You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

521 lines
14 KiB

7 years ago
7 years ago
7 years ago
7 years ago
7 years ago
7 years ago
7 years ago
7 years ago
  1. <?php
  2. use Abraham\TwitterOAuth\TwitterOAuth;
  3. function require_login(&$app, $redirect=true) {
  4. $params = $app->request()->params();
  5. if(array_key_exists('token', $params)) {
  6. try {
  7. $data = JWT::decode($params['token'], Config::$jwtSecret, array('HS256'));
  8. $_SESSION['user_id'] = $data->user_id;
  9. $_SESSION['me'] = $data->me;
  10. } catch(DomainException $e) {
  11. if($redirect) {
  12. header('X-Error: DomainException');
  13. $app->redirect('/', 302);
  14. } else {
  15. return false;
  16. }
  17. } catch(UnexpectedValueException $e) {
  18. if($redirect) {
  19. header('X-Error: UnexpectedValueException');
  20. $app->redirect('/', 302);
  21. } else {
  22. return false;
  23. }
  24. }
  25. }
  26. if(!array_key_exists('user_id', $_SESSION)) {
  27. if($redirect)
  28. $app->redirect('/', 302);
  29. return false;
  30. } else {
  31. return ORM::for_table('users')->find_one($_SESSION['user_id']);
  32. }
  33. }
  34. function generate_login_token($opts=[]) {
  35. return JWT::encode(array_merge([
  36. 'user_id' => $_SESSION['user_id'],
  37. 'me' => $_SESSION['me'],
  38. 'created_at' => time()
  39. ], $opts), Config::$jwtSecret);
  40. }
  41. $app->get('/dashboard', function() use($app) {
  42. if($user=require_login($app)) {
  43. render('dashboard', array(
  44. 'title' => 'Dashboard',
  45. 'authorizing' => false
  46. ));
  47. }
  48. });
  49. $app->get('/new', function() use($app) {
  50. if($user=require_login($app)) {
  51. $params = $app->request()->params();
  52. $entry = false;
  53. $in_reply_to = '';
  54. if(array_key_exists('reply', $params))
  55. $in_reply_to = $params['reply'];
  56. $test_response = '';
  57. if($user->last_micropub_response) {
  58. try {
  59. if(@json_decode($user->last_micropub_response)) {
  60. $d = json_decode($user->last_micropub_response);
  61. $test_response = $d->response;
  62. }
  63. } catch(Exception $e) {
  64. }
  65. }
  66. render('new-post', array(
  67. 'title' => 'New Post',
  68. 'in_reply_to' => $in_reply_to,
  69. 'micropub_endpoint' => $user->micropub_endpoint,
  70. 'media_endpoint' => $user->micropub_media_endpoint,
  71. 'micropub_scope' => $user->micropub_scope,
  72. 'micropub_access_token' => $user->micropub_access_token,
  73. 'response_date' => $user->last_micropub_response_date,
  74. 'syndication_targets' => json_decode($user->syndication_targets, true),
  75. 'test_response' => $test_response,
  76. 'location_enabled' => $user->location_enabled,
  77. 'user' => $user,
  78. 'authorizing' => false
  79. ));
  80. }
  81. });
  82. $app->get('/bookmark', function() use($app) {
  83. if($user=require_login($app)) {
  84. $params = $app->request()->params();
  85. $url = '';
  86. $name = '';
  87. $content = '';
  88. $tags = '';
  89. if(array_key_exists('url', $params))
  90. $url = $params['url'];
  91. if(array_key_exists('name', $params))
  92. $name = $params['name'];
  93. if(array_key_exists('content', $params))
  94. $content = $params['content'];
  95. render('new-bookmark', array(
  96. 'title' => 'New Bookmark',
  97. 'bookmark_url' => $url,
  98. 'bookmark_name' => $name,
  99. 'bookmark_content' => $content,
  100. 'bookmark_tags' => $tags,
  101. 'token' => generate_login_token(),
  102. 'syndication_targets' => json_decode($user->syndication_targets, true),
  103. 'user' => $user,
  104. 'authorizing' => false
  105. ));
  106. }
  107. });
  108. $app->get('/favorite', function() use($app) {
  109. if($user=require_login($app)) {
  110. $params = $app->request()->params();
  111. $url = '';
  112. if(array_key_exists('url', $params))
  113. $url = $params['url'];
  114. // Check if there was a login token in the query string and whether it has autosubmit=true
  115. $autosubmit = false;
  116. if(array_key_exists('token', $params)) {
