friendica
/
friendica
mirror of https://github.com/friendica/friendica
6
0
Fork 1
Code Issues Packages Projects Releases 1 Wiki Activity

Merge pull request #6244 from annando/auth-fix 

Fix for remote authentication when visiting contact's pages
This commit is contained in:
Hypolite Petovan 2018-12-09 09:05:46 -05:00 committed by GitHub
parent 5e79ad277a f2e2066d33
commit 8a185a0346
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
6 changed files with 88 additions and 83 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/conversation.php
View File

@ -798,7 +798,7 @@ function conversation_add_children(array $parents, $block_authors, $order, $uid)
foreach ($parents AS $parent) {
$condition = ["`item`.`parent-uri` = ? AND `item`.`uid` IN (0, ?) ",
$parent['uri'], local_user()];
$parent['uri'], $uid];
if ($block_authors) {
$condition[0] .= "AND NOT `author`.`hidden`";
}

2
mod/delegate.php
View File

@ -163,6 +163,8 @@ function delegate_content(App $a)
if (!is_null($parent_user)) {
$parent_password = ['parent_password', L10n::t('Parent Password:'), '', L10n::t('Please enter the password of the parent account to legitimize your request.')];
} else {
$parent_password = '';
}
$o = Renderer::replaceMacros(Renderer::getMarkupTemplate('delegate.tpl'), [

