You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

685 lines
19 KiB

7 years ago
7 years ago
7 years ago
7 years ago
7 years ago
7 years ago
  1. <?php
  2. function require_login(&$app, $redirect=true) {
  3. $params = $app->request()->params();
  4. if(array_key_exists('token', $params)) {
  5. try {
  6. $data = JWT::decode($params['token'], Config::$jwtSecret, array('HS256'));
  7. $_SESSION['user_id'] = $data->user_id;
  8. $_SESSION['me'] = $data->me;
  9. } catch(DomainException $e) {
  10. if($redirect) {
  11. header('X-Error: DomainException');
  12. $app->redirect('/', 301);
  13. } else {
  14. return false;
  15. }
  16. } catch(UnexpectedValueException $e) {
  17. if($redirect) {
  18. header('X-Error: UnexpectedValueException');
  19. $app->redirect('/', 301);
  20. } else {
  21. return false;
  22. }
  23. }
  24. }
  25. if(!array_key_exists('user_id', $_SESSION)) {
  26. if($redirect)
  27. $app->redirect('/');
  28. return false;
  29. } else {
  30. return ORM::for_table('users')->find_one($_SESSION['user_id']);
  31. }
  32. }
  33. function generate_login_token() {
  34. return JWT::encode(array(
  35. 'user_id' => $_SESSION['user_id'],
  36. 'me' => $_SESSION['me'],
  37. 'created_at' => time()
  38. ), Config::$jwtSecret);
  39. }
  40. $app->get('/dashboard', function() use($app) {
  41. if($user=require_login($app)) {
  42. $html = render('dashboard', array(
  43. 'title' => 'Dashboard',
  44. 'authorizing' => false
  45. ));
  46. $app->response()->body($html);
  47. }
  48. });
  49. $app->get('/new', function() use($app) {
  50. if($user=require_login($app)) {
  51. $params = $app->request()->params();
  52. $entry = false;
  53. $photo_url = false;
  54. $in_reply_to = '';
  55. if(array_key_exists('reply', $params))
  56. $in_reply_to = $params['reply'];
  57. $test_response = '';
  58. if($user->last_micropub_response) {
  59. try {
  60. if(@json_decode($user->last_micropub_response)) {
  61. $d = json_decode($user->last_micropub_response);
  62. $test_response = $d->response;
  63. }
  64. } catch(Exception $e) {
  65. }
  66. }
  67. $html = render('new-post', array(
  68. 'title' => 'New Post',
  69. 'in_reply_to' => $in_reply_to,
  70. 'micropub_endpoint' => $user->micropub_endpoint,
  71. 'micropub_scope' => $user->micropub_scope,
  72. 'micropub_access_token' => $user->micropub_access_token,
  73. 'response_date' => $user->last_micropub_response_date,
  74. 'syndication_targets' => json_decode($user->syndication_targets, true),
  75. 'test_response' => $test_response,
  76. 'location_enabled' => $user->location_enabled,
  77. 'user' => $user,
  78. 'authorizing' => false
  79. ));
  80. $app->response()->body($html);
  81. }
  82. });
  83. $app->get('/bookmark', function() use($app) {
  84. if($user=require_login($app)) {
  85. $params = $app->request()->params();
  86. $url = '';
  87. $name = '';
  88. $content = '';
  89. $tags = '';
  90. if(array_key_exists('url', $params))
  91. $url = $params['url'];
  92. if(array_key_exists('name', $params))
  93. $name = $params['name'];
  94. if(array_key_exists('content', $params))
  95. $content = $params['content'];
  96. $html = render('new-bookmark', array(
  97. 'title' => 'New Bookmark',
  98. 'bookmark_url' => $url,
  99. 'bookmark_name' => $name,
  100. 'bookmark_content' => $content,
  101. 'bookmark_tags' => $tags,
  102. 'token' => generate_login_token(),
  103. 'syndication_targets' => json_decode($user->syndication_targets, true),
  104. 'authorizing' => false
  105. ));
