You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

590 lines
17 KiB

9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
  1. <?php
  2. use Abraham\TwitterOAuth\TwitterOAuth;
  3. function require_login(&$app, $redirect=true) {
  4. $params = $app->request()->params();
  5. if(array_key_exists('token', $params)) {
  6. try {
  7. $data = JWT::decode($params['token'], Config::$jwtSecret, array('HS256'));
  8. $_SESSION['user_id'] = $data->user_id;
  9. $_SESSION['me'] = $data->me;
  10. } catch(DomainException $e) {
  11. if($redirect) {
  12. header('X-Error: DomainException');
  13. $app->redirect('/', 302);
  14. } else {
  15. return false;
  16. }
  17. } catch(UnexpectedValueException $e) {
  18. if($redirect) {
  19. header('X-Error: UnexpectedValueException');
  20. $app->redirect('/', 302);
  21. } else {
  22. return false;
  23. }
  24. }
  25. }
  26. if(!array_key_exists('user_id', $_SESSION)) {
  27. if($redirect)
  28. $app->redirect('/', 302);
  29. return false;
  30. } else {
  31. return ORM::for_table('users')->find_one($_SESSION['user_id']);
  32. }
  33. }
  34. function generate_login_token() {
  35. return JWT::encode(array(
  36. 'user_id' => $_SESSION['user_id'],
  37. 'me' => $_SESSION['me'],
  38. 'created_at' => time()
  39. ), Config::$jwtSecret);
  40. }
  41. $app->get('/dashboard', function() use($app) {
  42. if($user=require_login($app)) {
  43. render('dashboard', array(
  44. 'title' => 'Dashboard',
  45. 'authorizing' => false
  46. ));
  47. }
  48. });
  49. $app->get('/new', function() use($app) {
  50. if($user=require_login($app)) {
  51. $params = $app->request()->params();
  52. $entry = false;
  53. $in_reply_to = '';
  54. if(array_key_exists('reply', $params))
  55. $in_reply_to = $params['reply'];
  56. $test_response = '';
  57. if($user->last_micropub_response) {
  58. try {
  59. if(@json_decode($user->last_micropub_response)) {
  60. $d = json_decode($user->last_micropub_response);
  61. $test_response = $d->response;
  62. }
  63. } catch(Exception $e) {
  64. }
  65. }
  66. render('new-post', array(
  67. 'title' => 'New Post',
  68. 'in_reply_to' => $in_reply_to,
  69. 'micropub_endpoint' => $user->micropub_endpoint,
  70. 'media_endpoint' => $user->micropub_media_endpoint,
  71. 'micropub_scope' => $user->micropub_scope,
  72. 'micropub_access_token' => $user->micropub_access_token,
  73. 'response_date' => $user->last_micropub_response_date,
  74. 'syndication_targets' => json_decode($user->syndication_targets, true),
  75. 'test_response' => $test_response,
  76. 'location_enabled' => $user->location_enabled,
  77. 'user' => $user,
  78. 'authorizing' => false
  79. ));
  80. }
  81. });
  82. $app->get('/bookmark', function() use($app) {
  83. if($user=require_login($app)) {
  84. $params = $app->request()->params();
  85. $url = '';
  86. $name = '';
  87. $content = '';
  88. $tags = '';
  89. if(array_key_exists('url', $params))
  90. $url = $params['url'];
  91. if(array_key_exists('name', $params))
  92. $name = $params['name'];
  93. if(array_key_exists('content', $params))
  94. $content = $params['content'];
  95. render('new-bookmark', array(
  96. 'title' => 'New Bookmark',
  97. 'bookmark_url' => $url,
  98. 'bookmark_name' => $name,
  99. 'bookmark_content' => $content,
  100. 'bookmark_tags' => $tags,
  101. 'token' => generate_login_token(),
  102. 'syndication_targets' => json_decode($user->syndication_targets, true),
  103. 'authorizing' => false
  104. ));
  105. }
  106. });
  107. $app->get('/favorite', function() use($app) {
  108. if($user=require_login($app)) {
  109. $params = $app->request()->params();
