X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=mod%2Fdfrn_poll.php;h=54539ee03d7bd4cc580bb7845b9fa34b59734488;hb=6d1b98dc0e951445e447a60d3ee17368891d17b8;hp=5042ed642d8725afa05fdaf7c5194b6fd9cb2411;hpb=ca76e49c230fce5fd6d86063f6fdfc3df05e78d4;p=friendica.git diff --git a/mod/dfrn_poll.php b/mod/dfrn_poll.php index 5042ed642d..54539ee03d 100644 --- a/mod/dfrn_poll.php +++ b/mod/dfrn_poll.php @@ -3,15 +3,17 @@ /** * @file mod/dfrn_poll.php */ + use Friendica\App; use Friendica\Core\Config; use Friendica\Core\L10n; use Friendica\Core\System; -use Friendica\Database\DBM; +use Friendica\Database\DBA; use Friendica\Module\Login; use Friendica\Protocol\DFRN; use Friendica\Protocol\OStatus; use Friendica\Util\Network; +use Friendica\Util\XML; require_once 'include/items.php'; @@ -30,7 +32,8 @@ function dfrn_poll_init(App $a) $quiet = x($_GET, 'quiet'); // Possibly it is an OStatus compatible server that requests a user feed - if (($a->argc > 1) && ($dfrn_id == '') && !strstr($_SERVER["HTTP_USER_AGENT"], 'Friendica')) { + $user_agent = defaults($_SERVER, 'HTTP_USER_AGENT', ''); + if (($a->argc > 1) && ($dfrn_id == '') && !strstr($user_agent, 'Friendica')) { $nickname = $a->argv[1]; header("Content-type: application/atom+xml"); echo OStatus::feed($nickname, $last_update, 10); @@ -48,16 +51,16 @@ function dfrn_poll_init(App $a) if (($dfrn_id === '') && (!x($_POST, 'dfrn_id'))) { if (Config::get('system', 'block_public') && !local_user() && !remote_user()) { - Network::httpStatusExit(403); + System::httpExit(403); } $user = ''; if ($a->argc > 1) { $r = q("SELECT `hidewall`,`nickname` FROM `user` WHERE `user`.`nickname` = '%s' LIMIT 1", - dbesc($a->argv[1]) + DBA::escape($a->argv[1]) ); if (!$r) { - Network::httpStatusExit(404); + System::httpExit(404); } $hidewall = ($r[0]['hidewall'] && !local_user()); @@ -75,15 +78,15 @@ function dfrn_poll_init(App $a) $sql_extra = ''; switch ($direction) { case -1: - $sql_extra = sprintf(" AND ( `dfrn-id` = '%s' OR `issued-id` = '%s' ) ", dbesc($dfrn_id), dbesc($dfrn_id)); + $sql_extra = sprintf(" AND ( `dfrn-id` = '%s' OR `issued-id` = '%s' ) ", DBA::escape($dfrn_id), DBA::escape($dfrn_id)); $my_id = $dfrn_id; break; case 0: - $sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id)); + $sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id)); $my_id = '1:' . $dfrn_id; break; case 1: - $sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id)); + $sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id)); $my_id = '0:' . $dfrn_id; break; default: @@ -95,16 +98,16 @@ function dfrn_poll_init(App $a) FROM `contact` LEFT JOIN `user` ON `contact`.`uid` = `user`.`uid` WHERE `contact`.`blocked` = 0 AND `contact`.`pending` = 0 AND `user`.`nickname` = '%s' $sql_extra LIMIT 1", - dbesc($a->argv[1]) + DBA::escape($a->argv[1]) ); - if (DBM::is_result($r)) { - $s = Network::fetchURL($r[0]['poll'] . '?dfrn_id=' . $my_id . '&type=profile-check'); + if (DBA::isResult($r)) { + $s = Network::fetchUrl($r[0]['poll'] . '?dfrn_id=' . $my_id . '&type=profile-check'); logger("dfrn_poll: old profile returns " . $s, LOGGER_DATA); if (strlen($s)) { - $xml = Network::parseXmlString($s); + $xml = XML::parseString($s); if ((int) $xml->status === 1) { $_SESSION['authenticated'] = 1; @@ -118,6 +121,7 @@ function dfrn_poll_init(App $a) $_SESSION['visitor_home'] = $r[0]['url']; $_SESSION['visitor_handle'] = $r[0]['addr']; $_SESSION['visitor_visiting'] = $r[0]['uid']; + $_SESSION['my_url'] = $r[0]['url']; if (!