You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

684 lines
19 KiB

9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
  1. <?php
  2. function require_login(&$app, $redirect=true) {
  3. $params = $app->request()->params();
  4. if(array_key_exists('token', $params)) {
  5. try {
  6. $data = JWT::decode($params['token'], Config::$jwtSecret, array('HS256'));
  7. $_SESSION['user_id'] = $data->user_id;
  8. $_SESSION['me'] = $data->me;
  9. } catch(DomainException $e) {
  10. if($redirect) {
  11. header('X-Error: DomainException');
  12. $app->redirect('/', 301);
  13. } else {
  14. return false;
  15. }
  16. } catch(UnexpectedValueException $e) {
  17. if($redirect) {
  18. header('X-Error: UnexpectedValueException');
  19. $app->redirect('/', 301);
  20. } else {
  21. return false;
  22. }
  23. }
  24. }
  25. if(!array_key_exists('user_id', $_SESSION)) {
  26. if($redirect)
  27. $app->redirect('/');
  28. return false;
  29. } else {
  30. return ORM::for_table('users')->find_one($_SESSION['user_id']);
  31. }
  32. }
  33. function generate_login_token() {
  34. return JWT::encode(array(
  35. 'user_id' => $_SESSION['user_id'],
  36. 'me' => $_SESSION['me'],
  37. 'created_at' => time()
  38. ), Config::$jwtSecret);
  39. }
  40. $app->get('/dashboard', function() use($app) {
  41. if($user=require_login($app)) {
  42. $html = render('dashboard', array(
  43. 'title' => 'Dashboard',
  44. 'authorizing' => false
  45. ));
  46. $app->response()->body($html);
  47. }
  48. });
  49. $app->get('/new', function() use($app) {
  50. if($user=require_login($app)) {
  51. $params = $app->request()->params();
  52. $entry = false;
  53. $photo_url = false;
  54. $in_reply_to = '';
  55. if(array_key_exists('reply', $params))
  56. $in_reply_to = $params['reply'];
  57. $test_response = '';
  58. if($user->last_micropub_response) {
  59. try {
  60. if(@json_decode($user->last_micropub_response)) {
  61. $d = json_decode($user->last_micropub_response);
  62. $test_response = $d->response;
  63. }
  64. } catch(Exception $e) {
  65. }
  66. }
  67. $html = render('new-post', array(
  68. 'title' => 'New Post',
  69. 'in_reply_to' => $in_reply_to,
  70. 'micropub_endpoint' => $user->micropub_endpoint,
  71. 'micropub_scope' => $user->micropub_scope,
  72. 'micropub_access_token' => $user->micropub_access_token,
  73. 'response_date' => $user->last_micropub_response_date,
  74. 'syndication_targets' => json_decode($user->syndication_targets, true),
  75. 'test_response' => $test_response,
  76. 'location_enabled' => $user->location_enabled,
  77. 'authorizing' => false
  78. ));
  79. $app->response()->body($html);
  80. }
  81. });
  82. $app->get('/bookmark', function() use($app) {
  83. if($user=require_login($app)) {
  84. $params = $app->request()->params();
  85. $url = '';
  86. $name = '';
  87. $content = '';
  88. $tags = '';
  89. if(array_key_exists('url', $params))
  90. $url = $params['url'];
  91. if(array_key_exists('name', $params))
  92. $name = $params['name'];
  93. if(array_key_exists('content', $params))
  94. $content = $params['content'];
  95. $html = render('new-bookmark', array(
  96. 'title' => 'New Bookmark',
  97. 'bookmark_url' => $url,
  98. 'bookmark_name' => $name,
  99. 'bookmark_content' => $content,
  100. 'bookmark_tags' => $tags,
  101. 'token' => generate_login_token(),
  102. 'syndication_targets' => json_decode($user->syndication_targets, true),
  103. 'authorizing' => false
  104. ));
  105. $app->response()->body($html);
  106. }
  107. });
  108. $app->get('/favorite', function() use($app) {
  109. if($user=require_login($app)) {
  110. $params = $app->request()->params();
  111. $url = '';
  112. if(array_key_exists('url', $params))
  113. $url = $params['url'];
  114. $html = render('new-favorite', array(
  115. 'title' => 'New Favorite',
  116. 'url' => $url,
  117. 'token' => generate_login_token(),
  118. 'authorizing' => false
  119. ));
  120. $app->response()->body($html);
  121. }
  122. });
  123. $app->get('/event', function() use($app) {
  124. if($user=require_login($app)) {
  125. $params = $app->request()->params();
  126. $html = render('event', array(
  127. 'title' => 'Event',
  128. 'authorizing' => false
  129. ));
  130. $app->response()->body($html);
