You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

584 lines
16 KiB

9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
  1. <?php
  2. use Abraham\TwitterOAuth\TwitterOAuth;
  3. function require_login(&$app, $redirect=true) {
  4. $params = $app->request()->params();
  5. if(array_key_exists('token', $params)) {
  6. try {
  7. $data = JWT::decode($params['token'], Config::$jwtSecret, array('HS256'));
  8. $_SESSION['user_id'] = $data->user_id;
  9. $_SESSION['me'] = $data->me;
  10. } catch(DomainException $e) {
  11. if($redirect) {
  12. header('X-Error: DomainException');
  13. $app->redirect('/', 301);
  14. } else {
  15. return false;
  16. }
  17. } catch(UnexpectedValueException $e) {
  18. if($redirect) {
  19. header('X-Error: UnexpectedValueException');
  20. $app->redirect('/', 301);
  21. } else {
  22. return false;
  23. }
  24. }
  25. }
  26. if(!array_key_exists('user_id', $_SESSION)) {
  27. if($redirect)
  28. $app->redirect('/');
  29. return false;
  30. } else {
  31. return ORM::for_table('users')->find_one($_SESSION['user_id']);
  32. }
  33. }
  34. function generate_login_token() {
  35. return JWT::encode(array(
  36. 'user_id' => $_SESSION['user_id'],
  37. 'me' => $_SESSION['me'],
  38. 'created_at' => time()
  39. ), Config::$jwtSecret);
  40. }
  41. $app->get('/dashboard', function() use($app) {
  42. if($user=require_login($app)) {
  43. $html = render('dashboard', array(
  44. 'title' => 'Dashboard',
  45. 'authorizing' => false
  46. ));
  47. $app->response()->body($html);
  48. }
  49. });
  50. $app->get('/new', function() use($app) {
  51. if($user=require_login($app)) {
  52. $params = $app->request()->params();
  53. $entry = false;
  54. $in_reply_to = '';
  55. if(array_key_exists('reply', $params))
  56. $in_reply_to = $params['reply'];
  57. $test_response = '';
  58. if($user->last_micropub_response) {
  59. try {
  60. if(@json_decode($user->last_micropub_response)) {
  61. $d = json_decode($user->last_micropub_response);
  62. $test_response = $d->response;
  63. }
  64. } catch(Exception $e) {
  65. }
  66. }
  67. $html = render('new-post', array(
  68. 'title' => 'New Post',
  69. 'in_reply_to' => $in_reply_to,
  70. 'micropub_endpoint' => $user->micropub_endpoint,
  71. 'media_endpoint' => $user->micropub_media_endpoint,
  72. 'micropub_scope' => $user->micropub_scope,
  73. 'micropub_access_token' => $user->micropub_access_token,
  74. 'response_date' => $user->last_micropub_response_date,
  75. 'syndication_targets' => json_decode($user->syndication_targets, true),
  76. 'test_response' => $test_response,
  77. 'location_enabled' => $user->location_enabled,
  78. 'user' => $user,
  79. 'authorizing' => false
  80. ));
  81. $app->response()->body($html);
  82. }
  83. });
  84. $app->get('/bookmark', function() use($app) {
  85. if($user=require_login($app)) {
  86. $params = $app->request()->params();
  87. $url = '';
  88. $name = '';
  89. $content = '';
  90. $tags = '';
  91. if(array_key_exists('url', $params))
  92. $url = $params['url'];
  93. if(array_key_exists('name', $params))
  94. $name = $params['name'];
  95. if(array_key_exists('content', $params))
  96. $content = $params['content'];
  97. $html = render('new-bookmark', array(
  98. 'title' => 'New Bookmark',
  99. 'bookmark_url' => $url,
  100. 'bookmark_name' => $name,
  101. 'bookmark_content' => $content,
  102. 'bookmark_tags' => $tags,
  103. 'token' => generate_login_token(),
  104. 'syndication_targets' => json_decode($user->syndication_targets, true),
  105. 'authorizing' => false
  106. ));
  107. $app->response()->body($html);
