diff --git a/boot.php b/boot.php index d5feaed2d..be4b8ca0e 100755 --- a/boot.php +++ b/boot.php @@ -9,7 +9,7 @@ require_once('include/nav.php'); require_once('include/cache.php'); define ( 'FRIENDICA_PLATFORM', 'Friendica'); -define ( 'FRIENDICA_VERSION', '2.3.1285' ); +define ( 'FRIENDICA_VERSION', '2.3.1286' ); define ( 'DFRN_PROTOCOL_VERSION', '2.23' ); define ( 'DB_UPDATE_VERSION', 1132 ); @@ -713,15 +713,16 @@ function login($register = false, $hiddens=false) { $noid = get_config('system','no_openid'); + $dest_url = $a->get_baseurl(true) . '/' . $a->query_string; + if(local_user()) { $tpl = get_markup_template("logout.tpl"); } else { $tpl = get_markup_template("login.tpl"); - + $_SESSION['return_url'] = $a->query_string; } - $dest_url = $a->get_baseurl(true) . '/' . $a->query_string; $o .= replace_macros($tpl,array( diff --git a/include/auth.php b/include/auth.php index fc52684e6..835616a82 100755 --- a/include/auth.php +++ b/include/auth.php @@ -24,7 +24,7 @@ if((isset($_SESSION)) && (x($_SESSION,'authenticated')) && ((! (x($_POST,'auth-p if(((x($_POST,'auth-params')) && ($_POST['auth-params'] === 'logout')) || ($a->module === 'logout')) { // process logout request - + call_hooks("logging_out"); nuke_session(); info( t('Logged out.') . EOL); goaway(z_root()); @@ -77,7 +77,7 @@ else { $noid = get_config('system','no_openid'); - $openid_url = trim( (strlen($_POST['openid_url'])?$_POST['openid_url']:$_POST['username']) ); + $openid_url = trim((strlen($_POST['openid_url'])?$_POST['openid_url']:$_POST['username']) ); // validate_url alters the calling parameter @@ -99,32 +99,12 @@ else { $openid->identity = $openid_url; $_SESSION['openid'] = $openid_url; $a = get_app(); - $openid->returnUrl = $a->get_baseurl() . '/openid'; - - $r = q("SELECT `uid` FROM `user` WHERE `openid` = '%s' LIMIT 1", - dbesc($openid_url) - ); - if(count($r)) { - // existing account - goaway($openid->authUrl()); - // NOTREACHED - } - else { - if($a->config['register_policy'] == REGISTER_CLOSED) { - $a = get_app(); - notice( t('Login failed.') . EOL); - goaway(z_root()); - // NOTREACHED - } - // new account - $_SESSION['register'] = 1; - $openid->required = array('namePerson/friendly', 'contact/email', 'namePerson'); - $openid->optional = array('namePerson/first','media/image/aspect11','media/image/default'); - goaway($openid->authUrl()); - // NOTREACHED - } + $openid->returnUrl = $a->get_baseurl(true) . '/openid'; + goaway($openid->authUrl()); + // NOTREACHED } } + if((x($_POST,'auth-params')) && $_POST['auth-params'] === 'login') { $record = null; @@ -165,7 +145,7 @@ else { } if((! $record) || (! count($record))) { - logger('authenticate: failed login attempt: ' . notags(trim($_POST['username']))); + logger('authenticate: failed login attempt: ' . notags(trim($_POST['username'])) . ' from IP ' . $_SERVER['REMOTE_ADDR']); notice( t('Login failed.') . EOL ); goaway(z_root()); } diff --git a/include/text.php b/include/text.php index 89acbf9fa..527f3a344 100644 --- a/include/text.php +++ b/include/text.php @@ -694,8 +694,13 @@ function linkify($s) { if(! function_exists('smilies')) { function smilies($s, $sample = false) { + $a = get_app(); + if(intval(get_config('system','no_smilies')) + || (local_user() && intval(get_pconfig(local_user(),'system','no_smilies')))) + return $s; + $s = preg_replace_callback('/
(.*?)<\/pre>/ism','smile_encode',$s);
 	$s = preg_replace_callback('/(.*?)<\/code>/ism','smile_encode',$s);
 
