You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

636 lines
18 KiB

7 years ago
7 years ago
7 years ago
7 years ago
7 years ago
7 years ago
7 years ago
7 years ago
  1. <?php
  2. use Abraham\TwitterOAuth\TwitterOAuth;
  3. function require_login(&$app, $redirect=true) {
  4. $params = $app->request()->params();
  5. if(array_key_exists('token', $params)) {
  6. try {
  7. $data = JWT::decode($params['token'], Config::$jwtSecret, array('HS256'));
  8. $_SESSION['user_id'] = $data->user_id;
  9. $_SESSION['me'] = $data->me;
  10. } catch(DomainException $e) {
  11. if($redirect) {
  12. header('X-Error: DomainException');
  13. $app->redirect('/', 302);
  14. } else {
  15. return false;
  16. }
  17. } catch(UnexpectedValueException $e) {
  18. if($redirect) {
  19. header('X-Error: UnexpectedValueException');
  20. $app->redirect('/', 302);
  21. } else {
  22. return false;
  23. }
  24. }
  25. }
  26. if(!array_key_exists('user_id', $_SESSION)) {
  27. if($redirect)
  28. $app->redirect('/', 302);
  29. return false;
  30. } else {
  31. return ORM::for_table('users')->find_one($_SESSION['user_id']);
  32. }
  33. }
  34. function generate_login_token($opts=[]) {
  35. return JWT::encode(array_merge([
  36. 'user_id' => $_SESSION['user_id'],
  37. 'me' => $_SESSION['me'],
  38. 'created_at' => time()
  39. ], $opts), Config::$jwtSecret);
  40. }
  41. $app->get('/dashboard', function() use($app) {
  42. if($user=require_login($app)) {
  43. render('dashboard', array(
  44. 'title' => 'Dashboard',
  45. 'authorizing' => false
  46. ));
  47. }
  48. });
  49. $app->get('/new', function() use($app) {
  50. if($user=require_login($app)) {
  51. $params = $app->request()->params();
  52. $entry = false;
  53. $in_reply_to = '';
  54. if(array_key_exists('reply', $params))
  55. $in_reply_to = $params['reply'];
  56. $test_response = '';
  57. if($user->last_micropub_response) {
  58. try {
  59. if(@json_decode($user->last_micropub_response)) {
  60. $d = json_decode($user->last_micropub_response);
  61. $test_response = $d->response;
  62. }
  63. } catch(Exception $e) {
  64. }
  65. }
  66. render('new-post', array(
  67. 'title' => 'New Post',
  68. 'in_reply_to' => $in_reply_to,
  69. 'micropub_endpoint' => $user->micropub_endpoint,
  70. 'media_endpoint' => $user->micropub_media_endpoint,
  71. 'micropub_scope' => $user->micropub_scope,
  72. 'micropub_access_token' => $user->micropub_access_token,
  73. 'response_date' => $user->last_micropub_response_date,
  74. 'syndication_targets' => json_decode($user->syndication_targets, true),
  75. 'test_response' => $test_response,
  76. 'location_enabled' => $user->location_enabled,
  77. 'user' => $user,
  78. 'authorizing' => false
  79. ));
  80. }
  81. });
  82. $app->get('/bookmark', function() use($app) {
  83. if($user=require_login($app)) {
  84. $params = $app->request()->params();
  85. $url = '';
  86. $name = '';
  87. $content = '';
  88. $tags = '';
  89. if(array_key_exists('url', $params))
  90. $url = $params['url'];
  91. if(array_key_exists('name', $params))
  92. $name = $params['name'];
  93. if(array_key_exists('content', $params))
  94. $content = $params['content'];
  95. render('new-bookmark', array(
  96. 'title' => 'New Bookmark',
  97. 'bookmark_url' => $url,
  98. 'bookmark_name' => $name,
  99. 'bookmark_content' => $content,
  100. 'bookmark_tags' => $tags,
  101. 'token' => generate_login_token(),
  102. 'syndication_targets' => json_decode($user->syndication_targets, true),
