util.php 74 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287228822892290229122922293229422952296229722982299230023012302230323042305230623072308230923102311231223132314231523162317231823192320232123222323232423252326232723282329233023312332233323342335233623372338233923402341234223432344234523462347234823492350235123522353235423552356235723582359236023612362236323642365236623672368236923702371237223732374237523762377237823792380238123822383238423852386238723882389239023912392239323942395239623972398239924002401240224032404240524062407240824092410241124122413241424152416241724182419242024212422242324242425242624272428242924302431243224332434243524362437243824392440
  1. <?php
  2. /*
  3. * StatusNet - the distributed open-source microblogging tool
  4. * Copyright (C) 2008-2011, StatusNet, Inc.
  5. *
  6. * This program is free software: you can redistribute it and/or modify
  7. * it under the terms of the GNU Affero General Public License as published by
  8. * the Free Software Foundation, either version 3 of the License, or
  9. * (at your option) any later version.
  10. *
  11. * This program is distributed in the hope that it will be useful,
  12. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  14. * GNU Affero General Public License for more details.
  15. *
  16. * You should have received a copy of the GNU Affero General Public License
  17. * along with this program. If not, see <http://www.gnu.org/licenses/>.
  18. */
  19. /* XXX: break up into separate modules (HTTP, user, files) */
  20. /**
  21. * Show a server error.
  22. */
  23. function common_server_error($msg, $code=500)
  24. {
  25. $err = new ServerErrorAction($msg, $code);
  26. $err->showPage();
  27. }
  28. /**
  29. * Show a user error.
  30. */
  31. function common_user_error($msg, $code=400)
  32. {
  33. $err = new ClientErrorAction($msg, $code);
  34. $err->showPage();
  35. }
  36. /**
  37. * This should only be used at setup; processes switching languages
  38. * to send text to other users should use common_switch_locale().
  39. *
  40. * @param string $language Locale language code (optional; empty uses
  41. * current user's preference or site default)
  42. * @return mixed success
  43. */
  44. function common_init_locale($language=null)
  45. {
  46. if(!$language) {
  47. $language = common_language();
  48. }
  49. putenv('LANGUAGE='.$language);
  50. putenv('LANG='.$language);
  51. $ok = setlocale(LC_ALL, $language . ".utf8",
  52. $language . ".UTF8",
  53. $language . ".utf-8",
  54. $language . ".UTF-8",
  55. $language);
  56. return $ok;
  57. }
  58. /**
  59. * Initialize locale and charset settings and gettext with our message catalog,
  60. * using the current user's language preference or the site default.
  61. *
  62. * This should generally only be run at framework initialization; code switching
  63. * languages at runtime should call common_switch_language().
  64. *
  65. * @access private
  66. */
  67. function common_init_language()
  68. {
  69. mb_internal_encoding('UTF-8');
  70. // Note that this setlocale() call may "fail" but this is harmless;
  71. // gettext will still select the right language.
  72. $language = common_language();
  73. $locale_set = common_init_locale($language);
  74. if (!$locale_set) {
  75. // The requested locale doesn't exist on the system.
  76. //
  77. // gettext seems very picky... We first need to setlocale()
  78. // to a locale which _does_ exist on the system, and _then_
  79. // we can set in another locale that may not be set up
  80. // (say, ga_ES for Galego/Galician) it seems to take it.
  81. //
  82. // For some reason C and POSIX which are guaranteed to work
  83. // don't do the job. en_US.UTF-8 should be there most of the
  84. // time, but not guaranteed.
  85. $ok = common_init_locale("en_US");
  86. if (!$ok && strtolower(substr(PHP_OS, 0, 3)) != 'win') {
  87. // Try to find a complete, working locale on Unix/Linux...
  88. // @fixme shelling out feels awfully inefficient
  89. // but I don't think there's a more standard way.
  90. $all = `locale -a`;
  91. foreach (explode("\n", $all) as $locale) {
  92. if (preg_match('/\.utf[-_]?8$/i', $locale)) {
  93. $ok = setlocale(LC_ALL, $locale);
  94. if ($ok) {
  95. break;
  96. }
  97. }
  98. }
  99. }
  100. if (!$ok) {
  101. common_log(LOG_ERR, "Unable to find a UTF-8 locale on this system; UI translations may not work.");
  102. }
  103. $locale_set = common_init_locale($language);
  104. }
  105. common_init_gettext();
  106. }
  107. /**
  108. * @access private
  109. */
  110. function common_init_gettext()
  111. {
  112. setlocale(LC_CTYPE, 'C');
  113. // So we do not have to make people install the gettext locales
  114. $path = common_config('site','locale_path');
  115. bindtextdomain("statusnet", $path);
  116. bind_textdomain_codeset("statusnet", "UTF-8");
  117. textdomain("statusnet");
  118. }
  119. /**
  120. * Switch locale during runtime, and poke gettext until it cries uncle.
  121. * Otherwise, sometimes it doesn't actually switch away from the old language.
  122. *
  123. * @param string $language code for locale ('en', 'fr', 'pt_BR' etc)
  124. */
  125. function common_switch_locale($language=null)
  126. {
  127. common_init_locale($language);
  128. setlocale(LC_CTYPE, 'C');
  129. // So we do not have to make people install the gettext locales
  130. $path = common_config('site','locale_path');
  131. bindtextdomain("statusnet", $path);
  132. bind_textdomain_codeset("statusnet", "UTF-8");
  133. textdomain("statusnet");
  134. }
  135. function common_timezone()
  136. {
  137. if (common_logged_in()) {
  138. $user = common_current_user();
  139. if ($user->timezone) {
  140. return $user->timezone;
  141. }
  142. }
  143. return common_config('site', 'timezone');
  144. }
  145. function common_valid_language($lang)
  146. {
  147. if ($lang) {
  148. // Validate -- we don't want to end up with a bogus code
  149. // left over from some old junk.
  150. foreach (common_config('site', 'languages') as $code => $info) {
  151. if ($info['lang'] == $lang) {
  152. return true;
  153. }
  154. }
  155. }
  156. return false;
  157. }
  158. function common_language()
  159. {
  160. // Allow ?uselang=xx override, very useful for debugging
  161. // and helping translators check usage and context.
  162. if (isset($_GET['uselang'])) {
  163. $uselang = strval($_GET['uselang']);
  164. if (common_valid_language($uselang)) {
  165. return $uselang;
  166. }
  167. }
  168. // If there is a user logged in and they've set a language preference
  169. // then return that one...
  170. if (_have_config() && common_logged_in()) {
  171. $user = common_current_user();
  172. if (common_valid_language($user->language)) {
  173. return $user->language;
  174. }
  175. }
  176. // Otherwise, find the best match for the languages requested by the
  177. // user's browser...
  178. if (common_config('site', 'langdetect')) {
  179. $httplang = isset($_SERVER['HTTP_ACCEPT_LANGUAGE']) ? $_SERVER['HTTP_ACCEPT_LANGUAGE'] : null;
  180. if (!empty($httplang)) {
  181. $language = client_prefered_language($httplang);
  182. if ($language)
  183. return $language;
  184. }
  185. }
  186. // Finally, if none of the above worked, use the site's default...
  187. return common_config('site', 'language');
  188. }
  189. /**
  190. * Salted, hashed passwords are stored in the DB.
  191. */
  192. function common_munge_password($password, $id, Profile $profile=null)
  193. {
  194. $hashed = null;
  195. if (Event::handle('StartHashPassword', array(&$hashed, $password, $profile))) {
  196. Event::handle('EndHashPassword', array(&$hashed, $password, $profile));
  197. }
  198. if (empty($hashed)) {
  199. throw new PasswordHashException();
  200. }
  201. return $hashed;
  202. }
  203. /**
  204. * Check if a username exists and has matching password.
  205. */
  206. function common_check_user($nickname, $password)
  207. {
  208. // empty nickname always unacceptable
  209. if (empty($nickname)) {
  210. return false;
  211. }
  212. $authenticatedUser = false;
  213. if (Event::handle('StartCheckPassword', array($nickname, $password, &$authenticatedUser))) {
  214. if (common_is_email($nickname)) {
  215. $user = User::getKV('email', common_canonical_email($nickname));
  216. } else {
  217. $user = User::getKV('nickname', Nickname::normalize($nickname));
  218. }
  219. if ($user instanceof User && !empty($password)) {
  220. if (0 == strcmp(common_munge_password($password, $user->id),
  221. $user->password)) {
  222. //internal checking passed
  223. $authenticatedUser = $user;
  224. }
  225. }
  226. }
  227. Event::handle('EndCheckPassword', array($nickname, $password, $authenticatedUser));
  228. return $authenticatedUser;
  229. }
  230. /**
  231. * Is the current user logged in?
  232. */
  233. function common_logged_in()
  234. {
  235. return (!is_null(common_current_user()));
  236. }
  237. function common_have_session()
  238. {
  239. return (0 != strcmp(session_id(), ''));
  240. }
  241. function common_ensure_session()
  242. {
  243. $c = null;
  244. if (array_key_exists(session_name(), $_COOKIE)) {
  245. $c = $_COOKIE[session_name()];
  246. }
  247. if (!common_have_session()) {
  248. if (common_config('sessions', 'handle')) {
  249. Session::setSaveHandler();
  250. }
  251. if (array_key_exists(session_name(), $_GET)) {
  252. $id = $_GET[session_name()];
  253. } else if (array_key_exists(session_name(), $_COOKIE)) {
  254. $id = $_COOKIE[session_name()];
  255. }
  256. if (isset($id)) {
  257. session_id($id);
  258. }
  259. @session_start();
  260. if (!isset($_SESSION['started'])) {
  261. $_SESSION['started'] = time();
  262. if (!empty($id)) {
  263. common_log(LOG_WARNING, 'Session cookie "' . $_COOKIE[session_name()] . '" ' .
  264. ' is set but started value is null');
  265. }
  266. }
  267. }
  268. }
  269. // Three kinds of arguments:
  270. // 1) a user object
  271. // 2) a nickname
  272. // 3) null to clear
  273. // Initialize to false; set to null if none found
  274. $_cur = false;
  275. function common_set_user($user)
  276. {
  277. global $_cur;
  278. if (is_null($user) && common_have_session()) {
  279. $_cur = null;
  280. unset($_SESSION['userid']);
  281. return true;
  282. } else if (is_string($user)) {
  283. $nickname = $user;
  284. $user = User::getKV('nickname', $nickname);
  285. } else if (!$user instanceof User) {
  286. return false;
  287. }
  288. if ($user) {
  289. if (Event::handle('StartSetUser', array(&$user))) {
  290. if (!empty($user)) {
  291. if (!$user->hasRight(Right::WEBLOGIN)) {
  292. // TRANS: Authorisation exception thrown when a user a not allowed to login.