  106. $app->response()->body($html);
  107. }
  108. });
  109. $app->get('/favorite', function() use($app) {
  110. if($user=require_login($app)) {
  111. $params = $app->request()->params();
  112. $url = '';
  113. if(array_key_exists('url', $params))
  114. $url = $params['url'];
  115. $html = render('new-favorite', array(
  116. 'title' => 'New Favorite',
  117. 'url' => $url,
  118. 'token' => generate_login_token(),
  119. 'authorizing' => false
  120. ));
  121. $app->response()->body($html);
  122. }
  123. });
  124. $app->get('/event', function() use($app) {
  125. if($user=require_login($app)) {
  126. $params = $app->request()->params();
  127. $html = render('event', array(
  128. 'title' => 'Event',
  129. 'authorizing' => false
  130. ));
  131. $app->response()->body($html);
  132. }
  133. });
  134. $app->get('/itinerary', function() use($app) {
  135. if($user=require_login($app)) {
  136. $params = $app->request()->params();
  137. $html = render('new-itinerary', array(
  138. 'title' => 'Itinerary',
  139. 'authorizing' => false
  140. ));
  141. $app->response()->body($html);
  142. }
  143. });
  144. $app->get('/photo', function() use($app) {
  145. if($user=require_login($app)) {
  146. $params = $app->request()->params();
  147. $html = render('photo', array(
  148. 'title' => 'New Photo',
  149. 'note_content' => '',
  150. 'authorizing' => false
  151. ));
  152. $app->response()->body($html);
  153. }
  154. });
  155. $app->get('/repost', function() use($app) {
  156. if($user=require_login($app)) {
  157. $params = $app->request()->params();
  158. $url = '';
  159. if(array_key_exists('url', $params))
  160. $url = $params['url'];
  161. $html = render('new-repost', array(
  162. 'title' => 'New Repost',
  163. 'url' => $url,
  164. 'token' => generate_login_token(),
  165. 'authorizing' => false
  166. ));
  167. $app->response()->body($html);
  168. }
  169. });
  170. $app->post('/prefs', function() use($app) {
  171. if($user=require_login($app)) {
  172. $params = $app->request()->params();
  173. $user->location_enabled = $params['enabled'];
  174. $user->save();
  175. }
  176. $app->response()->body(json_encode(array(
  177. 'result' => 'ok'
  178. )));
  179. });
  180. $app->get('/creating-a-token-endpoint', function() use($app) {
  181. $app->redirect('http://indiewebcamp.com/token-endpoint', 301);
  182. });
  183. $app->get('/creating-a-micropub-endpoint', function() use($app) {
  184. $html = render('creating-a-micropub-endpoint', array('title' => 'Creating a Micropub Endpoint', 'authorizing' => false));
  185. $app->response()->body($html);
  186. });
  187. $app->get('/docs', function() use($app) {
  188. $html = render('docs', array('title' => 'Documentation', 'authorizing' => false));
  189. $app->response()->body($html);
  190. });
  191. $app->get('/privacy', function() use($app) {
  192. $html = render('privacy', array('title' => 'Quill Privacy Policy', 'authorizing' => false));
  193. $app->response()->body($html);
  194. });
  195. $app->get('/add-to-home', function() use($app) {
  196. $params = $app->request()->params();
  197. header("Cache-Control: no-cache, must-revalidate");
  198. if(array_key_exists('token', $params) && !session('add-to-home-started')) {
  199. unset($_SESSION['add-to-home-started']);
  200. // Verify the token and sign the user in
  201. try {
  202. $data = JWT::decode($params['token'], Config::$jwtSecret, array('HS256'));
  203. $_SESSION['user_id'] = $data->user_id;
  204. $_SESSION['me'] = $data->me;
  205. $app->redirect('/new', 301);
