You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

527 lines
14 KiB

9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
  1. <?php
  2. function require_login(&$app, $redirect=true) {
  3. $params = $app->request()->params();
  4. if(array_key_exists('token', $params)) {
  5. try {
  6. $data = JWT::decode($params['token'], Config::$jwtSecret, array('HS256'));
  7. $_SESSION['user_id'] = $data->user_id;
  8. $_SESSION['me'] = $data->me;
  9. } catch(DomainException $e) {
  10. if($redirect) {
  11. header('X-Error: DomainException');
  12. $app->redirect('/', 301);
  13. } else {
  14. return false;
  15. }
  16. } catch(UnexpectedValueException $e) {
  17. if($redirect) {
  18. header('X-Error: UnexpectedValueException');
  19. $app->redirect('/', 301);
  20. } else {
  21. return false;
  22. }
  23. }
  24. }
  25. if(!array_key_exists('user_id', $_SESSION)) {
  26. if($redirect)
  27. $app->redirect('/');
  28. return false;
  29. } else {
  30. return ORM::for_table('users')->find_one($_SESSION['user_id']);
  31. }
  32. }
  33. function generate_login_token() {
  34. return JWT::encode(array(
  35. 'user_id' => $_SESSION['user_id'],
  36. 'me' => $_SESSION['me'],
  37. 'created_at' => time()
  38. ), Config::$jwtSecret);
  39. }
  40. $app->get('/dashboard', function() use($app) {
  41. if($user=require_login($app)) {
  42. $html = render('dashboard', array(
  43. 'title' => 'Dashboard',
  44. 'authorizing' => false
  45. ));
  46. $app->response()->body($html);
  47. }
  48. });
  49. $app->get('/new', function() use($app) {
  50. if($user=require_login($app)) {
  51. $params = $app->request()->params();
  52. $entry = false;
  53. $in_reply_to = '';
  54. if(array_key_exists('reply', $params))
  55. $in_reply_to = $params['reply'];
  56. $test_response = '';
  57. if($user->last_micropub_response) {
  58. try {
  59. if(@json_decode($user->last_micropub_response)) {
  60. $d = json_decode($user->last_micropub_response);
  61. $test_response = $d->response;
  62. }
  63. } catch(Exception $e) {
  64. }
  65. }
  66. $html = render('new-post', array(
  67. 'title' => 'New Post',
  68. 'in_reply_to' => $in_reply_to,
  69. 'micropub_endpoint' => $user->micropub_endpoint,
  70. 'media_endpoint' => $user->micropub_media_endpoint,
  71. 'micropub_scope' => $user->micropub_scope,
  72. 'micropub_access_token' => $user->micropub_access_token,
  73. 'response_date' => $user->last_micropub_response_date,
  74. 'syndication_targets' => json_decode($user->syndication_targets, true),
  75. 'test_response' => $test_response,
  76. 'location_enabled' => $user->location_enabled,
  77. 'user' => $user,
  78. 'authorizing' => false
  79. ));
  80. $app->response()->body($html);
  81. }
  82. });
  83. $app->get('/bookmark', function() use($app) {
  84. if($user=require_login($app)) {
  85. $params = $app->request()->params();
  86. $url = '';
  87. $name = '';
  88. $content = '';
  89. $tags = '';
  90. if(array_key_exists('url', $params))
  91. $url = $params['url'];
  92. if(array_key_exists('name', $params))
  93. $name = $params['name'];
  94. if(array_key_exists('content', $params))
  95. $content = $params['content'];
  96. $html = render('new-bookmark', array(
  97. 'title' => 'New Bookmark',
  98. 'bookmark_url' => $url,
  99. 'bookmark_name' => $name,
  100. 'bookmark_content' => $content,
  101. 'bookmark_tags' => $tags,
  102. 'token' => generate_login_token(),
  103. 'syndication_targets' => json_decode($user->syndication_targets, true),
  104. 'authorizing' => false
  105. ));
  106. $app->response()->body($html);
  107. }
  108. });
  109. $app->get('/favorite', function() use($app) {
  110. if($user=require_login($app)) {
  111. $params = $app->request()->params();
  112. $url = '';
  113. if(array_key_exists('url', $params))
  114. $url = $params['url'];
  115. $html = render('new-favorite', array(
  116. 'title' => 'New Favorite',
  117. 'url' => $url,
  118. 'token' => generate_login_token(),
  119. 'authorizing' => false
  120. ));
  121. $app->response()->body($html);
