])) {
 		// We are processing an external confirmation to an introduction created by our user.
 		$public_key =         defaults($_POST, 'public_key', '');
 		$dfrn_id    = hex2bin(defaults($_POST, 'dfrn_id'   , ''));
@@ -427,13 +357,13 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 		$forum = (($page == 1) ? 1 : 0);
 		$prv   = (($page == 2) ? 1 : 0);
 
-		logger('dfrn_confirm: requestee contacted: ' . $node);
+		Logger::log('dfrn_confirm: requestee contacted: ' . $node);
 
-		logger('dfrn_confirm: request: POST=' . print_r($_POST, true), LOGGER_DATA);
+		Logger::log('dfrn_confirm: request: POST=' . print_r($_POST, true), Logger::DATA);
 
 		// If $aes_key is set, both of these items require unpacking from the hex transport encoding.
 
-		if (x($aes_key)) {
+		if (!empty($aes_key)) {
 			$aes_key = hex2bin($aes_key);
 			$public_key = hex2bin($public_key);
 		}
@@ -537,12 +467,12 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 		if (DBA::isResult($contact)) {
 			$photo = $contact['photo'];
 		} else {
-			$photo = System::baseUrl() . '/images/person-175.jpg';
+			$photo = System::baseUrl() . '/images/person-300.jpg';
 		}
 
 		Contact::updateAvatar($photo, $local_uid, $dfrn_record);
 
-		logger('dfrn_confirm: request - photos imported');
+		Logger::log('dfrn_confirm: request - photos imported');
 
 		$new_relation = Contact::SHARING;
 
@@ -582,7 +512,7 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 		// Otherwise everything seems to have worked and we are almost done. Yay!
 		// Send an email notification
 
-		logger('dfrn_confirm: request: info updated');
+		Logger::log('dfrn_confirm: request: info updated');
 
 		$combined = null;
 		$r = q("SELECT `contact`.*, `user`.*
@@ -620,6 +550,6 @@ function dfrn_confirm_post(App $a, $handsfree = null)
 	}
 
 	// somebody arrived here by mistake or they are fishing. Send them to the homepage.
-	goaway(System::baseUrl());
+	$a->internalRedirect();
 	// NOTREACHED
 }