function fix_private_photos($s, $uid, $item = null, $cid = 0) { if (get_config('system', 'disable_embedded')) { return $s; } $a = get_app(); logger('fix_private_photos: check for photos', LOGGER_DEBUG); $site = substr($a->get_baseurl(), strpos($a->get_baseurl(), '://')); $orig_body = $s; $new_body = ''; $img_start = strpos($orig_body, '[img'); $img_st_close = $img_start !== false ? strpos(substr($orig_body, $img_start), ']') : false; $img_len = $img_start !== false ? strpos(substr($orig_body, $img_start + $img_st_close + 1), '[/img]') : false; while ($img_st_close !== false && $img_len !== false) { $img_st_close++; // make it point to AFTER the closing bracket $image = substr($orig_body, $img_start + $img_st_close, $img_len); logger('fix_private_photos: found photo ' . $image, LOGGER_DEBUG); if (stristr($image, $site . '/photo/')) { // Only embed locally hosted photos $replace = false; $i = basename($image); $i = str_replace(array('.jpg', '.png', '.gif'), array('', '', ''), $i); $x = strpos($i, '-'); if ($x) { $res = substr($i, $x + 1); $i = substr($i, 0, $x); $r = q("SELECT * FROM `photo` WHERE `resource-id` = '%s' AND `scale` = %d AND `uid` = %d", dbesc($i), intval($res), intval($uid)); if ($r) { // Check to see if we should replace this photo link with an embedded image // 1. No need to do so if the photo is public // 2. If there's a contact-id provided, see if they're in the access list // for the photo. If so, embed it. // 3. Otherwise, if we have an item, see if the item permissions match the photo // permissions, regardless of order but first check to see if they're an exact // match to save some processing overhead. if (has_permissions($r[0])) { if ($cid) { $recips = enumerate_permissions($r[0]); if (in_array($cid, $recips)) { $replace = true; } } elseif ($item) { if (compare_permissions($item, $r[0])) { $replace = true; } } } if ($replace) { $data = $r[0]['data']; $type = $r[0]['type']; // If a custom width and height were specified, apply before embedding if (preg_match("/\\[img\\=([0-9]*)x([0-9]*)\\]/is", substr($orig_body, $img_start, $img_st_close), $match)) { logger('fix_private_photos: scaling photo', LOGGER_DEBUG); $width = intval($match[1]); $height = intval($match[2]); $ph = new Photo($data, $type); if ($ph->is_valid()) { $ph->scaleImage(max($width, $height)); $data = $ph->imageString(); $type = $ph->getType(); } } logger('fix_private_photos: replacing photo', LOGGER_DEBUG); $image = 'data:' . $type . ';base64,' . base64_encode($data); logger('fix_private_photos: replaced: ' . $image, LOGGER_DATA); } } } } $new_body = $new_body . substr($orig_body, 0, $img_start + $img_st_close) . $image . '[/img]'; $orig_body = substr($orig_body, $img_start + $img_st_close + $img_len + strlen('[/img]')); if ($orig_body === false) { $orig_body = ''; } $img_start = strpos($orig_body, '[img'); $img_st_close = $img_start !== false ? strpos(substr($orig_body, $img_start), ']') : false; $img_len = $img_start !== false ? strpos(substr($orig_body, $img_start + $img_st_close + 1), '[/img]') : false; } $new_body = $new_body . $orig_body; return $new_body; }
function photo_init(&$a) { global $_SERVER; $prvcachecontrol = false; $file = ""; switch ($a->argc) { case 4: $person = $a->argv[3]; $customres = intval($a->argv[2]); $type = $a->argv[1]; break; case 3: $person = $a->argv[2]; $type = $a->argv[1]; break; case 2: $photo = $a->argv[1]; $file = $photo; break; case 1: default: killme(); // NOTREACHED } // strtotime($_SERVER['HTTP_IF_MODIFIED_SINCE']) >= filemtime($localFileName)) { if (isset($_SERVER['HTTP_IF_MODIFIED_SINCE'])) { header('HTTP/1.1 304 Not Modified'); header("Last-Modified: " . gmdate("D, d M Y H:i:s", time()) . " GMT"); header('Etag: ' . $_SERVER['HTTP_IF_NONE_MATCH']); header("Expires: " . gmdate("D, d M Y H:i:s", time() + 31536000) . " GMT"); header("Cache-Control: max-age=31536000"); if (function_exists('header_remove')) { header_remove('Last-Modified'); header_remove('Expires'); header_remove('Cache-Control'); } exit; } $default = 'images/person-175.jpg'; if (isset($type)) { /** * Profile