function share_init(&$a) { $post_id = argc() > 1 ? intval(argv(1)) : 0; if (!$post_id) { killme(); } if (!(local_channel() || remote_channel())) { killme(); } $r = q("SELECT * from item left join xchan on author_xchan = xchan_hash WHERE id = %d LIMIT 1", intval($post_id)); if (!$r) { killme(); } if ($r[0]['item_private'] && $r[0]['xchan_network'] !== 'rss') { killme(); } $sql_extra = item_permissions_sql($r[0]['uid']); $r = q("select * from item where id = %d {$sql_extra}", intval($post_id)); if (!$r) { killme(); } /** @FIXME we only share bbcode */ if ($r[0]['mimetype'] !== 'text/bbcode') { killme(); } /** @FIXME eventually we want to post remotely via rpost on your home site */ // When that works remove this next bit: if (!local_channel()) { killme(); } xchan_query($r); if (strpos($r[0]['body'], "[/share]") !== false) { $pos = strpos($r[0]['body'], "[share"); $o = substr($r[0]['body'], $pos); } else { $o = "[share author='" . urlencode($r[0]['author']['xchan_name']) . "' profile='" . $r[0]['author']['xchan_url'] . "' avatar='" . $r[0]['author']['xchan_photo_s'] . "' link='" . $r[0]['plink'] . "' posted='" . $r[0]['created'] . "' message_id='" . $r[0]['mid'] . "']"; if ($r[0]['title']) { $o .= '[b]' . $r[0]['title'] . '[/b]' . "\n"; } $o .= $r[0]['body']; $o .= "[/share]"; } if (local_channel()) { echo $o; killme(); } $observer = $a->get_observer(); $parsed = $observer['xchan_url']; if ($parsed) { $post_url = $parsed['scheme'] . ':' . $parsed['host'] . ($parsed['port'] ? ':' . $parsed['port'] : '') . '/rpost'; /** * @FIXME we were probably called from JS so we don't know the return page. * In fact we won't be able to load the remote page. * we might need an iframe */ $x = z_post_url($post_url, array('f' => '', 'body' => $o)); killme(); } }
function page_content(&$a) { $observer = $a->get_observer(); $ob_hash = $observer ? $observer['xchan_hash'] : ''; $perms = get_all_perms($a->profile['profile_uid'], $ob_hash); if (!$perms['view_pages']) { notice(t('Permission denied.') . EOL); return; } if (argc() < 3) { notice(t('Invalid item.') . EOL); return; } $channel_address = argv(1); $page_id = argv(2); $u = q("select channel_id from channel where channel_address = '%s' limit 1", dbesc($channel_address)); if (!$u) { notice(t('Channel not found.') . EOL); return; } if ($_REQUEST['rev']) { $revision = " and revision = " . intval($_REQUEST['rev']) . " "; } else { $revision = " order by revision desc "; } require_once 'include/security.php'; $sql_options = item_permissions_sql($u[0]['channel_id']); $r = q("select item.* from item left join item_id on item.id = item_id.iid\n\t\twhere item.uid = %d and sid = '%s' and service = 'WEBPAGE' and \n\t\titem_restrict = %d {$sql_options} {$revision} limit 1", intval($u[0]['channel_id']), dbesc($page_id), intval(ITEM_WEBPAGE)); if (!$r) { // Check again with no permissions clause to see if it is a permissions issue $x = q("select item.* from item left join item_id on item.id = item_id.iid\n\t\twhere item.uid = %d and sid = '%s' and service = 'WEBPAGE' and \n\t\titem_restrict = %d {$revision} limit 1", intval($u[0]['channel_id']), dbesc($page_id), intval(ITEM_WEBPAGE)); if ($x) { // Yes, it's there. You just aren't allowed to see it. notice(t('Permission denied.') . EOL); } else { notice(t('Page not found.') . EOL); } return; } if ($r[0]['layout_mid']) { $l = q("select body from item where mid = '%s' and uid = %d limit 1", dbesc($r[0]['layout_mid']), intval($u[0]['channel_id'])); if ($l) { require_once 'include/comanche.php'; comanche_parser(get_app(), $l[0]['body']); } } // logger('layout: ' . print_r($a->layout,true)); // Use of widgets should be determined by Comanche, but we don't have it on system pages yet, so... if ($perms['write_pages']) { $chan = $a->channel['channel_id']; $who = $channel_address; $which = $r[0]['id']; $o .= writepages_widget($who, $which); } xchan_query($r); $r = fetch_post_tags($r, true); $o .= prepare_page($r[0]); return $o; }
function page_init(&$a) { // We need this to make sure the channel theme is always loaded. $which = argv(1); $profile = 0; profile_load($a, $which, $profile); if ($a->profile['profile_uid']) { head_set_icon($a->profile['thumb']); } // load the item here in the init function because we need to extract // the page layout and initialise the correct theme. $observer = $a->get_observer(); $ob_hash = $observer ? $observer['xchan_hash'] : ''; $perms = get_all_perms($a->profile['profile_uid'], $ob_hash); if (!$perms['view_pages']) { notice(t('Permission denied.') . EOL); return; } if (argc() < 3) { notice(t('Invalid item.') . EOL); return; } $channel_address = argv(1); $page_id = argv(2); $u = q("select channel_id from channel where channel_address = '%s' limit 1", dbesc($channel_address)); if (!$u) { notice(t('Channel not found.') . EOL); return; } if ($_REQUEST['rev']) { $revision = " and revision = " . intval($_REQUEST['rev']) . " "; } else { $revision = " order by revision desc "; } require_once 'include/security.php'; $sql_options = item_permissions_sql($u[0]['channel_id']); $r = q("select item.* from item left join item_id on item.id = item_id.iid\n\t\twhere item.uid = %d and sid = '%s' and service = 'WEBPAGE' and \n\t\titem_restrict = %d {$sql_options} {$revision} limit 1", intval($u[0]['channel_id']), dbesc($page_id), intval(ITEM_WEBPAGE)); if (!$r) { // Check again with no permissions clause to see if it is a permissions issue $x = q("select item.* from item left join item_id on item.id = item_id.iid\n\t\twhere item.uid = %d and sid = '%s' and service = 'WEBPAGE' and \n\t\titem_restrict = %d {$revision} limit 1", intval($u[0]['channel_id']), dbesc($page_id), intval(ITEM_WEBPAGE)); if ($x) { // Yes, it's there. You just aren't allowed to see it. notice(t('Permission denied.') . EOL); } else { notice(t('Page not found.') . EOL); } return; } if ($r[0]['layout_mid']) { $l = q("select body from item where mid = '%s' and uid = %d limit 1", dbesc($r[0]['layout_mid']), intval($u[0]['channel_id'])); if ($l) { require_once 'include/comanche.php'; comanche_parser(get_app(), $l[0]['body']); get_app()->pdl = $l[0]['body']; } } $a->data['webpage'] = $r; }
function tagadelic($uid, $count = 0, $authors = '', $owner = '', $flags = 0, $restrict = 0, $type = TERM_HASHTAG) { require_once 'include/security.php'; if (!perm_is_allowed($uid, get_observer_hash(), 'view_stream')) { return array(); } $sql_options = item_permissions_sql($uid); $count = intval($count); if ($flags) { if ($flags === 'wall') { $sql_options .= " and item_wall = 1 "; } } if ($authors) { if (!is_array($authors)) { $authors = array($authors); } stringify_array_elms($authors, true); $sql_options .= " and author_xchan in (" . implode(',', $authors) . ") "; } if ($owner) { $sql_options .= " and owner_xchan = '" . dbesc($owner) . "' "; } // Fetch tags $r = q("select term, count(term) as total from term left join item on term.oid = item.id\n\t\twhere term.uid = %d and term.type = %d \n\t\tand otype = %d and item_type = %d and item_private = 0\n\t\t{$sql_options}\n\t\tgroup by term order by total desc %s", intval($uid), intval($type), intval(TERM_OBJ_POST), intval($restrict), intval($count) ? "limit {$count}" : ''); if (!$r) { return array(); } // Find minimum and maximum log-count. $tags = array(); $min = 1000000000.0; $max = -1000000000.0; $x = 0; foreach ($r as $rr) { $tags[$x][0] = $rr['term']; $tags[$x][1] = log($rr['total']); $tags[$x][2] = 0; $min = min($min, $tags[$x][1]); $max = max($max, $tags[$x][1]); $x++; } usort($tags, 'tags_sort'); $range = max(0.01, $max - $min) * 1.0001; for ($x = 0; $x < count($tags); $x++) { $tags[$x][2] = 1 + floor(9 * ($tags[$x][1] - $min) / $range); } return $tags; }
function pdl_selector($uid, $current = "") { $o = ''; $sql_extra = item_permissions_sql($uid); $r = q("select item_id.*, mid from item_id left join item on iid = item.id where item_id.uid = %d and item_id.uid = item.uid and service = 'PDL' {$sql_extra} order by sid asc", intval($uid)); $arr = array('channel_id' => $uid, 'current' => $current, 'entries' => $r); call_hooks('pdl_selector', $arr); $entries = $arr['entries']; $current = $arr['current']; $o .= '<select name="pdl_select" id="pdl_select" size="1">'; $entries[] = array('title' => t('Default'), 'mid' => ''); foreach ($entries as $selection) { $selected = $selection == $current ? ' selected="selected" ' : ''; $o .= "<option value=\"{$selection['mid']}\" {$selected} >{$selection['sid']}</option>"; } $o .= '</select>'; return $o; }
function block_content(&$a) { if (!perm_is_allowed($a->profile['profile_uid'], get_observer_hash(), 'view_pages')) { notice(t('Permission denied.') . EOL); return; } if (argc() < 3) { notice(t('Invalid item.') . EOL); return; } $channel_address = argv(1); $page_id = argv(2); $u = q("select channel_id from channel where channel_address = '%s' limit 1", dbesc($channel_address)); if (!$u) { notice(t('Channel not found.') . EOL); return; } if ($_REQUEST['rev']) { $revision = " and revision = " . intval($_REQUEST['rev']) . " "; } else { $revision = " order by revision desc "; } require_once 'include/security.php'; $sql_options = item_permissions_sql($u[0]['channel_id']); $r = q("select item.* from item left join item_id on item.id = item_id.iid\n\t\twhere item.uid = %d and sid = '%s' and service = 'BUILDBLOCK' and \n\t\titem_type = %d {$sql_options} {$revision} limit 1", intval($u[0]['channel_id']), dbesc($page_id), intval(ITEM_TYPE_BLOCK)); if (!$r) { // Check again with no permissions clause to see if it is a permissions issue $x = q("select item.* from item left join item_id on item.id = item_id.iid\n\t\twhere item.uid = %d and sid = '%s' and service = 'BUILDBLOCK' and \n\t\titem_type = %d {$revision} limit 1", intval($u[0]['channel_id']), dbesc($page_id), intval(ITEM_TYPE_BLOCK)); if ($x) { // Yes, it's there. You just aren't allowed to see it. notice(t('Permission denied.') . EOL); } else { notice(t('Page not found.') . EOL); } return; } xchan_query($r); $r = fetch_post_tags($r, true); $o .= prepare_page($r[0]); return $o; }
/** * API: map_getSharedData * Retrieve the available data * @param type $type * @param type $filter */ function map_getSharedData($type, $filter) { if (local_channel() || remote_channel()) { $channel = App::get_channel(); $sql_extra = item_permissions_sql($channel['channel_id'], get_observer_hash()); } else { $sql_extra = " AND item_private = 0 "; } switch ($filter) { case 'owner': $shares = q("SELECT owner_xchan,resource_id FROM item WHERE resource_type = '%s' AND owner_xchan != '%s' AND object LIKE '%s' {$sql_extra}", dbesc('locserv'), dbesc(App::get_channel()['channel_hash']), dbesc('%"locationDataType":"' . $type . '"%')); $channels = []; foreach ($shares as $share) { $channel = channelx_by_hash($share['owner_xchan']); $channels[] = array('name' => $channel['channel_name'], 'address' => $channel['xchan_addr'], 'photo_address' => $channel['xchan_photo_s']); } echo json_encode(array('sharedData' => $shares, 'channels' => $channels, 'status' => true)); die; case 'all': $shares = q("SELECT owner_xchan,resource_id FROM item WHERE resource_type = '%s' AND owner_xchan != '%s' AND object LIKE '%s' {$sql_extra}", dbesc('locserv'), dbesc(App::get_channel()['channel_hash']), dbesc('%"locationDataType":"' . $type . '"%')); $channels = []; $markers = []; foreach ($shares as $share) { $channel = channelx_by_hash($share['owner_xchan']); $channels[] = array('name' => $channel['channel_name'], 'address' => $channel['xchan_addr'], 'photo_address' => $channel['xchan_photo_s']); // FIXME: Not sure the permissions are checked appropriately here $marker = q("SELECT lat,lon,title,body,layer,created,resource_id FROM `locserv-static-markers` WHERE resource_id = '%s' limit 1", dbesc($share['resource_id'])); $markers[] = $marker[0]; } echo json_encode(array('sharedData' => $shares, 'channels' => $channels, 'markers' => $markers, 'status' => true)); die; default: echo json_encode(array('sharedData' => null, 'channels' => null, 'markers' => null, 'status' => false)); die; } }
