You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

637 lines
18 KiB

7 years ago
7 years ago
7 years ago
7 years ago
7 years ago
  1. <?php
  2. function require_login(&$app, $redirect=true) {
  3. $params = $app->request()->params();
  4. if(array_key_exists('token', $params)) {
  5. try {
  6. $data = JWT::decode($params['token'], Config::$jwtSecret, array('HS256'));
  7. $_SESSION['user_id'] = $data->user_id;
  8. $_SESSION['me'] = $data->me;
  9. } catch(DomainException $e) {
  10. if($redirect) {
  11. header('X-Error: DomainException');
  12. $app->redirect('/', 301);
  13. } else {
  14. return false;
  15. }
  16. } catch(UnexpectedValueException $e) {
  17. if($redirect) {
  18. header('X-Error: UnexpectedValueException');
  19. $app->redirect('/', 301);
  20. } else {
  21. return false;
  22. }
  23. }
  24. }
  25. if(!array_key_exists('user_id', $_SESSION)) {
  26. if($redirect)
  27. $app->redirect('/');
  28. return false;
  29. } else {
  30. return ORM::for_table('users')->find_one($_SESSION['user_id']);
  31. }
  32. }
  33. function generate_login_token() {
  34. return JWT::encode(array(
  35. 'user_id' => $_SESSION['user_id'],
  36. 'me' => $_SESSION['me'],
  37. 'created_at' => time()
  38. ), Config::$jwtSecret);
  39. }
  40. $app->get('/new', function() use($app) {
  41. if($user=require_login($app)) {
  42. $params = $app->request()->params();
  43. $entry = false;
  44. $photo_url = false;
  45. $in_reply_to = '';
  46. if(array_key_exists('reply', $params))
  47. $in_reply_to = $params['reply'];
  48. $test_response = '';
  49. if($user->last_micropub_response) {
  50. try {
  51. if(@json_decode($user->last_micropub_response)) {
  52. $d = json_decode($user->last_micropub_response);
  53. $test_response = $d->response;
  54. }
  55. } catch(Exception $e) {
  56. }
  57. }
  58. $html = render('new-post', array(
  59. 'title' => 'New Post',
  60. 'in_reply_to' => $in_reply_to,
  61. 'micropub_endpoint' => $user->micropub_endpoint,
  62. 'micropub_scope' => $user->micropub_scope,
  63. 'micropub_access_token' => $user->micropub_access_token,
  64. 'response_date' => $user->last_micropub_response_date,
  65. 'syndication_targets' => json_decode($user->syndication_targets, true),
  66. 'test_response' => $test_response,
  67. 'location_enabled' => $user->location_enabled,
  68. 'authorizing' => false
  69. ));
  70. $app->response()->body($html);
  71. }
  72. });
  73. $app->get('/bookmark', function() use($app) {
  74. if($user=require_login($app)) {
  75. $params = $app->request()->params();
  76. $url = '';
  77. $name = '';
  78. $content = '';
  79. $tags = '';
  80. if(array_key_exists('url', $params))
  81. $url = $params['url'];
  82. if(array_key_exists('name', $params))
  83. $name = $params['name'];
  84. if(array_key_exists('content', $params))
  85. $content = $params['content'];
  86. $html = render('new-bookmark', array(
  87. 'title' => 'New Bookmark',
  88. 'bookmark_url' => $url,
  89. 'bookmark_name' => $name,
  90. 'bookmark_content' => $content,
  91. 'bookmark_tags' => $tags,
  92. 'token' => generate_login_token(),
  93. 'syndication_targets' => json_decode($user->syndication_targets, true),
  94. 'authorizing' => false
  95. ));
  96. $app->response()->body($html);
  97. }
  98. });
  99. $app->get('/favorite', function() use($app) {
  100. if($user=require_login($app)) {
  101. $params = $app->request()->params();
  102. $url = '';
  103. if(array_key_exists('url', $params))
  104. $url = $params['url'];
  105. $html = render('new-favorite', array(
  106. 'title' => 'New Favorite',
  107. 'url' => $url,
  108. 'token' => generate_login_token(),
  109. 'authorizing' => false
  110. ));
  111. $app->response()->body($html);
  112. }
  113. });
  114. $app->get('/photo', function() use($app) {
  115. if($user=require_login($app)) {
  116. $params = $app->request()->params();
  117. $html = render('photo', array(
  118. 'title' => 'New Photo',
  119. 'note_content' => '',
  120. 'authorizing' => false
  121. ));
