X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=mod%2Fdfrn_request.php;h=a9e17b34b362decab98f55913894bbfcac387bba;hb=5a15e6bc598f90e0add22f2bd0531619d9e1f584;hp=141e5e5aca64e3d3af6aea352d160782dd279151;hpb=ff203c277dfd8619ccfb63edebaf54274e27bf2d;p=friendica.git

diff --git a/mod/dfrn_request.php b/mod/dfrn_request.php
index 141e5e5aca..a9e17b34b3 100644
--- a/mod/dfrn_request.php
+++ b/mod/dfrn_request.php
@@ -15,8 +15,11 @@
 use Friendica\App;
 use Friendica\Core\Config;
 use Friendica\Core\L10n;
+use Friendica\Core\Logger;
 use Friendica\Core\Protocol;
+use Friendica\Core\Renderer;
 use Friendica\Core\System;
+use Friendica\Core\Session;
 use Friendica\Database\DBA;
 use Friendica\Model\Contact;
 use Friendica\Model\Group;
@@ -24,18 +27,18 @@ use Friendica\Model\Profile;
 use Friendica\Model\User;
 use Friendica\Module\Login;
 use Friendica\Network\Probe;
+use Friendica\Protocol\Activity;
 use Friendica\Util\DateTimeFormat;
 use Friendica\Util\Network;
-
-require_once 'include/enotify.php';
+use Friendica\Util\Strings;
 
 function dfrn_request_init(App $a)
 {
 	if ($a->argc > 1) {
 		$which = $a->argv[1];
+		Profile::load($a, $which);
 	}
 
-	Profile::load($a, $which);
 	return;
 }
 
@@ -53,15 +56,18 @@ function dfrn_request_init(App $a)
  * in order to link our friend request with our own server cell.
  * After logging in, we click 'submit' to approve the linkage.
  *
+ * @param App $a
+ * @throws ImagickException
+ * @throws \Friendica\Network\HTTPException\InternalServerErrorException
  */
 function dfrn_request_post(App $a)
 {
 	if (($a->argc != 2) || (!count($a->profile))) {
-		logger('Wrong count of argc or profiles: argc=' . $a->argc . ',profile()=' . count($a->profile));
+		Logger::log('Wrong count of argc or profiles: argc=' . $a->argc . ',profile()=' . count($a->profile));
 		return;
 	}
 
-	if (x($_POST, 'cancel')) {
+	if (!empty($_POST['cancel'])) {
 		$a->internalRedirect();
 	}
 
@@ -70,22 +76,22 @@ function dfrn_request_post(App $a)
 	 * to confirm the request, and then we've clicked submit (perhaps after logging in).
 	 * That brings us here:
 	 */
-	if ((x($_POST, 'localconfirm')) && ($_POST['localconfirm'] == 1)) {
+	if (!empty($_POST['localconfirm']) && ($_POST['localconfirm'] == 1)) {
 		// Ensure this is a valid request
-		if (local_user() && ($a->user['nickname'] == $a->argv[1]) && (x($_POST, 'dfrn_url'))) {
-			$dfrn_url = notags(trim($_POST['dfrn_url']));
-			$aes_allow = (((x($_POST, 'aes_allow')) && ($_POST['aes_allow'] == 1)) ? 1 : 0);
-			$confirm_key = ((x($_POST, 'confirm_key')) ? $_POST['confirm_key'] : "");
-			$hidden = ((x($_POST, 'hidden-contact')) ? intval($_POST['hidden-contact']) : 0);
+		if (local_user() && ($a->user['nickname'] == $a->argv[1]) && !empty($_POST['dfrn_url'])) {
+			$dfrn_url    = Strings::escapeTags(trim($_POST['dfrn_url']));
+			$aes_allow   = !empty($_POST['aes_allow']);
+			$confirm_key = $_POST['confirm_key'] ?? '';
+			$hidden      = (!empty($_POST['hidden-contact']) ? intval($_POST['hidden-contact']) : 0);
 			$contact_record = null;
-			$blocked = 1;
-			$pending = 1;
+			$blocked     = 1;
+			$pending     = 1;
 
