You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

522 lines
15 KiB

9 years ago
9 years ago
9 years ago
9 years ago
  1. <?php
  2. function require_login(&$app, $redirect=true) {
  3. $params = $app->request()->params();
  4. if(array_key_exists('token', $params)) {
  5. try {
  6. $data = JWT::decode($params['token'], Config::$jwtSecret);
  7. $_SESSION['user_id'] = $data->user_id;
  8. $_SESSION['me'] = $data->me;
  9. } catch(DomainException $e) {
  10. if($redirect) {
  11. header('X-Error: DomainException');
  12. $app->redirect('/', 301);
  13. } else {
  14. return false;
  15. }
  16. } catch(UnexpectedValueException $e) {
  17. if($redirect) {
  18. header('X-Error: UnexpectedValueException');
  19. $app->redirect('/', 301);
  20. } else {
  21. return false;
  22. }
  23. }
  24. }
  25. if(!array_key_exists('user_id', $_SESSION)) {
  26. if($redirect)
  27. $app->redirect('/');
  28. return false;
  29. } else {
  30. return ORM::for_table('users')->find_one($_SESSION['user_id']);
  31. }
  32. }
  33. function generate_login_token() {
  34. return JWT::encode(array(
  35. 'user_id' => $_SESSION['user_id'],
  36. 'me' => $_SESSION['me'],
  37. 'created_at' => time()
  38. ), Config::$jwtSecret);
  39. }
  40. $app->get('/new', function() use($app) {
  41. if($user=require_login($app)) {
  42. $params = $app->request()->params();
  43. $entry = false;
  44. $photo_url = false;
  45. $in_reply_to = '';
  46. if(array_key_exists('reply', $params))
  47. $in_reply_to = $params['reply'];
  48. $test_response = '';
  49. if($user->last_micropub_response) {
  50. try {
  51. if(@json_decode($user->last_micropub_response)) {
  52. $d = json_decode($user->last_micropub_response);
  53. $test_response = $d->response;
  54. }
  55. } catch(Exception $e) {
  56. }
  57. }
  58. $html = render('new-post', array(
  59. 'title' => 'New Post',
  60. 'in_reply_to' => $in_reply_to,
  61. 'micropub_endpoint' => $user->micropub_endpoint,
  62. 'micropub_scope' => $user->micropub_scope,
  63. 'micropub_access_token' => $user->micropub_access_token,
  64. 'response_date' => $user->last_micropub_response_date,
  65. 'syndication_targets' => json_decode($user->syndication_targets, true),
  66. 'test_response' => $test_response,
  67. 'location_enabled' => $user->location_enabled
  68. ));
  69. $app->response()->body($html);
  70. }
  71. });
  72. $app->get('/bookmark', function() use($app) {
  73. if($user=require_login($app)) {
  74. $params = $app->request()->params();
  75. $url = '';
  76. $name = '';
  77. $content = '';
  78. $tags = '';
  79. if(array_key_exists('url', $params))
  80. $url = $params['url'];
  81. if(array_key_exists('name', $params))
  82. $name = $params['name'];
  83. if(array_key_exists('content', $params))
  84. $content = $params['content'];
  85. $html = render('new-bookmark', array(
  86. 'title' => 'New Bookmark',
  87. 'bookmark_url' => $url,
  88. 'bookmark_name' => $name,
  89. 'bookmark_content' => $content,
  90. 'bookmark_tags' => $tags,
  91. 'token' => generate_login_token(),
  92. 'syndication_targets' => json_decode($user->syndication_targets, true)
  93. ));
  94. $app->response()->body($html);
  95. }
  96. });
  97. $app->get('/favorite', function() use($app) {
  98. if($user=require_login($app)) {
  99. $params = $app->request()->params();
  100. $url = '';
  101. if(array_key_exists('url', $params))
  102. $url = $params['url'];
  103. $html = render('new-favorite', array(
  104. 'title' => 'New Favorite',
  105. 'url' => $url,
  106. 'token' => generate_login_token()
  107. ));
  108. $app->response()->body($html);
  109. }
  110. });
  111. $app->get('/repost', function() use($app) {
  112. if($user=require_login($app)) {
  113. $params = $app->request()->params();
  114. $url = '';
  115. if(array_key_exists('url', $params))
  116. $url = $params['url'];
  117. $html = render('new-repost', array(
  118. 'title' => 'New Repost',
  119. 'url' => $url,
  120. 'token' => generate_login_token()
  121. ));
  122. $app->response()->body($html);
  123. }
  124. });