  293. throw new AuthorizationException(_('Not allowed to log in.'));
  294. }
  295. common_ensure_session();
  296. $_SESSION['userid'] = $user->id;
  297. $_cur = $user;
  298. Event::handle('EndSetUser', array($user));
  299. return $_cur;
  300. }
  301. }
  302. }
  303. return false;
  304. }
  305. function common_set_cookie($key, $value, $expiration=0)
  306. {
  307. $path = common_config('site', 'path');
  308. $server = common_config('site', 'server');
  309. if ($path && ($path != '/')) {
  310. $cookiepath = '/' . $path . '/';
  311. } else {
  312. $cookiepath = '/';
  313. }
  314. return setcookie($key,
  315. $value,
  316. $expiration,
  317. $cookiepath,
  318. $server,
  319. common_config('site', 'ssl')=='always');
  320. }
  321. define('REMEMBERME', 'rememberme');
  322. define('REMEMBERME_EXPIRY', 30 * 24 * 60 * 60); // 30 days
  323. function common_rememberme($user=null)
  324. {
  325. if (!$user) {
  326. $user = common_current_user();
  327. if (!$user) {
  328. return false;
  329. }
  330. }
  331. $rm = new Remember_me();
  332. $rm->code = common_random_hexstr(16);
  333. $rm->user_id = $user->id;
  334. // Wrap the insert in some good ol' fashioned transaction code
  335. $rm->query('BEGIN');
  336. $result = $rm->insert();
  337. if (!$result) {
  338. common_log_db_error($rm, 'INSERT', __FILE__);
  339. $rm->query('ROLLBACK');
  340. return false;
  341. }
  342. $rm->query('COMMIT');
  343. $cookieval = $rm->user_id . ':' . $rm->code;
  344. common_log(LOG_INFO, 'adding rememberme cookie "' . $cookieval . '" for ' . $user->nickname);
  345. common_set_cookie(REMEMBERME, $cookieval, time() + REMEMBERME_EXPIRY);
  346. return true;
  347. }
  348. function common_remembered_user()
  349. {
  350. $user = null;
  351. $packed = isset($_COOKIE[REMEMBERME]) ? $_COOKIE[REMEMBERME] : null;
  352. if (!$packed) {
  353. return null;
  354. }
  355. list($id, $code) = explode(':', $packed);
  356. if (!$id || !$code) {
  357. common_log(LOG_WARNING, 'Malformed rememberme cookie: ' . $packed);
  358. common_forgetme();
  359. return null;
  360. }
  361. $rm = Remember_me::getKV('code', $code);
  362. if (!$rm) {
  363. common_log(LOG_WARNING, 'No such remember code: ' . $code);
  364. common_forgetme();
  365. return null;
  366. }
  367. if ($rm->user_id != $id) {
  368. common_log(LOG_WARNING, 'Rememberme code for wrong user: ' . $rm->user_id . ' != ' . $id);
  369. common_forgetme();
  370. return null;
  371. }
  372. $user = User::getKV('id', $rm->user_id);
  373. if (!$user instanceof User) {
  374. common_log(LOG_WARNING, 'No such user for rememberme: ' . $rm->user_id);
  375. common_forgetme();
  376. return null;
  377. }
  378. // successful!
  379. $result = $rm->delete();
  380. if (!$result) {
  381. common_log_db_error($rm, 'DELETE', __FILE__);
  382. common_log(LOG_WARNING, 'Could not delete rememberme: ' . $code);
  383. common_forgetme();
  384. return null;
  385. }
  386. common_log(LOG_INFO, 'logging in ' . $user->nickname . ' using rememberme code ' . $rm->code);
  387. common_set_user($user);
  388. common_real_login(false);
  389. // We issue a new cookie, so they can log in
  390. // automatically again after this session
  391. common_rememberme($user);
  392. return $user;
  393. }
  394. /**
  395. * must be called with a valid user!
  396. */
  397. function common_forgetme()
  398. {
  399. common_set_cookie(REMEMBERME, '', 0);
  400. }
  401. /**
  402. * Who is the current user?
  403. */
  404. function common_current_user()
  405. {
  406. global $_cur;
  407. if (!_have_config()) {
  408. return null;
  409. }
  410. if ($_cur === false) {
  411. if (isset($_COOKIE[session_name()]) || isset($_GET[session_name()])
  412. || (isset($_SESSION['userid']) && $_SESSION['userid'])) {
  413. common_ensure_session();
  414. $id = isset($_SESSION['userid']) ? $_SESSION['userid'] : false;
  415. if ($id) {
  416. $user = User::getKV('id', $id);
  417. if ($user instanceof User) {
  418. $_cur = $user;
  419. return $_cur;
  420. }
  421. }
  422. }
  423. // that didn't work; try to remember; will init $_cur to null on failure
  424. $_cur = common_remembered_user();
  425. if ($_cur) {
  426. // XXX: Is this necessary?
  427. $_SESSION['userid'] = $_cur->id;
  428. }
  429. }
  430. return $_cur;
  431. }
  432. /**
  433. * Logins that are 'remembered' aren't 'real' -- they're subject to
  434. * cookie-stealing. So, we don't let them do certain things. New reg,
  435. * OpenID, and password logins _are_ real.
  436. */
  437. function common_real_login($real=true)
  438. {
  439. common_ensure_session();
  440. $_SESSION['real_login'] = $real;
  441. }
  442. function common_is_real_login()
  443. {
  444. return common_logged_in() && $_SESSION['real_login'];
  445. }
  446. /**
  447. * Get a hash portion for HTTP caching Etags and such including
  448. * info on the current user's session. If login/logout state changes,
  449. * or we've changed accounts, or we've renamed the current user,
  450. * we'll get a new hash value.
  451. *
  452. * This should not be considered secure information.
  453. *
  454. * @param User $user (optional; uses common_current_user() if left out)
  455. * @return string
  456. */
  457. function common_user_cache_hash($user=false)
  458. {
  459. if ($user === false) {
  460. $user = common_current_user();
  461. }
  462. if ($user) {
  463. return crc32($user->id . ':' . $user->nickname);
  464. } else {
  465. return '0';
  466. }
  467. }
  468. /**
  469. * get canonical version of nickname for comparison
  470. *
  471. * @param string $nickname
  472. * @return string
  473. *
  474. * @throws NicknameException on invalid input
  475. * @deprecated call Nickname::normalize() directly.
  476. */
  477. function common_canonical_nickname($nickname)
  478. {
  479. return Nickname::normalize($nickname);
  480. }
  481. /**
  482. * get canonical version of email for comparison
  483. *
  484. * @fixme actually normalize
  485. * @fixme reject invalid input
  486. *
  487. * @param string $email
  488. * @return string
  489. */
  490. function common_canonical_email($email)
  491. {
  492. // XXX: canonicalize UTF-8
  493. // XXX: lcase the domain part
  494. return $email;
  495. }
  496. function common_purify($html)
  497. {
  498. require_once INSTALLDIR.'/extlib/htmLawed/htmLawed.php';
  499. $config = array('safe' => 1, // means that elements=* means elements=*-applet-embed-iframe-object-script or so
  500. 'elements' => '*',
  501. 'deny_attribute' => 'id,style,on*');
  502. // Remove more elements than what the 'safe' filter gives (elements must be '*' before this)
  503. // http://www.bioinformatics.org/phplabware/internal_utilities/htmLawed/htmLawed_README.htm#s3.6
  504. foreach (common_config('htmlfilter') as $tag=>$filter) {
  505. if ($filter === true) {
  506. $config['elements'] .= "-{$tag}";
  507. }
  508. }
  509. $html = common_remove_unicode_formatting($html);
  510. return htmLawed($html, $config);
  511. }
  512. function common_remove_unicode_formatting($text)
  513. {
  514. // Strip Unicode text formatting/direction codes
  515. // this is pretty dangerous for visualisation of text and can be used for mischief
  516. return preg_replace('/[\\x{200b}-\\x{200f}\\x{202a}-\\x{202e}]/u', '', $text);
  517. }
  518. /**
  519. * Partial notice markup rendering step: build links to !group references.
  520. *
  521. * @param string $text partially rendered HTML
  522. * @param Notice $notice in whose context we're working
  523. * @return string partially rendered HTML
  524. */
  525. function common_render_content($text, Notice $notice)
  526. {
  527. $text = common_render_text($text);
  528. $text = common_linkify_mentions($text, $notice);
  529. return $text;
  530. }
  531. /**
  532. * Finds @-mentions within the partially-rendered text section and
  533. * turns them into live links.
  534. *
  535. * Should generally not be called except from common_render_content().
  536. *
  537. * @param string $text partially-rendered HTML
  538. * @param Notice $notice in-progress or complete Notice object for context
  539. * @return string partially-rendered HTML
  540. */
  541. function common_linkify_mentions($text, $notice)
  542. {
  543. $mentions = common_find_mentions($text, $notice);
  544. // We need to go through in reverse order by position,
  545. // so our positions stay valid despite our fudging with the
  546. // string!
  547. $points = array();
  548. foreach ($mentions as $mention)
  549. {
  550. $points[$mention['position']] = $mention;
  551. }
  552. krsort($points);
  553. foreach ($points as $position => $mention) {
  554. $linkText = common_linkify_mention($mention);
  555. $text = substr_replace($text, $linkText, $position, mb_strlen($mention['text']));
  556. }
  557. return $text;
  558. }
  559. function common_linkify_mention($mention)
  560. {
  561. $output = null;
  562. if (Event::handle('StartLinkifyMention', array($mention, &$output))) {
  563. $xs = new XMLStringer(false);
  564. $attrs = array('href' => $mention['url'],
  565. 'class' => 'h-card '.$mention['type']);
  566. if (!empty($mention['title'])) {
  567. $attrs['title'] = $mention['title'];
  568. }
  569. $xs->element('a', $attrs, $mention['text']);
  570. $output = $xs->getString();
  571. Event::handle('EndLinkifyMention', array($mention, &$output));
  572. }
  573. return $output;
  574. }
  575. /**
  576. * Find @-mentions in the given text, using the given notice object as context.
  577. * References will be resolved with common_relative_profile() against the user
  578. * who posted the notice.
  579. *
  580. * Note the return data format is internal, to be used for building links and
  581. * such. Should not be used directly; rather, call common_linkify_mentions().