function public_content(&$a, $update = 0, $load = false) { if ($load) { $_SESSION['loadtime'] = datetime_convert(); } if (get_config('system', 'block_public') && !get_account_id() && !remote_channel()) { return login(); } if (get_config('system', 'disable_discover_tab')) { return; } $item_normal = item_normal(); if (!$update) { $maxheight = get_config('system', 'home_divmore_height'); if (!$maxheight) { $maxheight = 400; } $o .= '<div id="live-public"></div>' . "\r\n"; $o .= "<script> var profile_uid = " . (intval(local_channel()) ? local_channel() : -1) . "; var profile_page = " . App::$pager['page'] . "; divmore_height = " . intval($maxheight) . "; </script>\r\n"; App::$page['htmlhead'] .= replace_macros(get_markup_template("build_query.tpl"), array('$baseurl' => z_root(), '$pgtype' => 'public', '$uid' => local_channel() ? local_channel() : '0', '$gid' => '0', '$cid' => '0', '$cmin' => '0', '$cmax' => '99', '$star' => '0', '$liked' => '0', '$conv' => '0', '$spam' => '0', '$fh' => '1', '$nouveau' => '0', '$wall' => '0', '$list' => '0', '$page' => App::$pager['page'] != 1 ? App::$pager['page'] : 1, '$search' => '', '$order' => 'comment', '$file' => '', '$cats' => '', '$tags' => '', '$dend' => '', '$mid' => '', '$verb' => '', '$dbegin' => '')); } if ($update && !$load) { // only setup pagination on initial page view $pager_sql = ''; } else { App::set_pager_itemspage(20); $pager_sql = sprintf(" LIMIT %d OFFSET %d ", intval(App::$pager['itemspage']), intval(App::$pager['start'])); } require_once 'include/identity.php'; require_once 'include/security.php'; if (get_config('system', 'site_firehose')) { $uids = " and item.uid in ( " . stream_perms_api_uids(PERMS_PUBLIC) . " ) and item_private = 0 and item_wall = 1 "; } else { $sys = get_sys_channel(); $uids = " and item.uid = " . intval($sys['channel_id']) . " "; $sql_extra = item_permissions_sql($sys['channel_id']); App::$data['firehose'] = intval($sys['channel_id']); } if (get_config('system', 'public_list_mode')) { $page_mode = 'list'; } else { $page_mode = 'client'; } $simple_update = $update ? " and item.item_unseen = 1 " : ''; if ($update && $_SESSION['loadtime']) { $simple_update = " AND (( item_unseen = 1 AND item.changed > '" . datetime_convert('UTC', 'UTC', $_SESSION['loadtime']) . "' ) OR item.changed > '" . datetime_convert('UTC', 'UTC', $_SESSION['loadtime']) . "' ) "; } if ($load) { $simple_update = ''; } //logger('update: ' . $update . ' load: ' . $load); if ($update) { $ordering = "commented"; if ($load) { // Fetch a page full of parent items for this page $r = q("SELECT distinct item.id AS item_id, {$ordering} FROM item\n\t\t\t\tleft join abook on item.author_xchan = abook.abook_xchan\n\t\t\t\tWHERE true {$uids} {$item_normal}\n\t\t\t\tAND item.parent = item.id\n\t\t\t\tand (abook.abook_blocked = 0 or abook.abook_flags is null)\n\t\t\t\t{$sql_extra3} {$sql_extra} {$sql_nets}\n\t\t\t\tORDER BY {$ordering} DESC {$pager_sql} "); } elseif ($update) { $r = q("SELECT distinct item.id AS item_id, {$ordering} FROM item\n\t\t\t\tleft join abook on item.author_xchan = abook.abook_xchan\n\t\t\t\tWHERE true {$uids} {$item_normal}\n\t\t\t\tAND item.parent = item.id {$simple_update}\n\t\t\t\tand (abook.abook_blocked = 0 or abook.abook_flags is null)\n\t\t\t\t{$sql_extra3} {$sql_extra} {$sql_nets}"); $_SESSION['loadtime'] = datetime_convert(); } // Then fetch all the children of the parents that are on this page $parents_str = ''; $update_unseen = ''; if ($r) { $parents_str = ids_to_querystr($r, 'item_id'); $items = q("SELECT item.*, item.id AS item_id FROM item\n\t\t\t\tWHERE true {$uids} {$item_normal}\n\t\t\t\tAND item.parent IN ( %s )\n\t\t\t\t{$sql_extra} ", dbesc($parents_str)); xchan_query($items, true, -1); $items = fetch_post_tags($items, true); $items = conv_sort($items, $ordering); } else { $items = array(); } } // fake it $mode = 'network'; $o .= conversation($a, $items, $mode, $update, $page_mode); if ($items && !$update) { $o .= alt_pager($a, count($items)); } return $o; }
function webpages_content(&$a) { if (!App::$profile) { notice(t('Requested profile is not available.') . EOL); App::$error = 404; return; } $which = argv(1); $_SESSION['return_url'] = App::$query_string; $uid = local_channel(); $owner = 0; $channel = null; $observer = App::get_observer(); $channel = App::get_channel(); if (App::$is_sys && is_site_admin()) { $sys = get_sys_channel(); if ($sys && intval($sys['channel_id'])) { $uid = $owner = intval($sys['channel_id']); $channel = $sys; $observer = $sys; } } if (!$owner) { // Figure out who the page owner is. $r = q("select channel_id from channel where channel_address = '%s'", dbesc($which)); if ($r) { $owner = intval($r[0]['channel_id']); } } $ob_hash = $observer ? $observer['xchan_hash'] : ''; $perms = get_all_perms($owner, $ob_hash); if (!$perms['write_pages']) { notice(t('Permission denied.') . EOL); return; } $mimetype = $_REQUEST['mimetype'] ? $_REQUEST['mimetype'] : get_pconfig($owner, 'system', 'page_mimetype'); if (!$mimetype) { $mimetype = 'choose'; } $layout = $_REQUEST['layout'] ? $_REQUEST['layout'] : get_pconfig($owner, 'system', 'page_layout'); if (!$layout) { $layout = 'choose'; } // Create a status editor (for now - we'll need a WYSIWYG eventually) to create pages // Nickname is set to the observers xchan, and profile_uid to the owner's. // This lets you post pages at other people's channels. if (!$channel && $uid && $uid == App::$profile_uid) { $channel = App::get_channel(); } if ($channel) { $channel_acl = array('allow_cid' => $channel['channel_allow_cid'], 'allow_gid' => $channel['channel_allow_gid'], 'deny_cid' => $channel['channel_deny_cid'], 'deny_gid' => $channel['channel_deny_gid']); } else { $channel_acl = array(); } $is_owner = $uid && $uid == $owner; $o = profile_tabs($a, $is_owner, App::$profile['channel_address']); $x = array('webpage' => ITEM_TYPE_WEBPAGE, 'is_owner' => true, 'nickname' => App::$profile['channel_address'], 'lockstate' => $channel['channel_allow_cid'] || $channel['channel_allow_gid'] || $channel['channel_deny_cid'] || $channel['channel_deny_gid'] ? 'lock' : 'unlock', 'bang' => '', 'acl' => $is_owner ? populate_acl($channel_acl, false) : '', 'showacl' => $is_owner ? true : false, 'visitor' => true, 'profile_uid' => intval($owner), 'mimetype' => $mimetype, 'layout' => $layout, 'expanded' => true, 'novoting' => true, 'bbco_autocomplete' => 'bbcode', 'bbcode' => true); if ($_REQUEST['title']) { $x['title'] = $_REQUEST['title']; } if ($_REQUEST['body']) { $x['body'] = $_REQUEST['body']; } if ($_REQUEST['pagetitle']) { $x['pagetitle'] = $_REQUEST['pagetitle']; } $editor = status_editor($a, $x); // Get a list of webpages. We can't display all them because endless scroll makes that unusable, // so just list titles and an edit link. /** @TODO - this should be replaced with pagelist_widget */ $sql_extra = item_permissions_sql($owner); $r = q("select * from item_id left join item on item_id.iid = item.id \n\t\twhere item_id.uid = %d and service = 'WEBPAGE' and item_type = %d {$sql_extra} order by item.created desc", intval($owner), intval(ITEM_TYPE_WEBPAGE)); $pages = null; if ($r) { $pages = array(); foreach ($r as $rr) { unobscure($rr); $lockstate = $rr['allow_cid'] || $rr['allow_gid'] || $rr['deny_cid'] || $rr['deny_gid'] ? 'lock' : 'unlock'; $element_arr = array('type' => 'webpage', 'title' => $rr['title'], 'body' => $rr['body'], 'created' => $rr['created'], 'edited' => $rr['edited'], 'mimetype' => $rr['mimetype'], 'pagetitle' => $rr['sid'], 'mid' => $rr['mid'], 'layout_mid' => $rr['layout_mid']); $pages[$rr['iid']][] = array('url' => $rr['iid'], 'pagetitle' => $rr['sid'], 'title' => $rr['title'], 'created' => datetime_convert('UTC', date_default_timezone_get(), $rr['created']), 'edited' => datetime_convert('UTC', date_default_timezone_get(), $rr['edited']), 'bb_element' => '[element]' . base64url_encode(json_encode($element_arr)) . '[/element]', 'lockstate' => $lockstate); } } //Build the base URL for edit links $url = z_root() . '/editwebpage/' . $which; $o .= replace_macros(get_markup_template('webpagelist.tpl'), array('$listtitle' => t('Webpages'), '$baseurl' => $url, '$create' => t('Create'), '$edit' => t('Edit'), '$share' => t('Share'), '$delete' => t('Delete'), '$pages' => $pages, '$channel' => $which, '$editor' => $editor, '$view' => t('View'), '$preview' => t('Preview'), '$actions_txt' => t('Actions'), '$pagelink_txt' => t('Page Link'), '$title_txt' => t('Page Title'), '$created_txt' => t('Created'), '$edited_txt' => t('Edited'))); return $o; }
function profile_content(&$a, $update = 0) { if (x($a->category)) { $category = $a->category; } else { $category = x($_GET, 'category') ? $_GET['category'] : ''; } if (get_config('system', 'block_public') && !local_user() && !remote_user()) { return login(); } require_once "include/bbcode.php"; require_once 'include/security.php'; require_once 'include/conversation.php'; require_once 'include/acl_selectors.php'; $groups = array(); $tab = 'posts'; $o = ''; if ($update) { // Ensure we've got a profile owner if updating. $a->profile['profile_uid'] = $update; } else { if ($a->profile['profile_uid'] == local_user()) { nav_set_selected('home'); } } $contact = null; $remote_contact = false; if (remote_user()) { $contact_id = $_SESSION['visitor_id']; $groups = init_groups_visitor($contact_id); $r = q("SELECT * FROM `contact` WHERE `id` = %d AND `uid` = %d LIMIT 1", intval($contact_id), intval($a->profile['profile_uid'])); if (count($r)) { $contact = $r[0]; $remote_contact = true; } } if (!$remote_contact) { if (local_user()) { $contact_id = $_SESSION['cid']; $contact = $a->contact; } } $is_owner = local_user() && local_user() == $a->profile['profile_uid'] ? true : false; if ($a->profile['hidewall'] && !$is_owner && !$remote_contact) { notice(t('Access to this profile has been restricted.') . EOL); return; } if (!$update) { if (x($_GET, 'tab')) { $tab = notags(trim($_GET['tab'])); } $o .= profile_tabs($a, $is_owner, $a->profile['nickname']); if ($tab === 'profile') { require_once 'include/profile_advanced.php'; $o .= advanced_profile($a); call_hooks('profile_advanced', $o); return $o; } $o .= common_friends_visitor_widget($a->profile['profile_uid']); if (x($_SESSION, 'new_member') && $_SESSION['new_member'] && $is_owner) { $o .= '<a href="newmember" id="newmember-tips" style="font-size: 1.2em;"><b>' . t('Tips for New Members') . '</b></a>' . EOL; } $commpage = $a->profile['page-flags'] == PAGE_COMMUNITY ? true : false; $commvisitor = $commpage && $remote_contact == true ? true : false; $celeb = $a->profile['page-flags'] == PAGE_SOAPBOX || $a->profile['page-flags'] == PAGE_COMMUNITY ? true : false; $a->page['aside'] .= categories_widget($a->get_baseurl(true) . '/profile/' . $a->profile['nickname'], x($category) ? xmlify($category) : ''); if (can_write_wall($a, $a->profile['profile_uid'])) { $x = array('is_owner' => $is_owner, 'allow_location' => ($is_owner || $commvisitor) && $a->profile['allow_location'] ? true : false, 'default_location' => $is_owner ? $a->user['default-location'] : '', 'nickname' => $a->profile['nickname'], 'lockstate' => is_array($a->user) && (strlen($a->user['allow_cid']) || strlen($a->user['allow_gid']) || strlen($a->user['deny_cid']) || strlen($a->user['deny_gid'])) ? 'lock' : 'unlock', 'acl' => $is_owner ? populate_acl($a->user, $celeb) : '', 'bang' => '', 'visitor' => $is_owner || $commvisitor ? 'block' : 'none', 'profile_uid' => $a->profile['profile_uid']); $o .= status_editor($a, $x); } } /** * Get permissions SQL - if $remote_contact is true, our remote user has been pre-verified and we already have fetched his/her groups */ $sql_extra = item_permissions_sql($a->profile['profile_uid'], $remote_contact, $groups); if ($update) { $r = q("SELECT distinct(parent) AS `item_id`, `contact`.`uid` AS `contact-uid`\n\t\t\tFROM `item` LEFT JOIN `contact` ON `contact`.`id` = `item`.`contact-id`\n\t\t\tWHERE `item`.`uid` = %d AND `item`.`visible` = 1 AND `item`.`deleted` = 0\n\t\t\tand `item`.`moderated` = 0 and `item`.`unseen` = 1\n\t\t\tAND `contact`.`blocked` = 0 AND `contact`.`pending` = 0\n\t\t\tAND `item`.`wall` = 1\n\t\t\t{$sql_extra}\n\t\t\tORDER BY `item`.`created` DESC", intval($a->profile['profile_uid'])); } else { if (x($category)) { $sql_extra .= file_tag_file_query('item', $category, 'category'); } $r = q("SELECT COUNT(*) AS `total`\n\t\t\tFROM `item` LEFT JOIN `contact` ON `contact`.`id` = `item`.`contact-id`\n\t\t\tWHERE `item`.`uid` = %d AND `item`.