photos */ switch ($type) { case 'profile': case 'custom': $resolution = 4; break; case 'micro': $resolution = 6; $default = 'images/person-48.jpg'; break; case 'avatar': default: $resolution = 5; $default = 'images/person-80.jpg'; break; } $uid = str_replace(array('.jpg', '.png'), array('', ''), $person); $r = q("SELECT * FROM `photo` WHERE `scale` = %d AND `uid` = %d AND `profile` = 1 LIMIT 1", intval($resolution), intval($uid)); if (count($r)) { $data = $r[0]['data']; $mimetype = $r[0]['type']; } if (!isset($data)) { $data = file_get_contents($default); $mimetype = 'image/jpeg'; } } else { /** * Other photos */ $resolution = 0; foreach (Photo::supportedTypes() as $m => $e) { $photo = str_replace(".{$e}", '', $photo); } if (substr($photo, -2, 1) == '-') { $resolution = intval(substr($photo, -1, 1)); $photo = substr($photo, 0, -2); } // check if the photo exists and get the owner of the photo $r = q("SELECT `uid` FROM `photo` WHERE `resource-id` = '%s' LIMIT 1", dbesc($photo), intval($resolution)); if (count($r)) { $sql_extra = permissions_sql($r[0]['uid']); // Now we'll see if we can access the photo $r = q("SELECT * FROM `photo` WHERE `resource-id` = '%s' AND `scale` <= %d {$sql_extra} ORDER BY scale DESC LIMIT 1", dbesc($photo), intval($resolution)); $public = $r[0]['allow_cid'] == '' and $r[0]['allow_gid'] == '' and $r[0]['deny_cid'] == '' and $r[0]['deny_gid'] == ''; if (count($r)) { $resolution = $r[0]['scale']; $data = $r[0]['data']; $mimetype = $r[0]['type']; } else { // The picure exists. We already checked with the first query. // obviously, this is not an authorized viev! $data = file_get_contents('images/nosign.jpg'); $mimetype = 'image/jpeg'; $prvcachecontrol = true; $public = false; } } } if (!isset($data)) { if (isset($resolution)) { switch ($resolution) { case 4: $data = file_get_contents('images/person-175.jpg'); $mimetype = 'image/jpeg'; break; case 5: $data = file_get_contents('images/person-80.jpg'); $mimetype = 'image/jpeg'; break; case 6: $data = file_get_contents('images/person-48.jpg'); $mimetype = 'image/jpeg'; break; default: killme(); // NOTREACHED break; } } } // Resize only if its not a GIF if ($mime != "image/gif") { $ph = new Photo($data, $mimetype); if ($ph->is_valid()) { if (isset($customres) && $customres > 0 && $customres < 500) { $ph->scaleImageSquare($customres); } $data = $ph->imageString(); $mimetype = $ph->getType(); } } if (function_exists('header_remove')) { header_remove('Pragma'); header_remove('pragma'); } header("Content-type: " . $mimetype); if ($prvcachecontrol) { // it is a private photo that they have no permission to view. // tell the browser not to cache it, in case they authenticate // and subsequently have permission to see it header("Cache-Control: no-store, no-cache, must-revalidate"); } else { header("Last-Modified: " . gmdate("D, d M Y H:i:s", time()) . " GMT"); header('Etag: "' . md5($data) . '"'); header("Expires: " . gmdate("D, d M Y H:i:s", time() + 31536000) . " GMT"); header("Cache-Control: max-age=31536000"); } echo $data; // If the photo is public and there is an existing photo directory store the photo there if ($public and $file != "") { // If the photo path isn't there, try to create it $basepath = $a->get_basepath(); if (!is_dir($basepath . "/photo")) { if (is_writable($basepath)) { mkdir($basepath . "/photo"); } } if (is_dir($basepath . "/photo")) { file_put_contents($basepath . "/photo/" . $file, $data); } } killme(); // NOTREACHED }