  122. }
  123. });
  124. $app->get('/event', function() use($app) {
  125. if($user=require_login($app)) {
  126. $params = $app->request()->params();
  127. $html = render('event', array(
  128. 'title' => 'Event',
  129. 'authorizing' => false
  130. ));
  131. $app->response()->body($html);
  132. }
  133. });
  134. $app->get('/itinerary', function() use($app) {
  135. if($user=require_login($app)) {
  136. $params = $app->request()->params();
  137. $html = render('new-itinerary', array(
  138. 'title' => 'Itinerary',
  139. 'authorizing' => false
  140. ));
  141. $app->response()->body($html);
  142. }
  143. });
  144. $app->get('/photo', function() use($app) {
  145. if($user=require_login($app)) {
  146. $params = $app->request()->params();
  147. $html = render('photo', array(
  148. 'title' => 'New Photo',
  149. 'note_content' => '',
  150. 'authorizing' => false
  151. ));
  152. $app->response()->body($html);
  153. }
  154. });
  155. $app->get('/review', function() use($app) {
  156. if($user=require_login($app)) {
  157. $params = $app->request()->params();
  158. $html = render('review', array(
  159. 'title' => 'Review',
  160. 'authorizing' => false
  161. ));
  162. $app->response()->body($html);
  163. }
  164. });
  165. $app->get('/repost', function() use($app) {
  166. if($user=require_login($app)) {
  167. $params = $app->request()->params();
  168. $url = '';
  169. if(array_key_exists('url', $params))
  170. $url = $params['url'];
  171. $html = render('new-repost', array(
  172. 'title' => 'New Repost',
  173. 'url' => $url,
  174. 'token' => generate_login_token(),
  175. 'authorizing' => false
  176. ));
  177. $app->response()->body($html);
  178. }
  179. });
  180. $app->post('/prefs', function() use($app) {
  181. if($user=require_login($app)) {
  182. $params = $app->request()->params();
  183. $user->location_enabled = $params['enabled'];
  184. $user->save();
  185. }
  186. $app->response()['Content-type'] = 'application/json';
  187. $app->response()->body(json_encode(array(
  188. 'result' => 'ok'
  189. )));
  190. });
  191. $app->get('/creating-a-token-endpoint', function() use($app) {
  192. $app->redirect('http://indiewebcamp.com/token-endpoint', 301);
  193. });
  194. $app->get('/creating-a-micropub-endpoint', function() use($app) {
  195. $html = render('creating-a-micropub-endpoint', array('title' => 'Creating a Micropub Endpoint', 'authorizing' => false));
  196. $app->response()->body($html);
  197. });
  198. $app->get('/docs', function() use($app) {
  199. $html = render('docs', array('title' => 'Documentation', 'authorizing' => false));
  200. $app->response()->body($html);
  201. });
  202. $app->get('/privacy', function() use($app) {
  203. $html = render('privacy', array('title' => 'Quill Privacy Policy', 'authorizing' => false));
  204. $app->response()->body($html);
  205. });
  206. $app->get('/add-to-home', function() use($app) {
  207. $params = $app->request()->params();
  208. header("Cache-Control: no-cache, must-revalidate");
  209. if(array_key_exists('token', $params) && !session('add-to-home-started')) {
  210. unset($_SESSION['add-to-home-started']);
  211. // Verify the token and sign the user in
  212. try {
  213. $data = JWT::decode($params['token'], Config::$jwtSecret, array('HS256'));
  214. $_SESSION['user_id'] = $data->user_id;
  215. $_SESSION['me'] = $data->me;
  216. $app->redirect('/new', 301);
  217. } catch(DomainException $e) {
  218. header('X-Error: DomainException');
  219. $app->redirect('/', 301);
  220. } catch(UnexpectedValueException $e) {
  221. header('X-Error: UnexpectedValueException');
  222. $app->redirect('/', 301);
  223. }
  224. } else {
  225. if($user=require_login($app)) {
  226. if(array_key_exists('start', $params)) {
  227. $_SESSION['add-to-home-started'] = true;
  228. $token = JWT::encode(array(
  229. 'user_id' => $_SESSION['user_id'],
  230. 'me' => $_SESSION['me'],
  231. 'created_at' => time()
  232. ), Config::$jwtSecret);