  131. }
  132. });
  133. $app->get('/itinerary', function() use($app) {
  134. if($user=require_login($app)) {
  135. $params = $app->request()->params();
  136. $html = render('new-itinerary', array(
  137. 'title' => 'Itinerary',
  138. 'authorizing' => false
  139. ));
  140. $app->response()->body($html);
  141. }
  142. });
  143. $app->get('/photo', function() use($app) {
  144. if($user=require_login($app)) {
  145. $params = $app->request()->params();
  146. $html = render('photo', array(
  147. 'title' => 'New Photo',
  148. 'note_content' => '',
  149. 'authorizing' => false
  150. ));
  151. $app->response()->body($html);
  152. }
  153. });
  154. $app->get('/repost', function() use($app) {
  155. if($user=require_login($app)) {
  156. $params = $app->request()->params();
  157. $url = '';
  158. if(array_key_exists('url', $params))
  159. $url = $params['url'];
  160. $html = render('new-repost', array(
  161. 'title' => 'New Repost',
  162. 'url' => $url,
  163. 'token' => generate_login_token(),
  164. 'authorizing' => false
  165. ));
  166. $app->response()->body($html);
  167. }
  168. });
  169. $app->post('/prefs', function() use($app) {
  170. if($user=require_login($app)) {
  171. $params = $app->request()->params();
  172. $user->location_enabled = $params['enabled'];
  173. $user->save();
  174. }
  175. $app->response()->body(json_encode(array(
  176. 'result' => 'ok'
  177. )));
  178. });
  179. $app->get('/creating-a-token-endpoint', function() use($app) {
  180. $app->redirect('http://indiewebcamp.com/token-endpoint', 301);
  181. });
  182. $app->get('/creating-a-micropub-endpoint', function() use($app) {
  183. $html = render('creating-a-micropub-endpoint', array('title' => 'Creating a Micropub Endpoint', 'authorizing' => false));
  184. $app->response()->body($html);
  185. });
  186. $app->get('/docs', function() use($app) {
  187. $html = render('docs', array('title' => 'Documentation', 'authorizing' => false));
  188. $app->response()->body($html);
  189. });
  190. $app->get('/privacy', function() use($app) {
  191. $html = render('privacy', array('title' => 'Quill Privacy Policy', 'authorizing' => false));
  192. $app->response()->body($html);
  193. });
  194. $app->get('/add-to-home', function() use($app) {
  195. $params = $app->request()->params();
  196. header("Cache-Control: no-cache, must-revalidate");
  197. if(array_key_exists('token', $params) && !session('add-to-home-started')) {
  198. unset($_SESSION['add-to-home-started']);
  199. // Verify the token and sign the user in
  200. try {
  201. $data = JWT::decode($params['token'], Config::$jwtSecret, array('HS256'));
  202. $_SESSION['user_id'] = $data->user_id;
  203. $_SESSION['me'] = $data->me;
  204. $app->redirect('/new', 301);
  205. } catch(DomainException $e) {
  206. header('X-Error: DomainException');
  207. $app->redirect('/', 301);
  208. } catch(UnexpectedValueException $e) {
  209. header('X-Error: UnexpectedValueException');
  210. $app->redirect('/', 301);
  211. }
  212. } else {
  213. if($user=require_login($app)) {
  214. if(array_key_exists('start', $params)) {
  215. $_SESSION['add-to-home-started'] = true;
  216. $token = JWT::encode(array(
  217. 'user_id' => $_SESSION['user_id'],
  218. 'me' => $_SESSION['me'],
  219. 'created_at' => time()
  220. ), Config::$jwtSecret);
  221. $app->redirect('/add-to-home?token='.$token, 301);
  222. } else {
  223. unset($_SESSION['add-to-home-started']);
  224. $html = render('add-to-home', array('title' => 'Quill'));
  225. $app->response()->body($html);
  226. }
  227. }
  228. }
  229. });
  230. $app->get('/email', function() use($app) {
  231. if($user=require_login($app)) {
  232. $test_response = '';
  233. if($user->last_micropub_response) {
  234. try {
  235. if(@json_decode($user->last_micropub_response)) {
  236. $d = json_decode($user->last_micropub_response);
  237. $test_response = $d->response;
  238. }
  239. } catch(Exception $e) {
  240. }
  241. }
  242. if(!$user->email_username) {
  243. $host = parse_url($user->url, PHP_URL_HOST);
  244. $user->email_username = $host . '.' . rand(100000,999999);
  245. $user->save();
  246. }
  247. $html = render('email', array(
  248. 'title' => 'Post-by-Email',
  249. 'micropub_endpoint' => $user->micropub_endpoint,