  125. $app->post('/prefs', function() use($app) {
  126. if($user=require_login($app)) {
  127. $params = $app->request()->params();
  128. $user->location_enabled = $params['enabled'];
  129. $user->save();
  130. }
  131. $app->response()->body(json_encode(array(
  132. 'result' => 'ok'
  133. )));
  134. });
  135. $app->get('/creating-a-token-endpoint', function() use($app) {
  136. $app->redirect('http://indiewebcamp.com/token-endpoint', 301);
  137. });
  138. $app->get('/creating-a-micropub-endpoint', function() use($app) {
  139. $html = render('creating-a-micropub-endpoint', array('title' => 'Creating a Micropub Endpoint'));
  140. $app->response()->body($html);
  141. });
  142. $app->get('/docs', function() use($app) {
  143. $html = render('docs', array('title' => 'Documentation'));
  144. $app->response()->body($html);
  145. });
  146. $app->get('/privacy', function() use($app) {
  147. $html = render('privacy', array('title' => 'Quill Privacy Policy'));
  148. $app->response()->body($html);
  149. });
  150. $app->get('/add-to-home', function() use($app) {
  151. $params = $app->request()->params();
  152. if(array_key_exists('token', $params) && !session('add-to-home-started')) {
  153. // Verify the token and sign the user in
  154. try {
  155. $data = JWT::decode($params['token'], Config::$jwtSecret);
  156. $_SESSION['user_id'] = $data->user_id;
  157. $_SESSION['me'] = $data->me;
  158. $app->redirect('/new', 301);
  159. } catch(DomainException $e) {
  160. header('X-Error: DomainException');
  161. $app->redirect('/', 301);
  162. } catch(UnexpectedValueException $e) {
  163. header('X-Error: UnexpectedValueException');
  164. $app->redirect('/', 301);
  165. }
  166. } else {
  167. if($user=require_login($app)) {
  168. if(array_key_exists('start', $params)) {
  169. $_SESSION['add-to-home-started'] = true;
  170. $token = JWT::encode(array(
  171. 'user_id' => $_SESSION['user_id'],
  172. 'me' => $_SESSION['me'],
  173. 'created_at' => time()
  174. ), Config::$jwtSecret);
  175. $app->redirect('/add-to-home?token='.$token, 301);
  176. } else {
  177. unset($_SESSION['add-to-home-started']);
  178. $html = render('add-to-home', array('title' => 'Quill'));
  179. $app->response()->body($html);
  180. }
  181. }
  182. }
  183. });
  184. $app->get('/settings', function() use($app) {
  185. if($user=require_login($app)) {
  186. $html = render('settings', array('title' => 'Settings', 'include_facebook' => true));
  187. $app->response()->body($html);
  188. }
  189. });
  190. $app->get('/favorite-popup', function() use($app) {
  191. if($user=require_login($app)) {
  192. $params = $app->request()->params();
  193. $html = $app->render('favorite-popup.php', array(
  194. 'url' => $params['url'],
  195. 'token' => $params['token']
  196. ));
  197. $app->response()->body($html);
  198. }
  199. });
  200. function create_favorite(&$user, $url) {
  201. $micropub_request = array(
  202. 'like-of' => $url
  203. );
  204. $r = micropub_post_for_user($user, $micropub_request);
  205. $facebook_id = false;
  206. $instagram_id = false;
  207. $tweet_id = false;
  208. /*
  209. // Facebook likes are posted via Javascript, so pass the FB ID to the javascript code
  210. if(preg_match('/https?:\/\/(?:www\.)?facebook\.com\/(?:[^\/]+)\/posts\/(\d+)/', $url, $match)) {
  211. $facebook_id = $match[1];
  212. }
  213. if(preg_match('/https?:\/\/(?:www\.)?facebook\.com\/photo\.php\?fbid=(\d+)/', $url, $match)) {
  214. $facebook_id = $match[1];
  215. }
  216. */
  217. if(preg_match('/https?:\/\/(?:www\.)?instagram\.com\/p\/([^\/]+)/', $url, $match)) {
  218. $instagram_id = $match[1];
  219. if($user->instagram_access_token) {
  220. $instagram = instagram_client();
  221. $instagram->setAccessToken($user->instagram_access_token);
  222. $ch = curl_init('https://api.instagram.com/v1/media/shortcode/' . $instagram_id . '?access_token=' . $user->instagram_access_token);
  223. curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  224. $result = json_decode(curl_exec($ch));
  225. $result = $instagram->likeMedia($result->data->id);