`visible` = 1 AND `item`.`deleted` = 0\n\t\t\tand `item`.`moderated` = 0 AND `contact`.`blocked` = 0 AND `contact`.`pending` = 0 \n\t\t\tAND `item`.`id` = `item`.`parent` AND `item`.`wall` = 1\n\t\t\t{$sql_extra} ", intval($a->profile['profile_uid'])); if (count($r)) { $a->set_pager_total($r[0]['total']); $a->set_pager_itemspage(40); } $pager_sql = sprintf(" LIMIT %d, %d ", intval($a->pager['start']), intval($a->pager['itemspage'])); $r = q("SELECT `item`.`id` AS `item_id`, `contact`.`uid` AS `contact-uid`\n\t\t\tFROM `item` LEFT JOIN `contact` ON `contact`.`id` = `item`.`contact-id`\n\t\t\tWHERE `item`.`uid` = %d AND `item`.`visible` = 1 AND `item`.`deleted` = 0\n\t\t\tand `item`.`moderated` = 0 AND `contact`.`blocked` = 0 AND `contact`.`pending` = 0\n\t\t\tAND `item`.`id` = `item`.`parent` AND `item`.`wall` = 1\n\t\t\t{$sql_extra}\n\t\t\tORDER BY `item`.`created` DESC {$pager_sql} ", intval($a->profile['profile_uid'])); } $parents_arr = array(); $parents_str = ''; if (count($r)) { foreach ($r as $rr) { $parents_arr[] = $rr['item_id']; } $parents_str = implode(', ', $parents_arr); $items = q("SELECT `item`.*, `item`.`id` AS `item_id`, \n\t\t\t`contact`.`name`, `contact`.`photo`, `contact`.`url`, `contact`.`alias`, `contact`.`network`, `contact`.`rel`, \n\t\t\t`contact`.`thumb`, `contact`.`self`, `contact`.`writable`, \n\t\t\t`contact`.`id` AS `cid`, `contact`.`uid` AS `contact-uid`\n\t\t\tFROM `item`, `contact`\n\t\t\tWHERE `item`.`uid` = %d AND `item`.`visible` = 1 AND `item`.`deleted` = 0\n\t\t\tand `item`.`moderated` = 0\n\t\t\tAND `contact`.`id` = `item`.`contact-id`\n\t\t\tAND `contact`.`blocked` = 0 AND `contact`.`pending` = 0\n\t\t\tAND `item`.`parent` IN ( %s )\n\t\t\t{$sql_extra} ", intval($a->profile['profile_uid']), dbesc($parents_str)); $items = conv_sort($items, 'created'); } else { $items = array(); } if ($is_owner && !$update) { $o .= get_birthdays(); $o .= get_events(); } if (!$update && $tab === 'posts') { // This is ugly, but we can't pass the profile_uid through the session to the ajax updater, // because browser prefetching might change it on us. We have to deliver it with the page. $o .= '<div id="live-profile"></div>' . "\r\n"; $o .= "<script> var profile_uid = " . $a->profile['profile_uid'] . "; var netargs = '?f='; var profile_page = " . $a->pager['page'] . "; </script>\r\n"; } if ($is_owner) { $r = q("UPDATE `item` SET `unseen` = 0 \n\t\t\tWHERE `wall` = 1 AND `unseen` = 1 AND `uid` = %d", intval(local_user())); } $o .= conversation($a, $items, 'profile', $update); if (!$update) { $o .= paginate($a); } return $o; }
function display_content(&$a, $update = 0) { if (get_config('system', 'block_public') && !local_user() && !remote_user()) { notice(t('Public access denied.') . EOL); return; } require_once "include/bbcode.php"; require_once 'include/security.php'; require_once 'include/conversation.php'; require_once 'include/acl_selectors.php'; $o = ''; $a->page['htmlhead'] .= replace_macros(get_markup_template('display-head.tpl'), array()); if ($update) { $nick = $_REQUEST['nick']; } else { $nick = $a->argc > 1 ? $a->argv[1] : ''; } if ($update) { $item_id = $_REQUEST['item_id']; $a->profile = array('uid' => intval($update), 'profile_uid' => intval($update)); } else { $item_id = $a->argc > 2 ? $a->argv[2] : 0; if ($a->argc == 2) { $nick = ""; if (local_user()) { $r = q("SELECT `id` FROM `item`\n\t\t\t\t\tWHERE `item`.`visible` = 1 AND `item`.`deleted` = 0 and `item`.`moderated` = 0\n\t\t\t\t\t\tAND `guid` = '%s' AND `uid` = %d", $a->argv[1], local_user()); if (count($r)) { $item_id = $r[0]["id"]; $nick = $a->user["nickname"]; } } if ($nick == "") { $r = q("SELECT `user`.`nickname`, `item`.`id` FROM `item` INNER JOIN `user` ON `user`.`uid` = `item`.`uid`\n\t\t\t\t\tWHERE `item`.`visible` = 1 AND `item`.`deleted` = 0 and `item`.`moderated` = 0\n\t\t\t\t\t\tAND `item`.`allow_cid` = '' AND `item`.`allow_gid` = ''\n\t\t\t\t\t\tAND `item`.`deny_cid` = '' AND `item`.`deny_gid` = ''\n\t\t\t\t\t\tAND `item`.`private` = 0 AND NOT `user`.`hidewall`\n\t\t\t\t\t\tAND `item`.`guid` = '%s'", $a->argv[1]); // AND `item`.`private` = 0 AND `item`.`wall` = 1 if (count($r)) { $item_id = $r[0]["id"]; $nick = $r[0]["nickname"]; } } if ($nick == "") { $r = q("SELECT `item`.`id` FROM `item`\n\t\t\t\t\tWHERE `item`.`visible` = 1 AND `item`.`deleted` = 0 and `item`.`moderated` = 0\n\t\t\t\t\t\tAND `item`.`allow_cid` = '' AND `item`.`allow_gid` = ''\n\t\t\t\t\t\tAND `item`.`deny_cid` = '' AND `item`.`deny_gid` = ''\n\t\t\t\t\t\tAND `item`.`private` = 0 AND `item`.`uid` = 0\n\t\t\t\t\t\tAND `item`.`guid` = '%s'", $a->argv[1]); // AND `item`.`private` = 0 AND `item`.`wall` = 1 if (count($r)) { $item_id = $r[0]["id"]; } } } } if (!$item_id) { $a->error = 404; notice(t('Item not found.') . EOL); return; } $groups = array(); $contact = null; $remote_contact = false; $contact_id = 0; if (is_array($_SESSION['remote'])) { foreach ($_SESSION['remote'] as $v) { if ($v['uid'] == $a->profile['uid']) { $contact_id = $v['cid']; break; } } } if ($contact_id) { $groups = init_groups_visitor($contact_id); $r = q("SELECT * FROM `contact` WHERE `id` = %d AND `uid` = %d LIMIT 1", intval($contact_id), intval($a->profile['uid'])); if (count($r)) { $contact = $r[0]; $remote_contact = true; } } if (!$remote_contact) { if (local_user()) { $contact_id = $_SESSION['cid']; $contact = $a->contact; } } $r = q("SELECT * FROM `contact` WHERE `uid` = %d AND `self` = 1 LIMIT 1", intval($a->profile['uid'])); if (count($r)) { $a->page_contact = $r[0]; } $is_owner = local_user() && local_user() == $a->profile['profile_uid'] ? true : false; if ($a->profile['hidewall'] && !$is_owner && !$remote_contact) { notice(t('Access to this profile has been restricted.') . EOL); return; } if ($is_owner) { $celeb = $a->user['page-flags'] == PAGE_SOAPBOX || $a->user['page-flags'] == PAGE_COMMUNITY ? true : false; $x = array('is_owner' => true, 'allow_location' => $a->user['allow_location'], 'default_location' => $a->user['default-location'], 'nickname' => $a->user['nickname'], 'lockstate' => is_array($a->user) && (strlen($a->user['allow_cid']) || strlen($a->user['allow_gid']) || strlen($a->user['deny_cid']) || strlen($a->user['deny_gid'])) ? 'lock' : 'unlock', 'acl' => populate_acl($a->user, $celeb), 'bang' => '', 'visitor' => 'block', 'profile_uid' => local_user(), 'acl_data' => construct_acl_data($a, $a->user)); $o .= status_editor($a, $x, 0, true); } $sql_extra = item_permissions_sql($a->profile['uid'], $remote_contact, $groups); // AND `item`.`parent` = ( SELECT `parent` FROM `item` FORCE INDEX (PRIMARY, `uri`) WHERE ( `id` = '%s' OR `uri` = '%s' )) if ($update) { $r = q("SELECT id FROM item WHERE item.uid = %d\n\t\t AND `item`.`parent` = (SELECT `parent` FROM `item` WHERE (`id` = '%s' OR `uri` = '%s'))\n\t\t {$sql_extra} AND unseen = 1", intval($a->profile['uid']), dbesc($item_id), dbesc($item_id)); if (!$r) { return ''; } } // AND `item`.`parent` = ( SELECT `parent` FROM `item` FORCE INDEX (PRIMARY, `uri`) WHERE ( `id` = '%s' OR `uri` = '%s' ) $r = q("SELECT `item`.*, `item`.`id` AS `item_id`, `item`.`network` AS `item_network`,\n\t\t`contact`.`name`, `contact`.`photo`, `contact`.`url`, `contact`.`rel`,\n\t\t`contact`.`network`, `contact`.`thumb`, `contact`.`self`, `contact`.`writable`,\n\t\t`contact`.`id` AS `cid`, `contact`.`uid` AS `contact-uid`\n\t\tFROM `item` INNER JOIN `contact` ON `contact`.`id` = `item`.`contact-id`\n\t\tAND `contact`.`blocked` = 0 AND `contact`.`pending` = 0\n\t\tWHERE `item`.`uid` = %d AND `item`.`visible` = 1 AND `item`.`deleted` = 0\n\t\tand `item`.`moderated` = 0\n\t\tAND `item`.`parent` = (SELECT `parent` FROM `item` WHERE (`id` = '%s' OR `uri` = '%s')\n\t\tAND uid = %d)\n\t\t{$sql_extra}\n\t\tORDER BY `parent` DESC, `gravity` ASC, `id` ASC", intval($a->profile['uid']), dbesc($item_id), dbesc($item_id), intval($a->profile['uid'])); if (!$r && local_user()) { // Check if this is another person's link to a post that we have $r = q("SELECT `item`.uri FROM `item`\n\t\t\tWHERE (`item`.`id` = '%s' OR `item`.`uri` = '%s' )\n\t\t\tLIMIT 1", dbesc($item_id), dbesc($item_id)); if ($r) { $item_uri = $r[0]['uri']; // AND `item`.`parent` = ( SELECT `parent` FROM `item` FORCE INDEX (PRIMARY, `uri`) WHERE `uri` = '%s' AND uid = %d ) $r = q("SELECT `item`.*, `item`.`id` AS `item_id`, `item`.`network` AS `item_network`,\n\t\t\t\t`contact`.`name`, `contact`.`photo`, `contact`.`url`, `contact`.`rel`,\n\t\t\t\t`contact`.`network`, `contact`.`thumb`, `contact`.`self`, `contact`.`writable`, \n\t\t\t\t`contact`.`id` AS `cid`, `contact`.`uid` AS `contact-uid`\n\t\t\t\tFROM `item` INNER JOIN `contact` ON `contact`.`id` = `item`.`contact-id`\n\t\t\t\tAND `contact`.`blocked` = 0 AND `contact`.`pending` = 0\n\t\t\t\tWHERE `item`.`uid` = %d AND `item`.`visible` = 1 AND `item`.`deleted` = 0\n\t\t\t\tand `item`.`moderated` = 0\n\t\t\t\tAND `item`.`parent` = (SELECT `parent` FROM `item` WHERE `uri` = '%s' AND uid = %d)\n\t\t\t\tORDER BY `parent` DESC, `gravity` ASC, `id` ASC ", intval(local_user()), dbesc($item_uri), intval(local_user())); } } if ($r) { if (local_user() && local_user() == $a->profile['uid']) { q("UPDATE `item` SET `unseen` = 0\n\t\t\t\tWHERE `parent` = %d AND `unseen` = 1", intval($r[0]['parent'])); } $items = conv_sort($r, "`commented`"); if (!$update) { $o .= "<script> var netargs = '?f=&nick=" . $nick . "&item_id=" . $item_id . "'; </script>"; } $o .= conversation($a, $items, 'display', $update); // Preparing the meta header require_once 'include/bbcode.php'; require_once "include/html2plain.php"; $description = trim(html2plain(bbcode($r[0]["body"], false, false), 0, true)); $title = trim(html2plain(bbcode($r[0]["title"], false, false), 0, true)); $author_name = $r[0]["author-name"]; $image = ""; if ($image == "") { $image = $r[0]["thumb"]; } if ($title == "") { $title = $author_name; } $description = htmlspecialchars($description, ENT_COMPAT, 'UTF-8', true); // allow double encoding here $title = htmlspecialchars($title, ENT_COMPAT, 'UTF-8', true); // allow double encoding here $author_name = htmlspecialchars($author_name, ENT_COMPAT, 'UTF-8', true); // allow double encoding here //<meta name="keywords" content=""> $a->page['htmlhead'] .= '<meta name="author" content="' . $author_name . '" />' . "\n"; $a->page['htmlhead'] .= '<meta name="title" content="' . $title . '" />' . "\n"; $a->page['htmlhead'] .= '<meta name="fulltitle" content="' . $title . '" />' . "\n"; $a->page['htmlhead'] .= '<meta name="description" content="' . $description . '" />' . "\n"; // Schema.org microdata $a->page['htmlhead'] .= '<meta itemprop="name" content="' . $title . '" />' . "\n"; $a->page['htmlhead'] .= '<meta itemprop="description" content="' . $description . '" />' . "\n"; $a->page['htmlhead'] .= '<meta itemprop="image" content="' . $image . '" />' . "\n"; $a->page['htmlhead'] .= '<meta itemprop="author" content="' . $author_name . '" />' . "\n"; // Twitter cards $a->page['htmlhead'] .= '<meta name="twitter:card" content="summary" />' . "\n"; $a->page['htmlhead'] .= '<meta name="twitter:title" content="' . $title . '" />' . "\n"; $a->page['htmlhead'] .= '<meta name="twitter:description" content="' . $description . '" />' . "\n"; $a->page['htmlhead'] .= '<meta name="twitter:image" content="' . $image . '" />' . "\n"; $a->page['htmlhead'] .= '<meta name="twitter:url" content="' . $r[0]["plink"] . '" />' . "\n"; // Dublin Core $a->page['htmlhead'] .= '<meta name="DC.title" content="' . $title . '" />' . "\n"; $a->page['htmlhead'] .= '<meta name="DC.description" content="' . $description . '" />' . "\n"; // Open Graph $a->page['htmlhead'] .= '<meta property="og:type" content="website" />' . "\n"; $a->page['htmlhead'] .= '<meta property="og:title" content="' . $title . '" />' . "\n"; $a->page['htmlhead'] .= '<meta property="og:image" content="' . $image . '" />' . "\n"; $a->page['htmlhead'] .= '<meta property="og:url" content="' . $r[0]["plink"] . '" />' . "\n"; $a->page['htmlhead'] .= '<meta property="og:description" content="' . $description . '" />' . "\n"; $a->page['htmlhead'] .= '<meta name="og:article:author" content="' . $author_name . '" />' . "\n"; // article:tag return $o; } $r = q("SELECT `id`,`deleted` FROM `item` WHERE `id` = '%s' OR `uri` = '%s' LIMIT 1", dbesc($item_id), dbesc($item_id)); if ($r) { if ($r[0]['deleted']) { notice(t('Item has been removed.') . EOL); } else { notice(t('Permission denied.') . EOL); } } else { notice(t('Item not found.') . EOL); } return $o; }