  250. 'test_response' => $test_response,
  251. 'user' => $user
  252. ));
  253. $app->response()->body($html);
  254. }
  255. });
  256. $app->get('/settings', function() use($app) {
  257. if($user=require_login($app)) {
  258. $html = render('settings', array('title' => 'Settings', 'include_facebook' => true, 'authorizing' => false));
  259. $app->response()->body($html);
  260. }
  261. });
  262. $app->post('/settings/html-content', function() use($app) {
  263. if($user=require_login($app)) {
  264. $params = $app->request()->params();
  265. $user->micropub_optin_html_content = $params['html'] ? 1 : 0;
  266. $user->save();
  267. $app->response()->body(json_encode(array(
  268. 'html' => $user->micropub_optin_html_content
  269. )));
  270. }
  271. });
  272. $app->get('/settings/html-content', function() use($app) {
  273. if($user=require_login($app)) {
  274. $app->response()->body(json_encode(array(
  275. 'html' => $user->micropub_optin_html_content
  276. )));
  277. }
  278. });
  279. $app->get('/favorite-popup', function() use($app) {
  280. if($user=require_login($app)) {
  281. $params = $app->request()->params();
  282. $html = $app->render('favorite-popup.php', array(
  283. 'url' => $params['url'],
  284. 'token' => $params['token']
  285. ));
  286. $app->response()->body($html);
  287. }
  288. });
  289. function create_favorite(&$user, $url) {
  290. $micropub_request = array(
  291. 'like-of' => $url
  292. );
  293. $r = micropub_post_for_user($user, $micropub_request);
  294. $facebook_id = false;
  295. $instagram_id = false;
  296. $tweet_id = false;
  297. /*
  298. // Facebook likes are posted via Javascript, so pass the FB ID to the javascript code
  299. if(preg_match('/https?:\/\/(?:www\.)?facebook\.com\/(?:[^\/]+)\/posts\/(\d+)/', $url, $match)) {
  300. $facebook_id = $match[1];
  301. }
  302. if(preg_match('/https?:\/\/(?:www\.)?facebook\.com\/photo\.php\?fbid=(\d+)/', $url, $match)) {
  303. $facebook_id = $match[1];
  304. }
  305. */
  306. if(preg_match('/https?:\/\/(?:www\.)?instagram\.com\/p\/([^\/]+)/', $url, $match)) {
  307. $instagram_id = $match[1];
  308. if($user->instagram_access_token) {
  309. $instagram = instagram_client();
  310. $instagram->setAccessToken($user->instagram_access_token);
  311. $ch = curl_init('https://api.instagram.com/v1/media/shortcode/' . $instagram_id . '?access_token=' . $user->instagram_access_token);
  312. curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  313. $result = json_decode(curl_exec($ch));
  314. $result = $instagram->likeMedia($result->data->id);
  315. } else {
  316. // TODO: indicate that the instagram post couldn't be liked because no access token was available
  317. }
  318. }
  319. if($user->twitter_access_token && preg_match('/https?:\/\/(?:www\.)?twitter\.com\/[^\/]+\/status(?:es)?\/(\d+)/', $url, $match)) {
  320. $tweet_id = $match[1];
  321. $twitter = new \TwitterOAuth\Api(Config::$twitterClientID, Config::$twitterClientSecret,
  322. $user->twitter_access_token, $user->twitter_token_secret);
  323. $result = $twitter->post('favorites/create', array(
  324. 'id' => $tweet_id
  325. ));
  326. }
  327. return $r;
  328. }
  329. function create_photo(&$user, $params, $file) {
  330. $error = validate_photo($file);
  331. if(!$error) {
  332. $file_path = $file['tmp_name'];
  333. $micropub_request = array('content' => $params['note_content']);
  334. $r = micropub_post_for_user($user, $micropub_request, $file_path);
  335. } else {
  336. $r = array('error' => $error);
  337. }
  338. return $r;
  339. }
  340. function create_repost(&$user, $url) {
  341. $micropub_request = array(
  342. 'repost-of' => $url
  343. );
  344. $r = micropub_post_for_user($user, $micropub_request);
  345. $tweet_id = false;
  346. if($user->twitter_access_token && preg_match('/https?:\/\/(?:www\.)?twitter\.com\/[^\/]+\/status(?:es)?\/(\d+)/', $url, $match)) {
  347. $tweet_id = $match[1];
  348. $twitter = new \TwitterOAuth\Api(Config::$twitterClientID, Config::$twitterClientSecret,
  349. $user->twitter_access_token, $user->twitter_token_secret);
  350. $result = $twitter->post('statuses/retweet/'.$tweet_id);
  351. }
  352. return $r;
  353. }
  354. $app->get('/favorite.js', function() use($app) {