  206. } catch(DomainException $e) {
  207. header('X-Error: DomainException');
  208. $app->redirect('/', 301);
  209. } catch(UnexpectedValueException $e) {
  210. header('X-Error: UnexpectedValueException');
  211. $app->redirect('/', 301);
  212. }
  213. } else {
  214. if($user=require_login($app)) {
  215. if(array_key_exists('start', $params)) {
  216. $_SESSION['add-to-home-started'] = true;
  217. $token = JWT::encode(array(
  218. 'user_id' => $_SESSION['user_id'],
  219. 'me' => $_SESSION['me'],
  220. 'created_at' => time()
  221. ), Config::$jwtSecret);
  222. $app->redirect('/add-to-home?token='.$token, 301);
  223. } else {
  224. unset($_SESSION['add-to-home-started']);
  225. $html = render('add-to-home', array('title' => 'Quill'));
  226. $app->response()->body($html);
  227. }
  228. }
  229. }
  230. });
  231. $app->get('/email', function() use($app) {
  232. if($user=require_login($app)) {
  233. $test_response = '';
  234. if($user->last_micropub_response) {
  235. try {
  236. if(@json_decode($user->last_micropub_response)) {
  237. $d = json_decode($user->last_micropub_response);
  238. $test_response = $d->response;
  239. }
  240. } catch(Exception $e) {
  241. }
  242. }
  243. if(!$user->email_username) {
  244. $host = parse_url($user->url, PHP_URL_HOST);
  245. $user->email_username = $host . '.' . rand(100000,999999);
  246. $user->save();
  247. }
  248. $html = render('email', array(
  249. 'title' => 'Post-by-Email',
  250. 'micropub_endpoint' => $user->micropub_endpoint,
  251. 'test_response' => $test_response,
  252. 'user' => $user
  253. ));
  254. $app->response()->body($html);
  255. }
  256. });
  257. $app->get('/settings', function() use($app) {
  258. if($user=require_login($app)) {
  259. $html = render('settings', array('title' => 'Settings', 'include_facebook' => true, 'authorizing' => false));
  260. $app->response()->body($html);
  261. }
  262. });
  263. $app->post('/settings/html-content', function() use($app) {
  264. if($user=require_login($app)) {
  265. $params = $app->request()->params();
  266. $user->micropub_optin_html_content = $params['html'] ? 1 : 0;
  267. $user->save();
  268. $app->response()->body(json_encode(array(
  269. 'html' => $user->micropub_optin_html_content
  270. )));
  271. }
  272. });
  273. $app->get('/settings/html-content', function() use($app) {
  274. if($user=require_login($app)) {
  275. $app->response()->body(json_encode(array(
  276. 'html' => $user->micropub_optin_html_content
  277. )));
  278. }
  279. });
  280. $app->get('/favorite-popup', function() use($app) {
  281. if($user=require_login($app)) {
  282. $params = $app->request()->params();
  283. $html = $app->render('favorite-popup.php', array(
  284. 'url' => $params['url'],
  285. 'token' => $params['token']
  286. ));
  287. $app->response()->body($html);
  288. }
  289. });
  290. function create_favorite(&$user, $url) {
  291. $micropub_request = array(
  292. 'like-of' => $url
  293. );
  294. $r = micropub_post_for_user($user, $micropub_request);
  295. $facebook_id = false;
  296. $instagram_id = false;
  297. $tweet_id = false;
  298. /*
  299. // Facebook likes are posted via Javascript, so pass the FB ID to the javascript code
  300. if(preg_match('/https?:\/\/(?:www\.)?facebook\.com\/(?:[^\/]+)\/posts\/(\d+)/', $url, $match)) {
  301. $facebook_id = $match[1];
  302. }
  303. if(preg_match('/https?:\/\/(?:www\.)?facebook\.com\/photo\.php\?fbid=(\d+)/', $url, $match)) {
  304. $facebook_id = $match[1];
  305. }
  306. */