84
mod/display.php
View File

@ -26,6 +26,10 @@ use Friendica\Module\Objects;
function display_init(App $a)
{
if (ActivityPub::isRequest()) {
Objects::rawContent();
}
if (Config::get('system', 'block_public') && !local_user() && !remote_user()) {
return;
}
@ -48,6 +52,7 @@ function display_init(App $a)
}
$item = null;
$item_user = local_user();
$fields = ['id', 'parent', 'author-id', 'body', 'uid', 'guid'];
@ -61,6 +66,16 @@ function display_init(App $a)
if (DBA::isResult($item)) {
$nick = $a->user["nickname"];
}
// Is this item private but could be visible to the remove visitor?
} elseif (remote_user()) {
$item = Item::selectFirst($fields, ['guid' => $a->argv[1], 'private' => 1]);
if (DBA::isResult($item)) {
if (!Contact::isFollower(remote_user(), $item['uid'])) {
$item = null;
} else {
$item_user = $item['uid'];
}
}
}
// Is it an item with uid=0?
@ -72,9 +87,7 @@ function display_init(App $a)
}
if (!DBA::isResult($item)) {
$a->error = 404;
notice(L10n::t('Item not found.') . EOL);
return;
System::httpExit(404);
}
if (!empty($_SERVER['HTTP_ACCEPT']) && strstr($_SERVER['HTTP_ACCEPT'], 'application/atom+xml')) {
@ -82,10 +95,6 @@ function display_init(App $a)
displayShowFeed($item["id"], false);
}
if (ActivityPub::isRequest()) {
Objects::rawContent();
}
if ($item["id"] != $item["parent"]) {
$item = Item::selectFirstForUser(local_user(), $fields, ['id' => $item["parent"]]);
}
@ -225,7 +234,7 @@ function display_content(App $a, $update = false, $update_uid = 0)
if ($a->argc == 2) {
$item_parent = 0;
$fields = ['id', 'parent', 'parent-uri'];
$fields = ['id', 'parent', 'parent-uri', 'uid'];
if (local_user()) {
$condition = ['guid' => $a->argv[1], 'uid' => local_user()];
@ -235,6 +244,13 @@ function display_content(App $a, $update = false, $update_uid = 0)
$item_parent = $item["parent"];
$item_parent_uri = $item['parent-uri'];
}
} elseif (remote_user()) {
$item = Item::selectFirst($fields, ['guid' => $a->argv[1], 'private' => 1]);
if (DBA::isResult($item) && Contact::isFollower(remote_user(), $item['uid'])) {
$item_id = $item["id"];
$item_parent = $item["parent"];
$item_parent_uri = $item['parent-uri'];
}
}
if ($item_parent == 0) {
@ -250,9 +266,7 @@ function display_content(App $a, $update = false, $update_uid = 0)
}
if (!$item_id) {
$a->error = 404;
notice(L10n::t('Item not found.').EOL);
return;
System::httpExit(404);
}
// We are displaying an "alternate" link if that post was public. See issue 2864
@ -271,34 +285,22 @@ function display_content(App $a, $update = false, $update_uid = 0)
'$conversation' => $conversation]);
$groups = [];
$contact = null;
$remote_cid = null;
$is_remote_contact = false;
$item_uid = local_user();
$contact_id = 0;
if (!empty($_SESSION['remote']) && is_array($_SESSION['remote'])) {
foreach ($_SESSION['remote'] as $v) {
if ($v['uid'] == $a->profile['uid']) {
$contact_id = $v['cid'];
break;
}
}
$parent = Item::selectFirst(['uid'], ['uri' => $item_parent_uri, 'wall' => true]);
if (DBA::isResult($parent)) {
$a->profile['profile_uid'] = $parent['uid'];
$is_remote_contact = Contact::isFollower(remote_user(), $a->profile['profile_uid']);
}
if ($contact_id) {
$groups = Group::getIdsByContactId($contact_id);
$remote_contact = DBA::selectFirst('contact', [], ['id' => $contact_id, 'uid' => $a->profile['uid']]);
if (DBA::isResult($remote_contact)) {
$contact = $remote_contact;
$is_remote_contact = true;
}
}
if (!$is_remote_contact) {
if (local_user()) {
$contact_id = $_SESSION['cid'];
$contact = $a->contact;
if ($is_remote_contact) {
$cdata = Contact::getPublicAndUserContacID(remote_user(), $a->profile['profile_uid']);
if (!empty($cdata['user'])) {
$groups = Group::getIdsByContactId($cdata['user']);
$remote_cid = $cdata['user'];
$item_uid = $parent['uid'];
}
}
@ -328,10 +330,9 @@ function display_content(App $a, $update = false, $update_uid = 0)
];
$o .= status_editor($a, $x, 0, true);
}
$sql_extra = Item::getPermissionsSQLByUserId($a->profile['profile_uid'], $is_remote_contact, $groups, $remote_cid);
$sql_extra = Item::getPermissionsSQLByUserId($a->profile['uid'], $is_remote_contact, $groups);
if (local_user() && (local_user() == $a->profile['uid'])) {
if (local_user() && (local_user() == $a->profile['profile_uid'])) {
$condition = ['parent-uri' => $item_parent_uri, 'uid' => local_user(), 'unseen' => true];
$unseen = Item::exists($condition);
} else {
@ -342,13 +343,12 @@ function display_content(App $a, $update = false, $update_uid = 0)
return '';
}
$condition = ["`id` = ? AND `item`.`uid` IN (0, ?) " . $sql_extra, $item_id, local_user()];
$condition = ["`id` = ? AND `item`.`uid` IN (0, ?) " . $sql_extra, $item_id, $item_uid];
$fields = ['parent-uri', 'body', 'title', 'author-name', 'author-avatar', 'plink'];
$item = Item::selectFirstForUser(local_user(), $fields, $condition);
if (!DBA::isResult($item)) {
notice(L10n::t('Item not found.') . EOL);
return $o;
System::httpExit(404);
}
$item['uri'] = $item['parent-uri'];
@ -362,7 +362,7 @@ function display_content(App $a, $update = false, $update_uid = 0)
$o .= "<script> var netargs = '?f=&item_id=" . $item_id . "'; </script>";
}
$o .= conversation($a, [$item], new Pager($a->query_string), 'display', $update_uid, false, 'commented', local_user());
$o .= conversation($a, [$item], new Pager($a->query_string), 'display', $update_uid, false, 'commented', $item_uid);
// Preparing the meta header
$description = trim(HTML::toPlaintext(BBCode::convert($item["body"], false), 0, true));

