X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=mod%2Fredir.php;h=d928e66df0c99f910063c73aa5f4af5e24baa441;hb=8172fbe75f0faf43a86c8650c1f0a96f39453989;hp=998e9cc0bd9bdac5a34195090074a3a429a267db;hpb=88fb02db8d830d8a74cd0aed67ee52f41a2151ab;p=friendica.git diff --git a/mod/redir.php b/mod/redir.php index 998e9cc0bd..d928e66df0 100644 --- a/mod/redir.php +++ b/mod/redir.php @@ -1,88 +1,205 @@ . + * + */ use Friendica\App; +use Friendica\Core\Logger; +use Friendica\Core\Session; use Friendica\Core\System; +use Friendica\Database\DBA; +use Friendica\DI; +use Friendica\Model\Contact; +use Friendica\Model\Profile; +use Friendica\Util\Network; +use Friendica\Util\Strings; function redir_init(App $a) { + if (!Session::isAuthenticated()) { + throw new \Friendica\Network\HTTPException\ForbiddenException(DI::l10n()->t('Access denied.')); + } + + $url = $_GET['url'] ?? ''; + $quiet = !empty($_GET['quiet']) ? '&quiet=1' : ''; + + if ($a->argc > 1 && intval($a->argv[1])) { + $cid = intval($a->argv[1]); + } else { + $cid = 0; + } + + // Try magic auth before the legacy stuff + redir_magic($a, $cid, $url); + + if (empty($cid)) { + throw new \Friendica\Network\HTTPException\BadRequestException(DI::l10n()->t('Bad Request.')); + } + + $fields = ['id', 'uid', 'nurl', 'url', 'addr', 'name', 'network', 'poll', 'issued-id', 'dfrn-id', 'duplex', 'pending']; + $contact = DBA::selectFirst('contact', $fields, ['id' => $cid, 'uid' => [0, local_user()]]); + if (!DBA::isResult($contact)) { + throw new \Friendica\Network\HTTPException\NotFoundException(DI::l10n()->t('Contact not found.')); + } + + $contact_url = $contact['url']; + + if (!empty($a->contact['id']) && $a->contact['id'] == $cid) { + // Local user is already authenticated. + redir_check_url($contact_url, $url); + $a->redirect($url ?: $contact_url); + } + + if ($contact['uid'] == 0 && local_user()) { + // Let's have a look if there is an established connection + // between the public contact we have found and the local user. + $contact = DBA::selectFirst('contact', $fields, ['nurl' => $contact['nurl'], 'uid' => local_user()]); - $url = ((x($_GET,'url')) ? $_GET['url'] : ''); - $quiet = ((x($_GET,'quiet')) ? '&quiet=1' : ''); - $con_url = ((x($_GET,'conurl')) ? $_GET['conurl'] : ''); - - // traditional DFRN - - if ($con_url || (local_user() && $a->argc > 1 && intval($a->argv[1]))) { - - if ($con_url) { - $con_url = str_replace('https', 'http', $con_url); - - $r = q("SELECT * FROM `contact` WHERE `nurl` = '%s' AND `uid` = %d LIMIT 1", - dbesc($con_url), - intval(local_user()) - ); - - if (!dbm::is_result($r)) { - goaway(System::baseUrl()); - } - if ($r[0]['network'] !== NETWORK_DFRN) { - goaway(($url != '' ? $url : $r[0]['url'])); - } - $cid = $r[0]['id']; - } else { - $cid = $a->argv[1]; - - $r = q("SELECT * FROM `contact` WHERE `id` = %d AND `uid` = %d LIMIT 1", - intval($cid), - intval(local_user()) - ); - - if (!dbm::is_result($r)) { - goaway(System::baseUrl()); - } - if ($r[0]['network'] !== NETWORK_DFRN) { - goaway(($url != '' ? $url : $r[0]['url'])); - } + if (DBA::isResult($contact)) { + $cid = $contact['id']; } - $dfrn_id = $orig_id = (($r[0]['issued-id']) ? $r[0]['issued-id'] : $r[0]['dfrn-id']); + if (!empty($a->contact['id']) && $a->contact['id'] == $cid) { + // Local user is already authenticated. + redir_check_url($contact_url, $url); + $target_url = $url ?: $contact_url; + Logger::log($contact['name'] . " is already authenticated. Redirecting to " . $target_url, Logger::DEBUG); + $a->redirect($target_url); + } + } - if ($r[0]['duplex'] && $r[0]['issued-id']) { - $orig_id = $r[0]['issued-id']; + if (remote_user()) { + $host = substr(DI::baseUrl()->getUrlPath() . (DI::baseUrl()->getUrlPath() ? '/' . DI::baseUrl()->getUrlPath() : ''), strpos(DI::baseUrl()->getUrlPath(), '://') + 3); + $remotehost = substr($contact['addr'], strpos($contact['addr'], '@') + 1); + + // On a local instance we have to check if the local user has already authenticated + // with the local contact. Otherwise the local user would ask the local contact + // for authentification everytime he/she is visiting a profile page of the local + // contact. + if (($host == $remotehost) && (Session::getRemoteContactID(Session::get('visitor_visiting')) == Session::get('visitor_id'))) { + // Remote user is already authenticated. + redir_check_url($contact_url, $url); + $target_url = $url ?: $contact_url; + Logger::log($contact['name'] . " is already