  582. *
  583. * @param string $text
  584. * @param Notice $notice notice in whose context we're building links
  585. *
  586. * @return array
  587. *
  588. * @access private
  589. */
  590. function common_find_mentions($text, $notice)
  591. {
  592. try {
  593. $sender = Profile::getKV('id', $notice->profile_id);
  594. } catch (NoProfileException $e) {
  595. return array();
  596. }
  597. $mentions = array();
  598. if (Event::handle('StartFindMentions', array($sender, $text, &$mentions))) {
  599. // Get the context of the original notice, if any
  600. $origAuthor = null;
  601. $origNotice = null;
  602. $origMentions = array();
  603. // Is it a reply?
  604. if ($notice instanceof Notice) {
  605. try {
  606. $origNotice = $notice->getParent();
  607. $origAuthor = $origNotice->getProfile();
  608. $ids = $origNotice->getReplies();
  609. foreach ($ids as $id) {
  610. $repliedTo = Profile::getKV('id', $id);
  611. if ($repliedTo instanceof Profile) {
  612. $origMentions[$repliedTo->nickname] = $repliedTo;
  613. }
  614. }
  615. } catch (NoProfileException $e) {
  616. common_log(LOG_WARNING, sprintf('Notice %d author profile id %d does not exist', $origNotice->id, $origNotice->profile_id));
  617. } catch (ServerException $e) {
  618. // Probably just no parent. Should get a specific NoParentException
  619. } catch (Exception $e) {
  620. common_log(LOG_WARNING, __METHOD__ . ' got exception ' . get_class($e) . ' : ' . $e->getMessage());
  621. }
  622. }
  623. $matches = common_find_mentions_raw($text);
  624. foreach ($matches as $match) {
  625. try {
  626. $nickname = Nickname::normalize($match[0]);
  627. } catch (NicknameException $e) {
  628. // Bogus match? Drop it.
  629. continue;
  630. }
  631. // Try to get a profile for this nickname.
  632. // Start with conversation context, then go to
  633. // sender context.
  634. if ($origAuthor instanceof Profile && $origAuthor->nickname == $nickname) {
  635. $mentioned = $origAuthor;
  636. } else if (!empty($origMentions) &&
  637. array_key_exists($nickname, $origMentions)) {
  638. $mentioned = $origMentions[$nickname];
  639. } else {
  640. $mentioned = common_relative_profile($sender, $nickname);
  641. }
  642. if ($mentioned instanceof Profile) {
  643. $user = User::getKV('id', $mentioned->id);
  644. if ($user instanceof User) {
  645. $url = common_local_url('userbyid', array('id' => $user->id));
  646. } else {
  647. $url = $mentioned->profileurl;
  648. }
  649. $mention = array('mentioned' => array($mentioned),
  650. 'type' => 'mention',
  651. 'text' => $match[0],
  652. 'position' => $match[1],
  653. 'url' => $url);
  654. if (!empty($mentioned->fullname)) {
  655. $mention['title'] = $mentioned->fullname;
  656. }
  657. $mentions[] = $mention;
  658. }
  659. }
  660. // @#tag => mention of all subscriptions tagged 'tag'
  661. preg_match_all('/(?:^|[\s\.\,\:\;]+)@#([\pL\pN_\-\.]{1,64})/',
  662. $text, $hmatches, PREG_OFFSET_CAPTURE);
  663. foreach ($hmatches[1] as $hmatch) {
  664. $tag = common_canonical_tag($hmatch[0]);
  665. $plist = Profile_list::getByTaggerAndTag($sender->id, $tag);
  666. if (!$plist instanceof Profile_list || $plist->private) {
  667. continue;
  668. }
  669. $tagged = $sender->getTaggedSubscribers($tag);
  670. $url = common_local_url('showprofiletag',
  671. array('tagger' => $sender->nickname,
  672. 'tag' => $tag));
  673. $mentions[] = array('mentioned' => $tagged,
  674. 'type' => 'list',
  675. 'text' => $hmatch[0],
  676. 'position' => $hmatch[1],
  677. 'url' => $url);
  678. }
  679. preg_match_all('/(?:^|[\s\.\,\:\;]+)!(' . Nickname::DISPLAY_FMT . ')/',
  680. $text, $hmatches, PREG_OFFSET_CAPTURE);
  681. foreach ($hmatches[1] as $hmatch) {
  682. $nickname = Nickname::normalize($hmatch[0]);
  683. $group = User_group::getForNickname($nickname, $sender);
  684. if (!$group instanceof User_group || !$sender->isMember($group)) {
  685. continue;
  686. }
  687. $profile = $group->getProfile();
  688. $mentions[] = array('mentioned' => array($profile),
  689. 'type' => 'group',
  690. 'text' => $hmatch[0],
  691. 'position' => $hmatch[1],
  692. 'url' => $group->permalink(),
  693. 'title' => $group->getFancyName());
  694. }
  695. Event::handle('EndFindMentions', array($sender, $text, &$mentions));
  696. }
  697. return $mentions;
  698. }
  699. /**
  700. * Does the actual regex pulls to find @-mentions in text.
  701. * Should generally not be called directly; for use in common_find_mentions.
  702. *
  703. * @param string $text
  704. * @return array of PCRE match arrays
  705. */
  706. function common_find_mentions_raw($text)
  707. {
  708. $tmatches = array();
  709. preg_match_all('/^T (' . Nickname::DISPLAY_FMT . ') /',
  710. $text,
  711. $tmatches,
  712. PREG_OFFSET_CAPTURE);
  713. $atmatches = array();
  714. preg_match_all('/(?:^|\s+)@(' . Nickname::DISPLAY_FMT . ')\b/',
  715. $text,
  716. $atmatches,
  717. PREG_OFFSET_CAPTURE);
  718. $matches = array_merge($tmatches[1], $atmatches[1]);
  719. return $matches;
  720. }
  721. function common_render_text($text)
  722. {
  723. $text = common_remove_unicode_formatting($text);
  724. $text = nl2br(htmlspecialchars($text));
  725. $text = preg_replace('/[\x{0}-\x{8}\x{b}-\x{c}\x{e}-\x{19}]/', '', $text);
  726. $text = common_replace_urls_callback($text, 'common_linkify');
  727. $text = preg_replace_callback('/(^|\&quot\;|\'|\(|\[|\{|\s+)#([\pL\pN_\-\.]{1,64})/u',
  728. function ($m) { return "{$m[1]}#".common_tag_link($m[2]); }, $text);
  729. // XXX: machine tags
  730. return $text;
  731. }
  732. /**
  733. * Find links in the given text and pass them to the given callback function.
  734. *
  735. * @param string $text
  736. * @param function($text, $arg) $callback: return replacement text
  737. * @param mixed $arg: optional argument will be passed on to the callback
  738. */
  739. function common_replace_urls_callback($text, $callback, $arg = null) {
  740. // Start off with a regex
  741. $regex = '#'.
  742. '(?:^|[\s\<\>\(\)\[\]\{\}\\\'\\\";]+)(?![\@\!\#])'.
  743. '('.
  744. '(?:'.
  745. '(?:'. //Known protocols
  746. '(?:'.
  747. '(?:(?:https?|ftps?|mms|rtsp|gopher|news|nntp|telnet|wais|file|prospero|webcal|irc)://)'.
  748. '|'.
  749. '(?:(?:mailto|aim|tel|xmpp):)'.
  750. ')'.
  751. '(?:[\pN\pL\-\_\+\%\~]+(?::[\pN\pL\-\_\+\%\~]+)?\@)?'. //user:pass@
  752. '(?:'.
  753. '(?:'.
  754. '\[[\pN\pL\-\_\:\.]+(?<![\.\:])\]'. //[dns]
  755. ')|(?:'.
  756. '[\pN\pL\-\_\:\.]+(?<![\.\:])'. //dns
  757. ')'.
  758. ')'.
  759. ')'.
  760. '|(?:(?:magnet):)'. // URLs without domain name
  761. '|(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)'. //IPv4
  762. '|(?:'. //IPv6
  763. '\[?(?:(?:(?:[0-9A-Fa-f]{1,4}:){7}(?:(?:[0-9A-Fa-f]{1,4})|:))|(?:(?:[0-9A-Fa-f]{1,4}:){6}(?::|(?:(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})(?:\.(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})|(?::[0-9A-Fa-f]{1,4})))|(?:(?:[0-9A-Fa-f]{1,4}:){5}(?:(?::(?:(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})(?:\.(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|(?:(?::[0-9A-Fa-f]{1,4}){1,2})))|(?:(?:[0-9A-Fa-f]{1,4}:){4}(?::[0-9A-Fa-f]{1,4}){0,1}(?:(?::(?:(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})(?:\.(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|(?:(?::[0-9A-Fa-f]{1,4}){1,2})))|(?:(?:[0-9A-Fa-f]{1,4}:){3}(?::[0-9A-Fa-f]{1,4}){0,2}(?:(?::(?:(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})(?:\.(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|(?:(?::[0-9A-Fa-f]{1,4}){1,2})))|(?:(?:[0-9A-Fa-f]{1,4}:){2}(?::[0-9A-Fa-f]{1,4}){0,3}(?:(?::(?:(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})(?:\.(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|(?:(?::[0-9A-Fa-f]{1,4}){1,2})))|(?:(?:[0-9A-Fa-f]{1,4}:)(?::[0-9A-Fa-f]{1,4}){0,4}(?:(?::(?:(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})(?:\.(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|(?:(?::[0-9A-Fa-f]{1,4}){1,2})))|(?::(?::[0-9A-Fa-f]{1,4}){0,5}(?:(?::(?:(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})(?:\.(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|(?:(?::[0-9A-Fa-f]{1,4}){1,2})))|(?:(?:(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})(?:\.(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})))\]?(?<!:)'.
  764. ')'.
  765. (common_config('linkify', 'bare_domains')
  766. ? '|(?:'. //DNS
  767. '(?:[\pN\pL\-\_\+\%\~]+(?:\:[\pN\pL\-\_\+\%\~]+)?\@)?'. //user:pass@
  768. '[\pN\pL\-\_]+(?:\.[\pN\pL\-\_]+)*\.'.