  226. } else {
  227. // TODO: indicate that the instagram post couldn't be liked because no access token was available
  228. }
  229. }
  230. if($user->twitter_access_token && preg_match('/https?:\/\/(?:www\.)?twitter\.com\/[^\/]+\/status(?:es)?\/(\d+)/', $url, $match)) {
  231. $tweet_id = $match[1];
  232. $twitter = new \TwitterOAuth\Api(Config::$twitterClientID, Config::$twitterClientSecret,
  233. $user->twitter_access_token, $user->twitter_token_secret);
  234. $result = $twitter->post('favorites/create', array(
  235. 'id' => $tweet_id
  236. ));
  237. }
  238. return $r;
  239. }
  240. function create_repost(&$user, $url) {
  241. $micropub_request = array(
  242. 'repost-of' => $url
  243. );
  244. $r = micropub_post_for_user($user, $micropub_request);
  245. $tweet_id = false;
  246. if($user->twitter_access_token && preg_match('/https?:\/\/(?:www\.)?twitter\.com\/[^\/]+\/status(?:es)?\/(\d+)/', $url, $match)) {
  247. $tweet_id = $match[1];
  248. $twitter = new \TwitterOAuth\Api(Config::$twitterClientID, Config::$twitterClientSecret,
  249. $user->twitter_access_token, $user->twitter_token_secret);
  250. $result = $twitter->post('statuses/retweet/'.$tweet_id);
  251. }
  252. return $r;
  253. }
  254. $app->get('/favorite.js', function() use($app) {
  255. $app->response()->header("Content-type", "text/javascript");
  256. if($user=require_login($app, false)) {
  257. $params = $app->request()->params();
  258. if(array_key_exists('url', $params)) {
  259. $r = create_favorite($user, $params['url']);
  260. $app->response()->body($app->render('favorite-js.php', array(
  261. 'url' => $params['url'],
  262. 'like_url' => $r['location'],
  263. 'error' => $r['error'],
  264. // 'facebook_id' => $facebook_id
  265. )));
  266. } else {
  267. $app->response()->body('alert("no url");');
  268. }
  269. } else {
  270. $app->response()->body('alert("invalid token");');
  271. }
  272. });
  273. $app->post('/favorite', function() use($app) {
  274. if($user=require_login($app)) {
  275. $params = $app->request()->params();
  276. $r = create_favorite($user, $params['url']);
  277. $app->response()->body(json_encode(array(
  278. 'location' => $r['location'],
  279. 'error' => $r['error']
  280. )));
  281. }
  282. });
  283. $app->post('/repost', function() use($app) {
  284. if($user=require_login($app)) {
  285. $params = $app->request()->params();
  286. $r = create_repost($user, $params['url']);
  287. $app->response()->body(json_encode(array(
  288. 'location' => $r['location'],
  289. 'error' => $r['error']
  290. )));
  291. }
  292. });
  293. $app->get('/micropub/syndications', function() use($app) {
  294. if($user=require_login($app)) {
  295. $data = get_syndication_targets($user);
  296. $app->response()->body(json_encode(array(
  297. 'targets' => $data['targets'],
  298. 'response' => $data['response']
  299. )));
  300. }
  301. });
  302. $app->post('/micropub/post', function() use($app) {
  303. if($user=require_login($app)) {
  304. $params = $app->request()->params();
  305. // Remove any blank params
  306. $params = array_filter($params, function($v){
  307. return $v !== '';
  308. });
  309. $r = micropub_post_for_user($user, $params);
  310. $app->response()->body(json_encode(array(
  311. 'request' => htmlspecialchars($r['request']),
  312. 'response' => htmlspecialchars($r['response']),
  313. 'location' => $r['location'],
  314. 'error' => $r['error'],
  315. 'curlinfo' => $r['curlinfo']
  316. )));
  317. }
  318. });
  319. /*
  320. $app->post('/auth/facebook', function() use($app) {
  321. if($user=require_login($app, false)) {
  322. $params = $app->request()->params();
  323. // User just auth'd with facebook, store the access token
  324. $user->facebook_access_token = $params['fb_token'];
  325. $user->save();
  326. $app->response()->body(json_encode(array(
  327. 'result' => 'ok'
  328. )));
  329. } else {
  330. $app->response()->body(json_encode(array(
  331. 'result' => 'error'
  332. )));
  333. }
  334. });
  335. */