$quiet) { info(L10n::t('%1$s welcomes %2$s', $r[0]['username'], $r[0]['name']) . EOL); } @@ -126,8 +130,8 @@ function dfrn_poll_init(App $a) $session_id = session_id(); $expire = time() + 86400; q("UPDATE `session` SET `expire` = '%s' WHERE `sid` = '%s'", - dbesc($expire), - dbesc($session_id) + DBA::escape($expire), + DBA::escape($session_id) ); } } @@ -139,12 +143,12 @@ function dfrn_poll_init(App $a) if ($type === 'profile-check' && $dfrn_version < 2.2) { if ((strlen($challenge)) && (strlen($sec))) { - q("DELETE FROM `profile_check` WHERE `expire` < " . intval(time())); + DBA::delete('profile_check', ["`expire` < ?", time()]); $r = q("SELECT * FROM `profile_check` WHERE `sec` = '%s' ORDER BY `expire` DESC LIMIT 1", - dbesc($sec) + DBA::escape($sec) ); - if (!DBM::is_result($r)) { - Network::xmlStatus(3, 'No ticket'); + if (!DBA::isResult($r)) { + System::xmlExit(3, 'No ticket'); // NOTREACHED } @@ -156,8 +160,8 @@ function dfrn_poll_init(App $a) $c = q("SELECT * FROM `contact` WHERE `id` = %d LIMIT 1", intval($r[0]['cid']) ); - if (!DBM::is_result($c)) { - Network::xmlStatus(3, 'No profile'); + if (!DBA::isResult($c)) { + System::xmlExit(3, 'No profile'); } $contact = $c[0]; @@ -184,7 +188,7 @@ function dfrn_poll_init(App $a) if ($final_dfrn_id != $orig_id) { logger('profile_check: ' . $final_dfrn_id . ' != ' . $orig_id, LOGGER_DEBUG); // did not decode properly - cannot trust this site - Network::xmlStatus(3, 'Bad decryption'); + System::xmlExit(3, 'Bad decryption'); } header("Content-type: text/xml"); @@ -204,14 +208,14 @@ function dfrn_poll_init(App $a) break; } - q("DELETE FROM `profile_check` WHERE `expire` < " . intval(time())); + DBA::delete('profile_check', ["`expire` < ?", time()]); $r = q("SELECT * FROM `profile_check` WHERE `dfrn_id` = '%s' ORDER BY `expire` DESC", - dbesc($dfrn_id)); - if (DBM::is_result($r)) { - Network::xmlStatus(1); + DBA::escape($dfrn_id)); + if (DBA::isResult($r)) { + System::xmlExit(1); return; // NOTREACHED } - Network::xmlStatus(0); + System::xmlExit(0); return; // NOTREACHED } } @@ -231,12 +235,12 @@ function dfrn_poll_post(App $a) if (strlen($challenge) && strlen($sec)) { logger('dfrn_poll: POST: profile-check'); - q("DELETE FROM `profile_check` WHERE `expire` < " . intval(time())); + DBA::delete('profile_check', ["`expire` < ?", time()]); $r = q("SELECT * FROM `profile_check` WHERE `sec` = '%s' ORDER BY `expire` DESC LIMIT 1", - dbesc($sec) + DBA::escape($sec) ); - if (!DBM::is_result($r)) { - Network::xmlStatus(3, 'No ticket'); + if (!DBA::isResult($r)) { + System::xmlExit(3, 'No ticket'); // NOTREACHED } @@ -248,8 +252,8 @@ function dfrn_poll_post(App $a) $c = q("SELECT * FROM `contact` WHERE `id` = %d LIMIT 1", intval($r[0]['cid']) ); - if (!DBM::is_result($c)) { - Network::xmlStatus(3, 'No profile'); + if (!DBA::isResult($c)) { + System::xmlExit(3, 'No profile'); } $contact = $c[0]; @@ -276,7 +280,7 @@ function dfrn_poll_post(App $a) if ($final_dfrn_id != $orig_id) { logger('profile_check: ' . $final_dfrn_id . ' != ' . $orig_id, LOGGER_DEBUG); // did not decode properly - cannot trust this site - Network::xmlStatus(3, 'Bad decryption'); + System::xmlExit(3, 'Bad decryption'); } header("Content-type: text/xml"); @@ -293,35 +297,31 @@ function dfrn_poll_post(App $a) } $r = q("SELECT * FROM `challenge` WHERE `dfrn-id` = '%s' AND `challenge` = '%s' LIMIT 1", - dbesc($dfrn_id), - dbesc($challenge) + DBA::escape($dfrn_id), + DBA::escape($challenge) ); - if (!DBM::is_result($r)) { + if (!DBA::isResult($r)) { killme(); } $type = $r[0]['type']; $last_update = $r[0]['last_update']; - $r = q("DELETE FROM `challenge` WHERE `dfrn-id` = '%s' AND `challenge` = '%s'", - dbesc($dfrn_id), - dbesc($challenge) - ); - + DBA::delete('challenge', ['dfrn-id' => $dfrn_id, 'challenge' => $challenge]); $sql_extra = ''; switch ($direction) { case -1: - $sql_extra = sprintf(" AND `issued-id` = '%s' ", dbesc($dfrn_id)); + $sql_extra = sprintf(" AND `issued-id` = '%s' ", DBA::escape($dfrn_id)); $my_id = $dfrn_id; break; case 0: - $sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id)); + $sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id)); $my_id = '1:' . $dfrn_id; break; case 1: - $sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id)); + $sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id)); $my_id = '0:' . $dfrn_id; break; default: @@ -330,7 +330,7 @@ function dfrn_poll_post(App $a) } $r = q("SELECT * FROM `contact` WHERE `blocked` = 0 AND `pending` = 0 $sql_extra LIMIT 1"); - if (!DBM::is_result($r)) { + if (!DBA::isResult($r)) { killme(); } @@ -340,13 +340,13 @@ function dfrn_poll_post(App $a) if ($type === 'reputation' && strlen($url)) { $r = q("SELECT * FROM `contact` WHERE `url` = '%s' AND `uid` = %d LIMIT 1", - dbesc($url), + DBA::escape($url), intval($owner_uid) ); $reputation = 0; $text = ''; - if (DBM::is_result($r)) { + if (DBA::isResult($r)) { $reputation = $r[0]['rating']; $text = $r[0]['reason']; @@ -413,16 +413,16 @@ function dfrn_poll_content(App $a) $status = 0; - $r = q("DELETE FROM `challenge` WHERE `expire` < " . intval(time())); + DBA::delete('challenge', ["`expire` < ?", time()]); if ($type !== 'profile') { $r = q("INSERT INTO `challenge` ( `challenge`, `dfrn-id`, `expire` , `type`, `last_update` ) VALUES( '%s', '%s', '%s', '%s', '%s' ) ", - dbesc($hash), - dbesc($dfrn_id), + DBA::escape($hash), + DBA::escape($dfrn_id), intval(time() + 60 ), - dbesc($type), - dbesc($last_update) + DBA::escape($type), + DBA::escape($last_update) ); } @@ -430,19 +430,19 @@ function dfrn_poll_content(App $a) switch ($direction) { case -1: if ($type === 'profile') { - $sql_extra = sprintf(" AND ( `dfrn-id` = '%s' OR `issued-id` = '%s' ) ", dbesc($dfrn_id), dbesc($dfrn_id)); + $sql_extra = sprintf(" AND ( `dfrn-id` = '%s' OR `issued-id` = '%s' ) ", DBA::escape($dfrn_id), DBA::escape($dfrn_id)); } else { - $sql_extra = sprintf(" AND `issued-id` = '%s' ", dbesc($dfrn_id)); + $sql_extra = sprintf(" AND `issued-id` = '%s' ", DBA::escape($dfrn_id)); } $my_id = $dfrn_id; break; case 0: - $sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id)); + $sql_extra = sprintf(" AND `issued-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id)); $my_id = '1:' . $dfrn_id; break; case 1: - $sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", dbesc($dfrn_id)); + $sql_extra = sprintf(" AND `dfrn-id` = '%s' AND `duplex` = 1 ", DBA::escape($dfrn_id)); $my_id = '0:' . $dfrn_id; break; default: @@ -456,9 +456,9 @@ function dfrn_poll_content(App $a) FROM `contact` LEFT JOIN `user` ON `contact`.`uid` = `user`.`uid` WHERE `contact`.`blocked` = 0 AND `contact`.`pending` = 0 AND `user`.`nickname` = '%s' $sql_extra LIMIT 1", - dbesc($nickname) + DBA::escape($nickname) ); - if (DBM::is_result($r)) { + if (DBA::isResult($r)) { $challenge = ''; $encrypted_id = ''; $id_str = $my_id . '.' . mt_rand(1000, 9999); @@ -480,9 +480,15 @@ function dfrn_poll_content(App $a) } if (($type === 'profile') && (strlen($sec))) { + // heluecht: I don't know why we don't fail immediately when the user or contact hadn't been found. + // Since it doesn't make sense to continue from this point on, we now fail here. This should be safe. + if (!DBA::isResult($r)) { + System::httpExit(404, ["title" => L10n::t('Page not found.')]); + } + // URL reply if ($dfrn_version < 2.2) { - $s = Network::fetchURL($r[0]['poll'] + $s = Network::fetchUrl($r[0]['poll'] . '?dfrn_id=' . $encrypted_id . '&type=profile-check' . '&dfrn_version=' . DFRN_PROTOCOL_VERSION @@ -490,7 +496,7 @@ function dfrn_poll_content(App $a) . '&sec=' . $sec ); } else { - $s = Network::postURL($r[0]['poll'], [ + $s = Network::post($r[0]['poll'], [ 'dfrn_id' => $encrypted_id, 'type' => 'profile-check', 'dfrn_version' => DFRN_PROTOCOL_VERSION, @@ -499,7 +505,7 @@ function dfrn_poll_content(App $a) ]); } - $profile = ((DBM::is_result($r) && $r[0]['nickname']) ? $r[0]['nickname'] : $nickname); + $profile = ((DBA::isResult($r) && $r[0]['nickname']) ? $r[0]['nickname'] : $nickname); switch ($destination_url) { case 'profile': @@ -521,7 +527,7 @@ function dfrn_poll_content(App $a) logger("dfrn_poll: sec profile: " . $s, LOGGER_DATA); if (strlen($s) && strstr($s, '