  122. $app->response()->body($html);
  123. }
  124. });
  125. $app->get('/repost', function() use($app) {
  126. if($user=require_login($app)) {
  127. $params = $app->request()->params();
  128. $url = '';
  129. if(array_key_exists('url', $params))
  130. $url = $params['url'];
  131. $html = render('new-repost', array(
  132. 'title' => 'New Repost',
  133. 'url' => $url,
  134. 'token' => generate_login_token(),
  135. 'authorizing' => false
  136. ));
  137. $app->response()->body($html);
  138. }
  139. });
  140. $app->post('/prefs', function() use($app) {
  141. if($user=require_login($app)) {
  142. $params = $app->request()->params();
  143. $user->location_enabled = $params['enabled'];
  144. $user->save();
  145. }
  146. $app->response()->body(json_encode(array(
  147. 'result' => 'ok'
  148. )));
  149. });
  150. $app->get('/creating-a-token-endpoint', function() use($app) {
  151. $app->redirect('http://indiewebcamp.com/token-endpoint', 301);
  152. });
  153. $app->get('/creating-a-micropub-endpoint', function() use($app) {
  154. $html = render('creating-a-micropub-endpoint', array('title' => 'Creating a Micropub Endpoint', 'authorizing' => false));
  155. $app->response()->body($html);
  156. });
  157. $app->get('/docs', function() use($app) {
  158. $html = render('docs', array('title' => 'Documentation', 'authorizing' => false));
  159. $app->response()->body($html);
  160. });
  161. $app->get('/privacy', function() use($app) {
  162. $html = render('privacy', array('title' => 'Quill Privacy Policy', 'authorizing' => false));
  163. $app->response()->body($html);
  164. });
  165. $app->get('/add-to-home', function() use($app) {
  166. $params = $app->request()->params();
  167. header("Cache-Control: no-cache, must-revalidate");
  168. if(array_key_exists('token', $params) && !session('add-to-home-started')) {
  169. unset($_SESSION['add-to-home-started']);
  170. // Verify the token and sign the user in
  171. try {
  172. $data = JWT::decode($params['token'], Config::$jwtSecret, array('HS256'));
  173. $_SESSION['user_id'] = $data->user_id;
  174. $_SESSION['me'] = $data->me;
  175. $app->redirect('/new', 301);
  176. } catch(DomainException $e) {
  177. header('X-Error: DomainException');
  178. $app->redirect('/', 301);
  179. } catch(UnexpectedValueException $e) {
  180. header('X-Error: UnexpectedValueException');
  181. $app->redirect('/', 301);
  182. }
  183. } else {
  184. if($user=require_login($app)) {
  185. if(array_key_exists('start', $params)) {
  186. $_SESSION['add-to-home-started'] = true;
  187. $token = JWT::encode(array(
  188. 'user_id' => $_SESSION['user_id'],
  189. 'me' => $_SESSION['me'],
  190. 'created_at' => time()
  191. ), Config::$jwtSecret);
  192. $app->redirect('/add-to-home?token='.$token, 301);
  193. } else {
  194. unset($_SESSION['add-to-home-started']);
  195. $html = render('add-to-home', array('title' => 'Quill'));
  196. $app->response()->body($html);
  197. }
  198. }
  199. }
  200. });
  201. $app->get('/email', function() use($app) {
  202. if($user=require_login($app)) {
  203. $test_response = '';
  204. if($user->last_micropub_response) {
  205. try {
  206. if(@json_decode($user->last_micropub_response)) {
  207. $d = json_decode($user->last_micropub_response);
  208. $test_response = $d->response;
  209. }
  210. } catch(Exception $e) {
  211. }
  212. }
  213. if(!$user->email_username) {
  214. $host = parse_url($user->url, PHP_URL_HOST);
  215. $user->email_username = $host . '.' . rand(100000,999999);
  216. $user->save();
  217. }
  218. $html = render('email', array(
  219. 'title' => 'Post-by-Email',
  220. 'micropub_endpoint' => $user->micropub_endpoint,
  221. 'test_response' => $test_response,
  222. 'user' => $user
  223. ));
  224. $app->response()->body($html);
  225. }
  226. });
  227. $app->get('/settings', function() use($app) {
  228. if($user=require_login($app)) {
  229. $html = render('settings', array('title' => 'Settings', 'include_facebook' => true, 'authorizing' => false));