-			if (x($dfrn_url)) {
+			if (!empty($dfrn_url)) {
 				// Lookup the contact based on their URL (which is the only unique thing we have at the moment)
 				$r = q("SELECT * FROM `contact` WHERE `uid` = %d AND `nurl` = '%s' AND NOT `self` LIMIT 1",
 					intval(local_user()),
-					DBA::escape(normalise_link($dfrn_url))
+					DBA::escape(Strings::normaliseLink($dfrn_url))
 				);
 
 				if (DBA::isResult($r)) {
@@ -112,10 +118,10 @@ function dfrn_request_post(App $a)
 						notice(L10n::t('Profile location is not valid or does not contain profile information.') . EOL);
 						return;
 					} else {
-						if (!x($parms, 'fn')) {
+						if (empty($parms['fn'])) {
 							notice(L10n::t('Warning: profile location has no identifiable owner name.') . EOL);
 						}
-						if (!x($parms, 'photo')) {
+						if (empty($parms['photo'])) {
 							notice(L10n::t('Warning: profile location has no profile photo.') . EOL);
 						}
 						$invalid = Probe::validDfrn($parms);
@@ -139,7 +145,7 @@ function dfrn_request_post(App $a)
 						intval(local_user()),
 						DateTimeFormat::utcNow(),
 						DBA::escape($dfrn_url),
-						DBA::escape(normalise_link($dfrn_url)),
+						DBA::escape(Strings::normaliseLink($dfrn_url)),
 						$parms['addr'],
 						$parms['fn'],
 						$parms['nick'],
@@ -164,7 +170,7 @@ function dfrn_request_post(App $a)
 				$r = q("SELECT `id`, `network` FROM `contact` WHERE `uid` = %d AND `url` = '%s' AND `site-pubkey` = '%s' LIMIT 1",
 					intval(local_user()),
 					DBA::escape($dfrn_url),
-					$parms['key'] // this was already escaped
+					$parms['key'] ?? '' // Potentially missing
 				);
 				if (DBA::isResult($r)) {
 					Group::addMember(User::getDefaultGroup(local_user(), $r[0]["network"]), $r[0]['id']);
@@ -183,8 +189,8 @@ function dfrn_request_post(App $a)
 					$dfrn_request = $contact_record['request'];
 				}
 
-				if (strlen($dfrn_request) && strlen($confirm_key)) {
-					$s = Network::fetchUrl($dfrn_request . '?confirm_key=' . $confirm_key);
+				if (!empty($dfrn_request) && strlen($confirm_key)) {
+					Network::fetchUrl($dfrn_request . '?confirm_key=' . $confirm_key);
 				}
 
 				// (ignore reply, nothing we can do it failed)
@@ -226,7 +232,6 @@ function dfrn_request_post(App $a)
 	}
 
 	$nickname       = $a->profile['nickname'];
-	$notify_flags   = $a->profile['notify-flags'];
 	$uid            = $a->profile['uid'];
 	$maxreq         = intval($a->profile['maxreq']);
 	$contact_record = null;
@@ -235,7 +240,7 @@ function dfrn_request_post(App $a)
 	$blocked = 1;
 	$pending = 1;
 
-	if (x($_POST, 'dfrn_url')) {
+	if (!empty($_POST['dfrn_url'])) {
 		// Block friend request spam
 		if ($maxreq) {
 			$r = q("SELECT * FROM `intro` WHERE `datetime` > '%s' AND `uid` = %d",
@@ -267,8 +272,6 @@ function dfrn_request_post(App $a)
 			}
 		}
 
-		$real_name = x($_POST, 'realname') ? notags(trim($_POST['realname'])) : '';
-
 		$url = trim($_POST['dfrn_url']);
 		if (!strlen($url)) {
 			notice(L10n::t("Invalid locator") . EOL);
@@ -297,7 +300,7 @@ function dfrn_request_post(App $a)
 			$network = Protocol::DFRN;
 		}
 
-		logger('dfrn_request: url: ' . $url . ',network=' . $network, LOGGER_DEBUG);
+		Logger::log('dfrn_request: url: ' . $url . ',network=' . $network, Logger::DEBUG);
 
 		if ($network === Protocol::DFRN) {
 			$ret = q("SELECT * FROM `contact` WHERE `uid` = %d AND `url` = '%s' AND `self` = 0 LIMIT 1",
@@ -318,7 +321,7 @@ function dfrn_request_post(App $a)
 				}
 			}
 
-			$issued_id = random_string();
+			$issued_id = Strings::getRandomHex();
 
 			if (is_array($contact_record)) {
 				// There is a contact record but no issued-id, so this
@@ -353,10 +356,10 @@ function dfrn_request_post(App $a)
 					notice(L10n::t('Profile location is not valid or does not contain profile information.') . EOL);
 					$a->internalRedirect($a->cmd);
 				} else {
-					if (!x($parms, 'fn')) {
+					if (empty($parms['fn'])) {
 						notice(L10n::t('Warning: profile location has no identifiable owner name.') . EOL);
 					}
-					if (!x($parms, 'photo')) {
+					if (empty($parms['photo'])) {
 						notice(L10n::t('Warning: profile location has no profile photo.') . EOL);
 					}
 					$invalid = Probe::validDfrn($parms);
@@ -378,7 +381,7 @@ function dfrn_request_post(App $a)
 					intval($uid),
 					DBA::escape(DateTimeFormat::utcNow()),
 					$parms['url'],
-					DBA::escape(normalise_link($url)),
+					DBA::escape(Strings::normaliseLink($url)),
 					$parms['addr'],
 					$parms['fn'],
 					$parms['nick'],
@@ -413,15 +416,15 @@ function dfrn_request_post(App $a)
 				return;
 			}
 