  103. 'user' => $user,
  104. 'authorizing' => false
  105. ));
  106. }
  107. });
  108. $app->get('/favorite', function() use($app) {
  109. if($user=require_login($app)) {
  110. $params = $app->request()->params();
  111. $like_of = '';
  112. if(array_key_exists('url', $params))
  113. $like_of = $params['url'];
  114. // Check if there was a login token in the query string and whether it has autosubmit=true
  115. $autosubmit = false;
  116. if(array_key_exists('token', $params)) {
  117. try {
  118. $data = JWT::decode($params['token'], Config::$jwtSecret, ['HS256']);
  119. if(isset($data->autosubmit) && $data->autosubmit) {
  120. // Only allow this token to be used for the user who created it
  121. if($data->user_id == $_SESSION['user_id']) {
  122. $autosubmit = true;
  123. }
  124. }
  125. } catch(Exception $e) {
  126. }
  127. }
  128. if(array_key_exists('edit', $params)) {
  129. $edit_data = get_micropub_source($user, $params['edit'], 'like-of');
  130. $url = $params['edit'];
  131. if(isset($edit_data['like-of'])) {
  132. $like_of = $edit_data['like-of'][0];
  133. }
  134. } else {
  135. $edit_data = false;
  136. $url = false;
  137. }
  138. render('new-favorite', array(
  139. 'title' => 'New Favorite',
  140. 'like_of' => $like_of,
  141. 'token' => generate_login_token(['autosubmit'=>true]),
  142. 'authorizing' => false,
  143. 'autosubmit' => $autosubmit,
  144. 'url' => $url
  145. ));
  146. }
  147. });
  148. $app->get('/event', function() use($app) {
  149. if($user=require_login($app)) {
  150. $params = $app->request()->params();
  151. render('event', array(
  152. 'title' => 'Event',
  153. 'authorizing' => false
  154. ));
  155. }
  156. });
  157. $app->get('/itinerary', function() use($app) {
  158. if($user=require_login($app)) {
  159. $params = $app->request()->params();
  160. render('new-itinerary', array(
  161. 'title' => 'Itinerary',
  162. 'authorizing' => false
  163. ));
  164. }
  165. });
  166. $app->get('/photo', function() use($app) {
  167. if($user=require_login($app)) {
  168. $params = $app->request()->params();
  169. render('photo', array(
  170. 'title' => 'New Photo',
  171. 'note_content' => '',
  172. 'authorizing' => false
  173. ));
  174. }
  175. });
  176. $app->get('/review', function() use($app) {
  177. if($user=require_login($app)) {
  178. $params = $app->request()->params();
  179. render('review', array(
  180. 'title' => 'Review',
  181. 'authorizing' => false
  182. ));
  183. }
  184. });
  185. $app->get('/repost', function() use($app) {
  186. if($user=require_login($app)) {
  187. $params = $app->request()->params();
  188. $url = '';
  189. if(array_key_exists('url', $params))
  190. $url = $params['url'];
  191. render('new-repost', array(
  192. 'title' => 'New Repost',
  193. 'url' => $url,
  194. 'token' => generate_login_token(),
  195. 'authorizing' => false
  196. ));
  197. }
  198. });
  199. $app->post('/prefs', function() use($app) {
  200. if($user=require_login($app)) {
  201. $params = $app->request()->params();
  202. $user->location_enabled = $params['enabled'];
  203. $user->save();
  204. }
  205. $app->response()['Content-type'] = 'application/json';
  206. $app->response()->body(json_encode(array(
  207. 'result' => 'ok'
  208. )));
  209. });
  210. $app->post('/prefs/timezone', function() use($app) {
  211. // Called when the interface finds the user's location.
  212. // Look up the timezone for this location and store it as their default.