  230. $app->response()->body($html);
  231. }
  232. });
  233. $app->post('/settings/html-content', function() use($app) {
  234. if($user=require_login($app)) {
  235. $params = $app->request()->params();
  236. $user->micropub_optin_html_content = $params['html'] ? 1 : 0;
  237. $user->save();
  238. $app->response()->body(json_encode(array(
  239. 'html' => $user->micropub_optin_html_content
  240. )));
  241. }
  242. });
  243. $app->get('/settings/html-content', function() use($app) {
  244. if($user=require_login($app)) {
  245. $app->response()->body(json_encode(array(
  246. 'html' => $user->micropub_optin_html_content
  247. )));
  248. }
  249. });
  250. $app->get('/favorite-popup', function() use($app) {
  251. if($user=require_login($app)) {
  252. $params = $app->request()->params();
  253. $html = $app->render('favorite-popup.php', array(
  254. 'url' => $params['url'],
  255. 'token' => $params['token']
  256. ));
  257. $app->response()->body($html);
  258. }
  259. });
  260. function create_favorite(&$user, $url) {
  261. $micropub_request = array(
  262. 'like-of' => $url
  263. );
  264. $r = micropub_post_for_user($user, $micropub_request);
  265. $facebook_id = false;
  266. $instagram_id = false;
  267. $tweet_id = false;
  268. /*
  269. // Facebook likes are posted via Javascript, so pass the FB ID to the javascript code
  270. if(preg_match('/https?:\/\/(?:www\.)?facebook\.com\/(?:[^\/]+)\/posts\/(\d+)/', $url, $match)) {
  271. $facebook_id = $match[1];
  272. }
  273. if(preg_match('/https?:\/\/(?:www\.)?facebook\.com\/photo\.php\?fbid=(\d+)/', $url, $match)) {
  274. $facebook_id = $match[1];
  275. }
  276. */
  277. if(preg_match('/https?:\/\/(?:www\.)?instagram\.com\/p\/([^\/]+)/', $url, $match)) {
  278. $instagram_id = $match[1];
  279. if($user->instagram_access_token) {
  280. $instagram = instagram_client();
  281. $instagram->setAccessToken($user->instagram_access_token);
  282. $ch = curl_init('https://api.instagram.com/v1/media/shortcode/' . $instagram_id . '?access_token=' . $user->instagram_access_token);
  283. curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  284. $result = json_decode(curl_exec($ch));
  285. $result = $instagram->likeMedia($result->data->id);
  286. } else {
  287. // TODO: indicate that the instagram post couldn't be liked because no access token was available
  288. }
  289. }
  290. if($user->twitter_access_token && preg_match('/https?:\/\/(?:www\.)?twitter\.com\/[^\/]+\/status(?:es)?\/(\d+)/', $url, $match)) {
  291. $tweet_id = $match[1];
  292. $twitter = new \TwitterOAuth\Api(Config::$twitterClientID, Config::$twitterClientSecret,
  293. $user->twitter_access_token, $user->twitter_token_secret);
  294. $result = $twitter->post('favorites/create', array(
  295. 'id' => $tweet_id
  296. ));
  297. }
  298. return $r;
  299. }
  300. function create_photo(&$user, $params, $file) {
  301. $error = validate_photo($file);
  302. if(!$error) {
  303. $file_path = $file['tmp_name'];
  304. $micropub_request = array('content' => $params['note_content']);
  305. $r = micropub_post_for_user($user, $micropub_request, $file_path);
  306. } else {
  307. $r = array('error' => $error);
  308. }
  309. return $r;
  310. }
  311. function create_repost(&$user, $url) {
  312. $micropub_request = array(
  313. 'repost-of' => $url
  314. );
  315. $r = micropub_post_for_user($user, $micropub_request);
  316. $tweet_id = false;
  317. if($user->twitter_access_token && preg_match('/https?:\/\/(?:www\.)?twitter\.com\/[^\/]+\/status(?:es)?\/(\d+)/', $url, $match)) {
  318. $tweet_id = $match[1];
  319. $twitter = new \TwitterOAuth\Api(Config::$twitterClientID, Config::$twitterClientSecret,
  320. $user->twitter_access_token, $user->twitter_token_secret);
  321. $result = $twitter->post('statuses/retweet/'.$tweet_id);
  322. }
  323. return $r;
  324. }
  325. $app->get('/favorite.js', function() use($app) {
  326. $app->response()->header("Content-type", "text/javascript");
  327. if($user=require_login($app, false)) {