  769. //tld list from http://data.iana.org/TLD/tlds-alpha-by-domain.txt, also added local, loc, and onion
  770. '(?:AC|AD|AE|AERO|AF|AG|AI|AL|AM|AN|AO|AQ|AR|ARPA|AS|ASIA|AT|AU|AW|AX|AZ|BA|BB|BD|BE|BF|BG|BH|BI|BIZ|BJ|BM|BN|BO|BR|BS|BT|BV|BW|BY|BZ|CA|CAT|CC|CD|CF|CG|CH|CI|CK|CL|CM|CN|CO|COM|COOP|CR|CU|CV|CX|CY|CZ|DE|DJ|DK|DM|DO|DZ|EC|EDU|EE|EG|ER|ES|ET|EU|FI|FJ|FK|FM|FO|FR|GA|GB|GD|GE|GF|GG|GH|GI|GL|GM|GN|GOV|GP|GQ|GR|GS|GT|GU|GW|GY|HK|HM|HN|HR|HT|HU|ID|IE|IL|IM|IN|INFO|INT|IO|IQ|IR|IS|IT|JE|JM|JO|JOBS|JP|KE|KG|KH|KI|KM|KN|KP|KR|KW|KY|KZ|LA|LB|LC|LI|LK|LR|LS|LT|LU|LV|LY|MA|MC|MD|ME|MG|MH|MIL|MK|ML|MM|MN|MO|MOBI|MP|MQ|MR|MS|MT|MU|MUSEUM|MV|MW|MX|MY|MZ|NA|NAME|NC|NE|NET|NF|NG|NI|NL|NO|NP|NR|NU|NZ|OM|ORG|PA|PE|PF|PG|PH|PK|PL|PM|PN|PR|PRO|PS|PT|PW|PY|QA|RE|RO|RS|RU|RW|SA|SB|SC|SD|SE|SG|SH|SI|SJ|SK|SL|SM|SN|SO|SR|ST|SU|SV|SY|SZ|TC|TD|TEL|TF|TG|TH|TJ|TK|TL|TM|TN|TO|TP|TR|TRAVEL|TT|TV|TW|TZ|UA|UG|UK|US|UY|UZ|VA|VC|VE|VG|VI|VN|VU|WF|WS|XN--0ZWM56D|测试|XN--11B5BS3A9AJ6G|परीक्षा|XN--80AKHBYKNJ4F|испытание|XN--9T4B11YI5A|테스트|XN--DEBA0AD|טעסט|XN--G6W251D|測試|XN--HGBK6AJ7F53BBA|آزمایشی|XN--HLCJ6AYA9ESC7A|பரிட்சை|XN--JXALPDLP|δοκιμή|XN--KGBECHTV|إختبار|XN--ZCKZAH|テスト|YE|YT|YU|ZA|ZM|ZONE|ZW|local|loc|onion)'.
  771. ')(?![\pN\pL\-\_])'
  772. : '') . // if common_config('linkify', 'bare_domains') is false, don't add anything here
  773. ')'.
  774. '(?:'.
  775. '(?:\:\d+)?'. //:port
  776. '(?:/[\pN\pL$\,\!\(\)\.\:\-\_\+\/\=\&\;\%\~\*\$\+\'@]*)?'. // /path
  777. '(?:\?[\pN\pL\$\,\!\(\)\.\:\-\_\+\/\=\&\;\%\~\*\$\+\'@\/]*)?'. // ?query string
  778. '(?:\#[\pN\pL$\,\!\(\)\.\:\-\_\+\/\=\&\;\%\~\*\$\+\'\@/\?\#]*)?'. // #fragment
  779. ')(?<![\?\.\,\#\,])'.
  780. ')'.
  781. '#ixu';
  782. //preg_match_all($regex,$text,$matches);
  783. //print_r($matches);
  784. return preg_replace_callback($regex, curry('callback_helper',$callback,$arg) ,$text);
  785. }
  786. /**
  787. * Intermediate callback for common_replace_links(), helps resolve some
  788. * ambiguous link forms before passing on to the final callback.
  789. *
  790. * @param array $matches
  791. * @param callable $callback
  792. * @param mixed $arg optional argument to pass on as second param to callback
  793. * @return string
  794. *
  795. * @access private
  796. */
  797. function callback_helper($matches, $callback, $arg=null) {
  798. $url=$matches[1];
  799. $left = strpos($matches[0],$url);
  800. $right = $left+strlen($url);
  801. $groupSymbolSets=array(
  802. array(
  803. 'left'=>'(',
  804. 'right'=>')'
  805. ),
  806. array(
  807. 'left'=>'[',
  808. 'right'=>']'
  809. ),
  810. array(
  811. 'left'=>'{',
  812. 'right'=>'}'
  813. ),
  814. array(
  815. 'left'=>'<',
  816. 'right'=>'>'
  817. )
  818. );
  819. $cannotEndWith=array('.','?',',','#');
  820. $original_url=$url;
  821. do{
  822. $original_url=$url;
  823. foreach($groupSymbolSets as $groupSymbolSet){
  824. if(substr($url,-1)==$groupSymbolSet['right']){
  825. $group_left_count = substr_count($url,$groupSymbolSet['left']);
  826. $group_right_count = substr_count($url,$groupSymbolSet['right']);
  827. if($group_left_count<$group_right_count){
  828. $right-=1;
  829. $url=substr($url,0,-1);
  830. }
  831. }
  832. }
  833. if(in_array(substr($url,-1),$cannotEndWith)){
  834. $right-=1;
  835. $url=substr($url,0,-1);
  836. }
  837. }while($original_url!=$url);
  838. $result = call_user_func_array($callback, array($url, $arg));
  839. return substr($matches[0],0,$left) . $result . substr($matches[0],$right);
  840. }
  841. require_once INSTALLDIR . "/lib/curry.php";
  842. function common_linkify($url) {
  843. // It comes in special'd, so we unspecial it before passing to the stringifying
  844. // functions
  845. $url = htmlspecialchars_decode($url);
  846. if (strpos($url, '@') !== false && strpos($url, ':') === false && Validate::email($url)) {
  847. //url is an email address without the mailto: protocol
  848. $canon = "mailto:$url";
  849. $longurl = "mailto:$url";
  850. } else {
  851. $canon = File_redirection::_canonUrl($url);
  852. $longurl_data = File_redirection::where($canon, common_config('attachments', 'process_links'));
  853. if (is_array($longurl_data)) {
  854. $longurl = $longurl_data['url'];
  855. } elseif (is_string($longurl_data)) {
  856. $longurl = $longurl_data;
  857. } else {
  858. // Unable to reach the server to verify contents, etc
  859. // Just pass the link on through for now.
  860. common_log(LOG_ERR, "Can't linkify url '$url'");
  861. $longurl = $url;
  862. }
  863. }
  864. $attrs = array('href' => $canon, 'title' => $longurl);
  865. $is_attachment = false;
  866. $attachment_id = null;
  867. $has_thumb = false;
  868. // Check to see whether this is a known "attachment" URL.
  869. $f = File::getKV('url', $longurl);
  870. if (!$f instanceof File) {
  871. if (common_config('attachments', 'process_links')) {
  872. // XXX: this writes to the database. :<
  873. try {
  874. $f = File::processNew($longurl);
  875. } catch (ServerException $e) {
  876. $f = null;
  877. }
  878. }
  879. }
  880. if ($f instanceof File) {
  881. try {
  882. $enclosure = $f->getEnclosure();
  883. $is_attachment = true;
  884. $attachment_id = $f->id;
  885. $thumb = File_thumbnail::getKV('file_id', $f->id);
  886. $has_thumb = ($thumb instanceof File_thumbnail);
  887. } catch (ServerException $e) {
  888. // There was not enough metadata available
  889. }
  890. }
  891. // Add clippy
  892. if ($is_attachment) {
  893. $attrs['class'] = 'attachment';
  894. if ($has_thumb) {
  895. $attrs['class'] = 'attachment thumbnail';
  896. }
  897. $attrs['id'] = "attachment-{$attachment_id}";
  898. }
  899. // Whether to nofollow
  900. $nf = common_config('nofollow', 'external');
  901. if ($nf == 'never') {
  902. $attrs['rel'] = 'external';
  903. } else {
  904. $attrs['rel'] = 'nofollow external';
  905. }
  906. return XMLStringer::estring('a', $attrs, $url);
  907. }
  908. /**
  909. * Find and shorten links in a given chunk of text if it's longer than the
  910. * configured notice content limit (or unconditionally).
  911. *
  912. * Side effects: may save file and file_redirection records for referenced URLs.
  913. *
  914. * Pass the $user option or call $user->shortenLinks($text) to ensure the proper
  915. * user's options are used; otherwise the current web session user's setitngs
  916. * will be used or ur1.ca if there is no active web login.
  917. *
  918. * @param string $text
  919. * @param boolean $always (optional)
  920. * @param User $user (optional)
  921. *
  922. * @return string
  923. */
  924. function common_shorten_links($text, $always = false, User $user=null)
  925. {
  926. if ($user === null) {
  927. $user = common_current_user();
  928. }
  929. $maxLength = User_urlshortener_prefs::maxNoticeLength($user);
  930. if ($always || ($maxLength != -1 && mb_strlen($text) > $maxLength)) {
  931. return common_replace_urls_callback($text, array('File_redirection', 'forceShort'), $user);
  932. } else {
  933. return common_replace_urls_callback($text, array('File_redirection', 'makeShort'), $user);
  934. }
  935. }
  936. /**
  937. * Very basic stripping of invalid UTF-8 input text.
  938. *
  939. * @param string $str
  940. * @return mixed string or null if invalid input
  941. *
  942. * @todo ideally we should drop bad chars, and maybe do some of the checks
  943. * from common_xml_safe_str. But we can't strip newlines, etc.
  944. * @todo Unicode normalization might also be useful, but not needed now.
  945. */
  946. function common_validate_utf8($str)
  947. {
  948. // preg_replace will return NULL on invalid UTF-8 input.
  949. //
  950. // Note: empty regex //u also caused NULL return on some
  951. // production machines, but none of our test machines.
  952. //
  953. // This should be replaced with a more reliable check.
  954. return preg_replace('/\x00/u', '', $str);
  955. }
  956. /**
  957. * Make sure an arbitrary string is safe for output in XML as a single line.
  958. *
  959. * @param string $str
  960. * @return string
  961. */
  962. function common_xml_safe_str($str)
  963. {
  964. // Replace common eol and extra whitespace input chars
  965. $unWelcome = array(
  966. "\t", // tab
  967. "\n", // newline
  968. "\r", // cr
  969. "\0", // null byte eos
  970. "\x0B" // vertical tab
  971. );
  972. $replacement = array(
  973. ' ', // single space
  974. ' ',
  975. '', // nothing
  976. '',
  977. ' '
  978. );
  979. $str = str_replace($unWelcome, $replacement, $str);
  980. // Neutralize any additional control codes and UTF-16 surrogates
  981. // (Twitter uses '*')
  982. return preg_replace('/[\p{Cc}\p{Cs}]/u', '*', $str);
  983. }
  984. function common_slugify($str)
  985. {
  986. // php5-intl is highly recommended...
  987. if (!function_exists('transliterator_transliterate')) {
  988. $str = preg_replace('/[^\pL\pN]/u', '', $str);
  989. $str = mb_convert_case($str, MB_CASE_LOWER, 'UTF-8');
  990. $str = substr($str, 0, 64);
  991. return $str;
  992. }
  993. $str = transliterator_transliterate(
  994. 'Any-Latin;' . // any charset to latin compatible
  995. 'NFD;' . // decompose
  996. '[:Nonspacing Mark:] Remove;' . // remove nonspacing marks (accents etc.)