48
mod/profile.php
View File

@ -139,6 +139,7 @@ function profile_content(App $a, $update = 0)
require_once 'include/items.php';
$groups = [];
$remote_cid = null;
$tab = 'posts';
$o = '';
@ -150,42 +151,18 @@ function profile_content(App $a, $update = 0)
Nav::setSelected('home');
}
$contact = null;
$remote_contact = false;
$contact_id = 0;
if (!empty($_SESSION['remote'])) {
foreach ($_SESSION['remote'] as $v) {
if ($v['uid'] == $a->profile['profile_uid']) {
$contact_id = $v['cid'];
break;
}
}
}
if ($contact_id) {
$groups = Group::getIdsByContactId($contact_id);
$r = q("SELECT * FROM `contact` WHERE `id` = %d AND `uid` = %d LIMIT 1",
intval($contact_id),
intval($a->profile['profile_uid'])
);
if (DBA::isResult($r)) {
$contact = $r[0];
$remote_contact = true;
}
}
if (!$remote_contact) {
if (local_user()) {
$contact_id = $_SESSION['cid'];
$contact = $a->contact;
}
}
$remote_contact = Contact::isFollower(remote_user(), $a->profile['profile_uid']);
$is_owner = local_user() == $a->profile['profile_uid'];
$last_updated_key = "profile:" . $a->profile['profile_uid'] . ":" . local_user() . ":" . remote_user();
if ($remote_contact) {
$cdata = Contact::getPublicAndUserContacID(remote_user(), $a->profile['profile_uid']);
if (!empty($cdata['user'])) {
$groups = Group::getIdsByContactId($cdata['user']);
$remote_cid = $cdata['user'];
}
}
if (!empty($a->profile['hidewall']) && !$is_owner && !$remote_contact) {
notice(L10n::t('Access to this profile has been restricted.') . EOL);
return;
@ -236,9 +213,8 @@ function profile_content(App $a, $update = 0)
}
}
// Get permissions SQL - if $remote_contact is true, our remote user has been pre-verified and we already have fetched his/her groups
$sql_extra = Item::getPermissionsSQLByUserId($a->profile['profile_uid'], $remote_contact, $groups);
$sql_extra = Item::getPermissionsSQLByUserId($a->profile['profile_uid'], $remote_contact, $groups, $remote_cid);
$sql_extra2 = '';
if ($update) {
@ -350,7 +326,7 @@ function profile_content(App $a, $update = 0)
}
}
$o .= conversation($a, $items, $pager, 'profile', $update, false, 'created', local_user());
$o .= conversation($a, $items, $pager, 'profile', $update, false, 'created', $a->profile['profile_uid']);
if (!$update) {
$o .= $pager->renderMinimal(count($items));

31
src/Model/Contact.php
View File

@ -98,6 +98,29 @@ class Contact extends BaseObject
* @}
*/
/**
* @brief Tests if the given contact is a follower
*
* @param int $cid Either public contact id or user's contact id
* @param int $uid User ID
*
* @return boolean is the contact id a follower?
*/
public static function isFollower($cid, $uid)
{
if (self::isBlockedByUser($cid, $uid)) {
return false;
}
$cdata = self::getPublicAndUserContacID($cid, $uid);
if (empty($cdata['user'])) {
return false;
}
$condition = ['id' => $cdata['user'], 'rel' => [self::FOLLOWER, self::FRIEND]];
return DBA::exists('contact', $condition);
}
/**
* @brief Get the basepath for a given contact link
* @todo Add functionality to store this value in the contact table
@ -125,7 +148,7 @@ class Contact extends BaseObject
*
* @return array with public and user's contact id
*/
private static function getPublicAndUserContacID($cid, $uid)
public static function getPublicAndUserContacID($cid, $uid)
{
if (empty($uid) || empty($cid)) {
return [];
@ -2054,6 +2077,10 @@ class Contact extends BaseObject
*/
public static function magicLink($contact_url, $url = '')
{
if (!local_user()) {
return $url ?: $contact_url; // Equivalent to: ($url != '') ? $url : $contact_url;
}
$cid = self::getIdForURL($contact_url, 0, true);
if (empty($cid)) {
return $url ?: $contact_url; // Equivalent to: ($url != '') ? $url : $contact_url;
@ -2087,7 +2114,7 @@ class Contact extends BaseObject
*/
public static function magicLinkbyContact($contact, $url = '')
{
if ($contact['network'] != Protocol::DFRN) {
if (!local_user() || ($contact['network'] != Protocol::DFRN)) {
return $url ?: $contact['url']; // Equivalent to ($url != '') ? $url : $contact['url'];
}

4
src/Model/Item.php
View File

@ -3214,7 +3214,7 @@ class Item extends BaseObject
}
}
public static function getPermissionsSQLByUserId($owner_id, $remote_verified = false, $groups = null)
public static function getPermissionsSQLByUserId($owner_id, $remote_verified = false, $groups = null, $remote_cid = null)
{
$local_user = local_user();
$remote_user = remote_user();
@ -3237,7 +3237,7 @@ class Item extends BaseObject
* If pre-verified, the caller is expected to have already
* done this and passed the groups into this function.
*/
$set = PermissionSet::get($owner_id, $remote_user, $groups);
$set = PermissionSet::get($owner_id, $remote_cid, $groups);
if (!empty($set)) {
$sql_set = " OR (`item`.`private` IN (1,2) AND `item`.`wall` AND `item`.`psid` IN (" . implode(',', $set) . "))";