  233. $app->redirect('/add-to-home?token='.$token, 301);
  234. } else {
  235. unset($_SESSION['add-to-home-started']);
  236. $html = render('add-to-home', array('title' => 'Quill'));
  237. $app->response()->body($html);
  238. }
  239. }
  240. }
  241. });
  242. $app->get('/email', function() use($app) {
  243. if($user=require_login($app)) {
  244. $test_response = '';
  245. if($user->last_micropub_response) {
  246. try {
  247. if(@json_decode($user->last_micropub_response)) {
  248. $d = json_decode($user->last_micropub_response);
  249. $test_response = $d->response;
  250. }
  251. } catch(Exception $e) {
  252. }
  253. }
  254. if(!$user->email_username) {
  255. $host = parse_url($user->url, PHP_URL_HOST);
  256. $user->email_username = $host . '.' . rand(100000,999999);
  257. $user->save();
  258. }
  259. $html = render('email', array(
  260. 'title' => 'Post-by-Email',
  261. 'micropub_endpoint' => $user->micropub_endpoint,
  262. 'test_response' => $test_response,
  263. 'user' => $user
  264. ));
  265. $app->response()->body($html);
  266. }
  267. });
  268. $app->get('/settings', function() use($app) {
  269. if($user=require_login($app)) {
  270. $html = render('settings', [
  271. 'title' => 'Settings',
  272. 'user' => $user,
  273. 'authorizing' => false
  274. ]);
  275. $app->response()->body($html);
  276. }
  277. });
  278. $app->post('/settings/html-content', function() use($app) {
  279. if($user=require_login($app)) {
  280. $params = $app->request()->params();
  281. $user->micropub_optin_html_content = $params['html'] ? 1 : 0;
  282. $user->save();
  283. $app->response()['Content-type'] = 'application/json';
  284. $app->response()->body(json_encode(array(
  285. 'html' => $user->micropub_optin_html_content
  286. )));
  287. }
  288. });
  289. $app->get('/settings/html-content', function() use($app) {
  290. if($user=require_login($app)) {
  291. $app->response()['Content-type'] = 'application/json';
  292. $app->response()->body(json_encode(array(
  293. 'html' => $user->micropub_optin_html_content
  294. )));
  295. }
  296. });
  297. function create_favorite(&$user, $url) {
  298. $micropub_request = array(
  299. 'like-of' => $url
  300. );
  301. $r = micropub_post_for_user($user, $micropub_request);
  302. $tweet_id = false;
  303. // POSSE favorites to Twitter
  304. if($user->twitter_access_token && preg_match('/https?:\/\/(?:www\.)?twitter\.com\/[^\/]+\/status(?:es)?\/(\d+)/', $url, $match)) {
  305. $tweet_id = $match[1];
  306. $twitter = new \TwitterOAuth\Api(Config::$twitterClientID, Config::$twitterClientSecret,
  307. $user->twitter_access_token, $user->twitter_token_secret);
  308. $result = $twitter->post('favorites/create', array(
  309. 'id' => $tweet_id
  310. ));
  311. }
  312. return $r;
  313. }
  314. function create_repost(&$user, $url) {
  315. $micropub_request = array(
  316. 'repost-of' => $url
  317. );
  318. $r = micropub_post_for_user($user, $micropub_request);
  319. $tweet_id = false;
  320. if($user->twitter_access_token && preg_match('/https?:\/\/(?:www\.)?twitter\.com\/[^\/]+\/status(?:es)?\/(\d+)/', $url, $match)) {
  321. $tweet_id = $match[1];
  322. $twitter = new \TwitterOAuth\Api(Config::$twitterClientID, Config::$twitterClientSecret,
  323. $user->twitter_access_token, $user->twitter_token_secret);
  324. $result = $twitter->post('statuses/retweet/'.$tweet_id);
  325. }
  326. return $r;
  327. }
  328. $app->post('/favorite', function() use($app) {
  329. if($user=require_login($app)) {
  330. $params = $app->request()->params();
  331. $r = create_favorite($user, $params['url']);
  332. $app->response()['Content-type'] = 'application/json';
  333. $app->response()->body(json_encode(array(
  334. 'location' => $r['location'],
  335. 'error' => $r['error']
  336. )));
  337. }
  338. });
  339. $app->post('/repost', function() use($app) {
  340. if($user=require_login($app)) {
  341. $params = $app->request()->params();
  342. $r = create_repost($user, $params['url']);
  343. $app->response()['Content-type'] = 'application/json';
