'source' => array('type' => 'varchar', 'length' => 32, 'description' => 'source of comment, like "web", "im", or "clientname"'),
'conversation' => array('type' => 'int', 'description' => 'id of root notice in this conversation'),
'repeat_of' => array('type' => 'int', 'description' => 'notice this is a repeat of'),
- 'object_type' => array('type' => 'varchar', 'length' => 191, 'description' => 'URI representing activity streams object type', 'default' => 'http://activitystrea.ms/schema/1.0/note'),
+ 'object_type' => array('type' => 'varchar', 'length' => 191, 'description' => 'URI representing activity streams object type', 'default' => null),
'verb' => array('type' => 'varchar', 'length' => 191, 'description' => 'URI representing activity streams verb', 'default' => 'http://activitystrea.ms/schema/1.0/post'),
'scope' => array('type' => 'int',
'description' => 'bit map for distribution scope; 0 = everywhere; 1 = this server only; 2 = addressees; 4 = followers; null = default'),
return $this->content;
}
+ public function getRendered()
+ {
+ return $this->rendered;
+ }
+
/*
* Get the original representation URL of this notice.
*
* Record the given set of hash tags in the db for this notice.
* Given tag strings will be normalized and checked for dupes.
*/
- function saveKnownTags($hashtags)
+ function saveKnownTags(array $hashtags)
{
//turn each into their canonical tag
//this is needed to remove dupes before saving e.g. #hash.tag = #hashtag
* @return Notice
* @throws ClientException
*/
- static function saveNew($profile_id, $content, $source, array $options=null) {
+ static function saveNew($profile_id, $content, $source, array $options=array()) {
$defaults = array('uri' => null,
'url' => null,
'conversation' => null, // URI of conversation
'object_type' => null,
'verb' => null);
- if (!empty($options) && is_array($options)) {
+ /*
+ * Above type-hint is already array, so simply count it, this saves
+ * "some" CPU cycles.
+ */
+ if (count($options) > 0) {
$options = array_merge($defaults, $options);
- extract($options);
- } else {
- extract($defaults);
}
+ extract($options);
+
if (!isset($is_local)) {
$is_local = Notice::LOCAL_PUBLIC;
}
throw new ClientException(_('You cannot repeat your own notice.'));
}
- if ($repeat->scope != Notice::SITE_SCOPE &&
- $repeat->scope != Notice::PUBLIC_SCOPE) {
+ if ($repeat->isPrivateScope()) {
// TRANS: Client error displayed when trying to repeat a non-public notice.
throw new ClientException(_('Cannot repeat a private notice.'), 403);
}
if (!empty($rendered)) {
$notice->rendered = $rendered;
} else {
- $notice->rendered = common_render_content($final, $notice);
+ $notice->rendered = common_render_content($final,
+ $notice->getProfile(),
+ $notice->hasParent() ? $notice->getParent() : null);
}
if (empty($verb)) {
}
}
- // Clear the cache for subscribed users, so they'll update at next request
- // XXX: someone clever could prepend instead of clearing the cache
-
- // Save per-notice metadata...
-
- if (isset($replies)) {
- $notice->saveKnownReplies($replies);
- } else {
- $notice->saveReplies();
- }
+ // Only save 'attention' and metadata stuff (URLs, tags...) stuff if
+ // the activityverb is a POST (since stuff like repeat, favorite etc.
+ // reasonably handle notifications themselves.
+ if (ActivityUtils::compareVerbs($notice->verb, array(ActivityVerb::POST))) {
+ if (isset($replies)) {
+ $notice->saveKnownReplies($replies);
+ } else {
+ $notice->saveReplies();
+ }
- if (isset($tags)) {
- $notice->saveKnownTags($tags);
- } else {
- $notice->saveTags();
- }
+ if (isset($tags)) {
+ $notice->saveKnownTags($tags);
+ } else {
+ $notice->saveTags();
+ }
- // Note: groups may save tags, so must be run after tags are saved
- // to avoid errors on duplicates.
- // Note: groups should always be set.
+ // Note: groups may save tags, so must be run after tags are saved
+ // to avoid errors on duplicates.
+ // Note: groups should always be set.