  307. if(preg_match('/https?:\/\/(?:www\.)?instagram\.com\/p\/([^\/]+)/', $url, $match)) {
  308. $instagram_id = $match[1];
  309. if($user->instagram_access_token) {
  310. $instagram = instagram_client();
  311. $instagram->setAccessToken($user->instagram_access_token);
  312. $ch = curl_init('https://api.instagram.com/v1/media/shortcode/' . $instagram_id . '?access_token=' . $user->instagram_access_token);
  313. curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  314. $result = json_decode(curl_exec($ch));
  315. $result = $instagram->likeMedia($result->data->id);
  316. } else {
  317. // TODO: indicate that the instagram post couldn't be liked because no access token was available
  318. }
  319. }
  320. if($user->twitter_access_token && preg_match('/https?:\/\/(?:www\.)?twitter\.com\/[^\/]+\/status(?:es)?\/(\d+)/', $url, $match)) {
  321. $tweet_id = $match[1];
  322. $twitter = new \TwitterOAuth\Api(Config::$twitterClientID, Config::$twitterClientSecret,
  323. $user->twitter_access_token, $user->twitter_token_secret);
  324. $result = $twitter->post('favorites/create', array(
  325. 'id' => $tweet_id
  326. ));
  327. }
  328. return $r;
  329. }
  330. function create_photo(&$user, $params, $file) {
  331. $error = validate_photo($file);
  332. if(!$error) {
  333. $file_path = $file['tmp_name'];
  334. $micropub_request = array('content' => $params['note_content']);
  335. $r = micropub_post_for_user($user, $micropub_request, $file_path);
  336. } else {
  337. $r = array('error' => $error);
  338. }
  339. return $r;
  340. }
  341. function create_repost(&$user, $url) {
  342. $micropub_request = array(
  343. 'repost-of' => $url
  344. );
  345. $r = micropub_post_for_user($user, $micropub_request);
  346. $tweet_id = false;
  347. if($user->twitter_access_token && preg_match('/https?:\/\/(?:www\.)?twitter\.com\/[^\/]+\/status(?:es)?\/(\d+)/', $url, $match)) {
  348. $tweet_id = $match[1];
  349. $twitter = new \TwitterOAuth\Api(Config::$twitterClientID, Config::$twitterClientSecret,
  350. $user->twitter_access_token, $user->twitter_token_secret);
  351. $result = $twitter->post('statuses/retweet/'.$tweet_id);
  352. }
  353. return $r;
  354. }
  355. $app->get('/favorite.js', function() use($app) {
  356. $app->response()->header("Content-type", "text/javascript");
  357. if($user=require_login($app, false)) {
  358. $params = $app->request()->params();
  359. if(array_key_exists('url', $params)) {
  360. $r = create_favorite($user, $params['url']);
  361. $app->response()->body($app->render('favorite-js.php', array(
  362. 'url' => $params['url'],
  363. 'like_url' => $r['location'],
  364. 'error' => $r['error'],
  365. // 'facebook_id' => $facebook_id
  366. )));
  367. } else {
  368. $app->response()->body('alert("no url");');
  369. }
  370. } else {
  371. $app->response()->body('alert("invalid token");');
  372. }
  373. });
  374. $app->post('/favorite', function() use($app) {
  375. if($user=require_login($app)) {
  376. $params = $app->request()->params();
  377. $r = create_favorite($user, $params['url']);
  378. $app->response()->body(json_encode(array(
  379. 'location' => $r['location'],
  380. 'error' => $r['error']
  381. )));
  382. }
  383. });
  384. $app->post('/photo', function() use($app) {
  385. if($user=require_login($app)) {
  386. // var_dump($app->request()->post());
  387. //
  388. // Since $app->request()->post() with multipart is always
  389. // empty (bug in Slim?) We're using the raw $_POST here
  390. // until this gets fixed.