function oep_mid_reply($args) { $ret = array(); $url = $args['url']; $maxwidth = intval($args['maxwidth']); $maxheight = intval($args['maxheight']); if (preg_match('#//(.*?)/(.*?)/(.*?)/(.*?)mid\\=(.*?)(&|$)#', $url, $matches)) { $chn = $matches[3]; $res = $matches[5]; } if (!($chn && $res)) { return; } $c = q("select * from channel where channel_address = '%s' limit 1", dbesc($chn)); if (!$c) { return; } $sql_extra = item_permissions_sql($c[0]['channel_id']); $p = q("select * from item where mid = '%s' and uid = %d {$sql_extra} limit 1", dbesc($res), intval($c[0]['channel_id'])); if (!$p) { return; } xchan_query($p, true); $p = fetch_post_tags($p, true); $o = "[share author='" . urlencode($p[0]['author']['xchan_name']) . "' profile='" . $p[0]['author']['xchan_url'] . "' avatar='" . $p[0]['author']['xchan_photo_s'] . "' link='" . $p[0]['plink'] . "' posted='" . $p[0]['created'] . "' message_id='" . $p[0]['mid'] . "']"; if ($p[0]['title']) { $o .= '[b]' . $p[0]['title'] . '[/b]' . "\r\n"; } $o .= $p[0]['body']; $o .= "[/share]"; $o = bbcode($o); $ret['type'] = 'rich'; $w = $maxwidth ? $maxwidth : 640; $h = $maxheight ? $maxheight : $w * 2 / 3; $ret['html'] = '<div style="width: ' . $w . '; height: ' . $h . '; font-family: sans-serif,arial,freesans;" >' . $o . '</div>'; $ret['width'] = $w; $ret['height'] = $h; return $ret; }
function wiki_get_permissions($resource_id, $owner_id, $observer_hash) { // TODO: For now, only the owner can edit $sql_extra = item_permissions_sql($owner_id, $observer_hash); $r = q("SELECT * FROM item WHERE resource_type = '%s' AND resource_id = '%s' {$sql_extra} LIMIT 1", dbesc(WIKI_ITEM_RESOURCE_TYPE), dbesc($resource_id)); if (!$r) { return array('read' => false, 'write' => false, 'success' => true); } else { $perms = get_all_perms($owner_id, $observer_hash); // TODO: Create a new permission setting for wiki analogous to webpages. Until // then, use webpage permissions if (!$perms['write_pages']) { $write = false; } else { $write = true; } return array('read' => true, 'write' => $write, 'success' => true); } }
function get_webpage_elements($channel, $type = 'all') { $elements = array(); if (!$channel['channel_id']) { return null; } switch ($type) { case 'all': // If all, execute all the pages, layouts, blocks case statements // If all, execute all the pages, layouts, blocks case statements case 'pages': $elements['pages'] = null; $owner = $channel['channel_id']; $sql_extra = item_permissions_sql($owner); $r = q("select * from iconfig left join item on iconfig.iid = item.id \n\t\t\t\t\t\t\twhere item.uid = %d and iconfig.cat = 'system' and iconfig.k = 'WEBPAGE' and item_type = %d \n\t\t\t\t\t\t\t{$sql_extra} order by item.created desc", intval($owner), intval(ITEM_TYPE_WEBPAGE)); $pages = null; if ($r) { $elements['pages'] = array(); $pages = array(); foreach ($r as $rr) { unobscure($rr); //$lockstate = (($rr['allow_cid'] || $rr['allow_gid'] || $rr['deny_cid'] || $rr['deny_gid']) ? 'lock' : 'unlock'); $element_arr = array('type' => 'webpage', 'title' => $rr['title'], 'body' => $rr['body'], 'created' => $rr['created'], 'edited' => $rr['edited'], 'mimetype' => $rr['mimetype'], 'pagetitle' => $rr['v'], 'mid' => $rr['mid'], 'layout_mid' => $rr['layout_mid']); $pages[$rr['iid']][] = array('url' => $rr['iid'], 'pagetitle' => $rr['v'], 'title' => $rr['title'], 'created' => datetime_convert('UTC', date_default_timezone_get(), $rr['created']), 'edited' => datetime_convert('UTC', date_default_timezone_get(), $rr['edited']), 'bb_element' => '[element]' . base64url_encode(json_encode($element_arr)) . '[/element]'); $elements['pages'][] = $element_arr; } } if ($type !== 'all') { break; } case 'layouts': $elements['layouts'] = null; $owner = $channel['channel_id']; $sql_extra = item_permissions_sql($owner); $r = q("select * from iconfig left join item on iconfig.iid = item.id \n\t\t\t\t\t\t\twhere item.uid = %d and iconfig.cat = 'system' and iconfig.k = 'PDL' and item_type = %d \n\t\t\t\t\t\t\t{$sql_extra} order by item.created desc", intval($owner), intval(ITEM_TYPE_PDL)); $layouts = null; if ($r) { $elements['layouts'] = array(); $layouts = array(); foreach ($r as $rr) { unobscure($rr); $elements['layouts'][] = array('type' => 'layout', 'description' => $rr['title'], 'body' => $rr['body'], 'created' => $rr['created'], 'edited' => $rr['edited'], 'mimetype' => $rr['mimetype'], 'name' => $rr['v'], 'mid' => $rr['mid']); } } if ($type !== 'all') { break; } case 'blocks': $elements['blocks'] = null; $owner = $channel['channel_id']; $sql_extra = item_permissions_sql($owner); $r = q("select iconfig.iid, iconfig.k, iconfig.v, mid, title, body, mimetype, created, edited from iconfig \n\t\t\t\t\t\t\t\tleft join item on iconfig.iid = item.id\n\t\t\t\t\t\t\t\twhere uid = %d and iconfig.cat = 'system' and iconfig.k = 'BUILDBLOCK' \n\t\t\t\t\t\t\t\tand item_type = %d order by item.created desc", intval($owner), intval(ITEM_TYPE_BLOCK)); $blocks = null; if ($r) { $elements['blocks'] = array(); $blocks = array(); foreach ($r as $rr) { unobscure($rr); $elements['blocks'][] = array('type' => 'block', 'title' => $rr['title'], 'body' => $rr['body'], 'created' => $rr['created'], 'edited' => $rr['edited'], 'mimetype' => $rr['mimetype'], 'name' => $rr['v'], 'mid' => $rr['mid']); } } if ($type !== 'all') { break; } default: break; } return $elements; }
function channel_content(&$a, $update = 0, $load = false) { $category = $datequery = $datequery2 = ''; $mid = $_GET['mid']; $datequery = x($_GET, 'dend') && is_a_date_arg($_GET['dend']) ? notags($_GET['dend']) : ''; $datequery2 = x($_GET, 'dbegin') && is_a_date_arg($_GET['dbegin']) ? notags($_GET['dbegin']) : ''; if (get_config('system', 'block_public') && !get_account_id() && !remote_user()) { return login(); } $category = x($_REQUEST, 'cat') ? $_REQUEST['cat'] : ''; $groups = array(); $o = ''; if ($update) { // Ensure we've got a profile owner if updating. $a->profile['profile_uid'] = $update; } else { if ($a->profile['profile_uid'] == local_user()) { nav_set_selected('home'); } } $is_owner = local_user() && $a->profile['profile_uid'] == local_user() ? true : false; $channel = $a->get_channel(); $observer = $a->get_observer(); $ob_hash = $observer ? $observer['xchan_hash'] : ''; $perms = get_all_perms($a->profile['profile_uid'], $ob_hash); if (!$perms['view_stream']) { // We may want to make the target of this redirect configurable if ($perms['view_profile']) { notice(t('Insufficient permissions. Request redirected to profile page.') . EOL); goaway(z_root() . "/profile/" . $a->profile['channel_address']); } notice(t('Permission denied.') . EOL); return; } if (!$update) { $o .= profile_tabs($a, $is_owner, $a->profile['channel_address']); $o .= common_friends_visitor_widget($a->profile['profile_uid']); if ($channel && $is_owner) { $channel_acl = array('allow_cid' => $channel['channel_allow_cid'], 'allow_gid' => $channel['channel_allow_gid'], 'deny_cid' => $channel['channel_deny_cid'], 'deny_gid' => $channel['channel_deny_gid']); } else { $channel_acl = array(); } if ($perms['post_wall']) { $x = array('is_owner' => $is_owner, 'allow_location' => ($is_owner || $observer) && intval(get_pconfig($a->profile['profile_uid'], 'system', 'use_browser_location')) ? true : false, 'default_location' => $is_owner ? $a->profile['channel_location'] : '', 'nickname' => $a->profile['channel_address'], 'lockstate' => strlen($a->profile['channel_allow_cid']) || strlen($a->profile['channel_allow_gid']) || strlen($a->profile['channel_deny_cid']) || strlen($a->profile['channel_deny_gid']) ? 'lock' : 'unlock', 'acl' => $is_owner ? populate_acl($channel_acl) : '', 'showacl' => $is_owner ? 'yes' : '', 'bang' => '', 'visitor' => $is_owner || $observer ? true : false, 'profile_uid' => $a->profile['profile_uid']); $o .= status_editor($a, $x); } } /** * Get permissions SQL - if $remote_contact is true, our remote user has been pre-verified and we already have fetched his/her groups */ $sql_extra = item_permissions_sql($a->profile['profile_uid'], $remote_contact, $groups); if ($update && !$load) { if ($mid) { $r = q("SELECT parent AS item_id from item where mid = '%s' and uid = %d AND item_restrict = 0\n\t\t\t\tAND (item_flags & %d) AND (item_flags & %d) {$sql_extra} limit 1", dbesc($mid), intval($a->profile['profile_uid']), intval(ITEM_WALL), intval(ITEM_UNSEEN)); } else { $r = q("SELECT distinct parent AS `item_id` from item\n\t\t\t\tleft join abook on item.author_xchan = abook.abook_xchan\n\t\t\t\tWHERE uid = %d AND item_restrict = 0\n\t\t\t\tAND (item_flags & %d) AND ( item_flags & %d ) \n\t\t\t\tAND ((abook.abook_flags & %d) = 0 or abook.abook_flags is null)\n\t\t\t\t{$sql_extra}\n\t\t\t\tORDER BY created DESC", intval($a->profile['profile_uid']), intval(ITEM_WALL), intval(ITEM_UNSEEN), intval(ABOOK_FLAG_BLOCKED)); } } else { if (x($category)) { $sql_extra .= protect_sprintf(term_query('item', $category, TERM_CATEGORY)); } if ($datequery) { $sql_extra2 .= protect_sprintf(sprintf(" AND item.created <= '%s' ", dbesc(datetime_convert(date_default_timezone_get(), '', $datequery)))); } if ($datequery2) { $sql_extra2 .= protect_sprintf(sprintf(" AND item.created >= '%s' ", dbesc(datetime_convert(date_default_timezone_get(), '', $datequery2)))); } $itemspage = get_pconfig(local_user(), 'system', 'itemspage'); $a->set_pager_itemspage(intval($itemspage) ? $itemspage : 20); $pager_sql = sprintf(" LIMIT %d, %d ", intval($a->pager['start']), intval($a->pager['itemspage'])); if ($load || $_COOKIE['jsAvailable'] != 1) { if ($mid) { $r = q("SELECT parent AS item_id from item where mid = '%s' and uid = %d AND item_restrict = 0\n\t\t\t\t\tAND (item_flags & %d) {$sql_extra} limit 1", dbesc($mid), intval($a->profile['profile_uid']), intval(ITEM_WALL)); if (!$r) { notice(t('Permission denied.') . EOL); } } else { $r = q("SELECT distinct id AS item_id FROM item \n\t\t\t\t\tleft join abook on item.author_xchan = abook.abook_xchan\n\t\t\t\t\tWHERE uid = %d AND item_restrict = 0\n\t\t\t\t\tAND (item_flags & %d) and (item_flags & %d)\n\t\t\t\t\tAND ((abook.abook_flags & %d) = 0 or abook.abook_flags is null)\n\t\t\t\t\t{$sql_extra} {$sql_extra2}\n\t\t\t\t\tORDER BY created DESC {$pager_sql} ", intval($a->profile['profile_uid']), intval(ITEM_WALL), intval(ITEM_THREAD_TOP), intval(ABOOK_FLAG_BLOCKED)); } } else { $r = array(); } } if ($r) { $parents_str = ids_to_querystr($r, 'item_id'); $items = q("SELECT `item`.*, `item`.`id` AS `item_id` \n\t\t\tFROM `item`\n\t\t\tWHERE `item`.`uid` = %d AND `item`.`item_restrict` = 0\n\t\t\tAND `item`.`parent` IN ( %s )\n\t\t\t{$sql_extra} ", intval($a->profile['profile_uid']), dbesc($parents_str)); xchan_query($items); $items = fetch_post_tags($items, true); $items = conv_sort($items, 'created'); if ($load && $mid && !count($items)) { // This will happen if we don't have sufficient permissions // to view the parent item (or the item itself if it is toplevel) notice(t('Permission denied.') . EOL); } } else { $items = array(); } if (!$update && !$load) { // This is ugly, but we can't pass the profile_uid through the session to the ajax updater, // because browser prefetching might change it on us. We have to deliver it with the page. $o .= '<div id="live-channel"></div>' . "\r\n"; $o .= "<script> var profile_uid = " . $a->profile['profile_uid'] . "; var netargs = '?f='; var profile_page = " . $a->pager['page'] . "; </script>\r\n"; $a->page['htmlhead'] .= replace_macros(get_markup_template("build_query.tpl"), array('$baseurl' => z_root(), '$pgtype' => 'channel', '$uid' => $a->profile['profile_uid'] ? $a->profile['profile_uid'] : '0', '$gid' => '0', '$cid' => '0', '$cmin' => '0', '$cmax' => '0', '$star' => '0', '$liked' => '0', '$conv' => '0', '$spam' => '0', '$nouveau' => '0', '$wall' => '1', '$fh' => '0', '$page' => $a->pager['page'] != 1 ? $a->pager['page'] : 1, '$search' => '', '$order' => '', '$list' => x($_REQUEST, 'list') ? intval($_REQUEST['list']) : 0, '$file' => '', '$cats' => $category ? $category : '', '$mid' => $mid, '$dend' => $datequery, '$dbegin' => $datequery2)); } if ($is_owner) { $r = q("UPDATE item SET item_flags = (item_flags ^ %d)\n\t\t\tWHERE (item_flags & %d) AND (item_flags & %d) AND uid = %d ", intval(ITEM_UNSEEN), intval(ITEM_UNSEEN), intval(ITEM_WALL), intval(local_user())); } if ($_COOKIE['jsAvailable'] == 1) { $o .= conversation($a, $items, 'channel', $update, 'client'); } else { $o .= conversation($a, $items, 'channel', $update, 'traditional'); } if (!$update || $_COOKIE['jsAvailable'] != 1) { $o .= alt_pager($a, count($items)); } if ($mid) { $o .= '<div id="content-complete"></div>'; } return $o; }