  997. 'NFC;' . // composite again
  998. '[:Punctuation:] Remove;' . // remove punctuation (.,¿? etc.)
  999. 'Lower();' . // turn into lowercase
  1000. 'Latin-ASCII;', // get ASCII equivalents (ð to d for example)
  1001. $str);
  1002. return preg_replace('/[^\pL\pN]/', '', $str);
  1003. }
  1004. function common_tag_link($tag)
  1005. {
  1006. $canonical = common_canonical_tag($tag);
  1007. if (common_config('singleuser', 'enabled')) {
  1008. // regular TagAction isn't set up in 1user mode
  1009. $nickname = User::singleUserNickname();
  1010. $url = common_local_url('showstream',
  1011. array('nickname' => $nickname,
  1012. 'tag' => $canonical));
  1013. } else {
  1014. $url = common_local_url('tag', array('tag' => $canonical));
  1015. }
  1016. $xs = new XMLStringer();
  1017. $xs->elementStart('span', 'tag');
  1018. $xs->element('a', array('href' => $url,
  1019. 'rel' => 'tag'),
  1020. $tag);
  1021. $xs->elementEnd('span');
  1022. return $xs->getString();
  1023. }
  1024. function common_canonical_tag($tag)
  1025. {
  1026. $tag = common_slugify($tag);
  1027. $tag = substr($tag, 0, 64);
  1028. return $tag;
  1029. }
  1030. function common_valid_profile_tag($str)
  1031. {
  1032. return preg_match('/^[A-Za-z0-9_\-\.]{1,64}$/', $str);
  1033. }
  1034. /**
  1035. * Resolve an ambiguous profile nickname reference, checking in following order:
  1036. * - profiles that $sender subscribes to
  1037. * - profiles that subscribe to $sender
  1038. * - local user profiles
  1039. *
  1040. * WARNING: does not validate or normalize $nickname -- MUST BE PRE-VALIDATED
  1041. * OR THERE MAY BE A RISK OF SQL INJECTION ATTACKS. THIS FUNCTION DOES NOT
  1042. * ESCAPE SQL.
  1043. *
  1044. * @fixme validate input
  1045. * @fixme escape SQL
  1046. * @fixme fix or remove mystery third parameter
  1047. * @fixme is $sender a User or Profile?
  1048. *
  1049. * @param <type> $sender the user or profile in whose context we're looking
  1050. * @param string $nickname validated nickname of
  1051. * @param <type> $dt unused mystery parameter; in Notice reply-to handling a timestamp is passed.
  1052. *
  1053. * @return Profile or null
  1054. */
  1055. function common_relative_profile($sender, $nickname, $dt=null)
  1056. {
  1057. // Will throw exception on invalid input.
  1058. $nickname = Nickname::normalize($nickname);
  1059. // Try to find profiles this profile is subscribed to that have this nickname
  1060. $recipient = new Profile();
  1061. // XXX: use a join instead of a subquery
  1062. $recipient->whereAdd('EXISTS (SELECT subscribed from subscription where subscriber = '.intval($sender->id).' and subscribed = id)', 'AND');
  1063. $recipient->whereAdd("nickname = '" . $recipient->escape($nickname) . "'", 'AND');
  1064. if ($recipient->find(true)) {
  1065. // XXX: should probably differentiate between profiles with
  1066. // the same name by date of most recent update
  1067. return $recipient;
  1068. }
  1069. // Try to find profiles that listen to this profile and that have this nickname
  1070. $recipient = new Profile();
  1071. // XXX: use a join instead of a subquery
  1072. $recipient->whereAdd('EXISTS (SELECT subscriber from subscription where subscribed = '.intval($sender->id).' and subscriber = id)', 'AND');
  1073. $recipient->whereAdd("nickname = '" . $recipient->escape($nickname) . "'", 'AND');
  1074. if ($recipient->find(true)) {
  1075. // XXX: should probably differentiate between profiles with
  1076. // the same name by date of most recent update
  1077. return $recipient;
  1078. }
  1079. // If this is a local user, try to find a local user with that nickname.
  1080. $sender = User::getKV('id', $sender->id);
  1081. if ($sender instanceof User) {
  1082. $recipient_user = User::getKV('nickname', $nickname);
  1083. if ($recipient_user instanceof User) {
  1084. return $recipient_user->getProfile();
  1085. }
  1086. }
  1087. // Otherwise, no links. @messages from local users to remote users,
  1088. // or from remote users to other remote users, are just
  1089. // outside our ability to make intelligent guesses about
  1090. return null;
  1091. }
  1092. function common_local_url($action, $args=null, $params=null, $fragment=null, $addSession=true)
  1093. {
  1094. if (Event::handle('StartLocalURL', array(&$action, &$params, &$fragment, &$addSession, &$url))) {
  1095. $r = Router::get();
  1096. $path = $r->build($action, $args, $params, $fragment);
  1097. $ssl = common_config('site', 'ssl') === 'always'
  1098. || GNUsocial::isHTTPS()
  1099. || common_is_sensitive($action);
  1100. if (common_config('site','fancy')) {
  1101. $url = common_path($path, $ssl, $addSession);
  1102. } else {
  1103. if (mb_strpos($path, '/index.php') === 0) {
  1104. $url = common_path($path, $ssl, $addSession);
  1105. } else {
  1106. $url = common_path('index.php/'.$path, $ssl, $addSession);
  1107. }
  1108. }
  1109. Event::handle('EndLocalURL', array(&$action, &$params, &$fragment, &$addSession, &$url));
  1110. }
  1111. return $url;
  1112. }
  1113. function common_is_sensitive($action)
  1114. {
  1115. static $sensitive = array(
  1116. 'login',
  1117. 'register',
  1118. 'passwordsettings',
  1119. 'api',
  1120. 'ApiOAuthRequestToken',
  1121. 'ApiOAuthAccessToken',
  1122. 'ApiOAuthAuthorize',
  1123. 'ApiOAuthPin',
  1124. 'showapplication'
  1125. );
  1126. $ssl = null;
  1127. if (Event::handle('SensitiveAction', array($action, &$ssl))) {
  1128. $ssl = in_array($action, $sensitive);
  1129. }
  1130. return $ssl;
  1131. }
  1132. function common_path($relative, $ssl=false, $addSession=true)
  1133. {
  1134. $pathpart = (common_config('site', 'path')) ? common_config('site', 'path')."/" : '';
  1135. if (($ssl && (common_config('site', 'ssl') === 'sometimes'))
  1136. || GNUsocial::isHTTPS()
  1137. || common_config('site', 'ssl') === 'always') {
  1138. $proto = 'https';
  1139. if (is_string(common_config('site', 'sslserver')) &&
  1140. mb_strlen(common_config('site', 'sslserver')) > 0) {
  1141. $serverpart = common_config('site', 'sslserver');
  1142. } else if (common_config('site', 'server')) {
  1143. $serverpart = common_config('site', 'server');
  1144. } else {
  1145. common_log(LOG_ERR, 'Site server not configured, unable to determine site name.');
  1146. }
  1147. } else {
  1148. $proto = 'http';
  1149. if (common_config('site', 'server')) {
  1150. $serverpart = common_config('site', 'server');
  1151. } else {
  1152. common_log(LOG_ERR, 'Site server not configured, unable to determine site name.');
  1153. }
  1154. }
  1155. if ($addSession) {
  1156. $relative = common_inject_session($relative, $serverpart);
  1157. }
  1158. return $proto.'://'.$serverpart.'/'.$pathpart.$relative;
  1159. }
  1160. function common_inject_session($url, $serverpart = null)
  1161. {
  1162. if (!common_have_session()) {
  1163. return $url;
  1164. }
  1165. if (empty($serverpart)) {
  1166. $serverpart = parse_url($url, PHP_URL_HOST);
  1167. }
  1168. $currentServer = (array_key_exists('HTTP_HOST', $_SERVER)) ? $_SERVER['HTTP_HOST'] : null;
  1169. // Are we pointing to another server (like an SSL server?)
  1170. if (!empty($currentServer) && 0 != strcasecmp($currentServer, $serverpart)) {
  1171. // Pass the session ID as a GET parameter
  1172. $sesspart = session_name() . '=' . session_id();
  1173. $i = strpos($url, '?');
  1174. if ($i === false) { // no GET params, just append
  1175. $url .= '?' . $sesspart;
  1176. } else {
  1177. $url = substr($url, 0, $i + 1).$sesspart.'&'.substr($url, $i + 1);
  1178. }
  1179. }
  1180. return $url;
  1181. }
  1182. function common_date_string($dt)
  1183. {
  1184. // XXX: do some sexy date formatting
  1185. // return date(DATE_RFC822, $dt);
  1186. $t = strtotime($dt);
  1187. $now = time();
  1188. $diff = $now - $t;
  1189. if ($now < $t) { // that shouldn't happen!
  1190. return common_exact_date($dt);
  1191. } else if ($diff < 60) {
  1192. // TRANS: Used in notices to indicate when the notice was made compared to now.
  1193. return _('a few seconds ago');
  1194. } else if ($diff < 92) {
  1195. // TRANS: Used in notices to indicate when the notice was made compared to now.
  1196. return _('about a minute ago');
  1197. } else if ($diff < 3300) {
  1198. $minutes = round($diff/60);
  1199. // TRANS: Used in notices to indicate when the notice was made compared to now.
  1200. return sprintf( _m('about one minute ago', 'about %d minutes ago', $minutes), $minutes);
  1201. } else if ($diff < 5400) {
  1202. // TRANS: Used in notices to indicate when the notice was made compared to now.
  1203. return _('about an hour ago');
  1204. } else if ($diff < 22 * 3600) {
  1205. $hours = round($diff/3600);
  1206. // TRANS: Used in notices to indicate when the notice was made compared to now.
  1207. return sprintf( _m('about one hour ago', 'about %d hours ago', $hours), $hours);
  1208. } else if ($diff < 37 * 3600) {
  1209. // TRANS: Used in notices to indicate when the notice was made compared to now.
  1210. return _('about a day ago');
  1211. } else if ($diff < 24 * 24 * 3600) {
  1212. $days = round($diff/(24*3600));
  1213. // TRANS: Used in notices to indicate when the notice was made compared to now.
  1214. return sprintf( _m('about one day ago', 'about %d days ago', $days), $days);
  1215. } else if ($diff < 46 * 24 * 3600) {
  1216. // TRANS: Used in notices to indicate when the notice was made compared to now.