  117. try {
  118. $data = JWT::decode($params['token'], Config::$jwtSecret, ['HS256']);
  119. if(isset($data->autosubmit) && $data->autosubmit) {
  120. // Only allow this token to be used for the user who created it
  121. if($data->user_id == $_SESSION['user_id']) {
  122. $autosubmit = true;
  123. }
  124. }
  125. } catch(Exception $e) {
  126. }
  127. }
  128. render('new-favorite', array(
  129. 'title' => 'New Favorite',
  130. 'url' => $url,
  131. 'token' => generate_login_token(['autosubmit'=>true]),
  132. 'authorizing' => false,
  133. 'autosubmit' => $autosubmit
  134. ));
  135. }
  136. });
  137. $app->get('/event', function() use($app) {
  138. if($user=require_login($app)) {
  139. $params = $app->request()->params();
  140. render('event', array(
  141. 'title' => 'Event',
  142. 'authorizing' => false
  143. ));
  144. }
  145. });
  146. $app->get('/itinerary', function() use($app) {
  147. if($user=require_login($app)) {
  148. $params = $app->request()->params();
  149. render('new-itinerary', array(
  150. 'title' => 'Itinerary',
  151. 'authorizing' => false
  152. ));
  153. }
  154. });
  155. $app->get('/photo', function() use($app) {
  156. if($user=require_login($app)) {
  157. $params = $app->request()->params();
  158. render('photo', array(
  159. 'title' => 'New Photo',
  160. 'note_content' => '',
  161. 'authorizing' => false
  162. ));
  163. }
  164. });
  165. $app->get('/review', function() use($app) {
  166. if($user=require_login($app)) {
  167. $params = $app->request()->params();
  168. render('review', array(
  169. 'title' => 'Review',
  170. 'authorizing' => false
  171. ));
  172. }
  173. });
  174. $app->get('/repost', function() use($app) {
  175. if($user=require_login($app)) {
  176. $params = $app->request()->params();
  177. $url = '';
  178. if(array_key_exists('url', $params))
  179. $url = $params['url'];
  180. render('new-repost', array(
  181. 'title' => 'New Repost',
  182. 'url' => $url,
  183. 'token' => generate_login_token(),
  184. 'authorizing' => false
  185. ));
  186. }
  187. });
  188. $app->post('/prefs', function() use($app) {
  189. if($user=require_login($app)) {
  190. $params = $app->request()->params();
  191. $user->location_enabled = $params['enabled'];
  192. $user->save();
  193. }
  194. $app->response()['Content-type'] = 'application/json';
  195. $app->response()->body(json_encode(array(
  196. 'result' => 'ok'
  197. )));
  198. });
  199. $app->post('/prefs/timezone', function() use($app) {
  200. // Called when the interface finds the user's location.
  201. // Look up the timezone for this location and store it as their default.
  202. $timezone = false;
  203. if($user=require_login($app)) {
  204. $params = $app->request()->params();
  205. $timezone = p3k\Timezone::timezone_for_location($params['latitude'], $params['longitude']);
  206. if($timezone) {
  207. $user->default_timezone = $timezone;
  208. $user->save();
  209. }
  210. }
  211. $app->response()['Content-type'] = 'application/json';
  212. $app->response()->body(json_encode(array(
  213. 'result' => 'ok',
  214. 'timezone' => $timezone,
  215. )));
  216. });
  217. $app->get('/add-to-home', function() use($app) {
  218. $params = $app->request()->params();
  219. header("Cache-Control: no-cache, must-revalidate");
  220. if(array_key_exists('token', $params) && !session('add-to-home-started')) {
  221. unset($_SESSION['add-to-home-started']);
  222. // Verify the token and sign the user in
  223. try {
  224. $data = JWT::decode($params['token'], Config::$jwtSecret, array('HS256'));
  225. $_SESSION['user_id'] = $data->user_id;
  226. $_SESSION['me'] = $data->me;
  227. $app->redirect('/new', 302);
  228. } catch(DomainException $e) {
  229. header('X-Error: DomainException');
  230. $app->redirect('/', 302);
  231. } catch(UnexpectedValueException $e) {
  232. header('X-Error: UnexpectedValueException');
  233. $app->redirect('/', 302);
  234. }
  235. } else {
  236. if($user=require_login($app)) {