  110. $url = '';
  111. if(array_key_exists('url', $params))
  112. $url = $params['url'];
  113. render('new-favorite', array(
  114. 'title' => 'New Favorite',
  115. 'url' => $url,
  116. 'token' => generate_login_token(),
  117. 'authorizing' => false
  118. ));
  119. }
  120. });
  121. $app->get('/event', function() use($app) {
  122. if($user=require_login($app)) {
  123. $params = $app->request()->params();
  124. render('event', array(
  125. 'title' => 'Event',
  126. 'authorizing' => false
  127. ));
  128. }
  129. });
  130. $app->get('/itinerary', function() use($app) {
  131. if($user=require_login($app)) {
  132. $params = $app->request()->params();
  133. render('new-itinerary', array(
  134. 'title' => 'Itinerary',
  135. 'authorizing' => false
  136. ));
  137. }
  138. });
  139. $app->get('/photo', function() use($app) {
  140. if($user=require_login($app)) {
  141. $params = $app->request()->params();
  142. render('photo', array(
  143. 'title' => 'New Photo',
  144. 'note_content' => '',
  145. 'authorizing' => false
  146. ));
  147. }
  148. });
  149. $app->get('/review', function() use($app) {
  150. if($user=require_login($app)) {
  151. $params = $app->request()->params();
  152. render('review', array(
  153. 'title' => 'Review',
  154. 'authorizing' => false
  155. ));
  156. }
  157. });
  158. $app->get('/repost', function() use($app) {
  159. if($user=require_login($app)) {
  160. $params = $app->request()->params();
  161. $url = '';
  162. if(array_key_exists('url', $params))
  163. $url = $params['url'];
  164. render('new-repost', array(
  165. 'title' => 'New Repost',
  166. 'url' => $url,
  167. 'token' => generate_login_token(),
  168. 'authorizing' => false
  169. ));
  170. }
  171. });
  172. $app->post('/prefs', function() use($app) {
  173. if($user=require_login($app)) {
  174. $params = $app->request()->params();
  175. $user->location_enabled = $params['enabled'];
  176. $user->save();
  177. }
  178. $app->response()['Content-type'] = 'application/json';
  179. $app->response()->body(json_encode(array(
  180. 'result' => 'ok'
  181. )));
  182. });
  183. $app->get('/add-to-home', function() use($app) {
  184. $params = $app->request()->params();
  185. header("Cache-Control: no-cache, must-revalidate");
  186. if(array_key_exists('token', $params) && !session('add-to-home-started')) {
  187. unset($_SESSION['add-to-home-started']);
  188. // Verify the token and sign the user in
  189. try {
  190. $data = JWT::decode($params['token'], Config::$jwtSecret, array('HS256'));
  191. $_SESSION['user_id'] = $data->user_id;
  192. $_SESSION['me'] = $data->me;
  193. $app->redirect('/new', 302);
  194. } catch(DomainException $e) {
  195. header('X-Error: DomainException');
  196. $app->redirect('/', 302);
  197. } catch(UnexpectedValueException $e) {
  198. header('X-Error: UnexpectedValueException');
  199. $app->redirect('/', 302);
  200. }
  201. } else {
  202. if($user=require_login($app)) {
  203. if(array_key_exists('start', $params)) {
  204. $_SESSION['add-to-home-started'] = true;
  205. $token = JWT::encode(array(
  206. 'user_id' => $_SESSION['user_id'],
  207. 'me' => $_SESSION['me'],
  208. 'created_at' => time()
  209. ), Config::$jwtSecret);
  210. $app->redirect('/add-to-home?token='.$token, 302);
  211. } else {
  212. unset($_SESSION['add-to-home-started']);
  213. render('add-to-home', array('title' => 'Quill'));
  214. }
  215. }
  216. }
  217. });
  218. $app->get('/email', function() use($app) {
  219. if($user=require_login($app)) {
  220. $test_response = '';
  221. if($user->last_micropub_response) {
  222. try {