  355. $app->response()->header("Content-type", "text/javascript");
  356. if($user=require_login($app, false)) {
  357. $params = $app->request()->params();
  358. if(array_key_exists('url', $params)) {
  359. $r = create_favorite($user, $params['url']);
  360. $app->response()->body($app->render('favorite-js.php', array(
  361. 'url' => $params['url'],
  362. 'like_url' => $r['location'],
  363. 'error' => $r['error'],
  364. // 'facebook_id' => $facebook_id
  365. )));
  366. } else {
  367. $app->response()->body('alert("no url");');
  368. }
  369. } else {
  370. $app->response()->body('alert("invalid token");');
  371. }
  372. });
  373. $app->post('/favorite', function() use($app) {
  374. if($user=require_login($app)) {
  375. $params = $app->request()->params();
  376. $r = create_favorite($user, $params['url']);
  377. $app->response()->body(json_encode(array(
  378. 'location' => $r['location'],
  379. 'error' => $r['error']
  380. )));
  381. }
  382. });
  383. $app->post('/photo', function() use($app) {
  384. if($user=require_login($app)) {
  385. // var_dump($app->request()->post());
  386. //
  387. // Since $app->request()->post() with multipart is always
  388. // empty (bug in Slim?) We're using the raw $_POST here
  389. // until this gets fixed.
  390. // PHP empties everything in $_POST if the file upload size exceeds
  391. // that is why we have to test if the variables exist first.
  392. $note_content = isset($_POST['note_content']) ? $_POST['note_content'] : null;
  393. $params = array('note_content' => $note_content);
  394. $file = isset($_FILES['note_photo']) ? $_FILES['note_photo'] : null;
  395. $r = create_photo($user, $params, $file);
  396. // Populate the error if there was no location header.
  397. if(empty($r['location']) && empty($r['error'])) {
  398. $r['error'] = "No 'Location' header in response.";
  399. }
  400. $html = render('photo', array(
  401. 'title' => 'Photo posted',
  402. 'note_content' => $params['note_content'],
  403. 'location' => (isset($r['location']) ? $r['location'] : null),
  404. 'error' => (isset($r['error']) ? $r['error'] : null),
  405. 'response' => (isset($r['response']) ? htmlspecialchars($r['response']) : null),
  406. 'authorizing' => false
  407. ));
  408. $app->response()->body($html);
  409. }
  410. });
  411. $app->post('/repost', function() use($app) {
  412. if($user=require_login($app)) {
  413. $params = $app->request()->params();
  414. $r = create_repost($user, $params['url']);
  415. $app->response()->body(json_encode(array(
  416. 'location' => $r['location'],
  417. 'error' => $r['error']
  418. )));
  419. }
  420. });
  421. $app->get('/micropub/syndications', function() use($app) {
  422. if($user=require_login($app)) {
  423. $data = get_syndication_targets($user);
  424. $app->response()->body(json_encode(array(
  425. 'targets' => $data['targets'],
  426. 'response' => $data['response']
  427. )));
  428. }
  429. });
  430. $app->post('/micropub/post', function() use($app) {
  431. if($user=require_login($app)) {
  432. $params = $app->request()->params();
  433. // Remove any blank params
  434. $params = array_filter($params, function($v){
  435. return $v !== '';
  436. });
  437. $r = micropub_post_for_user($user, $params);
  438. $app->response()->body(json_encode(array(
  439. 'request' => htmlspecialchars($r['request']),
  440. 'response' => htmlspecialchars($r['response']),
  441. 'location' => $r['location'],
  442. 'error' => $r['error'],
  443. 'curlinfo' => $r['curlinfo']
  444. )));
  445. }
  446. });
  447. $app->post('/micropub/postjson', function() use($app) {
  448. if($user=require_login($app)) {
  449. $params = $app->request()->params();
  450. $r = micropub_post_for_user($user, json_decode($params['data'], true), null, true);
  451. $app->response()->body(json_encode(array(
  452. 'location' => $r['location'],
  453. 'error' => $r['error'],
  454. 'response' => $r['response']
  455. )));
  456. }
  457. });
  458. /*
  459. $app->post('/auth/facebook', function() use($app) {
  460. if($user=require_login($app, false)) {
  461. $params = $app->request()->params();
  462. // User just auth'd with facebook, store the access token
  463. $user->facebook_access_token = $params['fb_token'];
  464. $user->save();