  108. }
  109. });
  110. $app->get('/favorite', function() use($app) {
  111. if($user=require_login($app)) {
  112. $params = $app->request()->params();
  113. $url = '';
  114. if(array_key_exists('url', $params))
  115. $url = $params['url'];
  116. $html = render('new-favorite', array(
  117. 'title' => 'New Favorite',
  118. 'url' => $url,
  119. 'token' => generate_login_token(),
  120. 'authorizing' => false
  121. ));
  122. $app->response()->body($html);
  123. }
  124. });
  125. $app->get('/event', function() use($app) {
  126. if($user=require_login($app)) {
  127. $params = $app->request()->params();
  128. $html = render('event', array(
  129. 'title' => 'Event',
  130. 'authorizing' => false
  131. ));
  132. $app->response()->body($html);
  133. }
  134. });
  135. $app->get('/itinerary', function() use($app) {
  136. if($user=require_login($app)) {
  137. $params = $app->request()->params();
  138. $html = render('new-itinerary', array(
  139. 'title' => 'Itinerary',
  140. 'authorizing' => false
  141. ));
  142. $app->response()->body($html);
  143. }
  144. });
  145. $app->get('/photo', function() use($app) {
  146. if($user=require_login($app)) {
  147. $params = $app->request()->params();
  148. $html = render('photo', array(
  149. 'title' => 'New Photo',
  150. 'note_content' => '',
  151. 'authorizing' => false
  152. ));
  153. $app->response()->body($html);
  154. }
  155. });
  156. $app->get('/review', function() use($app) {
  157. if($user=require_login($app)) {
  158. $params = $app->request()->params();
  159. $html = render('review', array(
  160. 'title' => 'Review',
  161. 'authorizing' => false
  162. ));
  163. $app->response()->body($html);
  164. }
  165. });
  166. $app->get('/repost', function() use($app) {
  167. if($user=require_login($app)) {
  168. $params = $app->request()->params();
  169. $url = '';
  170. if(array_key_exists('url', $params))
  171. $url = $params['url'];
  172. $html = render('new-repost', array(
  173. 'title' => 'New Repost',
  174. 'url' => $url,
  175. 'token' => generate_login_token(),
  176. 'authorizing' => false
  177. ));
  178. $app->response()->body($html);
  179. }
  180. });
  181. $app->post('/prefs', function() use($app) {
  182. if($user=require_login($app)) {
  183. $params = $app->request()->params();
  184. $user->location_enabled = $params['enabled'];
  185. $user->save();
  186. }
  187. $app->response()['Content-type'] = 'application/json';
  188. $app->response()->body(json_encode(array(
  189. 'result' => 'ok'
  190. )));
  191. });
  192. $app->get('/add-to-home', function() use($app) {
  193. $params = $app->request()->params();
  194. header("Cache-Control: no-cache, must-revalidate");
  195. if(array_key_exists('token', $params) && !session('add-to-home-started')) {
  196. unset($_SESSION['add-to-home-started']);
  197. // Verify the token and sign the user in
  198. try {
  199. $data = JWT::decode($params['token'], Config::$jwtSecret, array('HS256'));
  200. $_SESSION['user_id'] = $data->user_id;
  201. $_SESSION['me'] = $data->me;
  202. $app->redirect('/new', 301);
  203. } catch(DomainException $e) {
  204. header('X-Error: DomainException');
  205. $app->redirect('/', 301);
  206. } catch(UnexpectedValueException $e) {
  207. header('X-Error: UnexpectedValueException');
  208. $app->redirect('/', 301);
  209. }
  210. } else {
  211. if($user=require_login($app)) {
  212. if(array_key_exists('start', $params)) {
  213. $_SESSION['add-to-home-started'] = true;
  214. $token = JWT::encode(array(
  215. 'user_id' => $_SESSION['user_id'],
  216. 'me' => $_SESSION['me'],