  223. if(@json_decode($user->last_micropub_response)) {
  224. $d = json_decode($user->last_micropub_response);
  225. $test_response = $d->response;
  226. }
  227. } catch(Exception $e) {
  228. }
  229. }
  230. if(!$user->email_username) {
  231. $host = parse_url($user->url, PHP_URL_HOST);
  232. $user->email_username = $host . '.' . rand(100000,999999);
  233. $user->save();
  234. }
  235. render('email', array(
  236. 'title' => 'Post-by-Email',
  237. 'micropub_endpoint' => $user->micropub_endpoint,
  238. 'test_response' => $test_response,
  239. 'user' => $user
  240. ));
  241. }
  242. });
  243. $app->get('/settings', function() use($app) {
  244. if($user=require_login($app)) {
  245. render('settings', [
  246. 'title' => 'Settings',
  247. 'user' => $user,
  248. 'authorizing' => false
  249. ]);
  250. }
  251. });
  252. $app->post('/settings/save', function() use($app) {
  253. if($user=require_login($app)) {
  254. $params = $app->request()->params();
  255. if(array_key_exists('html_content', $params))
  256. $user->micropub_optin_html_content = $params['html_content'] ? 1 : 0;
  257. if(array_key_exists('slug_field', $params) && $params['slug_field'])
  258. $user->micropub_slug_field = $params['slug_field'];
  259. $user->save();
  260. $app->response()['Content-type'] = 'application/json';
  261. $app->response()->body(json_encode(array(
  262. 'result' => 'ok'
  263. )));
  264. }
  265. });
  266. $app->post('/settings/html-content', function() use($app) {
  267. if($user=require_login($app)) {
  268. $params = $app->request()->params();
  269. $user->micropub_optin_html_content = $params['html'] ? 1 : 0;
  270. $user->save();
  271. $app->response()['Content-type'] = 'application/json';
  272. $app->response()->body(json_encode(array(
  273. 'html' => $user->micropub_optin_html_content
  274. )));
  275. }
  276. });
  277. $app->get('/settings/html-content', function() use($app) {
  278. if($user=require_login($app)) {
  279. $app->response()['Content-type'] = 'application/json';
  280. $app->response()->body(json_encode(array(
  281. 'html' => $user->micropub_optin_html_content
  282. )));
  283. }
  284. });
  285. function create_favorite(&$user, $url) {
  286. $micropub_request = array(
  287. 'like-of' => $url
  288. );
  289. $r = micropub_post_for_user($user, $micropub_request);
  290. $tweet_id = false;
  291. // POSSE favorites to Twitter
  292. if($user->twitter_access_token && preg_match('/https?:\/\/(?:www\.)?twitter\.com\/[^\/]+\/status(?:es)?\/(\d+)/', $url, $match)) {
  293. $tweet_id = $match[1];
  294. $twitter = new TwitterOAuth(Config::$twitterClientID, Config::$twitterClientSecret,
  295. $user->twitter_access_token, $user->twitter_token_secret);
  296. $result = $twitter->post('favorites/create', array(
  297. 'id' => $tweet_id
  298. ));
  299. }
  300. return $r;
  301. }
  302. function create_repost(&$user, $url) {
  303. $micropub_request = array(
  304. 'repost-of' => $url
  305. );
  306. $r = micropub_post_for_user($user, $micropub_request);
  307. $tweet_id = false;
  308. if($user->twitter_access_token && preg_match('/https?:\/\/(?:www\.)?twitter\.com\/[^\/]+\/status(?:es)?\/(\d+)/', $url, $match)) {
  309. $tweet_id = $match[1];
  310. $twitter = new TwitterOAuth(Config::$twitterClientID, Config::$twitterClientSecret,
  311. $user->twitter_access_token, $user->twitter_token_secret);
  312. $result = $twitter->post('statuses/retweet/'.$tweet_id);
  313. }
  314. return $r;
  315. }
  316. $app->post('/favorite', function() use($app) {
  317. if($user=require_login($app)) {
  318. $params = $app->request()->params();