  336. $app->post('/auth/twitter', function() use($app) {
  337. if($user=require_login($app, false)) {
  338. $params = $app->request()->params();
  339. // User just auth'd with twitter, store the access token
  340. $user->twitter_access_token = $params['twitter_token'];
  341. $user->twitter_token_secret = $params['twitter_secret'];
  342. $user->save();
  343. $app->response()->body(json_encode(array(
  344. 'result' => 'ok'
  345. )));
  346. } else {
  347. $app->response()->body(json_encode(array(
  348. 'result' => 'error'
  349. )));
  350. }
  351. });
  352. function getTwitterLoginURL(&$twitter) {
  353. $request_token = $twitter->getRequestToken(Config::$base_url . 'auth/twitter/callback');
  354. $_SESSION['twitter_auth'] = $request_token;
  355. return $twitter->getAuthorizeURL($request_token['oauth_token']);
  356. }
  357. $app->get('/auth/twitter', function() use($app) {
  358. $params = $app->request()->params();
  359. if($user=require_login($app, false)) {
  360. // If there is an existing Twitter token, check if it is valid
  361. // Otherwise, generate a Twitter login link
  362. $twitter_login_url = false;
  363. $twitter = new \TwitterOAuth\Api(Config::$twitterClientID, Config::$twitterClientSecret,
  364. $user->twitter_access_token, $user->twitter_token_secret);
  365. if(array_key_exists('login', $params)) {
  366. $twitter = new \TwitterOAuth\Api(Config::$twitterClientID, Config::$twitterClientSecret);
  367. $twitter_login_url = getTwitterLoginURL($twitter);
  368. } else {
  369. if($user->twitter_access_token) {
  370. if ($twitter->get('account/verify_credentials')) {
  371. $app->response()->body(json_encode(array(
  372. 'result' => 'ok'
  373. )));
  374. return;
  375. } else {
  376. // If the existing twitter token is not valid, generate a login link
  377. $twitter_login_url = getTwitterLoginURL($twitter);
  378. }
  379. } else {
  380. $twitter_login_url = getTwitterLoginURL($twitter);
  381. }
  382. }
  383. $app->response()->body(json_encode(array(
  384. 'url' => $twitter_login_url
  385. )));
  386. } else {
  387. $app->response()->body(json_encode(array(
  388. 'result' => 'error'
  389. )));
  390. }
  391. });
  392. $app->get('/auth/twitter/callback', function() use($app) {
  393. if($user=require_login($app)) {
  394. $params = $app->request()->params();
  395. $twitter = new \TwitterOAuth\Api(Config::$twitterClientID, Config::$twitterClientSecret,
  396. $_SESSION['twitter_auth']['oauth_token'], $_SESSION['twitter_auth']['oauth_token_secret']);
  397. $credentials = $twitter->getAccessToken($params['oauth_verifier']);
  398. $user->twitter_access_token = $credentials['oauth_token'];
  399. $user->twitter_token_secret = $credentials['oauth_token_secret'];
  400. $user->twitter_username = $credentials['screen_name'];
  401. $user->save();
  402. $app->redirect('/settings');
  403. }
  404. });
  405. $app->get('/auth/instagram', function() use($app) {
  406. if($user=require_login($app, false)) {
  407. $instagram = instagram_client();
  408. // If there is an existing Instagram auth token, check if it's valid
  409. if($user->instagram_access_token) {
  410. $instagram->setAccessToken($user->instagram_access_token);
  411. $igUser = $instagram->getUser();
  412. if($igUser && $igUser->meta->code == 200) {
  413. $app->response()->body(json_encode(array(
  414. 'result' => 'ok',
  415. 'username' => $igUser->data->username,
  416. 'url' => $instagram->getLoginUrl(array('basic','likes'))
  417. )));
  418. return;
  419. }
  420. }
  421. $app->response()->body(json_encode(array(
  422. 'result' => 'error',
  423. 'url' => $instagram->getLoginUrl(array('basic','likes'))
  424. )));
  425. }
  426. });
  427. $app->get('/auth/instagram/callback', function() use($app) {
  428. if($user=require_login($app)) {
  429. $params = $app->request()->params();
  430. $instagram = instagram_client();
  431. $data = $instagram->getOAuthToken($params['code']);
  432. $user->instagram_access_token = $data->access_token;
  433. $user->save();
  434. $app->redirect('/settings');
  435. }
  436. });