- $notice->saveKnownGroups($groups);
+ $notice->saveKnownGroups($groups);
- if (isset($urls)) {
- $notice->saveKnownUrls($urls);
- } else {
- $notice->saveUrls();
+ if (isset($urls)) {
+ $notice->saveKnownUrls($urls);
+ } else {
+ $notice->saveUrls();
+ }
}
if ($distribute) {
}
// Get ActivityObject properties
+ $actobj = null;
if (!empty($act->id)) {
// implied object
$options['uri'] = $act->id;
$defaults = array(
'groups' => array(),
- 'is_local' => self::LOCAL_PUBLIC,
+ 'is_local' => $actor->isLocal() ? self::LOCAL_PUBLIC : self::REMOTE,
'mentions' => array(),
'reply_to' => null,
'repeat_of' => null,
$stored->uri = $uri;
if ($stored->find()) {
common_debug('cannot create duplicate Notice URI: '.$stored->uri);
- throw new Exception('Notice URI already exists');
+ // I _assume_ saving a Notice with a colliding URI means we're really trying to
+ // save the same notice again...
+ throw new AlreadyFulfilledException('Notice URI already exists');
+ }
+ }
+
+ $autosource = common_config('public', 'autosource');
+
+ // Sandboxed are non-false, but not 1, either
+ if (!$actor->hasRight(Right::PUBLICNOTICE) ||
+ ($source && $autosource && in_array($source, $autosource))) {
+ // FIXME: ...what about remote nonpublic? Hmmm. That is, if we sandbox remote profiles...
+ $stored->is_local = Notice::LOCAL_NONPUBLIC;
+ } else {
+ $stored->is_local = intval($is_local);
+ }
+
+ if (!$stored->isLocal()) {
+ // Only do these checks for non-local notices. Local notices will generate these values later.
+ if (!common_valid_http_url($url)) {
+ common_debug('Bad notice URL: ['.$url.'], URI: ['.$uri.']. Cannot link back to original! This is normal for shared notices etc.');
+ }
+ if (empty($uri)) {
+ throw new ServerException('No URI for remote notice. Cannot accept that.');
}
}
$stored->url = $url;
$stored->verb = $act->verb;
- // Use the local user's shortening preferences, if applicable.
- $stored->rendered = $actor->isLocal()
- ? $actor->shortenLinks($act->content)
- : $act->content;
+ // Notice content. We trust local users to provide HTML we like, but of course not remote users.
+ // FIXME: What about local users importing feeds? Mirror functions must filter out bad HTML first...
+ $content = $act->content ?: $act->summary;
+ if (is_null($content) && !is_null($actobj)) {
+ $content = $actobj->content ?: $actobj->summary;
+ }
+ $stored->rendered = $actor->isLocal() ? $content : common_purify($content);
$stored->content = common_strip_html($stored->rendered);
- $autosource = common_config('public', 'autosource');
-
- // Sandboxed are non-false, but not 1, either
- if (!$actor->hasRight(Right::PUBLICNOTICE) ||
- ($source && $autosource && in_array($source, $autosource))) {
- $stored->is_local = Notice::LOCAL_NONPUBLIC;
- } else {
- $stored->is_local = $is_local;
+ // Reject notice if it is too long (without the HTML)
+ // FIXME: Reject if too short (empty) too? But we have to pass the
+ if ($actor->isLocal() && Notice::contentTooLong($stored->content)) {
+ // TRANS: Client error displayed when the parameter "status" is missing.
+ // TRANS: %d is the maximum number of character for a notice.
+ throw new ClientException(sprintf(_m('That\'s too long. Maximum notice size is %d character.',
+ 'That\'s too long. Maximum notice size is %d characters.',
+ Notice::maxContent()),
+ Notice::maxContent()));
}
// Maybe a missing act-time should be fatal if the actor is not local?
// If the original is private to a group, and notice has no group specified,
// make it to the same group(s)
if (empty($groups) && ($reply->scope & Notice::GROUP_SCOPE)) {
- $groups = array();
$replyGroups = $reply->getGroups();
foreach ($replyGroups as $group) {
if ($actor->isMember($group)) {
// Save per-notice metadata...
$mentions = array();
- $groups = array();
+ $group_ids = array();
// This event lets plugins filter out non-local recipients (attentions we don't care about)
// Used primarily for OStatus (and if we don't federate, all attentions would be local anyway)
- Event::handle('GetLocalAttentions', array($actor, $act->context->attention, &$mentions, &$groups));
+ Event::handle('GetLocalAttentions', array($actor, $act->context->attention, &$mentions, &$group_ids));
- if (!empty($mentions)) {
- $stored->saveKnownReplies($mentions);
- } else {
- $stored->saveReplies();
- }
+ // Only save 'attention' and metadata stuff (URLs, tags...) stuff if
+ // the activityverb is a POST (since stuff like repeat, favorite etc.