  213. $timezone = false;
  214. if($user=require_login($app)) {
  215. $params = $app->request()->params();
  216. $timezone = p3k\Timezone::timezone_for_location($params['latitude'], $params['longitude']);
  217. if($timezone) {
  218. $user->default_timezone = $timezone;
  219. $user->save();
  220. }
  221. }
  222. $app->response()['Content-type'] = 'application/json';
  223. $app->response()->body(json_encode(array(
  224. 'result' => 'ok',
  225. 'timezone' => $timezone,
  226. )));
  227. });
  228. $app->get('/add-to-home', function() use($app) {
  229. $params = $app->request()->params();
  230. header("Cache-Control: no-cache, must-revalidate");
  231. if(array_key_exists('token', $params) && !session('add-to-home-started')) {
  232. unset($_SESSION['add-to-home-started']);
  233. // Verify the token and sign the user in
  234. try {
  235. $data = JWT::decode($params['token'], Config::$jwtSecret, array('HS256'));
  236. $_SESSION['user_id'] = $data->user_id;
  237. $_SESSION['me'] = $data->me;
  238. $app->redirect('/new', 302);
  239. } catch(DomainException $e) {
  240. header('X-Error: DomainException');
  241. $app->redirect('/', 302);
  242. } catch(UnexpectedValueException $e) {
  243. header('X-Error: UnexpectedValueException');
  244. $app->redirect('/', 302);
  245. }
  246. } else {
  247. if($user=require_login($app)) {
  248. if(array_key_exists('start', $params)) {
  249. $_SESSION['add-to-home-started'] = true;
  250. $token = JWT::encode(array(
  251. 'user_id' => $_SESSION['user_id'],
  252. 'me' => $_SESSION['me'],
  253. 'created_at' => time()
  254. ), Config::$jwtSecret);
  255. $app->redirect('/add-to-home?token='.$token, 302);
  256. } else {
  257. unset($_SESSION['add-to-home-started']);
  258. render('add-to-home', array('title' => 'Quill'));
  259. }
  260. }
  261. }
  262. });
  263. $app->get('/email', function() use($app) {
  264. if($user=require_login($app)) {
  265. $test_response = '';
  266. if($user->last_micropub_response) {
  267. try {
  268. if(@json_decode($user->last_micropub_response)) {
  269. $d = json_decode($user->last_micropub_response);
  270. $test_response = $d->response;
  271. }
  272. } catch(Exception $e) {
  273. }
  274. }
  275. if(!$user->email_username) {
  276. $host = parse_url($user->url, PHP_URL_HOST);
  277. $user->email_username = $host . '.' . rand(100000,999999);
  278. $user->save();
  279. }
  280. render('email', array(
  281. 'title' => 'Post-by-Email',
  282. 'micropub_endpoint' => $user->micropub_endpoint,
  283. 'test_response' => $test_response,
  284. 'user' => $user
  285. ));
  286. }
  287. });
  288. $app->get('/settings', function() use($app) {
  289. if($user=require_login($app)) {
  290. render('settings', [
  291. 'title' => 'Settings',
  292. 'user' => $user,
  293. 'authorizing' => false
  294. ]);
  295. }
  296. });
  297. $app->post('/settings/save', function() use($app) {
  298. if($user=require_login($app)) {
  299. $params = $app->request()->params();
  300. if(array_key_exists('html_content', $params))
  301. $user->micropub_optin_html_content = $params['html_content'] ? 1 : 0;
  302. if(array_key_exists('slug_field', $params) && $params['slug_field'])
  303. $user->micropub_slug_field = $params['slug_field'];
  304. if(array_key_exists('syndicate_field', $params) && $params['syndicate_field']) {
  305. if(in_array($params['syndicate_field'], ['syndicate-to','mp-syndicate-to']))
  306. $user->micropub_syndicate_field = $params['syndicate_field'];
  307. }
  308. $user->save();
  309. $app->response()['Content-type'] = 'application/json';
  310. $app->response()->body(json_encode(array(
  311. 'result' => 'ok'
  312. )));
  313. }
  314. });
  315. $app->post('/settings/html-content', function() use($app) {
  316. if($user=require_login($app)) {
  317. $params = $app->request()->params();
  318. $user->micropub_optin_html_content = $params['html'] ? 1 : 0;
  319. $user->save();
  320. $app->response()['Content-type'] = 'application/json';
  321. $app->response()->body(json_encode(array(
  322. 'html' => $user->micropub_optin_html_content
  323. )));
  324. }
  325. });