  217. 'created_at' => time()
  218. ), Config::$jwtSecret);
  219. $app->redirect('/add-to-home?token='.$token, 301);
  220. } else {
  221. unset($_SESSION['add-to-home-started']);
  222. $html = render('add-to-home', array('title' => 'Quill'));
  223. $app->response()->body($html);
  224. }
  225. }
  226. }
  227. });
  228. $app->get('/email', function() use($app) {
  229. if($user=require_login($app)) {
  230. $test_response = '';
  231. if($user->last_micropub_response) {
  232. try {
  233. if(@json_decode($user->last_micropub_response)) {
  234. $d = json_decode($user->last_micropub_response);
  235. $test_response = $d->response;
  236. }
  237. } catch(Exception $e) {
  238. }
  239. }
  240. if(!$user->email_username) {
  241. $host = parse_url($user->url, PHP_URL_HOST);
  242. $user->email_username = $host . '.' . rand(100000,999999);
  243. $user->save();
  244. }
  245. $html = render('email', array(
  246. 'title' => 'Post-by-Email',
  247. 'micropub_endpoint' => $user->micropub_endpoint,
  248. 'test_response' => $test_response,
  249. 'user' => $user
  250. ));
  251. $app->response()->body($html);
  252. }
  253. });
  254. $app->get('/settings', function() use($app) {
  255. if($user=require_login($app)) {
  256. $html = render('settings', [
  257. 'title' => 'Settings',
  258. 'user' => $user,
  259. 'authorizing' => false
  260. ]);
  261. $app->response()->body($html);
  262. }
  263. });
  264. $app->post('/settings/html-content', function() use($app) {
  265. if($user=require_login($app)) {
  266. $params = $app->request()->params();
  267. $user->micropub_optin_html_content = $params['html'] ? 1 : 0;
  268. $user->save();
  269. $app->response()['Content-type'] = 'application/json';
  270. $app->response()->body(json_encode(array(
  271. 'html' => $user->micropub_optin_html_content
  272. )));
  273. }
  274. });
  275. $app->get('/settings/html-content', function() use($app) {
  276. if($user=require_login($app)) {
  277. $app->response()['Content-type'] = 'application/json';
  278. $app->response()->body(json_encode(array(
  279. 'html' => $user->micropub_optin_html_content
  280. )));
  281. }
  282. });
  283. function create_favorite(&$user, $url) {
  284. $micropub_request = array(
  285. 'like-of' => $url
  286. );
  287. $r = micropub_post_for_user($user, $micropub_request);
  288. $tweet_id = false;
  289. // POSSE favorites to Twitter
  290. if($user->twitter_access_token && preg_match('/https?:\/\/(?:www\.)?twitter\.com\/[^\/]+\/status(?:es)?\/(\d+)/', $url, $match)) {
  291. $tweet_id = $match[1];
  292. $twitter = new TwitterOAuth(Config::$twitterClientID, Config::$twitterClientSecret,
  293. $user->twitter_access_token, $user->twitter_token_secret);
  294. $result = $twitter->post('favorites/create', array(
  295. 'id' => $tweet_id
  296. ));
  297. }
  298. return $r;
  299. }
  300. function create_repost(&$user, $url) {
  301. $micropub_request = array(
  302. 'repost-of' => $url
  303. );
  304. $r = micropub_post_for_user($user, $micropub_request);
  305. $tweet_id = false;
  306. if($user->twitter_access_token && preg_match('/https?:\/\/(?:www\.)?twitter\.com\/[^\/]+\/status(?:es)?\/(\d+)/', $url, $match)) {
  307. $tweet_id = $match[1];
  308. $twitter = new TwitterOAuth(Config::$twitterClientID, Config::$twitterClientSecret,
  309. $user->twitter_access_token, $user->twitter_token_secret);
  310. $result = $twitter->post('statuses/retweet/'.$tweet_id);
  311. }
  312. return $r;
  313. }
  314. $app->post('/favorite', function() use($app) {
  315. if($user=require_login($app)) {
  316. $params = $app->request()->params();