  391. // PHP empties everything in $_POST if the file upload size exceeds
  392. // that is why we have to test if the variables exist first.
  393. $note_content = isset($_POST['note_content']) ? $_POST['note_content'] : null;
  394. $params = array('note_content' => $note_content);
  395. $file = isset($_FILES['note_photo']) ? $_FILES['note_photo'] : null;
  396. $r = create_photo($user, $params, $file);
  397. // Populate the error if there was no location header.
  398. if(empty($r['location']) && empty($r['error'])) {
  399. $r['error'] = "No 'Location' header in response.";
  400. }
  401. $html = render('photo', array(
  402. 'title' => 'Photo posted',
  403. 'note_content' => $params['note_content'],
  404. 'location' => (isset($r['location']) ? $r['location'] : null),
  405. 'error' => (isset($r['error']) ? $r['error'] : null),
  406. 'response' => (isset($r['response']) ? htmlspecialchars($r['response']) : null),
  407. 'authorizing' => false
  408. ));
  409. $app->response()->body($html);
  410. }
  411. });
  412. $app->post('/repost', function() use($app) {
  413. if($user=require_login($app)) {
  414. $params = $app->request()->params();
  415. $r = create_repost($user, $params['url']);
  416. $app->response()->body(json_encode(array(
  417. 'location' => $r['location'],
  418. 'error' => $r['error']
  419. )));
  420. }
  421. });
  422. $app->get('/micropub/syndications', function() use($app) {
  423. if($user=require_login($app)) {
  424. $data = get_syndication_targets($user);
  425. $app->response()->body(json_encode(array(
  426. 'targets' => $data['targets'],
  427. 'response' => $data['response']
  428. )));
  429. }
  430. });
  431. $app->post('/micropub/post', function() use($app) {
  432. if($user=require_login($app)) {
  433. $params = $app->request()->params();
  434. // Remove any blank params
  435. $params = array_filter($params, function($v){
  436. return $v !== '';
  437. });
  438. $r = micropub_post_for_user($user, $params);
  439. $app->response()->body(json_encode(array(
  440. 'request' => htmlspecialchars($r['request']),
  441. 'response' => htmlspecialchars($r['response']),
  442. 'location' => $r['location'],
  443. 'error' => $r['error'],
  444. 'curlinfo' => $r['curlinfo']
  445. )));
  446. }
  447. });
  448. $app->post('/micropub/postjson', function() use($app) {
  449. if($user=require_login($app)) {
  450. $params = $app->request()->params();
  451. $r = micropub_post_for_user($user, json_decode($params['data'], true), null, true);
  452. $app->response()->body(json_encode(array(
  453. 'location' => $r['location'],
  454. 'error' => $r['error'],
  455. 'response' => $r['response']
  456. )));
  457. }
  458. });
  459. /*
  460. $app->post('/auth/facebook', function() use($app) {
  461. if($user=require_login($app, false)) {
  462. $params = $app->request()->params();
  463. // User just auth'd with facebook, store the access token
  464. $user->facebook_access_token = $params['fb_token'];
  465. $user->save();
  466. $app->response()->body(json_encode(array(
  467. 'result' => 'ok'
  468. )));
  469. } else {
  470. $app->response()->body(json_encode(array(
  471. 'result' => 'error'
  472. )));
  473. }
  474. });
  475. */
  476. $app->post('/auth/twitter', function() use($app) {
  477. if($user=require_login($app, false)) {
  478. $params = $app->request()->params();
  479. // User just auth'd with twitter, store the access token
  480. $user->twitter_access_token = $params['twitter_token'];
  481. $user->twitter_token_secret = $params['twitter_secret'];
  482. $user->save();
  483. $app->response()->body(json_encode(array(
  484. 'result' => 'ok'