authenticated. Redirecting to " . $target_url, Logger::DEBUG); + $a->redirect($target_url); + } + } + + // Doing remote auth with dfrn. + if (local_user() && (!empty($contact['dfrn-id']) || !empty($contact['issued-id'])) && empty($contact['pending'])) { + $dfrn_id = $orig_id = (($contact['issued-id']) ? $contact['issued-id'] : $contact['dfrn-id']); + + if ($contact['duplex'] && $contact['issued-id']) { + $orig_id = $contact['issued-id']; $dfrn_id = '1:' . $orig_id; } - if ($r[0]['duplex'] && $r[0]['dfrn-id']) { - $orig_id = $r[0]['dfrn-id']; + if ($contact['duplex'] && $contact['dfrn-id']) { + $orig_id = $contact['dfrn-id']; $dfrn_id = '0:' . $orig_id; } - $sec = random_string(); + $sec = Strings::getRandomHex(); + + $fields = ['uid' => local_user(), 'cid' => $cid, 'dfrn_id' => $dfrn_id, + 'sec' => $sec, 'expire' => time() + 45]; + DBA::insert('profile_check', $fields); + + Logger::log('mod_redir: ' . $contact['name'] . ' ' . $sec, Logger::DEBUG); - q("INSERT INTO `profile_check` ( `uid`, `cid`, `dfrn_id`, `sec`, `expire`) - VALUES( %d, %s, '%s', '%s', %d )", - intval(local_user()), - intval($cid), - dbesc($dfrn_id), - dbesc($sec), - intval(time() + 45) - ); + $dest = (!empty($url) ? '&destination_url=' . $url : ''); - logger('mod_redir: ' . $r[0]['name'] . ' ' . $sec, LOGGER_DEBUG); - $dest = (($url) ? '&destination_url=' . $url : ''); - goaway ($r[0]['poll'] . '?dfrn_id=' . $dfrn_id + System::externalRedirect($contact['poll'] . '?dfrn_id=' . $dfrn_id . '&dfrn_version=' . DFRN_PROTOCOL_VERSION . '&type=profile&sec=' . $sec . $dest . $quiet); } - if (local_user()) { - $handle = $a->user['nickname'] . '@' . substr(System::baseUrl(),strpos(System::baseUrl(),'://')+3); + if (empty($url)) { + throw new \Friendica\Network\HTTPException\BadRequestException(DI::l10n()->t('Bad Request.')); } - if (remote_user()) { - $handle = $_SESSION['handle']; + + // If we don't have a connected contact, redirect with + // the 'zrl' parameter. + $my_profile = Profile::getMyURL(); + + if (!empty($my_profile) && !Strings::compareLink($my_profile, $url)) { + $separator = strpos($url, '?') ? '&' : '?'; + + $url .= $separator . 'zrl=' . urlencode($my_profile); + } + + Logger::log('redirecting to ' . $url, Logger::DEBUG); + $a->redirect($url); +} + +function redir_magic($a, $cid, $url) +{ + $visitor = Profile::getMyURL(); + if (!empty($visitor)) { + Logger::info('Got my url', ['visitor' => $visitor]); + } + + $contact = DBA::selectFirst('contact', ['url'], ['id' => $cid]); + if (!DBA::isResult($contact)) { + Logger::info('Contact not found', ['id' => $cid]); + throw new \Friendica\Network\HTTPException\NotFoundException(DI::l10n()->t('Contact not found.')); + } else { + $contact_url = $contact['url']; + redir_check_url($contact_url, $url); + $target_url = $url ?: $contact_url; + } + + $basepath = Contact::getBasepath($contact_url); + + // We don't use magic auth when there is no visitor, we are on the same system or we visit our own stuff + if (empty($visitor) || Strings::compareLink($basepath, DI::baseUrl()) || Strings::compareLink($contact_url, $visitor)) { + Logger::info('Redirecting without magic', ['target' => $target_url, 'visitor' => $visitor, 'contact' => $contact_url]); + DI::app()->redirect($target_url); + } + + // Test for magic auth on the target system + $serverret = Network::curl($basepath . '/magic'); + if ($serverret->isSuccess()) { + $separator = strpos($target_url, '?') ? '&' : '?'; + $target_url .= $separator . 'zrl=' . urlencode($visitor) . '&addr=' . urlencode($contact_url); + + Logger::info('Redirecting with magic', ['target' => $target_url, 'visitor' => $visitor, 'contact' => $contact_url]); + System::externalRedirect($target_url); + } else { + Logger::info('No magic for contact', ['contact' => $contact_url]); } +} + +function redir_check_url(string $contact_url, string $url) +{ + if (empty($contact_url) || empty($url)) { + return; + } + + $url_host = parse_url($url, PHP_URL_HOST); + if (empty($url_host)) { + $url_host = parse_url(DI::baseUrl(), PHP_URL_HOST); + } + + $contact_url_host = parse_url($contact_url, PHP_URL_HOST); - if ($url) { - $url = str_replace('{zid}','&zid=' . $handle,$url); - goaway($url); + if ($url_host == $contact_url_host) { + return; } - goaway(System::baseUrl()); + Logger::error('URL check host mismatch', ['contact' => $contact_url, 'url' => $url]); + throw new \Friendica\Network\HTTPException\ForbiddenException(DI::l10n()->t('Access denied.')); }