  317. $r = create_favorite($user, $params['url']);
  318. $app->response()['Content-type'] = 'application/json';
  319. $app->response()->body(json_encode(array(
  320. 'location' => $r['location'],
  321. 'error' => $r['error']
  322. )));
  323. }
  324. });
  325. $app->post('/repost', function() use($app) {
  326. if($user=require_login($app)) {
  327. $params = $app->request()->params();
  328. $r = create_repost($user, $params['url']);
  329. $app->response()['Content-type'] = 'application/json';
  330. $app->response()->body(json_encode(array(
  331. 'location' => $r['location'],
  332. 'error' => $r['error']
  333. )));
  334. }
  335. });
  336. $app->get('/reply/preview', function() use($app) {
  337. if($user=require_login($app)) {
  338. $params = $app->request()->params();
  339. if(!isset($params['url']) || !$params['url']) {
  340. return '';
  341. }
  342. $reply_url = trim($params['url']);
  343. if(preg_match('/twtr\.io\/([0-9a-z]+)/i', $reply_url, $match)) {
  344. $twtr = 'https://twitter.com/_/status/' . sxg_to_num($match[1]);
  345. $ch = curl_init($twtr);
  346. curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  347. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
  348. curl_exec($ch);
  349. $expanded_url = curl_getinfo($ch, CURLINFO_EFFECTIVE_URL);
  350. if($expanded_url) $reply_url = $expanded_url;
  351. }
  352. $entry = false;
  353. // Convert Tweets to h-entry
  354. if(preg_match('/twitter\.com\/(?:[^\/]+)\/statuse?s?\/(.+)/', $reply_url, $match)) {
  355. $tweet_id = $match[1];
  356. if($user->twitter_access_token) {
  357. $twitter = new TwitterOAuth(Config::$twitterClientID, Config::$twitterClientSecret,
  358. $user->twitter_access_token, $user->twitter_token_secret);
  359. } else {
  360. $twitter = new TwitterOAuth(Config::$twitterClientID, Config::$twitterClientSecret);
  361. }
  362. $tweet = $twitter->get('statuses/show/'.$tweet_id);
  363. $entry = tweet_to_h_entry($tweet);
  364. } else {
  365. // Pass to X-Ray to see if it can expand the entry
  366. $ch = curl_init('https://xray.p3k.io/parse?url='.urlencode($reply_url));
  367. curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  368. $response = curl_exec($ch);
  369. $data = @json_decode($response, true);
  370. if($data && $data['data']['type'] == 'entry') {
  371. $entry = $data['data'];
  372. // Create a nickname based on the author URL
  373. if(array_key_exists('author', $entry) && $entry['author']['url']) {
  374. $entry['author']['nickname'] = display_url($entry['author']['url']);
  375. }
  376. }
  377. }
  378. $mentions = [];
  379. if($entry) {
  380. if(array_key_exists('author', $entry)) {
  381. // Find all @-names in the post, as well as the author name
  382. $mentions[] = strtolower($entry['author']['nickname']);
  383. }
  384. if(preg_match_all('/(^|(?<=[\s\/]))@([a-z0-9_]+([a-z0-9_\.]*)?)/i', $entry['content']['text'], $matches)) {
  385. foreach($matches[0] as $nick) {
  386. if(trim($nick,'@') != $user->twitter_username && trim($nick,'@') != display_url($user->url))
  387. $mentions[] = strtolower(trim($nick,'@'));
  388. }
  389. }
  390. $mentions = array_values(array_unique($mentions));
  391. }
  392. $app->response()['Content-type'] = 'application/json';
  393. $app->response()->body(json_encode([
  394. 'canonical_reply_url' => $reply_url,
  395. 'entry' => $entry,
  396. 'mentions' => $mentions
  397. ]));
  398. }
  399. });
  400. $app->get('/micropub/syndications', function() use($app) {
  401. if($user=require_login($app)) {
  402. $data = get_micropub_config($user, ['q'=>'syndicate-to']);
  403. $app->response()['Content-type'] = 'application/json';