  485. )));
  486. } else {
  487. $app->response()->body(json_encode(array(
  488. 'result' => 'error'
  489. )));
  490. }
  491. });
  492. function getTwitterLoginURL(&$twitter) {
  493. $request_token = $twitter->getRequestToken(Config::$base_url . 'auth/twitter/callback');
  494. $_SESSION['twitter_auth'] = $request_token;
  495. return $twitter->getAuthorizeURL($request_token['oauth_token']);
  496. }
  497. $app->get('/auth/twitter', function() use($app) {
  498. $params = $app->request()->params();
  499. if($user=require_login($app, false)) {
  500. // If there is an existing Twitter token, check if it is valid
  501. // Otherwise, generate a Twitter login link
  502. $twitter_login_url = false;
  503. $twitter = new \TwitterOAuth\Api(Config::$twitterClientID, Config::$twitterClientSecret,
  504. $user->twitter_access_token, $user->twitter_token_secret);
  505. if(array_key_exists('login', $params)) {
  506. $twitter = new \TwitterOAuth\Api(Config::$twitterClientID, Config::$twitterClientSecret);
  507. $twitter_login_url = getTwitterLoginURL($twitter);
  508. } else {
  509. if($user->twitter_access_token) {
  510. if ($twitter->get('account/verify_credentials')) {
  511. $app->response()->body(json_encode(array(
  512. 'result' => 'ok'
  513. )));
  514. return;
  515. } else {
  516. // If the existing twitter token is not valid, generate a login link
  517. $twitter_login_url = getTwitterLoginURL($twitter);
  518. }
  519. } else {
  520. $twitter_login_url = getTwitterLoginURL($twitter);
  521. }
  522. }
  523. $app->response()->body(json_encode(array(
  524. 'url' => $twitter_login_url
  525. )));
  526. } else {
  527. $app->response()->body(json_encode(array(
  528. 'result' => 'error'
  529. )));
  530. }
  531. });
  532. $app->get('/auth/twitter/callback', function() use($app) {
  533. if($user=require_login($app)) {
  534. $params = $app->request()->params();
  535. $twitter = new \TwitterOAuth\Api(Config::$twitterClientID, Config::$twitterClientSecret,
  536. $_SESSION['twitter_auth']['oauth_token'], $_SESSION['twitter_auth']['oauth_token_secret']);
  537. $credentials = $twitter->getAccessToken($params['oauth_verifier']);
  538. $user->twitter_access_token = $credentials['oauth_token'];
  539. $user->twitter_token_secret = $credentials['oauth_token_secret'];
  540. $user->twitter_username = $credentials['screen_name'];
  541. $user->save();
  542. $app->redirect('/settings');
  543. }
  544. });
  545. $app->get('/auth/instagram', function() use($app) {
  546. if($user=require_login($app, false)) {
  547. $instagram = instagram_client();
  548. // If there is an existing Instagram auth token, check if it's valid
  549. if($user->instagram_access_token) {
  550. $instagram->setAccessToken($user->instagram_access_token);
  551. $igUser = $instagram->getUser();
  552. if($igUser && $igUser->meta->code == 200) {
  553. $app->response()->body(json_encode(array(
  554. 'result' => 'ok',
  555. 'username' => $igUser->data->username,
  556. 'url' => $instagram->getLoginUrl(array('basic','likes'))
  557. )));
  558. return;
  559. }
  560. }
  561. $app->response()->body(json_encode(array(
  562. 'result' => 'error',
  563. 'url' => $instagram->getLoginUrl(array('basic','likes'))
  564. )));
  565. }
  566. });
  567. $app->get('/auth/instagram/callback', function() use($app) {
  568. if($user=require_login($app)) {
  569. $params = $app->request()->params();
  570. $instagram = instagram_client();
  571. $data = $instagram->getOAuthToken($params['code']);
  572. $user->instagram_access_token = $data->access_token;
  573. $user->save();
  574. $app->redirect('/settings');
  575. }
  576. });