  237. if(array_key_exists('start', $params)) {
  238. $_SESSION['add-to-home-started'] = true;
  239. $token = JWT::encode(array(
  240. 'user_id' => $_SESSION['user_id'],
  241. 'me' => $_SESSION['me'],
  242. 'created_at' => time()
  243. ), Config::$jwtSecret);
  244. $app->redirect('/add-to-home?token='.$token, 302);
  245. } else {
  246. unset($_SESSION['add-to-home-started']);
  247. render('add-to-home', array('title' => 'Quill'));
  248. }
  249. }
  250. }
  251. });
  252. $app->get('/email', function() use($app) {
  253. if($user=require_login($app)) {
  254. $test_response = '';
  255. if($user->last_micropub_response) {
  256. try {
  257. if(@json_decode($user->last_micropub_response)) {
  258. $d = json_decode($user->last_micropub_response);
  259. $test_response = $d->response;
  260. }
  261. } catch(Exception $e) {
  262. }
  263. }
  264. if(!$user->email_username) {
  265. $host = parse_url($user->url, PHP_URL_HOST);
  266. $user->email_username = $host . '.' . rand(100000,999999);
  267. $user->save();
  268. }
  269. render('email', array(
  270. 'title' => 'Post-by-Email',
  271. 'micropub_endpoint' => $user->micropub_endpoint,
  272. 'test_response' => $test_response,
  273. 'user' => $user
  274. ));
  275. }
  276. });
  277. $app->get('/settings', function() use($app) {
  278. if($user=require_login($app)) {
  279. render('settings', [
  280. 'title' => 'Settings',
  281. 'user' => $user,
  282. 'authorizing' => false
  283. ]);
  284. }
  285. });
  286. $app->post('/settings/save', function() use($app) {
  287. if($user=require_login($app)) {
  288. $params = $app->request()->params();
  289. if(array_key_exists('html_content', $params))
  290. $user->micropub_optin_html_content = $params['html_content'] ? 1 : 0;
  291. if(array_key_exists('slug_field', $params) && $params['slug_field'])
  292. $user->micropub_slug_field = $params['slug_field'];
  293. if(array_key_exists('syndicate_field', $params) && $params['syndicate_field']) {
  294. if(in_array($params['syndicate_field'], ['syndicate-to','mp-syndicate-to']))
  295. $user->micropub_syndicate_field = $params['syndicate_field'];
  296. }
  297. $user->save();
  298. $app->response()['Content-type'] = 'application/json';
  299. $app->response()->body(json_encode(array(
  300. 'result' => 'ok'
  301. )));
  302. }
  303. });
  304. $app->post('/settings/html-content', function() use($app) {
  305. if($user=require_login($app)) {
  306. $params = $app->request()->params();
  307. $user->micropub_optin_html_content = $params['html'] ? 1 : 0;
  308. $user->save();
  309. $app->response()['Content-type'] = 'application/json';
  310. $app->response()->body(json_encode(array(
  311. 'html' => $user->micropub_optin_html_content
  312. )));
  313. }
  314. });
  315. $app->get('/settings/html-content', function() use($app) {
  316. if($user=require_login($app)) {
  317. $app->response()['Content-type'] = 'application/json';
  318. $app->response()->body(json_encode(array(
  319. 'html' => $user->micropub_optin_html_content
  320. )));
  321. }
  322. });
  323. function create_favorite(&$user, $url) {
  324. $micropub_request = array(
  325. 'like-of' => $url
  326. );
  327. $r = micropub_post_for_user($user, $micropub_request);
  328. $tweet_id = false;
  329. // POSSE favorites to Twitter
  330. if($user->twitter_access_token && preg_match('/https?:\/\/(?:www\.)?twitter\.com\/[^\/]+\/status(?:es)?\/(\d+)/', $url, $match)) {
  331. $tweet_id = $match[1];
  332. $twitter = new TwitterOAuth(Config::$twitterClientID, Config::$twitterClientSecret,
  333. $user->twitter_access_token, $user->twitter_token_secret);
  334. $result = $twitter->post('favorites/create', array(
  335. 'id' => $tweet_id
  336. ));
  337. }
  338. return $r;
  339. }
  340. function create_repost(&$user, $url) {
  341. $micropub_request = array(
  342. 'repost-of' => $url
  343. );
  344. $r = micropub_post_for_user($user, $micropub_request);
  345. $tweet_id = false;