  326. $app->get('/settings/html-content', function() use($app) {
  327. if($user=require_login($app)) {
  328. $app->response()['Content-type'] = 'application/json';
  329. $app->response()->body(json_encode(array(
  330. 'html' => $user->micropub_optin_html_content
  331. )));
  332. }
  333. });
  334. function create_favorite(&$user, $url) {
  335. $micropub_request = array(
  336. 'like-of' => $url
  337. );
  338. $r = micropub_post_for_user($user, $micropub_request);
  339. $tweet_id = false;
  340. // POSSE favorites to Twitter
  341. if($user->twitter_access_token && preg_match('/https?:\/\/(?:www\.)?twitter\.com\/[^\/]+\/status(?:es)?\/(\d+)/', $url, $match)) {
  342. $tweet_id = $match[1];
  343. $twitter = new TwitterOAuth(Config::$twitterClientID, Config::$twitterClientSecret,
  344. $user->twitter_access_token, $user->twitter_token_secret);
  345. $result = $twitter->post('favorites/create', array(
  346. 'id' => $tweet_id
  347. ));
  348. }
  349. return $r;
  350. }
  351. function edit_favorite(&$user, $post_url, $like_of) {
  352. $micropub_request = [
  353. 'action' => 'update',
  354. 'url' => $post_url,
  355. 'replace' => [
  356. 'like-of' => $like_of
  357. ]
  358. ];
  359. $r = micropub_post_for_user($user, $micropub_request, null, true);
  360. return $r;
  361. }
  362. function create_repost(&$user, $url) {
  363. $micropub_request = array(
  364. 'repost-of' => $url
  365. );
  366. $r = micropub_post_for_user($user, $micropub_request);
  367. $tweet_id = false;
  368. if($user->twitter_access_token && preg_match('/https?:\/\/(?:www\.)?twitter\.com\/[^\/]+\/status(?:es)?\/(\d+)/', $url, $match)) {
  369. $tweet_id = $match[1];
  370. $twitter = new TwitterOAuth(Config::$twitterClientID, Config::$twitterClientSecret,
  371. $user->twitter_access_token, $user->twitter_token_secret);
  372. $result = $twitter->post('statuses/retweet/'.$tweet_id);
  373. }
  374. return $r;
  375. }
  376. $app->post('/favorite', function() use($app) {
  377. if($user=require_login($app)) {
  378. $params = $app->request()->params();
  379. if(isset($params['edit'])) {
  380. $r = edit_favorite($user, $params['edit'], $params['like_of']);
  381. if(isset($r['location']) && $r['location'])
  382. $location = $r['location'];
  383. else
  384. $location = $params['edit'];
  385. } else {
  386. $r = create_favorite($user, $params['like_of']);
  387. $location = $r['location'];
  388. }
  389. $app->response()['Content-type'] = 'application/json';
  390. $app->response()->body(json_encode(array(
  391. 'location' => $location,
  392. 'error' => $r['error']
  393. )));
  394. }
  395. });
  396. $app->post('/repost', function() use($app) {
  397. if($user=require_login($app)) {
  398. $params = $app->request()->params();
  399. $r = create_repost($user, $params['url']);
  400. $app->response()['Content-type'] = 'application/json';
  401. $app->response()->body(json_encode(array(
  402. 'location' => $r['location'],
  403. 'error' => $r['error']
  404. )));
  405. }
  406. });
  407. $app->get('/reply/preview', function() use($app) {
  408. if($user=require_login($app)) {
  409. $params = $app->request()->params();
  410. if(!isset($params['url']) || !$params['url']) {
  411. return '';
  412. }
  413. $reply_url = trim($params['url']);
  414. if(preg_match('/twtr\.io\/([0-9a-z]+)/i', $reply_url, $match)) {
  415. $twtr = 'https://twitter.com/_/status/' . sxg_to_num($match[1]);
  416. $ch = curl_init($twtr);
  417. curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  418. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
  419. curl_exec($ch);
  420. $expanded_url = curl_getinfo($ch, CURLINFO_EFFECTIVE_URL);
  421. if($expanded_url) $reply_url = $expanded_url;
  422. }
  423. $entry = false;
  424. $xray = [
  425. 'url' => $reply_url
  426. ];
  427. if(preg_match('/twitter\.com\/(?:[^\/]+)\/statuse?s?\/(.+)/', $reply_url, $match)) {
  428. if($user->twitter_access_token) {
  429. $xray['twitter_api_key'] = Config::$twitterClientID;
  430. $xray['twitter_api_secret'] = Config::$twitterClientSecret;
  431. $xray['twitter_access_token'] = $user->twitter_access_token;
  432. $xray['twitter_access_token_secret'] = $user->twitter_token_secret;