function items_fetch($arr, $channel = null, $observer_hash = null, $client_mode = CLIENT_MODE_NORMAL, $module = 'network') { $result = array('success' => false); $a = get_app(); $sql_extra = ''; $sql_nets = ''; $sql_options = ''; $sql_extra2 = ''; $sql_extra3 = ''; $def_acl = ''; $item_uids = ' true '; if ($arr['uid']) { $uid = $arr['uid']; } if ($channel) { $uid = $channel['channel_id']; $uidhash = $channel['channel_hash']; $item_uids = " item.uid = " . intval($uid) . " "; } if ($arr['star']) { $sql_options .= " and (item_flags & " . intval(ITEM_STARRED) . ")>0 "; } if ($arr['wall']) { $sql_options .= " and (item_flags & " . intval(ITEM_WALL) . ")>0 "; } $sql_extra = " AND item.parent IN ( SELECT parent FROM item WHERE (item_flags & " . intval(ITEM_THREAD_TOP) . ")>0 {$sql_options} ) "; if ($arr['since_id']) { $sql_extra .= " and item.id > " . $since_id . " "; } if ($arr['gid'] && $uid) { $r = q("SELECT * FROM `groups` WHERE id = %d AND uid = %d LIMIT 1", intval($arr['group']), intval($uid)); if (!$r) { $result['message'] = t('Collection not found.'); return $result; } $contact_str = ''; /** @FIXME $group is undefined */ $contacts = group_get_members($group); if ($contacts) { foreach ($contacts as $c) { if ($contact_str) { $contact_str .= ','; } $contact_str .= "'" . $c['xchan'] . "'"; } } else { $contact_str = ' 0 '; $result['message'] = t('Collection is empty.'); return $result; } $sql_extra = " AND item.parent IN ( SELECT DISTINCT parent FROM item WHERE true {$sql_options} AND (( author_xchan IN ( {$contact_str} ) OR owner_xchan in ( {$contact_str})) or allow_gid like '" . protect_sprintf('%<' . dbesc($r[0]['hash']) . '>%') . "' ) and id = parent and item_restrict = 0 ) "; $x = group_rec_byhash($uid, $r[0]['hash']); $result['headline'] = sprintf(t('Collection: %s'), $x['name']); } elseif ($arr['cid'] && $uid) { $r = q("SELECT abook.*, xchan.* from abook left join xchan on abook_xchan = xchan_hash where abook_id = %d and abook_channel = %d and not ( abook_flags & " . intval(ABOOK_FLAG_BLOCKED) . ")>0 limit 1", intval($arr['cid']), intval(local_channel())); if ($r) { $sql_extra = " AND item.parent IN ( SELECT DISTINCT parent FROM item WHERE true {$sql_options} AND uid = " . intval($arr['uid']) . " AND ( author_xchan = '" . dbesc($r[0]['abook_xchan']) . "' or owner_xchan = '" . dbesc($r[0]['abook_xchan']) . "' ) and item_restrict = 0 ) "; $result['headline'] = sprintf(t('Connection: %s'), $r[0]['xchan_name']); } else { $result['message'] = t('Connection not found.'); return $result; } } if ($arr['datequery']) { $sql_extra3 .= protect_sprintf(sprintf(" AND item.created <= '%s' ", dbesc(datetime_convert(date_default_timezone_get(), '', $arr['datequery'])))); } if ($arr['datequery2']) { $sql_extra3 .= protect_sprintf(sprintf(" AND item.created >= '%s' ", dbesc(datetime_convert(date_default_timezone_get(), '', $arr['datequery2'])))); } if (!array_key_exists('nouveau', $arr)) { $sql_extra2 = " AND item.parent = item.id "; $sql_extra3 = ''; } if ($arr['search']) { if (strpos($arr['search'], '#') === 0) { $sql_extra .= term_query('item', substr($arr['search'], 1), TERM_HASHTAG); } else { $sql_extra .= sprintf(" AND item.body like '%s' ", dbesc(protect_sprintf('%' . $arr['search'] . '%'))); } } if (strlen($arr['file'])) { $sql_extra .= term_query('item', $arr['files'], TERM_FILE); } if ($arr['conv'] && $channel) { $sql_extra .= sprintf(" AND parent IN (SELECT distinct parent from item where ( author_xchan like '%s' or ( item_flags & %d )>0)) ", dbesc(protect_sprintf($uidhash)), intval(ITEM_MENTIONSME)); } if ($client_mode & CLIENT_MODE_UPDATE && !($client_mode & CLIENT_MODE_LOAD)) { // only setup pagination on initial page view $pager_sql = ''; } else { $itemspage = $channel ? get_pconfig($uid, 'system', 'itemspage') : 20; $a->set_pager_itemspage(intval($itemspage) ? $itemspage : 20); $pager_sql = sprintf(" LIMIT %d OFFSET %d ", intval(get_app()->pager['itemspage']), intval(get_app()->pager['start'])); } if (isset($arr['start']) && isset($arr['records'])) { $pager_sql = sprintf(" LIMIT %d OFFSET %d ", intval($arr['records']), intval($arr['start'])); } if (array_key_exists('cmin', $arr) || array_key_exists('cmax', $arr)) { if ($arr['cmin'] != 0 || $arr['cmax'] != 99) { // Not everybody who shows up in the network stream will be in your address book. // By default those that aren't are assumed to have closeness = 99; but this isn't // recorded anywhere. So if cmax is 99, we'll open the search up to anybody in // the stream with a NULL address book entry. $sql_nets .= " AND "; if ($arr['cmax'] == 99) { $sql_nets .= " ( "; } $sql_nets .= "( abook.abook_closeness >= " . intval($arr['cmin']) . " "; $sql_nets .= " AND abook.abook_closeness <= " . intval($arr['cmax']) . " ) "; /** @fixme dead code, $cmax is undefined */ if ($cmax == 99) { $sql_nets .= " OR abook.abook_closeness IS NULL ) "; } } } $simple_update = $client_mode & CLIENT_MODE_UPDATE ? " and ( item.item_unseen = 1 ) " : ''; if ($client_mode & CLIENT_MODE_LOAD) { $simple_update = ''; } //$start = dba_timer(); require_once 'include/security.php'; $sql_extra .= item_permissions_sql($channel['channel_id'], $observer_hash); if ($arr['pages']) { $item_restrict = " AND (item_restrict & " . ITEM_WEBPAGE . ") "; } else { $item_restrict = " AND item_restrict = 0 "; } if ($arr['nouveau'] && $client_mode & CLIENT_MODE_LOAD && $channel) { // "New Item View" - show all items unthreaded in reverse created date order $items = q("SELECT item.*, item.id AS item_id FROM item\n\t\t\t\tWHERE {$item_uids} {$item_restrict}\n\t\t\t\t{$simple_update}\n\t\t\t\t{$sql_extra} {$sql_nets}\n\t\t\t\tORDER BY item.received DESC {$pager_sql}"); require_once 'include/items.php'; xchan_query($items); $items = fetch_post_tags($items, true); } else { // Normal conversation view if ($arr['order'] === 'post') { $ordering = "created"; } else { $ordering = "commented"; } if ($client_mode & CLIENT_MODE_LOAD || $client_mode == CLIENT_MODE_NORMAL) { // Fetch a page full of parent items for this page $r = q("SELECT distinct item.id AS item_id, item.{$ordering} FROM item\n left join abook on item.author_xchan = abook.abook_xchan\n WHERE {$item_uids} {$item_restrict}\n AND item.parent = item.id\n and ((abook.abook_flags & %d) = 0 or abook.abook_flags is null)\n {$sql_extra3} {$sql_extra} {$sql_nets}\n ORDER BY item.{$ordering} DESC {$pager_sql} ", intval(ABOOK_FLAG_BLOCKED)); } else { // update $r = q("SELECT item.parent AS item_id FROM item\n left join abook on item.author_xchan = abook.abook_xchan\n WHERE {$item_uids} {$item_restrict} {$simple_update}\n and ((abook.abook_flags & %d) = 0 or abook.abook_flags is null)\n {$sql_extra3} {$sql_extra} {$sql_nets} ", intval(ABOOK_FLAG_BLOCKED)); } //$first = dba_timer(); // Then fetch all the children of the parents that are on this page if ($r) { $parents_str = ids_to_querystr($r, 'item_id'); if ($arr['top']) { $sql_extra = ' and id = parent ' . $sql_extra; } $items = q("SELECT item.*, item.id AS item_id FROM item\n\t\t\t\tWHERE {$item_uids} {$item_restrict}\n\t\t\t\tAND item.parent IN ( %s )\n\t\t\t\t{$sql_extra} ", dbesc($parents_str)); //$second = dba_timer(); xchan_query($items); //$third = dba_timer(); $items = fetch_post_tags($items, true); //$fourth = dba_timer(); require_once 'include/conversation.php'; $items = conv_sort($items, $ordering); //logger('items: ' . print_r($items,true)); } else { $items = array(); } if ($parents_str && $arr['mark_seen']) { $update_unseen = ' AND parent IN ( ' . dbesc($parents_str) . ' )'; } /** @FIXME finish mark unseen sql */ } return $items; }
function widget_forums($arr) { $a = get_app(); if (!local_channel()) { return ''; } $o = ''; if (is_array($arr) && array_key_exists('limit', $arr)) { $limit = " limit " . intval($limit) . " "; } else { $limit = ''; } $unseen = 0; if (is_array($arr) && array_key_exists('unseen', $arr) && intval($arr['unseen'])) { $unseen = 1; } $perms_sql = item_permissions_sql(local_channel()) . item_normal(); $r1 = q("select * from abook left join xchan on abook_xchan = xchan_hash where ( xchan_pubforum = 1 or ((abook_their_perms & %d ) != 0 and (abook_their_perms & %d ) = 0) ) and abook_channel = %d order by xchan_name {$limit} ", intval(PERMS_W_TAGWALL), intval(PERMS_W_STREAM), intval(local_channel())); if (!$r1) { return $o; } $str = ''; // Trying to cram all this into a single query with joins and the proper group by's is tough. // There also should be a way to update this via ajax. for ($x = 0; $x < count($r1); $x++) { $r = q("select sum(item_unseen) as unseen from item where owner_xchan = '%s' and uid = %d {$perms_sql} ", dbesc($r1[$x]['xchan_hash']), intval(local_channel())); if ($r) { $r1[$x]['unseen'] = $r[0]['unseen']; } } if ($r1) { $o .= '<div class="widget">'; $o .= '<h3>' . t('Forums') . '</h3><ul class="nav nav-pills nav-stacked">'; foreach ($r1 as $rr) { if ($unseen && !intval($rr['unseen'])) { continue; } $o .= '<li><a href="network?f=&pf=1&cid=' . $rr['abook_id'] . '" ><span class="badge pull-right">' . (intval($rr['unseen']) ? intval($rr['unseen']) : '') . '</span><img src="' . $rr['xchan_photo_s'] . '" style="width: 16px; height: 16px;" /> ' . $rr['xchan_name'] . '</a></li>'; } $o .= '</ul></div>'; } return $o; }
function display_content(&$a) { if (get_config('system', 'block_public') && !local_user() && !remote_user()) { notice(t('Public access denied.') . EOL); return; } require_once "include/bbcode.php"; require_once 'include/security.php'; require_once 'include/conversation.php'; require_once 'include/acl_selectors.php'; $o = '<div id="live-display"></div>' . "\r\n"; $a->page['htmlhead'] .= <<<EOT <script> \$(document).ready(function() { \t\$(".comment-edit-wrapper textarea").contact_autocomplete(baseurl+"/acl"); \t// make auto-complete work in more places \t\$(".wall-item-comment-wrapper textarea").contact_autocomplete(baseurl+"/acl"); }); </script> EOT; $nick = $a->argc > 1 ? $a->argv[1] : ''; profile_load($a, $nick); $item_id = $a->argc > 2 ? intval($a->argv[2]) : 0; if (!$item_id) { $a->error = 404; notice(t('Item not found.') . EOL); return; } $groups = array(); $contact = null; $remote_contact = false; if (remote_user()) { $contact_id = $_SESSION['visitor_id']; $groups = init_groups_visitor($contact_id); $r = q("SELECT * FROM `contact` WHERE `id` = %d AND `uid` = %d LIMIT 1", intval($contact_id), intval($a->profile['uid'])); if (count($r)) { $contact = $r[0]; $remote_contact = true; } } if (!$remote_contact) { if (local_user()) { $contact_id = $_SESSION['cid']; $contact = $a->contact; } } $r = q("SELECT * FROM `contact` WHERE `uid` = %d AND `self` = 1 LIMIT 1", intval($a->profile['uid'])); if (count($r)) { $a->page_contact = $r[0]; } $is_owner = local_user() && local_user() == $a->profile['profile_uid'] ? true : false; if ($a->profile['hidewall'] && !$is_owner && !$remote_contact) { notice(t('Access to this profile has been restricted.') . EOL); return; } if ($is_owner) { $celeb = $a->user['page-flags'] == PAGE_SOAPBOX || $a->user['page-flags'] == PAGE_COMMUNITY ? true : false; } $x = array('is_owner' => true, 'allow_location' => $a->user['allow_location'], 'default_location' => $a->user['default-location'], 'nickname' => $a->user['nickname'], 'lockstate' => is_array($a->user) && (strlen($a->user['allow_cid']) || strlen($a->user['allow_gid']) || strlen($a->user['deny_cid']) || strlen($a->user['deny_gid'])) ? 'lock' : 'unlock', 'acl' => populate_acl($a->user, $celeb), 'bang' => '', 'visitor' => 'block', 'profile_uid' => local_user()); $o .= status_editor($a, $x, 0, true); $sql_extra = item_permissions_sql($a->profile['uid'], $remote_contact, $groups); $r = q("SELECT `item`.*, `item`.`id` AS `item_id`, \n\t\t`contact`.`name`, `contact`.`photo`, `contact`.`url`, `contact`.`rel`,\n\t\t`contact`.`network`, `contact`.`thumb`, `contact`.`self`, `contact`.`writable`, \n\t\t`contact`.`id` AS `cid`, `contact`.`uid` AS `contact-uid`\n\t\tFROM `item` LEFT JOIN `contact` ON `contact`.`id` = `item`.`contact-id`\n\t\tWHERE `item`.`uid` = %d AND `item`.`visible` = 1 AND `item`.`deleted` = 0\n\t\tand `item`.`moderated` = 0\n\t\tAND `contact`.`blocked` = 0 AND `contact`.`pending` = 0\n\t\tAND `item`.`parent` = ( SELECT `parent` FROM `item` WHERE ( `id` = '%s' OR `uri` = '%s' ))\n\t\t{$sql_extra}\n\t\tORDER BY `parent` DESC, `gravity` ASC, `id` ASC ", intval($a->profile['uid']), dbesc($item_id), dbesc($item_id)); if (count($r)) { if (local_user() && local_user() == $a->profile['uid']) { q("UPDATE `item` SET `unseen` = 0 \n\t\t\t\tWHERE `parent` = %d AND `unseen` = 1", intval($r[0]['parent'])); } $o .= conversation($a, $r, 'display', false); } else { $r = q("SELECT `id` FROM `item` WHERE `id` = '%s' OR `uri` = '%s' LIMIT 1", dbesc($item_id), dbesc($item_id)); if (count($r)) { if ($r[0]['deleted']) { notice(t('Item has been removed.') . EOL); } else { notice(t('Permission denied.') . EOL); } } else { notice(t('Item not found.') . EOL); } } return $o; }