-			$hash = random_string() . (string) time();   // Generate a confirm_key
+			$hash = Strings::getRandomHex() . (string) time();   // Generate a confirm_key
 
 			if (is_array($contact_record)) {
-				$ret = q("INSERT INTO `intro` ( `uid`, `contact-id`, `blocked`, `knowyou`, `note`, `hash`, `datetime`)
+				q("INSERT INTO `intro` ( `uid`, `contact-id`, `blocked`, `knowyou`, `note`, `hash`, `datetime`)
 					VALUES ( %d, %d, 1, %d, '%s', '%s', '%s' )",
 					intval($uid),
 					intval($contact_record['id']),
-					((x($_POST,'knowyou') && ($_POST['knowyou'] == 1)) ? 1 : 0),
-					DBA::escape(notags(trim(defaults($_POST, 'dfrn-request-message', '')))),
+					intval(!empty($_POST['knowyou'])),
+					DBA::escape(Strings::escapeTags(trim($_POST['dfrn-request-message'] ?? ''))),
 					DBA::escape($hash),
 					DBA::escape(DateTimeFormat::utcNow())
 				);
@@ -475,13 +478,13 @@ function dfrn_request_post(App $a)
 
 function dfrn_request_content(App $a)
 {
-	if (($a->argc != 2) || (!count($a->profile))) {
+	if ($a->argc != 2 || empty($a->profile)) {
 		return "";
 	}
 
 	// "Homecoming". Make sure we're logged in to this site as the correct user. Then offer a confirm button
 	// to send us to the post section to record the introduction.
-	if (x($_GET, 'dfrn_url')) {
+	if (!empty($_GET['dfrn_url'])) {
 		if (!local_user()) {
 			info(L10n::t("Please login to confirm introduction.") . EOL);
 			/* setup the return URL to come back to this page if they use openid */
@@ -495,12 +498,12 @@ function dfrn_request_content(App $a)
 			return Login::form();
 		}
 
-		$dfrn_url = notags(trim(hex2bin($_GET['dfrn_url'])));
-		$aes_allow = x($_GET, 'aes_allow') && $_GET['aes_allow'] == 1 ? 1 : 0;
-		$confirm_key = x($_GET, 'confirm_key') ? $_GET['confirm_key'] : "";
+		$dfrn_url = Strings::escapeTags(trim(hex2bin($_GET['dfrn_url'])));
+		$aes_allow = !empty($_GET['aes_allow']);
+		$confirm_key = $_GET['confirm_key'] ?? '';
 
 		// Checking fastlane for validity
-		if (x($_SESSION, "fastlane") && (normalise_link($_SESSION["fastlane"]) == normalise_link($dfrn_url))) {
+		if (!empty($_SESSION['fastlane']) && (Strings::normaliseLink($_SESSION["fastlane"]) == Strings::normaliseLink($dfrn_url))) {
 			$_POST["dfrn_url"] = $dfrn_url;
 			$_POST["confirm_key"] = $confirm_key;
 			$_POST["localconfirm"] = 1;
@@ -509,16 +512,14 @@ function dfrn_request_content(App $a)
 
 			dfrn_request_post($a);
 
-			killme();
-			return; // NOTREACHED
+			exit();
 		}
 
-		$tpl = get_markup_template("dfrn_req_confirm.tpl");
-		$o = replace_macros($tpl, [
+		$tpl = Renderer::getMarkupTemplate("dfrn_req_confirm.tpl");
+		$o = Renderer::replaceMacros($tpl, [
 			'$dfrn_url' => $dfrn_url,
 			'$aes_allow' => (($aes_allow) ? '<input type="hidden" name="aes_allow" value="1" />' : "" ),
 			'$hidethem' => L10n::t('Hide this contact'),
-			'$hidechecked' => '',
 			'$confirm_key' => $confirm_key,
 			'$welcome' => L10n::t('Welcome home %s.', $a->user['username']),
 			'$please' => L10n::t('Please confirm your introduction/connection request to %s.', $dfrn_url),
@@ -528,7 +529,7 @@ function dfrn_request_content(App $a)
 			'dfrn_rawurl' => $_GET['dfrn_url']
 		]);
 		return $o;
-	} elseif ((x($_GET, 'confirm_key')) && strlen($_GET['confirm_key'])) {
+	} elseif (!empty($_GET['confirm_key'])) {
 		// we are the requestee and it is now safe to send our user their introduction,
 		// We could just unblock it, but first we have to jump through a few hoops to
 		// send an email, or even to find out if we need to send an email.
@@ -545,7 +546,7 @@ function dfrn_request_content(App $a)
 			$auto_confirm = false;
 
 			if (DBA::isResult($r)) {
-				if ($r[0]['page-flags'] != Contact::PAGE_NORMAL && $r[0]['page-flags'] != Contact::PAGE_PRVGROUP) {
+				if ($r[0]['page-flags'] != User::PAGE_FLAGS_NORMAL && $r[0]['page-flags'] != User::PAGE_FLAGS_PRVGROUP) {
 					$auto_confirm = true;
 				}
 