  433. }
  434. }
  435. // Pass to X-Ray to see if it can expand the entry
  436. $ch = curl_init('https://xray.p3k.io/parse');
  437. curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  438. curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($xray));
  439. $response = curl_exec($ch);
  440. $data = @json_decode($response, true);
  441. if($data && isset($data['data']) && $data['data']['type'] == 'entry') {
  442. $entry = $data['data'];
  443. // Create a nickname based on the author URL
  444. if(array_key_exists('author', $entry)) {
  445. if($entry['author']['url']) {
  446. if(!isset($entry['author']['nickname']) || !$entry['author']['nickname'])
  447. $entry['author']['nickname'] = display_url($entry['author']['url']);
  448. }
  449. }
  450. }
  451. $mentions = [];
  452. if($entry) {
  453. if(array_key_exists('author', $entry)) {
  454. // Find all @-names in the post, as well as the author name
  455. $mentions[] = strtolower($entry['author']['nickname']);
  456. }
  457. if(preg_match_all('/(^|(?<=[\s\/]))@([a-z0-9_]+([a-z0-9_\.]*)?)/i', $entry['content']['text'], $matches)) {
  458. foreach($matches[0] as $nick) {
  459. if(trim($nick,'@') != $user->twitter_username && trim($nick,'@') != display_url($user->url))
  460. $mentions[] = strtolower(trim($nick,'@'));
  461. }
  462. }
  463. $mentions = array_values(array_unique($mentions));
  464. }
  465. $app->response()['Content-type'] = 'application/json';
  466. $app->response()->body(json_encode([
  467. 'canonical_reply_url' => $reply_url,
  468. 'entry' => $entry,
  469. 'mentions' => $mentions
  470. ]));
  471. }
  472. });
  473. $app->get('/edit', function() use($app) {
  474. if($user=require_login($app)) {
  475. $params = $app->request()->params();
  476. if(!isset($params['url']) || !$params['url']) {
  477. $app->response()->body('no URL specified');
  478. }
  479. // Query the micropub endpoint for the source properties
  480. $source = micropub_get($user->micropub_endpoint, [
  481. 'q' => 'source',
  482. 'url' => $params['url']
  483. ], $user->micropub_access_token);
  484. $data = $source['data'];
  485. if(array_key_exists('error', $data)) {
  486. render('edit/error', [
  487. 'title' => 'Error',
  488. 'summary' => 'Your Micropub endpoint returned an error:',
  489. 'error' => $data['error'],
  490. 'error_description' => $data['error_description']
  491. ]);
  492. return;
  493. }
  494. if(!array_key_exists('properties', $data) || !array_key_exists('type', $data)) {
  495. render('edit/error', [
  496. 'title' => 'Error',
  497. 'summary' => '',
  498. 'error' => 'Invalid Response',
  499. 'error_description' => 'Your endpoint did not return "properties" and "type" in the response.'
  500. ]);
  501. return;
  502. }
  503. // Start checking for content types
  504. $type = $data['type'][0];
  505. $error = false;
  506. $url = false;
  507. if($type == 'h-review') {
  508. $url = '/review';
  509. } elseif($type == 'h-event') {
  510. $url = '/event';
  511. } elseif($type != 'h-entry') {
  512. $error = 'This type of post is not supported by any of Quill\'s editing interfaces. Type: '.$type;
  513. } else {
  514. if(array_key_exists('bookmark-of', $data['properties'])) {
  515. $url = '/bookmark';
  516. } elseif(array_key_exists('like-of', $data['properties'])) {
  517. $url = '/favorite';
  518. } elseif(array_key_exists('repost-of', $data['properties'])) {
  519. $url = '/repost';
  520. }
  521. }
  522. if($error) {
  523. render('edit/error', [
  524. 'title' => 'Error',
  525. 'summary' => '',
  526. 'error' => 'There was a problem!',
  527. 'error_description' => $error
  528. ]);
  529. return;
  530. }
  531. // Until all interfaces are complete, show an error here for unsupported ones
  532. if(!in_array($url, ['/favorite',])) {
  533. render('edit/error', [
  534. 'title' => 'Not Yet Supported',
  535. 'summary' => '',
  536. 'error' => 'Not Yet Supported',
  537. 'error_description' => 'Editing is not yet supported for this type of post.'
  538. ]);
  539. return;
  540. }
  541. $app->redirect($url . '?edit=' . $params['url'], 302);
  542. }
  543. });