function tagadelic($uid, $count = 0, $authors = '', $owner = '', $flags = 0, $restrict = 0, $type = TERM_HASHTAG) { require_once 'include/security.php'; if (!perm_is_allowed($uid, get_observer_hash(), 'view_stream')) { return array(); } $item_normal = item_normal(); $sql_options = item_permissions_sql($uid); $count = intval($count); if ($flags) { if ($flags === 'wall') { $sql_options .= " and item_wall = 1 "; } } if ($authors) { if (!is_array($authors)) { $authors = array($authors); } stringify_array_elms($authors, true); $sql_options .= " and author_xchan in (" . implode(',', $authors) . ") "; } if ($owner) { $sql_options .= " and owner_xchan = '" . dbesc($owner) . "' "; } // Fetch tags $r = q("select term, count(term) as total from term left join item on term.oid = item.id\n\t\twhere term.uid = %d and term.ttype = %d \n\t\tand otype = %d and item_type = %d and item_private = 0\n\t\t{$sql_options} {$item_normal}\n\t\tgroup by term order by total desc %s", intval($uid), intval($type), intval(TERM_OBJ_POST), intval($restrict), intval($count) ? "limit {$count}" : ''); if (!$r) { return array(); } return Zotlabs\Text\Tagadelic::calc($r); }
function get($update = 0, $load = false) { if ($load) { $_SESSION['loadtime'] = datetime_convert(); } $checkjs = new \Zotlabs\Web\CheckJS(1); $category = $datequery = $datequery2 = ''; $mid = x($_REQUEST, 'mid') ? $_REQUEST['mid'] : ''; $datequery = x($_GET, 'dend') && is_a_date_arg($_GET['dend']) ? notags($_GET['dend']) : ''; $datequery2 = x($_GET, 'dbegin') && is_a_date_arg($_GET['dbegin']) ? notags($_GET['dbegin']) : ''; if (observer_prohibited(true)) { return login(); } $category = x($_REQUEST, 'cat') ? $_REQUEST['cat'] : ''; $hashtags = x($_REQUEST, 'tag') ? $_REQUEST['tag'] : ''; $groups = array(); $o = ''; if ($update) { // Ensure we've got a profile owner if updating. \App::$profile['profile_uid'] = \App::$profile_uid = $update; } else { if (\App::$profile['profile_uid'] == local_channel()) { nav_set_selected('home'); } } $is_owner = local_channel() && \App::$profile['profile_uid'] == local_channel() ? true : false; $channel = \App::get_channel(); $observer = \App::get_observer(); $ob_hash = $observer ? $observer['xchan_hash'] : ''; $perms = get_all_perms(\App::$profile['profile_uid'], $ob_hash); if (!$perms['view_stream']) { // We may want to make the target of this redirect configurable if ($perms['view_profile']) { notice(t('Insufficient permissions. Request redirected to profile page.') . EOL); goaway(z_root() . "/profile/" . \App::$profile['channel_address']); } notice(t('Permission denied.') . EOL); return; } if (!$update) { $o .= profile_tabs($a, $is_owner, \App::$profile['channel_address']); $o .= common_friends_visitor_widget(\App::$profile['profile_uid']); if ($channel && $is_owner) { $channel_acl = array('allow_cid' => $channel['channel_allow_cid'], 'allow_gid' => $channel['channel_allow_gid'], 'deny_cid' => $channel['channel_deny_cid'], 'deny_gid' => $channel['channel_deny_gid']); } else { $channel_acl = array(); } if ($perms['post_wall']) { $x = array('is_owner' => $is_owner, 'allow_location' => ($is_owner || $observer) && intval(get_pconfig(\App::$profile['profile_uid'], 'system', 'use_browser_location')) ? true : false, 'default_location' => $is_owner ? \App::$profile['channel_location'] : '', 'nickname' => \App::$profile['channel_address'], 'lockstate' => strlen(\App::$profile['channel_allow_cid']) || strlen(\App::$profile['channel_allow_gid']) || strlen(\App::$profile['channel_deny_cid']) || strlen(\App::$profile['channel_deny_gid']) ? 'lock' : 'unlock', 'acl' => $is_owner ? populate_acl($channel_acl, true, \PermissionDescription::fromGlobalPermission('view_stream'), get_post_aclDialogDescription(), 'acl_dialog_post') : '', 'showacl' => $is_owner ? 'yes' : '', 'bang' => '', 'visitor' => $is_owner || $observer ? true : false, 'profile_uid' => \App::$profile['profile_uid'], 'editor_autocomplete' => true, 'bbco_autocomplete' => 'bbcode', 'bbcode' => true); $o .= status_editor($a, $x); } } /** * Get permissions SQL - if $remote_contact is true, our remote user has been pre-verified and we already have fetched his/her groups */ $item_normal = item_normal(); $sql_extra = item_permissions_sql(\App::$profile['profile_uid']); if (get_pconfig(\App::$profile['profile_uid'], 'system', 'channel_list_mode') && !$mid) { $page_mode = 'list'; } else { $page_mode = 'client'; } $abook_uids = " and abook.abook_channel = " . intval(\App::$profile['profile_uid']) . " "; $simple_update = $update ? " AND item_unseen = 1 " : ''; \App::$page['htmlhead'] .= "\r\n" . '<link rel="alternate" type="application/json+oembed" href="' . z_root() . '/oep?f=&url=' . urlencode(z_root() . '/' . \App::$query_string) . '" title="oembed" />' . "\r\n"; if ($update && $_SESSION['loadtime']) { $simple_update = " AND (( item_unseen = 1 AND item.changed > '" . datetime_convert('UTC', 'UTC', $_SESSION['loadtime']) . "' ) OR item.changed > '" . datetime_convert('UTC', 'UTC', $_SESSION['loadtime']) . "' ) "; } if ($load) { $simple_update = ''; } if ($update && !$load) { if ($mid) { $r = q("SELECT parent AS item_id from item where mid like '%s' and uid = %d {$item_normal}\n\t\t\t\t\tAND item_wall = 1 AND item_unseen = 1 {$sql_extra} limit 1", dbesc($mid . '%'), intval(\App::$profile['profile_uid'])); } else { $r = q("SELECT distinct parent AS `item_id`, created from item\n\t\t\t\t\tleft join abook on ( item.owner_xchan = abook.abook_xchan {$abook_uids} )\n\t\t\t\t\tWHERE uid = %d {$item_normal}\n\t\t\t\t\tAND item_wall = 1 {$simple_update}\n\t\t\t\t\tAND (abook.abook_blocked = 0 or abook.abook_flags is null)\n\t\t\t\t\t{$sql_extra}\n\t\t\t\t\tORDER BY created DESC", intval(\App::$profile['profile_uid'])); $_SESSION['loadtime'] = datetime_convert(); } } else { if (x($category)) { $sql_extra .= protect_sprintf(term_query('item', $category, TERM_CATEGORY)); } if (x($hashtags)) { $sql_extra .= protect_sprintf(term_query('item', $hashtags, TERM_HASHTAG, TERM_COMMUNITYTAG)); } if ($datequery) { $sql_extra2 .= protect_sprintf(sprintf(" AND item.created <= '%s' ", dbesc(datetime_convert(date_default_timezone_get(), '', $datequery)))); } if ($datequery2) { $sql_extra2 .= protect_sprintf(sprintf(" AND item.created >= '%s' ", dbesc(datetime_convert(date_default_timezone_get(), '', $datequery2)))); } $itemspage = get_pconfig(local_channel(), 'system', 'itemspage'); \App::set_pager_itemspage(intval($itemspage) ? $itemspage : 20); $pager_sql = sprintf(" LIMIT %d OFFSET %d ", intval(\App::$pager['itemspage']), intval(\App::$pager['start'])); if ($load || $checkjs->disabled()) { if ($mid) { $r = q("SELECT parent AS item_id from item where mid = '%s' and uid = %d {$item_normal}\n\t\t\t\t\t\tAND item_wall = 1 {$sql_extra} limit 1", dbesc($mid), intval(\App::$profile['profile_uid'])); if (!$r) { notice(t('Permission denied.') . EOL); } } else { $r = q("SELECT distinct id AS item_id, created FROM item \n\t\t\t\t\t\tleft join abook on item.author_xchan = abook.abook_xchan\n\t\t\t\t\t\tWHERE uid = %d {$item_normal}\n\t\t\t\t\t\tAND item_wall = 1 and item_thread_top = 1\n\t\t\t\t\t\tAND (abook_blocked = 0 or abook.abook_flags is null)\n\t\t\t\t\t\t{$sql_extra} {$sql_extra2}\n\t\t\t\t\t\tORDER BY created DESC {$pager_sql} ", intval(\App::$profile['profile_uid'])); } } else { $r = array(); } } if ($r) { $parents_str = ids_to_querystr($r, 'item_id'); $items = q("SELECT `item`.*, `item`.`id` AS `item_id` \n\t\t\t\tFROM `item`\n\t\t\t\tWHERE `item`.`uid` = %d {$item_normal}\n\t\t\t\tAND `item`.`parent` IN ( %s )\n\t\t\t\t{$sql_extra} ", intval(\App::$profile['profile_uid']), dbesc($parents_str)); xchan_query($items); $items = fetch_post_tags($items, true); $items = conv_sort($items, 'created'); if ($load && $mid && !count($items)) { // This will happen if we don't have sufficient permissions // to view the parent item (or the item itself if it is toplevel) notice(t('Permission denied.') . EOL); } } else { $items = array(); } if (!$update && !$load) { // This is ugly, but we can't pass the profile_uid through the session to the ajax updater, // because browser prefetching might change it on us. We have to deliver it with the page. $maxheight = get_pconfig(\App::$profile['profile_uid'], 'system', 'channel_divmore_height'); if (!$maxheight) { $maxheight = 400; } $o .= '<div id="live-channel"></div>' . "\r\n"; $o .= "<script> var profile_uid = " . \App::$profile['profile_uid'] . "; var netargs = '?f='; var profile_page = " . \App::$pager['page'] . "; divmore_height = " . intval($maxheight) . "; </script>\r\n"; \App::$page['htmlhead'] .= replace_macros(get_markup_template("build_query.tpl"), array('$baseurl' => z_root(), '$pgtype' => 'channel', '$uid' => \App::$profile['profile_uid'] ? \App::$profile['profile_uid'] : '0', '$gid' => '0', '$cid' => '0', '$cmin' => '0', '$cmax' => '0', '$star' => '0', '$liked' => '0', '$conv' => '0', '$spam' => '0', '$nouveau' => '0', '$wall' => '1', '$fh' => '0', '$page' => \App::$pager['page'] != 1 ? \App::$pager['page'] : 1, '$search' => '', '$order' => '', '$list' => x($_REQUEST, 'list') ? intval($_REQUEST['list']) : 0, '$file' => '', '$cats' => $category ? $category : '', '$tags' => $hashtags ? $hashtags : '', '$mid' => $mid, '$verb' => '', '$dend' => $datequery, '$dbegin' => $datequery2)); } $update_unseen = ''; if ($page_mode === 'list') { /** * in "list mode", only mark the parent item and any like activities as "seen". * We won't distinguish between comment likes and post likes. The important thing * is that the number of unseen comments will be accurate. The SQL to separate the * comment likes could also get somewhat hairy. */ if ($parents_str) { $update_unseen = " AND ( id IN ( " . dbesc($parents_str) . " )"; $update_unseen .= " OR ( parent IN ( " . dbesc($parents_str) . " ) AND verb in ( '" . dbesc(ACTIVITY_LIKE) . "','" . dbesc(ACTIVITY_DISLIKE) . "' ))) "; } } else { if ($parents_str) { $update_unseen = " AND parent IN ( " . dbesc($parents_str) . " )"; } } if ($is_owner && $update_unseen) { $r = q("UPDATE item SET item_unseen = 0 where item_unseen = 1 and item_wall = 1 AND uid = %d {$update_unseen}", intval(local_channel())); } if ($checkjs->disabled()) { $o .= conversation($a, $items, 'channel', $update, 'traditional'); } else { $o .= conversation($a, $items, 'channel', $update, $page_mode); } if (!$update || $checkjs->disabled()) { $o .= alt_pager($a, count($items)); if ($mid && $items[0]['title']) { \App::$page['title'] = $items[0]['title'] . " - " . \App::$page['title']; } } if ($mid) { $o .= '<div id="content-complete"></div>'; } return $o; }