+ // reasonably handle notifications themselves.
+ if (ActivityUtils::compareVerbs($stored->verb, array(ActivityVerb::POST))) {
+ if (!empty($mentions)) {
+ $stored->saveKnownReplies($mentions);
+ } else {
+ $stored->saveReplies();
+ }
- if (!empty($tags)) {
- $stored->saveKnownTags($tags);
- } else {
- $stored->saveTags();
- }
+ if (!empty($tags)) {
+ $stored->saveKnownTags($tags);
+ } else {
+ $stored->saveTags();
+ }
- // Note: groups may save tags, so must be run after tags are saved
- // to avoid errors on duplicates.
- // Note: groups should always be set.
+ // Note: groups may save tags, so must be run after tags are saved
+ // to avoid errors on duplicates.
+ // Note: groups should always be set.
- $stored->saveKnownGroups($groups);
+ $stored->saveKnownGroups($group_ids);
- if (!empty($urls)) {
- $stored->saveKnownUrls($urls);
- } else {
- $stored->saveUrls();
+ if (!empty($urls)) {
+ $stored->saveKnownUrls($urls);
+ } else {
+ $stored->saveUrls();
+ }
}
if ($distribute) {
}
static public function figureOutScope(Profile $actor, array $groups, $scope=null) {
- if (is_null($scope)) {
- $scope = self::defaultScope();
- }
+ $scope = is_null($scope) ? self::defaultScope() : intval($scope);
// For private streams
try {
$user = $actor->getUser();
// FIXME: We can't do bit comparison with == (Legacy StatusNet thing. Let's keep it for now.)
- if ($user->private_stream && ($scope == Notice::PUBLIC_SCOPE || $scope == Notice::SITE_SCOPE)) {
+ if ($user->private_stream && ($scope === Notice::PUBLIC_SCOPE || $scope === Notice::SITE_SCOPE)) {
$scope |= Notice::FOLLOWER_SCOPE;
}
} catch (NoSuchUserException $e) {
$this->blowStream('networkpublic');
}
- self::blow('notice:list-ids:conversation:%s', $this->conversation);
- self::blow('conversation:notice_count:%d', $this->conversation);
+ if ($this->conversation) {
+ self::blow('notice:list-ids:conversation:%s', $this->conversation);
+ self::blow('conversation:notice_count:%d', $this->conversation);
+ }
if ($this->isRepeat()) {
// XXX: we should probably only use one of these
*
* @return void
*/
- function saveKnownUrls($urls)
+ function saveKnownUrls(array $urls)
{
if (common_config('attachments', 'process_links')) {
// @fixme validation?
* best with generalizations on user_group to support
* remote groups better.
*/
- function saveKnownGroups($group_ids)
+ function saveKnownGroups(array $group_ids)
{
- if (!is_array($group_ids)) {
- // TRANS: Server exception thrown when no array is provided to the method saveKnownGroups().
- throw new ServerException(_('Bad type provided to saveKnownGroups.'));
- }
-
$groups = array();
foreach (array_unique($group_ids) as $id) {
$group = User_group::getKV('id', $id);
return;
}
- $sender = Profile::getKV($this->profile_id);
+ $sender = $this->getProfile();
foreach (array_unique($uris) as $uri) {
try {
continue;
}
- $this->saveReply($profile->id);
- self::blow('reply:stream:%d', $profile->id);
+ $this->saveReply($profile->getID());
+ self::blow('reply:stream:%d', $profile->getID());
}
-
- return;
}
/**
function saveReplies()
{
- // Don't save reply data for repeats
-
- if ($this->isRepeat()) {
- return array();
- }
-
$sender = $this->getProfile();
$replied = array();
try {
$parent = $this->getParent();
$parentauthor = $parent->getProfile();
- $this->saveReply($parentauthor->id);
- $replied[$parentauthor->id] = 1;
- self::blow('reply:stream:%d', $parentauthor->id);
+ $this->saveReply($parentauthor->getID());
+ $replied[$parentauthor->getID()] = 1;
+ self::blow('reply:stream:%d', $parentauthor->getID());
} catch (NoParentNoticeException $e) {
// Not a reply, since it has no parent!
+ $parent = null;
} catch (NoResultException $e) {
// Parent notice was probably deleted
+ $parent = null;
}
// @todo ideally this parser information would only
// be calculated once.