  1217. return _('about a month ago');
  1218. } else if ($diff < 330 * 24 * 3600) {
  1219. $months = round($diff/(30*24*3600));
  1220. // TRANS: Used in notices to indicate when the notice was made compared to now.
  1221. return sprintf( _m('about one month ago', 'about %d months ago',$months), $months);
  1222. } else if ($diff < 480 * 24 * 3600) {
  1223. // TRANS: Used in notices to indicate when the notice was made compared to now.
  1224. return _('about a year ago');
  1225. } else {
  1226. return common_exact_date($dt);
  1227. }
  1228. }
  1229. function common_exact_date($dt)
  1230. {
  1231. static $_utc;
  1232. static $_siteTz;
  1233. if (!$_utc) {
  1234. $_utc = new DateTimeZone('UTC');
  1235. $_siteTz = new DateTimeZone(common_timezone());
  1236. }
  1237. $dateStr = date('d F Y H:i:s', strtotime($dt));
  1238. $d = new DateTime($dateStr, $_utc);
  1239. $d->setTimezone($_siteTz);
  1240. // TRANS: Human-readable full date-time specification (formatting on http://php.net/date)
  1241. return $d->format(_('l, d-M-Y H:i:s T'));
  1242. }
  1243. function common_date_w3dtf($dt)
  1244. {
  1245. $dateStr = date('d F Y H:i:s', strtotime($dt));
  1246. $d = new DateTime($dateStr, new DateTimeZone('UTC'));
  1247. $d->setTimezone(new DateTimeZone(common_timezone()));
  1248. return $d->format(DATE_W3C);
  1249. }
  1250. function common_date_rfc2822($dt)
  1251. {
  1252. $dateStr = date('d F Y H:i:s', strtotime($dt));
  1253. $d = new DateTime($dateStr, new DateTimeZone('UTC'));
  1254. $d->setTimezone(new DateTimeZone(common_timezone()));
  1255. return $d->format('r');
  1256. }
  1257. function common_date_iso8601($dt)
  1258. {
  1259. $dateStr = date('d F Y H:i:s', strtotime($dt));
  1260. $d = new DateTime($dateStr, new DateTimeZone('UTC'));
  1261. $d->setTimezone(new DateTimeZone(common_timezone()));
  1262. return $d->format('c');
  1263. }
  1264. function common_sql_now()
  1265. {
  1266. return common_sql_date(time());
  1267. }
  1268. function common_sql_date($datetime)
  1269. {
  1270. return strftime('%Y-%m-%d %H:%M:%S', $datetime);
  1271. }
  1272. /**
  1273. * Return an SQL fragment to calculate an age-based weight from a given
  1274. * timestamp or datetime column.
  1275. *
  1276. * @param string $column name of field we're comparing against current time
  1277. * @param integer $dropoff divisor for age in seconds before exponentiation
  1278. * @return string SQL fragment
  1279. */
  1280. function common_sql_weight($column, $dropoff)
  1281. {
  1282. if (common_config('db', 'type') == 'pgsql') {
  1283. // PostgreSQL doesn't support timestampdiff function.
  1284. // @fixme will this use the right time zone?
  1285. // @fixme does this handle cross-year subtraction correctly?
  1286. return "sum(exp(-extract(epoch from (now() - $column)) / $dropoff))";
  1287. } else {
  1288. return "sum(exp(timestampdiff(second, utc_timestamp(), $column) / $dropoff))";
  1289. }
  1290. }
  1291. function common_redirect($url, $code=307)
  1292. {
  1293. static $status = array(301 => "Moved Permanently",
  1294. 302 => "Found",
  1295. 303 => "See Other",
  1296. 307 => "Temporary Redirect");
  1297. header('HTTP/1.1 '.$code.' '.$status[$code]);
  1298. header("Location: $url");
  1299. header("Connection: close");
  1300. $xo = new XMLOutputter();
  1301. $xo->startXML('a',
  1302. '-//W3C//DTD XHTML 1.0 Strict//EN',
  1303. 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd');
  1304. $xo->element('a', array('href' => $url), $url);
  1305. $xo->endXML();
  1306. exit;
  1307. }
  1308. // Stick the notice on the queue
  1309. function common_enqueue_notice($notice)
  1310. {
  1311. static $localTransports = array('ping');
  1312. $transports = array();
  1313. if (common_config('sms', 'enabled')) {
  1314. $transports[] = 'sms';
  1315. }
  1316. if (Event::hasHandler('HandleQueuedNotice')) {
  1317. $transports[] = 'plugin';
  1318. }
  1319. // We can skip these for gatewayed notices.
  1320. if ($notice->isLocal()) {
  1321. $transports = array_merge($transports, $localTransports);
  1322. }
  1323. if (Event::handle('StartEnqueueNotice', array($notice, &$transports))) {
  1324. $qm = QueueManager::get();
  1325. foreach ($transports as $transport)
  1326. {
  1327. $qm->enqueue($notice, $transport);
  1328. }
  1329. Event::handle('EndEnqueueNotice', array($notice, $transports));
  1330. }
  1331. return true;
  1332. }
  1333. function common_profile_url($nickname)
  1334. {
  1335. return common_local_url('showstream', array('nickname' => $nickname),
  1336. null, null, false);
  1337. }
  1338. /**
  1339. * Should make up a reasonable root URL
  1340. */
  1341. function common_root_url($ssl=false)
  1342. {
  1343. $url = common_path('', $ssl, false);
  1344. $i = strpos($url, '?');
  1345. if ($i !== false) {
  1346. $url = substr($url, 0, $i);
  1347. }
  1348. return $url;
  1349. }
  1350. /**
  1351. * returns $bytes bytes of random data as a hexadecimal string
  1352. */
  1353. function common_random_hexstr($bytes)
  1354. {
  1355. $str = @file_exists('/dev/urandom')
  1356. ? common_urandom($bytes)
  1357. : common_mtrand($bytes);
  1358. $hexstr = '';
  1359. for ($i = 0; $i < $bytes; $i++) {
  1360. $hexstr .= sprintf("%02x", ord($str[$i]));
  1361. }
  1362. return $hexstr;
  1363. }
  1364. function common_urandom($bytes)
  1365. {
  1366. $h = fopen('/dev/urandom', 'rb');
  1367. // should not block
  1368. $src = fread($h, $bytes);
  1369. fclose($h);
  1370. return $src;
  1371. }
  1372. function common_mtrand($bytes)
  1373. {
  1374. $str = '';
  1375. for ($i = 0; $i < $bytes; $i++) {
  1376. $str .= chr(mt_rand(0, 255));
  1377. }
  1378. return $str;
  1379. }
  1380. /**
  1381. * Record the given URL as the return destination for a future
  1382. * form submission, to be read by common_get_returnto().
  1383. *
  1384. * @param string $url
  1385. *
  1386. * @fixme as a session-global setting, this can allow multiple forms
  1387. * to conflict and overwrite each others' returnto destinations if
  1388. * the user has multiple tabs or windows open.
  1389. *
  1390. * Should refactor to index with a token or otherwise only pass the
  1391. * data along its intended path.
  1392. */
  1393. function common_set_returnto($url)
  1394. {
  1395. common_ensure_session();
  1396. $_SESSION['returnto'] = $url;
  1397. }
  1398. /**
  1399. * Fetch a return-destination URL previously recorded by
  1400. * common_set_returnto().
  1401. *
  1402. * @return mixed URL string or null
  1403. *
  1404. * @fixme as a session-global setting, this can allow multiple forms
  1405. * to conflict and overwrite each others' returnto destinations if
  1406. * the user has multiple tabs or windows open.
  1407. *
  1408. * Should refactor to index with a token or otherwise only pass the
  1409. * data along its intended path.
  1410. */
  1411. function common_get_returnto()
  1412. {
  1413. common_ensure_session();
  1414. return (array_key_exists('returnto', $_SESSION)) ? $_SESSION['returnto'] : null;
  1415. }
  1416. function common_timestamp()
  1417. {
  1418. return date('YmdHis');
  1419. }
  1420. function common_ensure_syslog()
  1421. {
  1422. static $initialized = false;
  1423. if (!$initialized) {
  1424. openlog(common_config('syslog', 'appname'), 0,
  1425. common_config('syslog', 'facility'));
  1426. $initialized = true;
  1427. }
  1428. }
  1429. function common_log_line($priority, $msg)
  1430. {
  1431. static $syslog_priorities = array('LOG_EMERG', 'LOG_ALERT', 'LOG_CRIT', 'LOG_ERR',
  1432. 'LOG_WARNING', 'LOG_NOTICE', 'LOG_INFO', 'LOG_DEBUG');
  1433. return date('Y-m-d H:i:s') . ' ' . $syslog_priorities[$priority] . ': ' . $msg . PHP_EOL;
  1434. }
  1435. function common_request_id()
  1436. {
  1437. $pid = getmypid();
  1438. $server = common_config('site', 'server');
  1439. if (php_sapi_name() == 'cli') {
  1440. $script = basename($_SERVER['PHP_SELF']);
  1441. return "$server:$script:$pid";
  1442. } else {
  1443. static $req_id = null;
  1444. if (!isset($req_id)) {
  1445. $req_id = substr(md5(mt_rand()), 0, 8);
  1446. }
  1447. if (isset($_SERVER['REQUEST_URI'])) {
  1448. $url = $_SERVER['REQUEST_URI'];
  1449. }
  1450. $method = $_SERVER['REQUEST_METHOD'];
  1451. return "$server:$pid.$req_id $method $url";
  1452. }
  1453. }
  1454. function common_log($priority, $msg, $filename=null)
  1455. {
  1456. if(Event::handle('StartLog', array(&$priority, &$msg, &$filename))){
  1457. $msg = (empty($filename)) ? $msg : basename($filename) . ' - ' . $msg;
  1458. $msg = '[' . common_request_id() . '] ' . $msg;
  1459. $logfile = common_config('site', 'logfile');
  1460. if ($logfile) {
  1461. $log = fopen($logfile, "a");
  1462. if ($log) {
  1463. $output = common_log_line($priority, $msg);
  1464. fwrite($log, $output);
  1465. fclose($log);
  1466. }
  1467. } else {
  1468. common_ensure_syslog();
  1469. syslog($priority, $msg);
  1470. }
  1471. Event::handle('EndLog', array($priority, $msg, $filename));
  1472. }
  1473. }
  1474. function common_debug($msg, $filename=null)
  1475. {
  1476. if ($filename) {
  1477. common_log(LOG_DEBUG, basename($filename).' - '.$msg);
  1478. } else {
  1479. common_log(LOG_DEBUG, $msg);
  1480. }
  1481. }
  1482. function common_log_db_error(&$object, $verb, $filename=null)
  1483. {
  1484. global $_PEAR;
  1485. $objstr = common_log_objstring($object);
  1486. $last_error = &$_PEAR->getStaticProperty('DB_DataObject','lastError');
  1487. if (is_object($last_error)) {
  1488. $msg = $last_error->message;
  1489. } else {
  1490. $msg = 'Unknown error (' . var_export($last_error, true) . ')';
  1491. }
  1492. common_log(LOG_ERR, $msg . '(' . $verb . ' on ' . $objstr . ')', $filename);
  1493. }
  1494. function common_log_objstring(&$object)
  1495. {
  1496. if (is_null($object)) {
  1497. return "null";
  1498. }
  1499. if (!($object instanceof DB_DataObject)) {
  1500. return "(unknown)";
  1501. }
  1502. $arr = $object->toArray();
  1503. $fields = array();
  1504. foreach ($arr as $k => $v) {
  1505. if (is_object($v)) {
  1506. $fields[] = "$k='".get_class($v)."'";
  1507. } else {
  1508. $fields[] = "$k='$v'";
  1509. }
  1510. }
  1511. $objstring = $object->tableName() . '[' . implode(',', $fields) . ']';
  1512. return $objstring;
  1513. }
  1514. function common_valid_http_url($url, $secure=false)
  1515. {
  1516. // If $secure is true, only allow https URLs to pass
  1517. // (if false, we use '?' in 'https?' to say the 's' is optional)
  1518. $regex = $secure ? '/^https$/' : '/^https?$/';
  1519. return filter_var($url, FILTER_VALIDATE_URL)
  1520. && preg_match($regex, parse_url($url, PHP_URL_SCHEME));
  1521. }
  1522. function common_valid_tag($tag)
  1523. {
  1524. if (preg_match('/^tag:(.*?),(\d{4}(-\d{2}(-\d{2})?)?):(.*)$/', $tag, $matches)) {
  1525. return (Validate::email($matches[1]) ||
  1526. preg_match('/^([\w-\.]+)$/', $matches[1]));
  1527. }
  1528. return false;
  1529. }
  1530. /**
  1531. * Determine if given domain or address literal is valid
  1532. * eg for use in JIDs and URLs. Does not check if the domain
  1533. * exists!