function get() { if (!\App::$profile) { notice(t('Requested profile is not available.') . EOL); \App::$error = 404; return; } $which = argv(1); $uid = local_channel(); $owner = 0; $channel = null; $observer = \App::get_observer(); $channel = \App::get_channel(); if (\App::$is_sys && is_site_admin()) { $sys = get_sys_channel(); if ($sys && intval($sys['channel_id'])) { $uid = $owner = intval($sys['channel_id']); $channel = $sys; $observer = $sys; } } if (!$owner) { // Figure out who the page owner is. $r = q("select channel_id from channel where channel_address = '%s'", dbesc($which)); if ($r) { $owner = intval($r[0]['channel_id']); } } $ob_hash = $observer ? $observer['xchan_hash'] : ''; if (!perm_is_allowed($owner, $ob_hash, 'write_pages')) { notice(t('Permission denied.') . EOL); return; } $is_owner = $uid && $uid == $owner ? true : false; $o = ''; // Figure out which post we're editing $post_id = argc() > 2 ? intval(argv(2)) : 0; if (!$post_id) { notice(t('Item not found') . EOL); return; } $ob_hash = $observer ? $observer['xchan_hash'] : ''; $perms = get_all_perms($owner, $ob_hash); if (!$perms['write_pages']) { notice(t('Permission denied.') . EOL); return; } // We've already figured out which item we want and whose copy we need, // so we don't need anything fancy here $sql_extra = item_permissions_sql($owner); $itm = q("SELECT * FROM `item` WHERE `id` = %d and uid = %s {$sql_extra} LIMIT 1", intval($post_id), intval($owner)); if (!$itm) { notice(t('Permission denied.') . EOL); return; } if (intval($itm[0]['item_obscured'])) { $key = get_config('system', 'prvkey'); if ($itm[0]['title']) { $itm[0]['title'] = crypto_unencapsulate(json_decode_plus($itm[0]['title']), $key); } if ($itm[0]['body']) { $itm[0]['body'] = crypto_unencapsulate(json_decode_plus($itm[0]['body']), $key); } } $item_id = q("select * from item_id where service = 'WEBPAGE' and iid = %d limit 1", intval($itm[0]['id'])); if ($item_id) { $page_title = $item_id[0]['sid']; } $mimetype = $itm[0]['mimetype']; if ($mimetype === 'application/x-php') { if (!$uid || $uid != $itm[0]['uid']) { notice(t('Permission denied.') . EOL); return; } } $layout = $itm[0]['layout_mid']; $tpl = get_markup_template("jot.tpl"); $rp = 'webpages/' . $which; $x = array('nickname' => $channel['channel_address'], 'bbco_autocomplete' => $mimetype == 'text/bbcode' ? 'bbcode' : '', 'return_path' => $rp, 'webpage' => ITEM_TYPE_WEBPAGE, 'ptlabel' => t('Page link'), 'pagetitle' => $page_title, 'writefiles' => $mimetype == 'text/bbcode' ? perm_is_allowed($owner, get_observer_hash(), 'write_storage') : false, 'button' => t('Edit'), 'weblink' => $mimetype == 'text/bbcode' ? t('Insert web link') : false, 'hide_location' => true, 'hide_voting' => true, 'ptyp' => $itm[0]['type'], 'body' => undo_post_tagging($itm[0]['body']), 'post_id' => $post_id, 'visitor' => $is_owner ? true : false, 'acl' => populate_acl($itm[0], false, \PermissionDescription::fromGlobalPermission('view_pages')), 'showacl' => $is_owner ? true : false, 'mimetype' => $mimetype, 'mimeselect' => true, 'layout' => $layout, 'layoutselect' => true, 'title' => htmlspecialchars($itm[0]['title'], ENT_COMPAT, 'UTF-8'), 'lockstate' => strlen($itm[0]['allow_cid']) || strlen($itm[0]['allow_gid']) || strlen($itm[0]['deny_cid']) || strlen($itm[0]['deny_gid']) ? 'lock' : 'unlock', 'profile_uid' => intval($owner), 'bbcode' => $mimetype == 'text/bbcode' ? true : false); $editor = status_editor($a, $x); $o .= replace_macros(get_markup_template('edpost_head.tpl'), array('$title' => t('Edit Webpage'), '$delete' => $itm[0]['author_xchan'] === $ob_hash || $itm[0]['owner_xchan'] === $ob_hash ? t('Delete') : false, '$editor' => $editor, '$id' => $itm[0]['id'])); return $o; }
function profile_content(&$a, $update = 0) { $category = $datequery = $datequery2 = ''; if ($a->argc > 2) { for ($x = 2; $x < $a->argc; $x++) { if (is_a_date_arg($a->argv[$x])) { if ($datequery) { $datequery2 = escape_tags($a->argv[$x]); } else { $datequery = escape_tags($a->argv[$x]); } } else { $category = $a->argv[$x]; } } } if (!x($category)) { $category = x($_GET, 'category') ? $_GET['category'] : ''; } if (get_config('system', 'block_public') && !local_user() && !remote_user()) { return login(); } require_once "include/bbcode.php"; require_once 'include/security.php'; require_once 'include/conversation.php'; require_once 'include/acl_selectors.php'; require_once 'include/items.php'; $groups = array(); $tab = 'posts'; $o = ''; if ($update) { // Ensure we've got a profile owner if updating. $a->profile['profile_uid'] = $update; } else { if ($a->profile['profile_uid'] == local_user()) { nav_set_selected('home'); } } $contact = null; $remote_contact = false; $contact_id = 0; if (is_array($_SESSION['remote'])) { foreach ($_SESSION['remote'] as $v) { if ($v['uid'] == $a->profile['profile_uid']) { $contact_id = $v['cid']; break; } } } if ($contact_id) { $groups = init_groups_visitor($contact_id); $r = q("SELECT * FROM `contact` WHERE `id` = %d AND `uid` = %d LIMIT 1", intval($contact_id), intval($a->profile['profile_uid'])); if (count($r)) { $contact = $r[0]; $remote_contact = true; } } if (!$remote_contact) { if (local_user()) { $contact_id = $_SESSION['cid']; $contact = $a->contact; } } $is_owner = local_user() && local_user() == $a->profile['profile_uid'] ? true : false; if ($a->profile['hidewall'] && !$is_owner && !$remote_contact) { notice(t('Access to this profile has been restricted.') . EOL); return; } if (!$update) { if (x($_GET, 'tab')) { $tab = notags(trim($_GET['tab'])); } $o .= profile_tabs($a, $is_owner, $a->profile['nickname']); if ($tab === 'profile') { $o .= advanced_profile($a); call_hooks('profile_advanced', $o); return $o; } $o .= common_friends_visitor_widget($a->profile['profile_uid']); if (x($_SESSION, 'new_member') && $_SESSION['new_member'] && $is_owner) { $o .= '<a href="newmember" id="newmember-tips" style="font-size: 1.2em;"><b>' . t('Tips for New Members') . '</b></a>' . EOL; } $commpage = $a->profile['page-flags'] == PAGE_COMMUNITY ? true : false; $commvisitor = $commpage && $remote_contact == true ? true : false; $a->page['aside'] .= posted_date_widget($a->get_baseurl(true) . '/profile/' . $a->profile['nickname'], $a->profile['profile_uid'], true); $a->page['aside'] .= categories_widget($a->get_baseurl(true) . '/profile/' . $a->profile['nickname'], x($category) ? xmlify($category) : ''); if (can_write_wall($a, $a->profile['profile_uid'])) { $x = array('is_owner' => $is_owner, 'allow_location' => ($is_owner || $commvisitor) && $a->profile['allow_location'] ? true : false, 'default_location' => $is_owner ? $a->user['default-location'] : '', 'nickname' => $a->profile['nickname'], 'lockstate' => is_array($a->user) && (strlen($a->user['allow_cid']) || strlen($a->user['allow_gid']) || strlen($a->user['deny_cid']) || strlen($a->user['deny_gid'])) ? 'lock' : 'unlock', 'acl' => $is_owner ? populate_acl($a->user, true) : '', 'bang' => '', 'visitor' => $is_owner || $commvisitor ? 'block' : 'none', 'profile_uid' => $a->profile['profile_uid'], 'acl_data' => $is_owner ? construct_acl_data($a, $a->user) : ''); $o .= status_editor($a, $x); } } /** * Get permissions SQL - if $remote_contact is true, our remote user has been pre-verified and we already have fetched his/her groups */ $sql_extra = item_permissions_sql($a->profile['profile_uid'], $remote_contact, $groups); if ($update) { $r = q("SELECT distinct(parent) AS `item_id`, `item`.`network` AS `item_network`,\n\t\t\t`contact`.`uid` AS `contact-uid`\n\t\t\tFROM `item` INNER JOIN `contact` ON `contact`.`id` = `item`.`contact-id`\n\t\t\tAND `contact`.`blocked` = 0 AND `contact`.`pending` = 0\n\t\t\tWHERE `item`.`uid` = %d AND `item`.`visible` = 1 AND\n\t\t\t(`item`.`deleted` = 0 OR item.verb = '" . ACTIVITY_LIKE . "' OR item.verb = '" . ACTIVITY_DISLIKE . "')\n\t\t\tand `item`.`moderated` = 0 and `item`.`unseen` = 1\n\t\t\tAND `item`.`wall` = 1\n\t\t\t{$sql_extra}\n\t\t\tORDER BY `item`.`created` DESC", intval($a->profile['profile_uid'])); } else { $sql_post_table = ""; if (x($category)) { $sql_post_table = sprintf("INNER JOIN (SELECT `oid` FROM `term` WHERE `term` = '%s' AND `otype` = %d AND `type` = %d AND `uid` = %d ORDER BY `tid` DESC) AS `term` ON `item`.`id` = `term`.`oid` ", dbesc(protect_sprintf($category)), intval(TERM_OBJ_POST), intval(TERM_CATEGORY), intval($a->profile['profile_uid'])); //$sql_extra .= protect_sprintf(file_tag_file_query('item',$category,'category')); } if ($datequery) { $sql_extra2 .= protect_sprintf(sprintf(" AND `thread`.`created` <= '%s' ", dbesc(datetime_convert(date_default_timezone_get(), '', $datequery)))); } if ($datequery2) { $sql_extra2 .= protect_sprintf(sprintf(" AND `thread`.`created` >= '%s' ", dbesc(datetime_convert(date_default_timezone_get(), '', $datequery2)))); } if (get_config('system', 'old_pager')) { $r = q("SELECT COUNT(*) AS `total`\n\t\t\t FROM `thread` INNER JOIN `item` ON `item`.`id` = `thread`.`iid`\n\t\t\t {$sql_post_table} INNER JOIN `contact` ON `contact`.`id` = `thread`.`contact-id`\n\t\t\t AND `contact`.`blocked` = 0 AND `contact`.`pending` = 0\n\t\t\t WHERE `thread`.`uid` = %d AND `thread`.`visible` = 1 AND `thread`.`deleted` = 0\n\t\t\t and `thread`.`moderated` = 0\n\t\t\t AND `thread`.`wall` = 1\n\t\t\t {$sql_extra} {$sql_extra2} ", intval($a->profile['profile_uid'])); if (count($r)) { $a->set_pager_total($r[0]['total']); } } // check if we serve a mobile device and get the user settings // accordingly if ($a->is_mobile) { $itemspage_network = get_pconfig(local_user(), 'system', 'itemspage_mobile_network'); $itemspage_network = intval($itemspage_network) ? $itemspage_network : 20; } else { $itemspage_network = get_pconfig(local_user(), 'system', 'itemspage_network'); $itemspage_network = intval($itemspage_network) ? $itemspage_network : 40; } // now that we have the user settings, see if the theme forces // a maximum item number which is lower then the user choice if ($a->force_max_items > 0 && $a->force_max_items < $itemspage_network) { $itemspage_network = $a->force_max_items; } $a->set_pager_itemspage($itemspage_network); $pager_sql = sprintf(" LIMIT %d, %d ", intval($a->pager['start']), intval($a->pager['itemspage'])); $r = q("SELECT `thread`.`iid` AS `item_id`, `thread`.`network` AS `item_network`,\n\t\t\t`thread`.`uid` AS `contact-uid`\n\t\t\tFROM `thread` INNER JOIN `item` ON `item`.`id` = `thread`.`iid`\n\t\t\t{$sql_post_table} INNER JOIN `contact` ON `contact`.`id` = `thread`.`contact-id`\n\t\t\tAND `contact`.`blocked` = 0 AND `contact`.`pending` = 0\n\t\t\tWHERE `thread`.`uid` = %d AND `thread`.`visible` = 1 AND `thread`.`deleted` = 0\n\t\t\tand `thread`.`moderated` = 0\n\t\t\tAND `thread`.`wall` = 1\n\t\t\t{$sql_extra} {$sql_extra2}\n\t\t\tORDER BY `thread`.`created` DESC {$pager_sql} ", intval($a->profile['profile_uid'])); } $parents_arr = array(); $parents_str = ''; if (count($r)) { foreach ($r as $rr) { $parents_arr[] = $rr['item_id']; } $parents_str = implode(', ', $parents_arr); $items = q("SELECT `item`.*, `item`.`id` AS `item_id`, `item`.`network` AS `item_network`,\n\t\t\t`contact`.`name`, `contact`.`photo`, `contact`.`url`, `contact`.`alias`, `contact`.`network`, `contact`.`rel`,\n\t\t\t`contact`.`thumb`, `contact`.`self`, `contact`.`writable`,\n\t\t\t`contact`.`id` AS `cid`, `contact`.`uid` AS `contact-uid`\n\t\t\tFROM `item`, `contact`\n\t\t\tWHERE `item`.`uid` = %d AND `item`.`visible` = 1 AND `item`.`deleted` = 0\n\t\t\tand `item`.`moderated` = 0\n\t\t\tAND `contact`.`id` = `item`.`contact-id`\n\t\t\tAND `contact`.`blocked` = 0 AND `contact`.`pending` = 0\n\t\t\tAND `item`.`parent` IN ( %s )\n\t\t\t{$sql_extra} ", intval($a->profile['profile_uid']), dbesc($parents_str)); $items = conv_sort($items, 'created'); } else { $items = array(); } if ($is_owner && !$update && !get_config('theme', 'hide_eventlist')) { $o .= get_birthdays(); $o .= get_events(); } if ($is_owner) { $r = q("UPDATE `item` SET `unseen` = 0\n\t\t\tWHERE `wall` = 1 AND `unseen` = 1 AND `uid` = %d", intval(local_user())); } $o .= conversation($a, $items, 'profile', $update); if (!$update) { if (!get_config('system', 'old_pager')) { $o .= alt_pager($a, count($items)); } else { $o .= paginate($a); } } return $o; }