  404. $app->response()->body(json_encode(array(
  405. 'targets' => $data['targets'],
  406. 'response' => $data['response']
  407. )));
  408. }
  409. });
  410. $app->post('/micropub/post', function() use($app) {
  411. if($user=require_login($app)) {
  412. $params = $app->request()->params();
  413. // Remove any blank params
  414. $params = array_filter($params, function($v){
  415. return $v !== '';
  416. });
  417. $r = micropub_post_for_user($user, $params);
  418. $app->response()['Content-type'] = 'application/json';
  419. $app->response()->body(json_encode(array(
  420. 'request' => htmlspecialchars($r['request']),
  421. 'response' => htmlspecialchars($r['response']),
  422. 'location' => $r['location'],
  423. 'error' => $r['error'],
  424. 'curlinfo' => $r['curlinfo']
  425. )));
  426. }
  427. });
  428. $app->post('/micropub/multipart', function() use($app) {
  429. if($user=require_login($app)) {
  430. // var_dump($app->request()->post());
  431. //
  432. // Since $app->request()->post() with multipart is always
  433. // empty (bug in Slim?) We're using the raw $_POST here.
  434. // PHP empties everything in $_POST if the file upload size exceeds
  435. // that is why we have to test if the variables exist first.
  436. $file = isset($_FILES['photo']) ? $_FILES['photo'] : null;
  437. if($file) {
  438. $error = validate_photo($file);
  439. unset($_POST['null']);
  440. if(!$error) {
  441. $file_path = $file['tmp_name'];
  442. correct_photo_rotation($file_path);
  443. $r = micropub_post_for_user($user, $_POST, $file_path);
  444. } else {
  445. $r = array('error' => $error);
  446. }
  447. } else {
  448. unset($_POST['null']);
  449. $r = micropub_post_for_user($user, $_POST);
  450. }
  451. // Populate the error if there was no location header.
  452. if(empty($r['location']) && empty($r['error'])) {
  453. $r['error'] = "No 'Location' header in response.";
  454. }
  455. $app->response()['Content-type'] = 'application/json';
  456. $app->response()->body(json_encode(array(
  457. 'response' => (isset($r['response']) ? htmlspecialchars($r['response']) : null),
  458. 'location' => (isset($r['location']) ? $r['location'] : null),
  459. 'error' => (isset($r['error']) ? $r['error'] : null),
  460. )));
  461. }
  462. });
  463. $app->post('/micropub/media', function() use($app) {
  464. if($user=require_login($app)) {
  465. $file = isset($_FILES['photo']) ? $_FILES['photo'] : null;
  466. $error = validate_photo($file);
  467. unset($_POST['null']);
  468. if(!$error) {
  469. $file_path = $file['tmp_name'];
  470. correct_photo_rotation($file_path);
  471. $r = micropub_media_post_for_user($user, $file_path);
  472. } else {
  473. $r = array('error' => $error);
  474. }
  475. if(empty($r['location']) && empty($r['error'])) {
  476. $r['error'] = "No 'Location' header in response.";
  477. }
  478. $app->response()['Content-type'] = 'application/json';
  479. $app->response()->body(json_encode(array(
  480. 'location' => (isset($r['location']) ? $r['location'] : null),
  481. 'error' => (isset($r['error']) ? $r['error'] : null),
  482. )));
  483. }
  484. });
  485. $app->post('/micropub/postjson', function() use($app) {
  486. if($user=require_login($app)) {
  487. $params = $app->request()->params();
  488. $r = micropub_post_for_user($user, json_decode($params['data'], true), null, true);
  489. $app->response()['Content-type'] = 'application/json';
  490. $app->response()->body(json_encode(array(
  491. 'location' => $r['location'],
  492. 'error' => $r['error'],
  493. 'response' => $r['response']
  494. )));
  495. }
  496. });