  1534. *
  1535. * @param string $domain
  1536. * @return boolean valid or not
  1537. */
  1538. function common_valid_domain($domain)
  1539. {
  1540. $octet = "(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]|[0-9])";
  1541. $ipv4 = "(?:$octet(?:\.$octet){3})";
  1542. if (preg_match("/^$ipv4$/u", $domain)) return true;
  1543. $group = "(?:[0-9a-f]{1,4})";
  1544. $ipv6 = "(?:\[($group(?::$group){0,7})?(::)?($group(?::$group){0,7})?\])"; // http://tools.ietf.org/html/rfc3513#section-2.2
  1545. if (preg_match("/^$ipv6$/ui", $domain, $matches)) {
  1546. $before = explode(":", $matches[1]);
  1547. $zeroes = $matches[2];
  1548. $after = explode(":", $matches[3]);
  1549. if ($zeroes) {
  1550. $min = 0;
  1551. $max = 7;
  1552. } else {
  1553. $min = 1;
  1554. $max = 8;
  1555. }
  1556. $explicit = count($before) + count($after);
  1557. if ($explicit < $min || $explicit > $max) {
  1558. return false;
  1559. }
  1560. return true;
  1561. }
  1562. try {
  1563. require_once "Net/IDNA.php";
  1564. $idn = Net_IDNA::getInstance();
  1565. $domain = $idn->encode($domain);
  1566. } catch (Exception $e) {
  1567. return false;
  1568. }
  1569. $subdomain = "(?:[a-z0-9][a-z0-9-]*)"; // @fixme
  1570. $fqdn = "(?:$subdomain(?:\.$subdomain)*\.?)";
  1571. return preg_match("/^$fqdn$/ui", $domain);
  1572. }
  1573. /* Following functions are copied from MediaWiki GlobalFunctions.php
  1574. * and written by Evan Prodromou. */
  1575. function common_accept_to_prefs($accept, $def = '*/*')
  1576. {
  1577. // No arg means accept anything (per HTTP spec)
  1578. if(!$accept) {
  1579. return array($def => 1);
  1580. }
  1581. $prefs = array();
  1582. $parts = explode(',', $accept);
  1583. foreach($parts as $part) {
  1584. // FIXME: doesn't deal with params like 'text/html; level=1'
  1585. @list($value, $qpart) = explode(';', trim($part));
  1586. $match = array();
  1587. if(!isset($qpart)) {
  1588. $prefs[$value] = 1;
  1589. } elseif(preg_match('/q\s*=\s*(\d*\.\d+)/', $qpart, $match)) {
  1590. $prefs[$value] = $match[1];
  1591. }
  1592. }
  1593. return $prefs;
  1594. }
  1595. // Match by our supported file extensions
  1596. function common_supported_ext_to_mime($fileext)
  1597. {
  1598. // Accept a filename and take out the extension
  1599. if (strpos($fileext, '.') !== false) {
  1600. $fileext = substr(strrchr($fileext, '.'), 1);
  1601. }
  1602. $supported = common_config('attachments', 'supported');
  1603. foreach($supported as $type => $ext) {
  1604. if ($ext === $fileext) {
  1605. return $type;
  1606. }
  1607. }
  1608. throw new ServerException('Unsupported file extension');
  1609. }
  1610. // Match by our supported mime types
  1611. function common_supported_mime_to_ext($mimetype)
  1612. {
  1613. $supported = common_config('attachments', 'supported');
  1614. foreach($supported as $type => $ext) {
  1615. if ($mimetype === $type) {
  1616. return $ext;
  1617. }
  1618. }
  1619. throw new ServerException('Unsupported MIME type');
  1620. }
  1621. // The MIME "media" is the part before the slash (video in video/webm)
  1622. function common_get_mime_media($type)
  1623. {
  1624. $tmp = explode('/', $type);
  1625. return strtolower($tmp[0]);
  1626. }
  1627. function common_bare_mime($mimetype)
  1628. {
  1629. $mimetype = mb_strtolower($mimetype);
  1630. if ($semicolon = mb_strpos($mimetype, ';')) {
  1631. $mimetype = mb_substr($mimetype, 0, $semicolon);
  1632. }
  1633. return $mimetype;
  1634. }
  1635. function common_mime_type_match($type, $avail)
  1636. {
  1637. if(array_key_exists($type, $avail)) {
  1638. return $type;
  1639. } else {
  1640. $parts = explode('/', $type);
  1641. if(array_key_exists($parts[0] . '/*', $avail)) {
  1642. return $parts[0] . '/*';
  1643. } elseif(array_key_exists('*/*', $avail)) {
  1644. return '*/*';
  1645. } else {
  1646. return null;
  1647. }
  1648. }
  1649. }
  1650. function common_negotiate_type($cprefs, $sprefs)
  1651. {
  1652. $combine = array();
  1653. foreach(array_keys($sprefs) as $type) {
  1654. $parts = explode('/', $type);
  1655. if($parts[1] != '*') {
  1656. $ckey = common_mime_type_match($type, $cprefs);
  1657. if($ckey) {
  1658. $combine[$type] = $sprefs[$type] * $cprefs[$ckey];
  1659. }
  1660. }
  1661. }
  1662. foreach(array_keys($cprefs) as $type) {
  1663. $parts = explode('/', $type);
  1664. if($parts[1] != '*' && !array_key_exists($type, $sprefs)) {
  1665. $skey = common_mime_type_match($type, $sprefs);
  1666. if($skey) {
  1667. $combine[$type] = $sprefs[$skey] * $cprefs[$type];
  1668. }
  1669. }
  1670. }
  1671. $bestq = 0;
  1672. $besttype = 'text/html';
  1673. foreach(array_keys($combine) as $type) {
  1674. if($combine[$type] > $bestq) {
  1675. $besttype = $type;
  1676. $bestq = $combine[$type];
  1677. }
  1678. }
  1679. if ('text/html' === $besttype) {
  1680. return "text/html; charset=utf-8";
  1681. }
  1682. return $besttype;
  1683. }
  1684. function common_config($main, $sub=null)
  1685. {
  1686. global $config;
  1687. if (is_null($sub)) {
  1688. // Return the config category array
  1689. return array_key_exists($main, $config) ? $config[$main] : array();
  1690. }
  1691. // Return the config value
  1692. return (array_key_exists($main, $config) &&
  1693. array_key_exists($sub, $config[$main])) ? $config[$main][$sub] : false;
  1694. }
  1695. function common_config_set($main, $sub, $value)
  1696. {
  1697. global $config;
  1698. if (!array_key_exists($main, $config)) {
  1699. $config[$main] = array();
  1700. }
  1701. $config[$main][$sub] = $value;
  1702. }
  1703. function common_config_append($main, $sub, $value)
  1704. {
  1705. global $config;
  1706. if (!array_key_exists($main, $config)) {
  1707. $config[$main] = array();
  1708. }
  1709. if (!array_key_exists($sub, $config[$main])) {
  1710. $config[$main][$sub] = array();
  1711. }
  1712. if (!is_array($config[$main][$sub])) {
  1713. $config[$main][$sub] = array($config[$main][$sub]);
  1714. }
  1715. array_push($config[$main][$sub], $value);
  1716. }
  1717. /**
  1718. * Pull arguments from a GET/POST/REQUEST array with first-level input checks:
  1719. * strips "magic quotes" slashes if necessary, and kills invalid UTF-8 strings.
  1720. *
  1721. * @param array $from
  1722. * @return array
  1723. */
  1724. function common_copy_args($from)
  1725. {
  1726. $to = array();
  1727. $strip = get_magic_quotes_gpc();
  1728. foreach ($from as $k => $v) {
  1729. if(is_array($v)) {
  1730. $to[$k] = common_copy_args($v);
  1731. } else {
  1732. if ($strip) {
  1733. $v = stripslashes($v);
  1734. }
  1735. $to[$k] = strval(common_validate_utf8($v));
  1736. }
  1737. }
  1738. return $to;
  1739. }
  1740. /**
  1741. * Neutralise the evil effects of magic_quotes_gpc in the current request.
  1742. * This is used before handing a request off to OAuthRequest::from_request.
  1743. * @fixme Doesn't consider vars other than _POST and _GET?
  1744. * @fixme Can't be undone and could corrupt data if run twice.