@@ -704,27 +709,20 @@ function smilies($s, $sample = false) {
 		'</3', 
 		'<\\3', 
 		':-)', 
-//		':)', 
 		';-)', 
-//		';)', 
 		':-(', 
-//		':(', 
 		':-P', 
-//		':P', 
 		':-"', 
 		':-"', 
 		':-x', 
 		':-X', 
 		':-D', 
-//		':D', 
 		'8-|', 
 		'8-O', 
 		':-O', 
 		'\\o/', 
 		'o.O', 
 		'O.o', 
-		'\\.../', 
-		'\\ooo/', 
 		":'(", 
 		":-!", 
 		":-/", 
@@ -734,12 +732,8 @@ function smilies($s, $sample = false) {
 		':homebrew', 
 		':coffee', 
 		':facepalm',
-		':headdesk',
 		'~friendika', 
-		'~friendica', 
-//		'Diaspora*' 
-		':beard',
-		':whitebeard'
+		'~friendica'
 
 	);
 
@@ -748,27 +742,20 @@ function smilies($s, $sample = false) {
 		'</3',
 		'<\\3',
 		':-)',
-//		':)',
 		';-)',
-//		';)',                
 		':-(',
-//		':(',
 		':-P',
-//		':P',
 		':-\',
 		':-\',
 		':-x',
 		':-X',
 		':-D',
-//		':D',                
 		'8-|',
 		'8-O',
 		':-O',                
 		'\\o/',
 		'o.O',
 		'O.o',
-		'\\.../',
-		'\\ooo/',
 		':\'(',
 		':-!',
 		':-/',
@@ -778,12 +765,8 @@ function smilies($s, $sample = false) {
 		':homebrew',
 		':coffee',
 		':facepalm',
-		':headdesk',
 		'~friendika ~friendika',
-		'~friendica ~friendica',
-//		'DiasporaDiaspora*',
-		':beard',
-		':whitebeard'
+		'~friendica ~friendica'
 	);
 
 	$params = array('texts' => $texts, 'icons' => $icons, 'string' => $s);
@@ -1350,3 +1333,6 @@ function file_tag_unsave_file($uid,$item,$file) {
 	return true;
 }
 
+function normalise_openid($s) {
+	return trim(str_replace(array('http://','https://'),array('',''),$s),'/');
+}
diff --git a/mod/openid.php b/mod/openid.php
index df074b299..e2cea7d85 100755
--- a/mod/openid.php
+++ b/mod/openid.php
@@ -10,68 +10,84 @@ function openid_content(&$a) {
 	if($noid)
 		goaway(z_root());
 
+	logger('mod_openid ' . print_r($_REQUEST,true), LOGGER_DATA);
+
 	if((x($_GET,'openid_mode')) && (x($_SESSION,'openid'))) {
+
 		$openid = new LightOpenID;
 
 		if($openid->validate()) {
 
-			if(x($_SESSION,'register')) {
-				unset($_SESSION['register']);
-				$args = '';
-				$attr = $openid->getAttributes();
-				if(is_array($attr) && count($attr)) {
-					foreach($attr as $k => $v) {
-						if($k === 'namePerson/friendly')
-							$nick = notags(trim($v));
-						if($k === 'namePerson/first')
-							$first = notags(trim($v));
-						if($k === 'namePerson')
-							$args .= '&username=' . notags(trim($v));
-						if($k === 'contact/email')
-							$args .= '&email=' . notags(trim($v));
-						if($k === 'media/image/aspect11')
-							$photosq = bin2hex(trim($v));
-						if($k === 'media/image/default')
-							$photo = bin2hex(trim($v));
-					}
-				}
-				if($nick)
-					$args .= '&nickname=' . $nick;
-				elseif($first)
-					$args .= '&nickname=' . $first;
-
-				if($photosq)
-					$args .= '&photo=' . $photosq;
-				elseif($photo)
-					$args .= '&photo=' . $photo;
-
-				$args .= '&openid_url=' . notags(trim($_SESSION['openid']));
-				if($a->config['register_policy'] != REGISTER_CLOSED)
-					goaway($a->get_baseurl() . '/register' . $args);
-				else
-					goaway(z_root());
-
-				// NOTREACHED
-			} 
+			$authid = normalise_openid($_REQUEST['openid_identity']);
 
+			if(! strlen($authid)) {
+				logger( t('OpenID protocol error. No ID returned.') . EOL);
+				goaway(z_root());
+			}
 