  344. $app->response()->body(json_encode(array(
  345. 'location' => $r['location'],
  346. 'error' => $r['error']
  347. )));
  348. }
  349. });
  350. $app->get('/micropub/syndications', function() use($app) {
  351. if($user=require_login($app)) {
  352. $data = get_micropub_config($user, ['q'=>'syndicate-to']);
  353. $app->response()['Content-type'] = 'application/json';
  354. $app->response()->body(json_encode(array(
  355. 'targets' => $data['targets'],
  356. 'response' => $data['response']
  357. )));
  358. }
  359. });
  360. $app->post('/micropub/post', function() use($app) {
  361. if($user=require_login($app)) {
  362. $params = $app->request()->params();
  363. // Remove any blank params
  364. $params = array_filter($params, function($v){
  365. return $v !== '';
  366. });
  367. $r = micropub_post_for_user($user, $params);
  368. $app->response()['Content-type'] = 'application/json';
  369. $app->response()->body(json_encode(array(
  370. 'request' => htmlspecialchars($r['request']),
  371. 'response' => htmlspecialchars($r['response']),
  372. 'location' => $r['location'],
  373. 'error' => $r['error'],
  374. 'curlinfo' => $r['curlinfo']
  375. )));
  376. }
  377. });
  378. $app->post('/micropub/multipart', function() use($app) {
  379. if($user=require_login($app)) {
  380. // var_dump($app->request()->post());
  381. //
  382. // Since $app->request()->post() with multipart is always
  383. // empty (bug in Slim?) We're using the raw $_POST here.
  384. // PHP empties everything in $_POST if the file upload size exceeds
  385. // that is why we have to test if the variables exist first.
  386. $file = isset($_FILES['photo']) ? $_FILES['photo'] : null;
  387. if($file) {
  388. $error = validate_photo($file);
  389. unset($_POST['null']);
  390. if(!$error) {
  391. $file_path = $file['tmp_name'];
  392. correct_photo_rotation($file_path);
  393. $r = micropub_post_for_user($user, $_POST, $file_path);
  394. } else {
  395. $r = array('error' => $error);
  396. }
  397. } else {
  398. unset($_POST['null']);
  399. $r = micropub_post_for_user($user, $_POST);
  400. }
  401. // Populate the error if there was no location header.
  402. if(empty($r['location']) && empty($r['error'])) {
  403. $r['error'] = "No 'Location' header in response.";
  404. }
  405. $app->response()['Content-type'] = 'application/json';
  406. $app->response()->body(json_encode(array(
  407. 'response' => (isset($r['response']) ? htmlspecialchars($r['response']) : null),
  408. 'location' => (isset($r['location']) ? $r['location'] : null),
  409. 'error' => (isset($r['error']) ? $r['error'] : null),
  410. )));
  411. }
  412. });
  413. $app->post('/micropub/media', function() use($app) {
  414. if($user=require_login($app)) {
  415. $file = isset($_FILES['photo']) ? $_FILES['photo'] : null;
  416. $error = validate_photo($file);
  417. unset($_POST['null']);
  418. if(!$error) {
  419. $file_path = $file['tmp_name'];
  420. correct_photo_rotation($file_path);
  421. $r = micropub_media_post_for_user($user, $file_path);
  422. } else {
  423. $r = array('error' => $error);
  424. }
  425. if(empty($r['location']) && empty($r['error'])) {
  426. $r['error'] = "No 'Location' header in response.";
  427. }
  428. $app->response()['Content-type'] = 'application/json';
  429. $app->response()->body(json_encode(array(
  430. 'location' => (isset($r['location']) ? $r['location'] : null),
  431. 'error' => (isset($r['error']) ? $r['error'] : null),
  432. )));
  433. }
  434. });
  435. $app->post('/micropub/postjson', function() use($app) {
  436. if($user=require_login($app)) {
  437. $params = $app->request()->params();
  438. $r = micropub_post_for_user($user, json_decode($params['data'], true), null, true);
  439. $app->response()['Content-type'] = 'application/json';
  440. $app->response()->body(json_encode(array(
  441. 'location' => $r['location'],
  442. 'error' => $r['error'],
  443. 'response' => $r['response']
  444. )));
  445. }
  446. });