- $mentions = common_find_mentions($this->content, $this);
+ $mentions = common_find_mentions($this->content, $sender, $parent);
// store replied only for first @ (what user/notice what the reply directed,
// we assume first @ is it)
return $this->_replies[$this->getID()];
}
- function _setReplies($replies)
+ function _setReplies(array $replies)
{
$this->_replies[$this->getID()] = $replies;
}
function sendReplyNotifications()
{
// Don't send reply notifications for repeats
-
if ($this->isRepeat()) {
return array();
}
require_once INSTALLDIR.'/lib/mail.php';
foreach ($recipientIds as $recipientId) {
- $user = User::getKV('id', $recipientId);
- if ($user instanceof User) {
+ try {
+ $user = User::getByID($recipientId);
mail_notify_attn($user, $this);
+ } catch (NoResultException $e) {
+ // No such user
}
}
Event::handle('EndNotifyMentioned', array($this, $recipientIds));
}
$groups = User_group::multiGet('id', $ids);
- $this->_groups[$this->id] = $groups->fetchAll();
+ $this->_setGroups($groups->fetchAll());
return $this->_groups[$this->id];
}
- function _setGroups($groups)
+ function _setGroups(array $groups)
{
$this->_groups[$this->id] = $groups;
}
if (Event::handle('StartActivityObjectFromNotice', array($this, &$object))) {
$object->type = $this->object_type ?: ActivityObject::NOTE;
$object->id = $this->getUri();
+ //FIXME: = $object->title ?: sprintf(... because we might get a title from StartActivityObjectFromNotice
$object->title = sprintf('New %1$s by %2$s', ActivityObject::canonicalType($object->type), $this->getProfile()->getNickname());
$object->content = $this->rendered;
$object->link = $this->getUrl();
public function isLocal()
{
- return ($this->is_local == Notice::LOCAL_PUBLIC ||
- $this->is_local == Notice::LOCAL_NONPUBLIC);
+ $is_local = intval($this->is_local);
+ return ($is_local === self::LOCAL_PUBLIC || $is_local === self::LOCAL_NONPUBLIC);
+ }
+
+ public function getScope()
+ {
+ return intval($this->scope);
}
public function isRepeat()
*/
public function getTags()
{
+ // Check default scope (non-private notices)
+ $inScope = (!$this->isPrivateScope());
+
+ // Get current profile
+ $profile = Profile::current();
+
+ // Is the general scope check okay and the user in logged in?
+ //* NOISY-DEBUG: */ common_debug('[' . __METHOD__ . ':' . __LINE__ . ']: inScope=' . intval($inScope) . ',profile[]=' . gettype($profile));
+ if (($inScope === TRUE) && ($profile instanceof Profile)) {
+ /*
+ * Check scope, else a privacy leaks happens this way:
+ *
+ * 1) Bob and Alice follow each other and write private notices
+ * (this->scope=2) to each other.
+ * 2) Bob uses tags in his private notice to alice (which she can
+ * read from him).
+ * 3) Alice adds that notice (with tags) to her favorites
+ * ("faving") it.
+ * 4) The tags from Bob's private notice becomes visible in Alice's
+ * profile.
+ *
+ * This has the simple background that the scope is not being
+ * re-checked. This has to be done here at this point because given
+ * above scenario is a privacy leak as the tags may be *really*
+ * private (nobody else shall see them) such as initmate words or
+ * very political words.
+ */
+ $inScope = $this->inScope($profile);
+ //* NOISY-DEBUG: */ common_debug('[' . __METHOD__ . ':' . __LINE__ . ']: inScope=' . intval($inScope) . ' - After inScope() has been called.');
+ }
+
$tags = array();
$keypart = sprintf('notice:tags:%d', $this->id);
} else {
$tag = new Notice_tag();
$tag->notice_id = $this->id;
- if ($tag->find()) {
+
+ // Check scope for privacy-leak protection (see some lines above why)
+ if (($inScope === TRUE) && ($tag->find())) {
while ($tag->fetch()) {
$tags[] = $tag->tag;
}
($this->is_local != Notice::GATEWAY));
}
+ public function isPrivateScope () {
+ return ($this->scope != Notice::SITE_SCOPE &&
+ $this->scope != Notice::PUBLIC_SCOPE);
+ }
+
/**
* Check that the given profile is allowed to read, respond to, or otherwise
* act on this notice.