 			$r = q("SELECT `user`.*, `user`.`pubkey` as `upubkey`, `user`.`prvkey` as `uprvkey` 
-				FROM `user` WHERE `openid` = '%s' AND `blocked` = 0 AND `account_expired` = 0 AND `verified` = 1 LIMIT 1",
-				dbesc($_SESSION['openid'])
+				FROM `user` WHERE `openid` = '%s' AND `blocked` = 0 
+				AND `account_expired` = 0 AND `verified` = 1 LIMIT 1",
+				dbesc($authid)
 			);
-			if(! count($r)) {
-				notice( t('Login failed.') . EOL );
+
+			if($r && count($r)) {
+
+				// successful OpenID login
+
+				unset($_SESSION['openid']);
+
+				require_once('include/security.php');
+				authenticate_success($r[0],true,true);
+
+				// just in case there was no return url set 
+				// and we fell through
+
 				goaway(z_root());
-  			}
-			unset($_SESSION['openid']);
+			}
 
-			require_once('include/security.php');
-			authenticate_success($r[0],true,true);
+			// Successful OpenID login - but we can't match it to an existing account.
+			// New registration?
 
-			// just in case there was no return url set 
-			// and we fell through
+			if($a->config['register_policy'] == REGISTER_CLOSED) {
+				notice( t('Account not found and OpenID registration is not permitted on this site.') . EOL);
+				goaway(z_root());
+			}
 
-			goaway(z_root());
+			unset($_SESSION['register']);
+			$args = '';
+			$attr = $openid->getAttributes();
+			if(is_array($attr) && count($attr)) {
+				foreach($attr as $k => $v) {
+					if($k === 'namePerson/friendly')
+						$nick = notags(trim($v));
+					if($k === 'namePerson/first')
+						$first = notags(trim($v));
+					if($k === 'namePerson')
+						$args .= '&username=' . notags(trim($v));
+					if($k === 'contact/email')
+						$args .= '&email=' . notags(trim($v));
+					if($k === 'media/image/aspect11')
+						$photosq = bin2hex(trim($v));
+					if($k === 'media/image/default')
+						$photo = bin2hex(trim($v));
+				}
+			}
+			if($nick)
+				$args .= '&nickname=' . $nick;
+			elseif($first)
+				$args .= '&nickname=' . $first;
+
+			if($photosq)
+				$args .= '&photo=' . $photosq;
+			elseif($photo)
+				$args .= '&photo=' . $photo;
+
+			$args .= '&openid_url=' . notags(trim($authid));
+
+			goaway($a->get_baseurl() . '/register' . $args);
+
+			// NOTREACHED
 		}
 	}
 	notice( t('Login failed.') . EOL);
diff --git a/mod/photos.php b/mod/photos.php
index 4406780d3..b294f0a66 100755
--- a/mod/photos.php
+++ b/mod/photos.php
@@ -1069,7 +1069,7 @@ function photos_content(&$a) {
 		if($can_post && ($ph[0]['uid'] == $owner_uid)) {
 			$tools = array(
 				'edit'	=> array($a->get_baseurl() . '/photos/' . $a->data['user']['nickname'] . '/image/' . $datum . (($cmd === 'edit') ? '' : '/edit'), (($cmd === 'edit') ? t('View photo') : t('Edit photo'))),
-				'profile'=>array($a->get_baseurl() . '/profile_photo/use/'.$ph[0]['resource-id'] . '?form_security_token=' . get_form_security_token('profile_photo'), t('Use as profile photo')),
+				'profile'=>array($a->get_baseurl() . '/profile_photo/use/'.$ph[0]['resource-id'], t('Use as profile photo')),
 			);
 
 			// lock
@@ -1081,6 +1081,17 @@ function photos_content(&$a) {
 			
 		}
 
+		if(! $cmd !== 'edit') {
+			$a->page['htmlhead'] .= '';
+		}
+
 		if($prevlink)
 			$prevlink = array($prevlink, '') ;
 
diff --git a/mod/settings.php b/mod/settings.php
index 3a8ad29d2..59ede4729 100755
--- a/mod/settings.php
+++ b/mod/settings.php
@@ -322,6 +322,7 @@ function settings_post(&$a) {
 	$str_contact_deny  = perms2str($_POST['contact_deny']);
 
 	$openidserver = $a->user['openidserver'];
+	$openid = normalise_openid($openid);
 
 	// If openid has changed or if there's an openid but no openidserver, try and discover it.