  346. if($user->twitter_access_token && preg_match('/https?:\/\/(?:www\.)?twitter\.com\/[^\/]+\/status(?:es)?\/(\d+)/', $url, $match)) {
  347. $tweet_id = $match[1];
  348. $twitter = new TwitterOAuth(Config::$twitterClientID, Config::$twitterClientSecret,
  349. $user->twitter_access_token, $user->twitter_token_secret);
  350. $result = $twitter->post('statuses/retweet/'.$tweet_id);
  351. }
  352. return $r;
  353. }
  354. $app->post('/favorite', function() use($app) {
  355. if($user=require_login($app)) {
  356. $params = $app->request()->params();
  357. $r = create_favorite($user, $params['url']);
  358. $app->response()['Content-type'] = 'application/json';
  359. $app->response()->body(json_encode(array(
  360. 'location' => $r['location'],
  361. 'error' => $r['error']
  362. )));
  363. }
  364. });
  365. $app->post('/repost', function() use($app) {
  366. if($user=require_login($app)) {
  367. $params = $app->request()->params();
  368. $r = create_repost($user, $params['url']);
  369. $app->response()['Content-type'] = 'application/json';
  370. $app->response()->body(json_encode(array(
  371. 'location' => $r['location'],
  372. 'error' => $r['error']
  373. )));
  374. }
  375. });
  376. $app->get('/reply/preview', function() use($app) {
  377. if($user=require_login($app)) {
  378. $params = $app->request()->params();
  379. if(!isset($params['url']) || !$params['url']) {
  380. return '';
  381. }
  382. $reply_url = trim($params['url']);
  383. if(preg_match('/twtr\.io\/([0-9a-z]+)/i', $reply_url, $match)) {
  384. $twtr = 'https://twitter.com/_/status/' . sxg_to_num($match[1]);
  385. $ch = curl_init($twtr);
  386. curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  387. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
  388. curl_exec($ch);
  389. $expanded_url = curl_getinfo($ch, CURLINFO_EFFECTIVE_URL);
  390. if($expanded_url) $reply_url = $expanded_url;
  391. }
  392. $entry = false;
  393. $xray = [
  394. 'url' => $reply_url
  395. ];
  396. if(preg_match('/twitter\.com\/(?:[^\/]+)\/statuse?s?\/(.+)/', $reply_url, $match)) {
  397. if($user->twitter_access_token) {
  398. $xray['twitter_api_key'] = Config::$twitterClientID;
  399. $xray['twitter_api_secret'] = Config::$twitterClientSecret;
  400. $xray['twitter_access_token'] = $user->twitter_access_token;
  401. $xray['twitter_access_token_secret'] = $user->twitter_token_secret;
  402. }
  403. }
  404. // Pass to X-Ray to see if it can expand the entry
  405. $ch = curl_init('https://xray.p3k.io/parse');
  406. curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  407. curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($xray));
  408. $response = curl_exec($ch);
  409. $data = @json_decode($response, true);
  410. if($data && isset($data['data']) && $data['data']['type'] == 'entry') {
  411. $entry = $data['data'];
  412. // Create a nickname based on the author URL
  413. if(array_key_exists('author', $entry)) {
  414. if($entry['author']['url']) {
  415. if(!isset($entry['author']['nickname']) || !$entry['author']['nickname'])
  416. $entry['author']['nickname'] = display_url($entry['author']['url']);
  417. }
  418. }
  419. }
  420. $mentions = [];
  421. if($entry) {
  422. if(array_key_exists('author', $entry)) {
  423. // Find all @-names in the post, as well as the author name
  424. $mentions[] = strtolower($entry['author']['nickname']);
  425. }
  426. if(preg_match_all('/(^|(?<=[\s\/]))@([a-z0-9_]+([a-z0-9_\.]*)?)/i', $entry['content']['text'], $matches)) {
  427. foreach($matches[0] as $nick) {
  428. if(trim($nick,'@') != $user->twitter_username && trim($nick,'@') != display_url($user->url))
  429. $mentions[] = strtolower(trim($nick,'@'));
  430. }
  431. }
  432. $mentions = array_values(array_unique($mentions));
  433. }
  434. $app->response()['Content-type'] = 'application/json';
  435. $app->response()->body(json_encode([
  436. 'canonical_reply_url' => $reply_url,
  437. 'entry' => $entry,
  438. 'mentions' => $mentions
  439. ]));
  440. }
  441. });