  328. $params = $app->request()->params();
  329. if(array_key_exists('url', $params)) {
  330. $r = create_favorite($user, $params['url']);
  331. $app->response()->body($app->render('favorite-js.php', array(
  332. 'url' => $params['url'],
  333. 'like_url' => $r['location'],
  334. 'error' => $r['error'],
  335. // 'facebook_id' => $facebook_id
  336. )));
  337. } else {
  338. $app->response()->body('alert("no url");');
  339. }
  340. } else {
  341. $app->response()->body('alert("invalid token");');
  342. }
  343. });
  344. $app->post('/favorite', function() use($app) {
  345. if($user=require_login($app)) {
  346. $params = $app->request()->params();
  347. $r = create_favorite($user, $params['url']);
  348. $app->response()->body(json_encode(array(
  349. 'location' => $r['location'],
  350. 'error' => $r['error']
  351. )));
  352. }
  353. });
  354. $app->post('/photo', function() use($app) {
  355. if($user=require_login($app)) {
  356. // var_dump($app->request()->post());
  357. //
  358. // Since $app->request()->post() with multipart is always
  359. // empty (bug in Slim?) We're using the raw $_POST here
  360. // until this gets fixed.
  361. // PHP empties everything in $_POST if the file upload size exceeds
  362. // that is why we have to test if the variables exist first.
  363. $note_content = isset($_POST['note_content']) ? $_POST['note_content'] : null;
  364. $params = array('note_content' => $note_content);
  365. $file = isset($_FILES['note_photo']) ? $_FILES['note_photo'] : null;
  366. $r = create_photo($user, $params, $file);
  367. // Populate the error if there was no location header.
  368. if(empty($r['location']) && empty($r['error'])) {
  369. $r['error'] = "No 'Location' header in response.";
  370. }
  371. $html = render('photo', array(
  372. 'title' => 'Photo posted',
  373. 'note_content' => $params['note_content'],
  374. 'location' => (isset($r['location']) ? $r['location'] : null),
  375. 'error' => (isset($r['error']) ? $r['error'] : null),
  376. 'response' => (isset($r['response']) ? htmlspecialchars($r['response']) : null),
  377. 'authorizing' => false
  378. ));
  379. $app->response()->body($html);
  380. }
  381. });
  382. $app->post('/repost', function() use($app) {
  383. if($user=require_login($app)) {
  384. $params = $app->request()->params();
  385. $r = create_repost($user, $params['url']);
  386. $app->response()->body(json_encode(array(
  387. 'location' => $r['location'],
  388. 'error' => $r['error']
  389. )));
  390. }
  391. });
  392. $app->get('/micropub/syndications', function() use($app) {
  393. if($user=require_login($app)) {
  394. $data = get_syndication_targets($user);
  395. $app->response()->body(json_encode(array(
  396. 'targets' => $data['targets'],
  397. 'response' => $data['response']
  398. )));
  399. }
  400. });
  401. $app->post('/micropub/post', function() use($app) {
  402. if($user=require_login($app)) {
  403. $params = $app->request()->params();
  404. // Remove any blank params
  405. $params = array_filter($params, function($v){
  406. return $v !== '';
  407. });
  408. $r = micropub_post_for_user($user, $params);
  409. $app->response()->body(json_encode(array(
  410. 'request' => htmlspecialchars($r['request']),
  411. 'response' => htmlspecialchars($r['response']),
  412. 'location' => $r['location'],
  413. 'error' => $r['error'],
  414. 'curlinfo' => $r['curlinfo']
  415. )));
  416. }
  417. });
  418. /*
  419. $app->post('/auth/facebook', function() use($app) {
  420. if($user=require_login($app, false)) {
  421. $params = $app->request()->params();
  422. // User just auth'd with facebook, store the access token
  423. $user->facebook_access_token = $params['fb_token'];
  424. $user->save();
  425. $app->response()->body(json_encode(array(
  426. 'result' => 'ok'
  427. )));
  428. } else {
  429. $app->response()->body(json_encode(array(
  430. 'result' => 'error'
  431. )));
  432. }
  433. });
  434. */
  435. $app->post('/auth/twitter', function() use($app) {