function photo_init(&$a) { global $_SERVER; $prvcachecontrol = false; $file = ""; switch ($a->argc) { case 4: $person = $a->argv[3]; $customres = intval($a->argv[2]); $type = $a->argv[1]; break; case 3: $person = $a->argv[2]; $type = $a->argv[1]; break; case 2: $photo = $a->argv[1]; $file = $photo; break; case 1: default: killme(); // NOTREACHED } // strtotime($_SERVER['HTTP_IF_MODIFIED_SINCE']) >= filemtime($localFileName)) { if (isset($_SERVER['HTTP_IF_MODIFIED_SINCE'])) { header('HTTP/1.1 304 Not Modified'); header("Last-Modified: " . gmdate("D, d M Y H:i:s", time()) . " GMT"); header('Etag: ' . $_SERVER['HTTP_IF_NONE_MATCH']); header("Expires: " . gmdate("D, d M Y H:i:s", time() + 31536000) . " GMT"); header("Cache-Control: max-age=31536000"); if (function_exists('header_remove')) { header_remove('Last-Modified'); header_remove('Expires'); header_remove('Cache-Control'); } exit; } $default = 'images/person-175.jpg'; if (isset($type)) { /** * Profile photos */ switch ($type) { case 'profile': case 'custom': $resolution = 4; break; case 'micro': $resolution = 6; $default = 'images/person-48.jpg'; break; case 'avatar': default: $resolution = 5; $default = 'images/person-80.jpg'; break; } $uid = str_replace(array('.jpg', '.png'), array('', ''), $person); $r = q("SELECT * FROM `photo` WHERE `scale` = %d AND `uid` = %d AND `profile` = 1 LIMIT 1", intval($resolution), intval($uid)); if (count($r)) { $data = $r[0]['data']; $mimetype = $r[0]['type']; } if (!isset($data)) { $data = file_get_contents($default); $mimetype = 'image/jpeg'; } } else { /** * Other photos */ $resolution = 0; foreach (Photo::supportedTypes() as $m => $e) { $photo = str_replace(".{$e}", '', $photo); } if (substr($photo, -2, 1) == '-') { $resolution = intval(substr($photo, -1, 1)); $photo = substr($photo, 0, -2); } $r = q("SELECT `uid` FROM `photo` WHERE `resource-id` = '%s' AND `scale` = %d LIMIT 1", dbesc($photo), intval($resolution)); if (count($r)) { $sql_extra = permissions_sql($r[0]['uid']); // Now we'll see if we can access the photo $r = q("SELECT * FROM `photo` WHERE `resource-id` = '%s' AND `scale` = %d {$sql_extra} LIMIT 1", dbesc($photo), intval($resolution)); $public = $r[0]['allow_cid'] == '' and $r[0]['allow_gid'] == '' and $r[0]['deny_cid'] == '' and $r[0]['deny_gid'] == ''; if (count($r)) { $data = $r[0]['data']; $mimetype = $r[0]['type']; } else { // Does the picture exist? It may be a remote person with no credentials, // but who should otherwise be able to view it. Show a default image to let // them know permissions was denied. It may be possible to view the image // through an authenticated profile visit. // There won't be many completely unauthorised people seeing this because // they won't have the photo link, so there's a reasonable chance that the person // might be able to obtain permission to view it. $r = q("SELECT * FROM `photo` WHERE `resource-id` = '%s' AND `scale` = %d LIMIT 1", dbesc($photo), intval($resolution)); if (count($r)) { $data = file_get_contents('images/nosign.jpg'); $mimetype = 'image/jpeg'; $prvcachecontrol = true; } } } } if (!isset($data)) { if (isset($resolution)) { switch ($resolution) { case 4: $data = file_get_contents('images/person-175.jpg'); $mimetype = 'image/jpeg'; break; case 5: $data = file_get_contents('images/person-80.jpg'); $mimetype = 'image/jpeg'; break; case 6: $data = file_get_contents('images/person-48.jpg'); $mimetype = 'image/jpeg'; break; default: killme(); // NOTREACHED break; } } } // Resize only if its not a GIF if ($mime != "image/gif") { $ph = new Photo($data, $mimetype); if ($ph->is_valid()) { if (isset($customres) && $customres > 0 && $customres < 500) { $ph->scaleImageSquare($customres); } $data = $ph->imageString(); $mimetype = $ph->getType(); } } if (function_exists('header_remove')) { header_remove('Pragma'); header_remove('pragma'); } header("Content-type: " . $mimetype); if ($prvcachecontrol) { // it is a private photo that they have no permission to view. // tell the browser not to cache it, in case they authenticate // and subsequently have permission to see it header("Cache-Control: no-store, no-cache, must-revalidate"); } else { header("Last-Modified: " . gmdate("D, d M Y H:i:s", time()) . " GMT"); header('Etag: "' . md5($data) . '"'); header("Expires: " . gmdate("D, d M Y H:i:s", time() + 31536000) . " GMT"); header("Cache-Control: max-age=31536000"); } echo $data; // If the photo is public and there is an existing photo directory store the photo there if ($public and $file != "") { if (is_dir($_SERVER["DOCUMENT_ROOT"] . "/photo")) { file_put_contents($_SERVER["DOCUMENT_ROOT"] . "/photo/" . $file, $data); } } killme(); // NOTREACHED }