function widget_forums($arr) { if (!local_channel()) { return ''; } $o = ''; if (is_array($arr) && array_key_exists('limit', $arr)) { $limit = " limit " . intval($limit) . " "; } else { $limit = ''; } $unseen = 0; if (is_array($arr) && array_key_exists('unseen', $arr) && intval($arr['unseen'])) { $unseen = 1; } $perms_sql = item_permissions_sql(local_channel()) . item_normal(); $r1 = q("select abook_id, xchan_hash, xchan_name, xchan_url, xchan_photo_s from abook left join xchan on abook_xchan = xchan_hash where ( xchan_pubforum = 1 or ((abook_their_perms & %d ) != 0 and (abook_their_perms & %d ) = 0) ) and xchan_deleted = 0 and abook_channel = %d order by xchan_name {$limit} ", intval(PERMS_W_TAGWALL), intval(PERMS_W_STREAM), intval(local_channel())); if (!$r1) { return $o; } $str = ''; // Trying to cram all this into a single query with joins and the proper group by's is tough. // There also should be a way to update this via ajax. for ($x = 0; $x < count($r1); $x++) { $r = q("select sum(item_unseen) as unseen from item where owner_xchan = '%s' and uid = %d and item_unseen = 1 {$perms_sql} ", dbesc($r1[$x]['xchan_hash']), intval(local_channel())); if ($r) { $r1[$x]['unseen'] = $r[0]['unseen']; } /** * @FIXME * This SQL makes the counts correct when you get forum posts arriving from different routes/sources * (like personal channels). However the network query for these posts doesn't yet include this * correction and it makes the SQL for that query pretty hairy so this is left as a future exercise. * It may make more sense in that query to look for the mention in the body rather than another join, * but that makes it very inefficient. * $r = q("select sum(item_unseen) as unseen from item left join term on oid = id where otype = %d and owner_xchan != '%s' and item.uid = %d and url = '%s' and ttype = %d $perms_sql ", intval(TERM_OBJ_POST), dbesc($r1[$x]['xchan_hash']), intval(local_channel()), dbesc($r1[$x]['xchan_url']), intval(TERM_MENTION) ); if($r) $r1[$x]['unseen'] = ((array_key_exists('unseen',$r1[$x])) ? $r1[$x]['unseen'] + $r[0]['unseen'] : $r[0]['unseen']); * * end @FIXME */ } if ($r1) { $o .= '<div class="widget">'; $o .= '<h3>' . t('Forums') . '</h3><ul class="nav nav-pills nav-stacked">'; foreach ($r1 as $rr) { if ($unseen && !intval($rr['unseen'])) { continue; } $o .= '<li><a href="network?f=&pf=1&cid=' . $rr['abook_id'] . '" ><span class="badge pull-right">' . (intval($rr['unseen']) ? intval($rr['unseen']) : '') . '</span><img src="' . $rr['xchan_photo_s'] . '" style="width: 16px; height: 16px;" /> ' . $rr['xchan_name'] . '</a></li>'; } $o .= '</ul></div>'; } return $o; }
function init() { // We need this to make sure the channel theme is always loaded. $which = argv(1); $profile = 0; profile_load($a, $which, $profile); if (\App::$profile['profile_uid']) { head_set_icon(\App::$profile['thumb']); } // load the item here in the init function because we need to extract // the page layout and initialise the correct theme. $observer = \App::get_observer(); $ob_hash = $observer ? $observer['xchan_hash'] : ''; // perm_is_allowed is denied unconditionally when 'site blocked to unauthenticated members'. // This bypasses that restriction for sys channel (public) content if (!perm_is_allowed(\App::$profile['profile_uid'], $ob_hash, 'view_pages') && !is_sys_channel(\App::$profile['profile_uid'])) { notice(t('Permission denied.') . EOL); return; } if (argc() < 3) { notice(t('Invalid item.') . EOL); return; } $channel_address = argv(1); // The page link title was stored in a urlencoded format // php or the browser may/will have decoded it, so re-encode it for our search $page_id = urlencode(argv(2)); $u = q("select channel_id from channel where channel_address = '%s' limit 1", dbesc($channel_address)); if (!$u) { notice(t('Channel not found.') . EOL); return; } if ($_REQUEST['rev']) { $revision = " and revision = " . intval($_REQUEST['rev']) . " "; } else { $revision = " order by revision desc "; } require_once 'include/security.php'; $sql_options = item_permissions_sql($u[0]['channel_id']); $r = q("select item.* from item left join item_id on item.id = item_id.iid\n\t\t\twhere item.uid = %d and sid = '%s' and item.item_delayed = 0 and (( service = 'WEBPAGE' and item_type = %d ) \n\t\t\tOR ( service = 'PDL' AND item_type = %d )) {$sql_options} {$revision} limit 1", intval($u[0]['channel_id']), dbesc($page_id), intval(ITEM_TYPE_WEBPAGE), intval(ITEM_TYPE_PDL)); if (!$r) { // Check again with no permissions clause to see if it is a permissions issue $x = q("select item.* from item left join item_id on item.id = item_id.iid\n\t\t\twhere item.uid = %d and sid = '%s' and item.item_delayed = 0 and service = 'WEBPAGE' and \n\t\t\titem_type = %d {$revision} limit 1", intval($u[0]['channel_id']), dbesc($page_id), intval(ITEM_TYPE_WEBPAGE)); if ($x) { // Yes, it's there. You just aren't allowed to see it. notice(t('Permission denied.') . EOL); } else { notice(t('Page not found.') . EOL); } return; } if ($r[0]['title']) { \App::$page['title'] = escape_tags($r[0]['title']); } if ($r[0]['item_type'] == ITEM_TYPE_PDL) { \App::$comanche = new \Zotlabs\Render\Comanche(); \App::$comanche->parse($r[0]['body']); \App::$pdl = $r[0]['body']; } elseif ($r[0]['layout_mid']) { $l = q("select body from item where mid = '%s' and uid = %d limit 1", dbesc($r[0]['layout_mid']), intval($u[0]['channel_id'])); if ($l) { \App::$comanche = new \Zotlabs\Render\Comanche(); \App::$comanche->parse($l[0]['body']); \App::$pdl = $l[0]['body']; } } \App::$data['webpage'] = $r; }
function editwebpage_content(&$a) { if (!App::$profile) { notice(t('Requested profile is not available.') . EOL); App::$error = 404; return; } $which = argv(1); $uid = local_channel(); $owner = 0; $channel = null; $observer = App::get_observer(); $channel = App::get_channel(); if (App::$is_sys && is_site_admin()) { $sys = get_sys_channel(); if ($sys && intval($sys['channel_id'])) { $uid = $owner = intval($sys['channel_id']); $channel = $sys; $observer = $sys; } } if (!$owner) { // Figure out who the page owner is. $r = q("select channel_id from channel where channel_address = '%s'", dbesc($which)); if ($r) { $owner = intval($r[0]['channel_id']); } } $ob_hash = $observer ? $observer['xchan_hash'] : ''; if (!perm_is_allowed($owner, $ob_hash, 'write_pages')) { notice(t('Permission denied.') . EOL); return; } $is_owner = $uid && $uid == $owner ? true : false; $o = ''; // Figure out which post we're editing $post_id = argc() > 2 ? intval(argv(2)) : 0; if (!$post_id) { notice(t('Item not found') . EOL); return; } $ob_hash = $observer ? $observer['xchan_hash'] : ''; $perms = get_all_perms($owner, $ob_hash); if (!$perms['write_pages']) { notice(t('Permission denied.') . EOL); return; } // We've already figured out which item we want and whose copy we need, // so we don't need anything fancy here $sql_extra = item_permissions_sql($owner); $itm = q("SELECT * FROM `item` WHERE `id` = %d and uid = %s {$sql_extra} LIMIT 1", intval($post_id), intval($owner)); if (!$itm) { notice(t('Permission denied.') . EOL); return; } if (intval($itm[0]['item_obscured'])) { $key = get_config('system', 'prvkey'); if ($itm[0]['title']) { $itm[0]['title'] = crypto_unencapsulate(json_decode_plus($itm[0]['title']), $key); } if ($itm[0]['body']) { $itm[0]['body'] = crypto_unencapsulate(json_decode_plus($itm[0]['body']), $key); } } $item_id = q("select * from item_id where service = 'WEBPAGE' and iid = %d limit 1", intval($itm[0]['id'])); if ($item_id) { $page_title = $item_id[0]['sid']; } $plaintext = true; $mimetype = $itm[0]['mimetype']; if ($mimetype === 'application/x-php') { if (!$uid || $uid != $itm[0]['uid']) { notice(t('Permission denied.') . EOL); return; } } $mimeselect = ''; if ($mimetype != 'text/bbcode') { $plaintext = true; } if (get_config('system', 'page_mimetype')) { $mimeselect = '<input type="hidden" name="mimetype" value="' . $mimetype . '" />'; } else { $mimeselect = mimetype_select($itm[0]['uid'], $mimetype); } $layout = get_config('system', 'page_layout'); if ($layout) { $layoutselect = '<input type="hidden" name="layout_mid" value="' . $layout . '" />'; } else { $layoutselect = layout_select($itm[0]['uid'], $itm[0]['layout_mid']); } App::$page['htmlhead'] .= replace_macros(get_markup_template('jot-header.tpl'), array('$baseurl' => z_root(), '$editselect' => $plaintext ? 'none' : '/(profile-jot-text|prvmail-text)/', '$pretext' => '', '$ispublic' => ' ', '$geotag' => $geotag, '$nickname' => $channel['channel_address'], '$confirmdelete' => t('Delete webpage?'), '$bbco_autocomplete' => $mimetype == 'text/bbcode' ? 'bbcode' : '')); $tpl = get_markup_template("jot.tpl"); $jotplugins = ''; $jotnets = ''; call_hooks('jot_tool', $jotplugins); call_hooks('jot_networks', $jotnets); // FIXME A return path with $_SESSION doesn't always work for observer - it may WSoD // instead of loading a sensible page. So, send folk to the webpage list. $rp = 'webpages/' . $which; $editor = replace_macros($tpl, array('$return_path' => $rp, '$webpage' => ITEM_TYPE_WEBPAGE, '$placeholdpagetitle' => t('Page link title'), '$pagetitle' => $page_title, '$writefiles' => perm_is_allowed($owner, get_observer_hash(), 'write_storage'), '$action' => 'item', '$share' => t('Edit'), '$bold' => t('Bold'), '$italic' => t('Italic'), '$underline' => t('Underline'), '$quote' => t('Quote'), '$code' => t('Code'), '$upload' => t('Upload photo'), '$attach' => t('Attach file'), '$weblink' => t('Insert web link'), '$youtube' => t('Insert YouTube video'), '$video' => t('Insert Vorbis [.ogg] video'), '$audio' => t('Insert Vorbis [.ogg] audio'), '$setloc' => t('Set your location'), '$noloc' => get_pconfig($uid, 'system', 'use_browser_location') ? t('Clear browser location') : '', '$wait' => t('Please wait'), '$permset' => t('Permission settings'), '$ptyp' => $itm[0]['type'], '$content' => undo_post_tagging($itm[0]['body']), '$post_id' => $post_id, '$baseurl' => z_root(), '$defloc' => $itm[0]['location'], '$visitor' => $is_owner ? true : false, '$acl' => populate_acl($itm[0], false), '$showacl' => $is_owner ? true : false, '$public' => t('Public post'), '$jotnets' => $jotnets, '$mimeselect' => $mimeselect, '$layoutselect' => $layoutselect, '$title' => htmlspecialchars($itm[0]['title'], ENT_COMPAT, 'UTF-8'), '$placeholdertitle' => t('Title (optional)'), '$category' => '', '$placeholdercategory' => t('Categories (optional, comma-separated list)'), '$emtitle' => t('Example: bob@example.com, mary@example.com'), 'lockstate' => strlen($itm[0]['allow_cid']) || strlen($itm[0]['allow_gid']) || strlen($itm[0]['deny_cid']) || strlen($itm[0]['deny_gid']) ? 'lock' : 'unlock', '$bang' => '', '$profile_uid' => intval($owner), '$preview' => t('Preview'), '$jotplugins' => $jotplugins, '$sourceapp' => App::$sourcename, '$defexpire' => '', '$feature_expire' => false, '$expires' => t('Set expiration date'), '$bbcode' => $mimetype == 'text/bbcode' ? true : false)); $o .= replace_macros(get_markup_template('edpost_head.tpl'), array('$title' => t('Edit Webpage'), '$delete' => $itm[0]['author_xchan'] === $ob_hash || $itm[0]['owner_xchan'] === $ob_hash ? t('Delete') : false, '$editor' => $editor, '$id' => $itm[0]['id'])); return $o; }
function widget_item($arr) { $uid = $a->profile['profile_uid']; if (!$uid || !$arr['mid']) { return ''; } if (!perm_is_allowed($uid, get_observer_hash(), 'view_pages')) { return ''; } require_once 'include/security.php'; $sql_extra = item_permissions_sql($uid); $r = q("select * from item where mid = '%s' and uid = %d and item_restrict = " . intval(ITEM_WEBPAGE) . " {$sql_extra} limit 1", dbesc($arr['mid']), intval($uid)); if (!$r) { return ''; } xchan_query($r); $r = fetch_post_tags($r, true); $o .= prepare_page($r[0]); return $o; }
function widget_random_block($arr) { $channel_id = 0; if (array_key_exists('channel_id', $arr) && intval($arr['channel_id'])) { $channel_id = intval($arr['channel_id']); } if (!$channel_id) { $channel_id = get_app()->profile_uid; } if (!$channel_id) { return ''; } if (array_key_exists('contains', $arr)) { $contains = $arr['contains']; } $o = ''; require_once 'include/security.php'; $sql_options = item_permissions_sql($channel_id); $randfunc = db_getfunc('RAND'); $r = q("select item.* from item left join item_id on item.id = item_id.iid\n\t\twhere item.uid = %d and sid like '%s' and service = 'BUILDBLOCK' and \n\t\titem_restrict = %d {$sql_options} order by {$randfunc} limit 1", intval($channel_id), dbesc('%' . $contains . '%'), intval(ITEM_BUILDBLOCK)); if ($r) { $o = '<div class="widget bblock">'; if ($r[0]['title']) { $o .= '<h3>' . $r[0]['title'] . '</h3>'; } $o .= prepare_text($r[0]['body'], $r[0]['mimetype']); $o .= '</div>'; } return $o; }