  436. if($user=require_login($app, false)) {
  437. $params = $app->request()->params();
  438. // User just auth'd with twitter, store the access token
  439. $user->twitter_access_token = $params['twitter_token'];
  440. $user->twitter_token_secret = $params['twitter_secret'];
  441. $user->save();
  442. $app->response()->body(json_encode(array(
  443. 'result' => 'ok'
  444. )));
  445. } else {
  446. $app->response()->body(json_encode(array(
  447. 'result' => 'error'
  448. )));
  449. }
  450. });
  451. function getTwitterLoginURL(&$twitter) {
  452. $request_token = $twitter->getRequestToken(Config::$base_url . 'auth/twitter/callback');
  453. $_SESSION['twitter_auth'] = $request_token;
  454. return $twitter->getAuthorizeURL($request_token['oauth_token']);
  455. }
  456. $app->get('/auth/twitter', function() use($app) {
  457. $params = $app->request()->params();
  458. if($user=require_login($app, false)) {
  459. // If there is an existing Twitter token, check if it is valid
  460. // Otherwise, generate a Twitter login link
  461. $twitter_login_url = false;
  462. $twitter = new \TwitterOAuth\Api(Config::$twitterClientID, Config::$twitterClientSecret,
  463. $user->twitter_access_token, $user->twitter_token_secret);
  464. if(array_key_exists('login', $params)) {
  465. $twitter = new \TwitterOAuth\Api(Config::$twitterClientID, Config::$twitterClientSecret);
  466. $twitter_login_url = getTwitterLoginURL($twitter);
  467. } else {
  468. if($user->twitter_access_token) {
  469. if ($twitter->get('account/verify_credentials')) {
  470. $app->response()->body(json_encode(array(
  471. 'result' => 'ok'
  472. )));
  473. return;
  474. } else {
  475. // If the existing twitter token is not valid, generate a login link
  476. $twitter_login_url = getTwitterLoginURL($twitter);
  477. }
  478. } else {
  479. $twitter_login_url = getTwitterLoginURL($twitter);
  480. }
  481. }
  482. $app->response()->body(json_encode(array(
  483. 'url' => $twitter_login_url
  484. )));
  485. } else {
  486. $app->response()->body(json_encode(array(
  487. 'result' => 'error'
  488. )));
  489. }
  490. });
  491. $app->get('/auth/twitter/callback', function() use($app) {
  492. if($user=require_login($app)) {
  493. $params = $app->request()->params();
  494. $twitter = new \TwitterOAuth\Api(Config::$twitterClientID, Config::$twitterClientSecret,
  495. $_SESSION['twitter_auth']['oauth_token'], $_SESSION['twitter_auth']['oauth_token_secret']);
  496. $credentials = $twitter->getAccessToken($params['oauth_verifier']);
  497. $user->twitter_access_token = $credentials['oauth_token'];
  498. $user->twitter_token_secret = $credentials['oauth_token_secret'];
  499. $user->twitter_username = $credentials['screen_name'];
  500. $user->save();
  501. $app->redirect('/settings');
  502. }
  503. });
  504. $app->get('/auth/instagram', function() use($app) {
  505. if($user=require_login($app, false)) {
  506. $instagram = instagram_client();
  507. // If there is an existing Instagram auth token, check if it's valid
  508. if($user->instagram_access_token) {
  509. $instagram->setAccessToken($user->instagram_access_token);
  510. $igUser = $instagram->getUser();
  511. if($igUser && $igUser->meta->code == 200) {
  512. $app->response()->body(json_encode(array(
  513. 'result' => 'ok',
  514. 'username' => $igUser->data->username,
  515. 'url' => $instagram->getLoginUrl(array('basic','likes'))
  516. )));
  517. return;
  518. }
  519. }
  520. $app->response()->body(json_encode(array(
  521. 'result' => 'error',
  522. 'url' => $instagram->getLoginUrl(array('basic','likes'))
  523. )));
  524. }
  525. });
  526. $app->get('/auth/instagram/callback', function() use($app) {
  527. if($user=require_login($app)) {
  528. $params = $app->request()->params();
  529. $instagram = instagram_client();
  530. $data = $instagram->getOAuthToken($params['code']);
  531. $user->instagram_access_token = $data->access_token;
  532. $user->save();
  533. $app->redirect('/settings');
  534. }
  535. });