*
* @return boolean whether the profile is in the notice's scope
*/
- function inScope($profile)
+ function inScope(Profile $profile=null)
{
if (is_null($profile)) {
$keypart = sprintf('notice:in-scope-for:%d:null', $this->id);
return ($result == 1) ? true : false;
}
- protected function _inScope($profile)
+ protected function _inScope(Profile $profile=null)
{
- if (!is_null($this->scope)) {
- $scope = $this->scope;
- } else {
- $scope = self::defaultScope();
- }
+ $scope = is_null($this->scope) ? self::defaultScope() : $this->getScope();
- if ($scope == 0 && !$this->getProfile()->isPrivateStream()) { // Not scoping, so it is public.
+ if ($scope === 0 && !$this->getProfile()->isPrivateStream()) { // Not scoping, so it is public.
return !$this->isHiddenSpam($profile);
}
return !$this->isHiddenSpam($profile);
}
- function isHiddenSpam($profile) {
+ function isHiddenSpam(Profile $profile=null) {
// Hide posts by silenced users from everyone but moderators.
return false;
}
+ public function hasParent()
+ {
+ try {
+ $this->getParent();
+ } catch (NoParentNoticeException $e) {
+ return false;
+ }
+ return true;
+ }
+
public function getParent()
{
+ $reply_to_id = null;
+
if (empty($this->reply_to)) {
throw new NoParentNoticeException($this);
}
- return self::getByID($this->reply_to);
+
+ // The reply_to ID in the table Notice could exist with a number
+ // however, the replied to notice might not exist in the database.
+ // Thus we need to catch the exception and throw the NoParentNoticeException else
+ // the timeline will not display correctly.
+ try {
+ $reply_to_id = self::getByID($this->reply_to);
+ } catch(Exception $e){
+ throw new NoParentNoticeException($this);
+ }
+
+ return $reply_to_id;
}
/**
return $scope;
}
- static function fillProfiles($notices)
+ static function fillProfiles(array $notices)
{
$map = self::getProfiles($notices);
foreach ($notices as $entry=>$notice) {
return array_values($map);
}
- static function getProfiles(&$notices)
+ static function getProfiles(array &$notices)
{
$ids = array();
foreach ($notices as $notice) {
return Profile::pivotGet('id', $ids);
}
- static function fillGroups(&$notices)
+ static function fillGroups(array &$notices)
{
$ids = self::_idsOf($notices);
$gis = Group_inbox::listGet('notice_id', $ids);
return array_keys($ids);
}
- static function fillAttachments(&$notices)
+ static function fillAttachments(array &$notices)
{
$ids = self::_idsOf($notices);
$f2pMap = File_to_post::listGet('post_id', $ids);
}
}
- static function fillReplies(&$notices)
+ static function fillReplies(array &$notices)
{
$ids = self::_idsOf($notices);
$replyMap = Reply::listGet('notice_id', $ids);
}
}
+ /**
+ * Checks whether the current profile is allowed (in scope) to see this notice.
+ *
+ * @return $inScope Whether the current profile is allowed to see this notice
+ */
+ function isCurrentProfileInScope () {
+ // Check scope, default is allowed
+ $inScope = TRUE;
+
+ //* NOISY-DEBUG: */ common_debug('[' . __METHOD__ . ':' . __LINE__ . '] this->tag=' . $this->tag . ',this->id=' . $this->id . ',this->scope=' . $this->scope);
+
+ // Is it private scope?
+ if ($this->isPrivateScope()) {
+ // 2) Get current profile
+ $profile = Profile::current();
+
+ // Is the profile not set?
+ if (!$profile instanceof Profile) {
+ // Public viewer shall not see a tag from a private dent (privacy leak)
+ //* NOISY-DEBUG: */ common_debug('[' . __METHOD__ . ':' . __LINE__ . '] Not logged in (public view).');
+ $inScope = FALSE;
+ } elseif (!$this->inScope($profile)) {
+ // Current profile is not in scope (not allowed to see) of notice
+ //* NOISY-DEBUG: */ common_debug('[' . __METHOD__ . ':' . __LINE__ . '] profile->id=' . $profile->id . ' is not allowed to see this notice.');
+ $inScope = FALSE;
+ }
+ }
+
+ // Return result
+ //* NOISY-DEBUG: */ common_debug('[' . __METHOD__ . ':' . __LINE__ . '] this->tag=' . $this->tag . ',this->weight=' . $this->weight . ',inScope=' . intval($inScope) . ' - EXIT!');
+ return $inScope;
+ }
+
static public function beforeSchemaUpdate()
{
$table = strtolower(get_called_class());
projects / quix0rs-gnu-social.git / blobdiff