  319. $r = create_favorite($user, $params['url']);
  320. $app->response()['Content-type'] = 'application/json';
  321. $app->response()->body(json_encode(array(
  322. 'location' => $r['location'],
  323. 'error' => $r['error']
  324. )));
  325. }
  326. });
  327. $app->post('/repost', function() use($app) {
  328. if($user=require_login($app)) {
  329. $params = $app->request()->params();
  330. $r = create_repost($user, $params['url']);
  331. $app->response()['Content-type'] = 'application/json';
  332. $app->response()->body(json_encode(array(
  333. 'location' => $r['location'],
  334. 'error' => $r['error']
  335. )));
  336. }
  337. });
  338. $app->get('/reply/preview', function() use($app) {
  339. if($user=require_login($app)) {
  340. $params = $app->request()->params();
  341. if(!isset($params['url']) || !$params['url']) {
  342. return '';
  343. }
  344. $reply_url = trim($params['url']);
  345. if(preg_match('/twtr\.io\/([0-9a-z]+)/i', $reply_url, $match)) {
  346. $twtr = 'https://twitter.com/_/status/' . sxg_to_num($match[1]);
  347. $ch = curl_init($twtr);
  348. curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  349. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
  350. curl_exec($ch);
  351. $expanded_url = curl_getinfo($ch, CURLINFO_EFFECTIVE_URL);
  352. if($expanded_url) $reply_url = $expanded_url;
  353. }
  354. $entry = false;
  355. // Convert Tweets to h-entry
  356. if(preg_match('/twitter\.com\/(?:[^\/]+)\/statuse?s?\/(.+)/', $reply_url, $match)) {
  357. $tweet_id = $match[1];
  358. if($user->twitter_access_token) {
  359. $twitter = new TwitterOAuth(Config::$twitterClientID, Config::$twitterClientSecret,
  360. $user->twitter_access_token, $user->twitter_token_secret);
  361. } else {
  362. $twitter = new TwitterOAuth(Config::$twitterClientID, Config::$twitterClientSecret);
  363. }
  364. $tweet = $twitter->get('statuses/show/'.$tweet_id);
  365. $entry = tweet_to_h_entry($tweet);
  366. } else {
  367. // Pass to X-Ray to see if it can expand the entry
  368. $ch = curl_init('https://xray.p3k.io/parse?url='.urlencode($reply_url));
  369. curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  370. $response = curl_exec($ch);
  371. $data = @json_decode($response, true);
  372. if($data && isset($data['data']) && $data['data']['type'] == 'entry') {
  373. $entry = $data['data'];
  374. // Create a nickname based on the author URL
  375. if(array_key_exists('author', $entry) && $entry['author']['url']) {
  376. $entry['author']['nickname'] = display_url($entry['author']['url']);
  377. }
  378. }
  379. }
  380. $mentions = [];
  381. if($entry) {
  382. if(array_key_exists('author', $entry)) {
  383. // Find all @-names in the post, as well as the author name
  384. $mentions[] = strtolower($entry['author']['nickname']);
  385. }
  386. if(preg_match_all('/(^|(?<=[\s\/]))@([a-z0-9_]+([a-z0-9_\.]*)?)/i', $entry['content']['text'], $matches)) {
  387. foreach($matches[0] as $nick) {
  388. if(trim($nick,'@') != $user->twitter_username && trim($nick,'@') != display_url($user->url))
  389. $mentions[] = strtolower(trim($nick,'@'));
  390. }
  391. }
  392. $mentions = array_values(array_unique($mentions));
  393. }
  394. $app->response()['Content-type'] = 'application/json';
  395. $app->response()->body(json_encode([
  396. 'canonical_reply_url' => $reply_url,
  397. 'entry' => $entry,
  398. 'mentions' => $mentions
  399. ]));
  400. }
  401. });
  402. $app->get('/micropub/syndications', function() use($app) {
  403. if($user=require_login($app)) {
  404. $data = get_micropub_config($user, ['q'=>'syndicate-to']);
  405. $app->response()['Content-type'] = 'application/json';