  465. $app->response()->body(json_encode(array(
  466. 'result' => 'ok'
  467. )));
  468. } else {
  469. $app->response()->body(json_encode(array(
  470. 'result' => 'error'
  471. )));
  472. }
  473. });
  474. */
  475. $app->post('/auth/twitter', function() use($app) {
  476. if($user=require_login($app, false)) {
  477. $params = $app->request()->params();
  478. // User just auth'd with twitter, store the access token
  479. $user->twitter_access_token = $params['twitter_token'];
  480. $user->twitter_token_secret = $params['twitter_secret'];
  481. $user->save();
  482. $app->response()->body(json_encode(array(
  483. 'result' => 'ok'
  484. )));
  485. } else {
  486. $app->response()->body(json_encode(array(
  487. 'result' => 'error'
  488. )));
  489. }
  490. });
  491. function getTwitterLoginURL(&$twitter) {
  492. $request_token = $twitter->getRequestToken(Config::$base_url . 'auth/twitter/callback');
  493. $_SESSION['twitter_auth'] = $request_token;
  494. return $twitter->getAuthorizeURL($request_token['oauth_token']);
  495. }
  496. $app->get('/auth/twitter', function() use($app) {
  497. $params = $app->request()->params();
  498. if($user=require_login($app, false)) {
  499. // If there is an existing Twitter token, check if it is valid
  500. // Otherwise, generate a Twitter login link
  501. $twitter_login_url = false;
  502. $twitter = new \TwitterOAuth\Api(Config::$twitterClientID, Config::$twitterClientSecret,
  503. $user->twitter_access_token, $user->twitter_token_secret);
  504. if(array_key_exists('login', $params)) {
  505. $twitter = new \TwitterOAuth\Api(Config::$twitterClientID, Config::$twitterClientSecret);
  506. $twitter_login_url = getTwitterLoginURL($twitter);
  507. } else {
  508. if($user->twitter_access_token) {
  509. if ($twitter->get('account/verify_credentials')) {
  510. $app->response()->body(json_encode(array(
  511. 'result' => 'ok'
  512. )));
  513. return;
  514. } else {
  515. // If the existing twitter token is not valid, generate a login link
  516. $twitter_login_url = getTwitterLoginURL($twitter);
  517. }
  518. } else {
  519. $twitter_login_url = getTwitterLoginURL($twitter);
  520. }
  521. }
  522. $app->response()->body(json_encode(array(
  523. 'url' => $twitter_login_url
  524. )));
  525. } else {
  526. $app->response()->body(json_encode(array(
  527. 'result' => 'error'
  528. )));
  529. }
  530. });
  531. $app->get('/auth/twitter/callback', function() use($app) {
  532. if($user=require_login($app)) {
  533. $params = $app->request()->params();
  534. $twitter = new \TwitterOAuth\Api(Config::$twitterClientID, Config::$twitterClientSecret,
  535. $_SESSION['twitter_auth']['oauth_token'], $_SESSION['twitter_auth']['oauth_token_secret']);
  536. $credentials = $twitter->getAccessToken($params['oauth_verifier']);
  537. $user->twitter_access_token = $credentials['oauth_token'];
  538. $user->twitter_token_secret = $credentials['oauth_token_secret'];
  539. $user->twitter_username = $credentials['screen_name'];
  540. $user->save();
  541. $app->redirect('/settings');
  542. }
  543. });
  544. $app->get('/auth/instagram', function() use($app) {
  545. if($user=require_login($app, false)) {
  546. $instagram = instagram_client();
  547. // If there is an existing Instagram auth token, check if it's valid
  548. if($user->instagram_access_token) {
  549. $instagram->setAccessToken($user->instagram_access_token);
  550. $igUser = $instagram->getUser();
  551. if($igUser && $igUser->meta->code == 200) {
  552. $app->response()->body(json_encode(array(
  553. 'result' => 'ok',
  554. 'username' => $igUser->data->username,
  555. 'url' => $instagram->getLoginUrl(array('basic','likes'))
  556. )));
  557. return;
  558. }
  559. }
  560. $app->response()->body(json_encode(array(
  561. 'result' => 'error',
  562. 'url' => $instagram->getLoginUrl(array('basic','likes'))
  563. )));
  564. }
  565. });
  566. $app->get('/auth/instagram/callback', function() use($app) {
  567. if($user=require_login($app)) {
  568. $params = $app->request()->params();
  569. $instagram = instagram_client();
  570. $data = $instagram->getOAuthToken($params['code']);
  571. $user->instagram_access_token = $data->access_token;
  572. $user->save();
  573. $app->redirect('/settings');
  574. }
  575. });