@@ -561,7 +562,7 @@ function dfrn_request_content(App $a)
 						'source_name'  => ((strlen(stripslashes($r[0]['name']))) ? stripslashes($r[0]['name']) : L10n::t('[Name Withheld]')),
 						'source_link'  => $r[0]['url'],
 						'source_photo' => $r[0]['photo'],
-						'verb'         => ACTIVITY_REQ_FRIEND,
+						'verb'         => Activity::REQ_FRIEND,
 						'otype'        => 'intro'
 					]);
 				}
@@ -573,7 +574,7 @@ function dfrn_request_content(App $a)
 						'node'     => $r[0]['nickname'],
 						'dfrn_id'  => $r[0]['issued-id'],
 						'intro_id' => $intro[0]['id'],
-						'duplex'   => (($r[0]['page-flags'] == Contact::PAGE_FREELOVE) ? 1 : 0),
+						'duplex'   => (($r[0]['page-flags'] == User::PAGE_FLAGS_FREELOVE) ? 1 : 0),
 					];
 					dfrn_confirm_post($a, $handsfree);
 				}
@@ -584,17 +585,16 @@ function dfrn_request_content(App $a)
 				// If we are auto_confirming, this record will have already been nuked
 				// in dfrn_confirm_post()
 
-				$r = q("UPDATE `intro` SET `blocked` = 0 WHERE `hash` = '%s'",
+				q("UPDATE `intro` SET `blocked` = 0 WHERE `hash` = '%s'",
 					DBA::escape($_GET['confirm_key'])
 				);
 			}
 		}
 
-		killme();
-		return; // NOTREACHED
+		exit();
 	} else {
 		// Normal web request. Display our user's introduction form.
-		if ((Config::get('system', 'block_public')) && (!local_user()) && (!remote_user())) {
+		if (Config::get('system', 'block_public') && !Session::isAuthenticated()) {
 			if (!Config::get('system', 'local_block')) {
 				notice(L10n::t('Public access denied.') . EOL);
 				return;
@@ -604,9 +604,9 @@ function dfrn_request_content(App $a)
 		// Try to auto-fill the profile address
 		// At first look if an address was provided
 		// Otherwise take the local address
-		if (x($_GET, 'addr') && ($_GET['addr'] != "")) {
+		if (!empty($_GET['addr'])) {
 			$myaddr = hex2bin($_GET['addr']);
-		} elseif (x($_GET, 'address') && ($_GET['address'] != "")) {
+		} elseif (!empty($_GET['address'])) {
 			$myaddr = $_GET['address'];
 		} elseif (local_user()) {
 			if (strlen($a->getURLPath())) {
@@ -625,20 +625,17 @@ function dfrn_request_content(App $a)
 		 * because nobody is going to read the comments and
 		 * it doesn't matter if they know you or not.
 		 */
-		if ($a->profile['page-flags'] == Contact::PAGE_NORMAL) {
-			$tpl = get_markup_template('dfrn_request.tpl');
+		if ($a->profile['page-flags'] == User::PAGE_FLAGS_NORMAL) {
+			$tpl = Renderer::getMarkupTemplate('dfrn_request.tpl');
 		} else {
-			$tpl = get_markup_template('auto_request.tpl');
+			$tpl = Renderer::getMarkupTemplate('auto_request.tpl');
 		}
 
 		$page_desc = L10n::t("Please enter your 'Identity Address' from one of the following supported communications networks:");
 
-		$invite_desc = sprintf(
-			L10n::t('If you are not yet a member of the free social web, <a href="%s">follow this link to find a public Friendica site and join us today</a>.'),
-			get_server() . '/servers'
-		);
+		$invite_desc = L10n::t('If you are not yet a member of the free social web, <a href="%s">follow this link to find a public Friendica site and join us today</a>.', get_server() . '/servers');
 
-		$o = replace_macros($tpl, [
+		$o = Renderer::replaceMacros($tpl, [
 			'$header' => L10n::t('Friend/Connection Request'),
 			'$desc' => L10n::t('Examples: jojo@demo.friendica.com, http://demo.friendica.com/profile/jojo, testuser@gnusocial.de'),
 			'$pls_answer' => L10n::t('Please answer the following:'),
@@ -659,6 +656,4 @@ function dfrn_request_content(App $a)
 		]);
 		return $o;
 	}
-
-	return; // Somebody is fishing.
 }