  406. $app->response()->body(json_encode(array(
  407. 'targets' => $data['targets'],
  408. 'response' => $data['response']
  409. )));
  410. }
  411. });
  412. $app->post('/micropub/post', function() use($app) {
  413. if($user=require_login($app)) {
  414. $params = $app->request()->params();
  415. // Remove any blank params
  416. $params = array_filter($params, function($v){
  417. return $v !== '';
  418. });
  419. $r = micropub_post_for_user($user, $params);
  420. $app->response()['Content-type'] = 'application/json';
  421. $app->response()->body(json_encode(array(
  422. 'request' => htmlspecialchars($r['request']),
  423. 'response' => htmlspecialchars($r['response']),
  424. 'location' => $r['location'],
  425. 'error' => $r['error'],
  426. 'curlinfo' => $r['curlinfo']
  427. )));
  428. }
  429. });
  430. $app->post('/micropub/multipart', function() use($app) {
  431. if($user=require_login($app)) {
  432. // var_dump($app->request()->post());
  433. //
  434. // Since $app->request()->post() with multipart is always
  435. // empty (bug in Slim?) We're using the raw $_POST here.
  436. // PHP empties everything in $_POST if the file upload size exceeds
  437. // that is why we have to test if the variables exist first.
  438. $file = isset($_FILES['photo']) ? $_FILES['photo'] : null;
  439. if($file) {
  440. $error = validate_photo($file);
  441. unset($_POST['null']);
  442. if(!$error) {
  443. $file_path = $file['tmp_name'];
  444. correct_photo_rotation($file_path);
  445. $r = micropub_post_for_user($user, $_POST, $file_path);
  446. } else {
  447. $r = array('error' => $error);
  448. }
  449. } else {
  450. unset($_POST['null']);
  451. $r = micropub_post_for_user($user, $_POST);
  452. }
  453. // Populate the error if there was no location header.
  454. if(empty($r['location']) && empty($r['error'])) {
  455. $r['error'] = "No 'Location' header in response.";
  456. }
  457. $app->response()['Content-type'] = 'application/json';
  458. $app->response()->body(json_encode(array(
  459. 'response' => (isset($r['response']) ? htmlspecialchars($r['response']) : null),
  460. 'location' => (isset($r['location']) ? $r['location'] : null),
  461. 'error' => (isset($r['error']) ? $r['error'] : null),
  462. )));
  463. }
  464. });
  465. $app->post('/micropub/media', function() use($app) {
  466. if($user=require_login($app)) {
  467. $file = isset($_FILES['photo']) ? $_FILES['photo'] : null;
  468. $error = validate_photo($file);
  469. unset($_POST['null']);
  470. if(!$error) {
  471. $file_path = $file['tmp_name'];
  472. correct_photo_rotation($file_path);
  473. $r = micropub_media_post_for_user($user, $file_path);
  474. } else {
  475. $r = array('error' => $error);
  476. }
  477. if(empty($r['location']) && empty($r['error'])) {
  478. $r['error'] = "No 'Location' header in response.";
  479. }
  480. $app->response()['Content-type'] = 'application/json';
  481. $app->response()->body(json_encode(array(
  482. 'location' => (isset($r['location']) ? $r['location'] : null),
  483. 'error' => (isset($r['error']) ? $r['error'] : null),
  484. )));
  485. }
  486. });
  487. $app->post('/micropub/postjson', function() use($app) {
  488. if($user=require_login($app)) {
  489. $params = $app->request()->params();
  490. $r = micropub_post_for_user($user, json_decode($params['data'], true), null, true);
  491. $app->response()['Content-type'] = 'application/json';
  492. $app->response()->body(json_encode(array(
  493. 'location' => $r['location'],
  494. 'error' => $r['error'],
  495. 'response' => $r['response']
  496. )));
  497. }
  498. });