  1745. */
  1746. function common_remove_magic_from_request()
  1747. {
  1748. if(get_magic_quotes_gpc()) {
  1749. $_POST=array_map('stripslashes',$_POST);
  1750. $_GET=array_map('stripslashes',$_GET);
  1751. }
  1752. }
  1753. function common_user_uri(&$user)
  1754. {
  1755. return common_local_url('userbyid', array('id' => $user->id),
  1756. null, null, false);
  1757. }
  1758. // 36 alphanums - lookalikes (0, O, 1, I) = 32 chars = 5 bits
  1759. function common_confirmation_code($bits)
  1760. {
  1761. // 36 alphanums - lookalikes (0, O, 1, I) = 32 chars = 5 bits
  1762. static $codechars = '23456789ABCDEFGHJKLMNPQRSTUVWXYZ';
  1763. $chars = ceil($bits/5);
  1764. $code = '';
  1765. for ($i = 0; $i < $chars; $i++) {
  1766. // XXX: convert to string and back
  1767. $num = hexdec(common_random_hexstr(1));
  1768. // XXX: randomness is too precious to throw away almost
  1769. // 40% of the bits we get!
  1770. $code .= $codechars[$num%32];
  1771. }
  1772. return $code;
  1773. }
  1774. // convert markup to HTML
  1775. function common_markup_to_html($c, $args=null)
  1776. {
  1777. if ($c === null) {
  1778. return '';
  1779. }
  1780. if (is_null($args)) {
  1781. $args = array();
  1782. }
  1783. // XXX: not very efficient
  1784. foreach ($args as $name => $value) {
  1785. $c = preg_replace('/%%arg.'.$name.'%%/', $value, $c);
  1786. }
  1787. $c = preg_replace_callback('/%%user.(\w+)%%/', function ($m) { return common_user_property($m[1]); }, $c);
  1788. $c = preg_replace_callback('/%%action.(\w+)%%/', function ($m) { return common_local_url($m[1]); }, $c);
  1789. $c = preg_replace_callback('/%%doc.(\w+)%%/', function ($m) { return common_local_url('doc', array('title'=>$m[1])); }, $c);
  1790. $c = preg_replace_callback('/%%(\w+).(\w+)%%/', function ($m) { return common_config($m[1], $m[2]); }, $c);
  1791. return \Michelf\Markdown::defaultTransform($c);
  1792. }
  1793. function common_user_property($property)
  1794. {
  1795. $profile = Profile::current();
  1796. if (empty($profile)) {
  1797. return null;
  1798. }
  1799. switch ($property) {
  1800. case 'profileurl':
  1801. case 'nickname':
  1802. case 'fullname':
  1803. case 'location':
  1804. case 'bio':
  1805. return $profile->$property;
  1806. break;
  1807. case 'avatar':
  1808. try {
  1809. return $profile->getAvatar(AVATAR_STREAM_SIZE);
  1810. } catch (Exception $e) {
  1811. return null;
  1812. }
  1813. break;
  1814. case 'bestname':
  1815. return $profile->getBestName();
  1816. break;
  1817. default:
  1818. return null;
  1819. }
  1820. }
  1821. function common_profile_uri($profile)
  1822. {
  1823. $uri = null;
  1824. if (!empty($profile)) {
  1825. if (Event::handle('StartCommonProfileURI', array($profile, &$uri))) {
  1826. $user = User::getKV('id', $profile->id);
  1827. if ($user instanceof User) {
  1828. $uri = $user->getUri();
  1829. }
  1830. Event::handle('EndCommonProfileURI', array($profile, &$uri));
  1831. }
  1832. }
  1833. // XXX: this is a very bad profile!
  1834. return $uri;
  1835. }
  1836. function common_canonical_sms($sms)
  1837. {
  1838. // strip non-digits
  1839. preg_replace('/\D/', '', $sms);
  1840. return $sms;
  1841. }
  1842. function common_error_handler($errno, $errstr, $errfile, $errline, $errcontext)
  1843. {
  1844. switch ($errno) {
  1845. case E_ERROR:
  1846. case E_COMPILE_ERROR:
  1847. case E_CORE_ERROR:
  1848. case E_USER_ERROR:
  1849. case E_PARSE:
  1850. case E_RECOVERABLE_ERROR:
  1851. common_log(LOG_ERR, "[$errno] $errstr ($errfile:$errline) [ABORT]");
  1852. die();
  1853. break;
  1854. case E_WARNING:
  1855. case E_COMPILE_WARNING:
  1856. case E_CORE_WARNING:
  1857. case E_USER_WARNING:
  1858. common_log(LOG_WARNING, "[$errno] $errstr ($errfile:$errline)");
  1859. break;
  1860. case E_NOTICE:
  1861. case E_USER_NOTICE:
  1862. common_log(LOG_NOTICE, "[$errno] $errstr ($errfile:$errline)");
  1863. break;
  1864. case E_STRICT:
  1865. case E_DEPRECATED:
  1866. case E_USER_DEPRECATED:
  1867. // XXX: config variable to log this stuff, too
  1868. break;
  1869. default:
  1870. common_log(LOG_ERR, "[$errno] $errstr ($errfile:$errline) [UNKNOWN LEVEL, die()'ing]");
  1871. die();
  1872. break;
  1873. }
  1874. // FIXME: show error page if we're on the Web
  1875. /* Don't execute PHP internal error handler */
  1876. return true;
  1877. }
  1878. function common_session_token()
  1879. {
  1880. common_ensure_session();
  1881. if (!array_key_exists('token', $_SESSION)) {
  1882. $_SESSION['token'] = common_random_hexstr(64);
  1883. }
  1884. return $_SESSION['token'];
  1885. }
  1886. function common_license_terms($uri)
  1887. {
  1888. if(preg_match('/creativecommons.org\/licenses\/([^\/]+)/', $uri, $matches)) {
  1889. return explode('-',$matches[1]);
  1890. }
  1891. return array($uri);
  1892. }
  1893. function common_compatible_license($from, $to)
  1894. {
  1895. $from_terms = common_license_terms($from);
  1896. // public domain and cc-by are compatible with everything
  1897. if(count($from_terms) == 1 && ($from_terms[0] == 'publicdomain' || $from_terms[0] == 'by')) {
  1898. return true;
  1899. }
  1900. $to_terms = common_license_terms($to);
  1901. // sa is compatible across versions. IANAL
  1902. if(in_array('sa',$from_terms) || in_array('sa',$to_terms)) {
  1903. return count(array_diff($from_terms, $to_terms)) == 0;
  1904. }
  1905. // XXX: better compatibility check needed here!
  1906. // Should at least normalise URIs
  1907. return ($from == $to);
  1908. }
  1909. /**
  1910. * returns a quoted table name, if required according to config
  1911. */
  1912. function common_database_tablename($tablename)
  1913. {
  1914. if(common_config('db','quote_identifiers')) {
  1915. $tablename = '"'. $tablename .'"';
  1916. }
  1917. //table prefixes could be added here later
  1918. return $tablename;
  1919. }
  1920. /**
  1921. * Shorten a URL with the current user's configured shortening service,
  1922. * or ur1.ca if configured, or not at all if no shortening is set up.
  1923. *
  1924. * @param string $long_url original URL
  1925. * @param User $user to specify a particular user's options
  1926. * @param boolean $force Force shortening (used when notice is too long)
  1927. * @return string may return the original URL if shortening failed
  1928. *
  1929. * @fixme provide a way to specify a particular shortener
  1930. */
  1931. function common_shorten_url($long_url, User $user=null, $force = false)
  1932. {
  1933. $long_url = trim($long_url);
  1934. $user = common_current_user();
  1935. $maxUrlLength = User_urlshortener_prefs::maxUrlLength($user);
  1936. // $force forces shortening even if it's not strictly needed
  1937. // I doubt URL shortening is ever 'strictly' needed. - ESP
  1938. if (($maxUrlLength == -1 || mb_strlen($long_url) < $maxUrlLength) && !$force) {
  1939. return $long_url;
  1940. }
  1941. $shortenerName = User_urlshortener_prefs::urlShorteningService($user);
  1942. if (Event::handle('StartShortenUrl',
  1943. array($long_url, $shortenerName, &$shortenedUrl))) {
  1944. if ($shortenerName == 'internal') {
  1945. try {
  1946. $f = File::processNew($long_url);
  1947. $shortenedUrl = common_local_url('redirecturl', array('id' => $f->id));
  1948. if ((mb_strlen($shortenedUrl) < mb_strlen($long_url)) || $force) {
  1949. return $shortenedUrl;
  1950. } else {
  1951. return $long_url;
  1952. }
  1953. } catch (ServerException $e) {
  1954. return $long_url;
  1955. }
  1956. } else {
  1957. return $long_url;
  1958. }
  1959. } else {
  1960. //URL was shortened, so return the result
  1961. return trim($shortenedUrl);
  1962. }
  1963. }
  1964. /**
  1965. * @return mixed array($proxy, $ip) for web requests; proxy may be null
  1966. * null if not a web request
  1967. *
  1968. * @fixme X-Forwarded-For can be chained by multiple proxies;
  1969. we should parse the list and provide a cleaner array
  1970. * @fixme X-Forwarded-For can be forged by clients; only use them if trusted
  1971. * @fixme X_Forwarded_For headers will override X-Forwarded-For read through $_SERVER;
  1972. * use function to get exact request headers from Apache if possible.
  1973. */
  1974. function common_client_ip()
  1975. {
  1976. if (!isset($_SERVER) || !array_key_exists('REQUEST_METHOD', $_SERVER)) {
  1977. return null;
  1978. }
  1979. if (array_key_exists('HTTP_X_FORWARDED_FOR', $_SERVER)) {
  1980. if (array_key_exists('HTTP_CLIENT_IP', $_SERVER)) {
  1981. $proxy = $_SERVER['HTTP_CLIENT_IP'];
  1982. } else {
  1983. $proxy = $_SERVER['REMOTE_ADDR'];
  1984. }
  1985. $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
  1986. } else {
  1987. $proxy = null;
  1988. if (array_key_exists('HTTP_CLIENT_IP', $_SERVER)) {
  1989. $ip = $_SERVER['HTTP_CLIENT_IP'];
  1990. } else {
  1991. $ip = $_SERVER['REMOTE_ADDR'];
  1992. }
  1993. }
  1994. return array($proxy, $ip);
  1995. }
  1996. function common_url_to_nickname($url)
  1997. {
  1998. static $bad = array('query', 'user', 'password', 'port', 'fragment');
  1999. $parts = parse_url($url);
  2000. // If any of these parts exist, this won't work
  2001. foreach ($bad as $badpart) {
  2002. if (array_key_exists($badpart, $parts)) {
  2003. return null;
  2004. }
  2005. }
  2006. // We just have host and/or path
  2007. // If it's just a host...
  2008. if (array_key_exists('host', $parts) &&
  2009. (!array_key_exists('path', $parts) || strcmp($parts['path'], '/') == 0))
  2010. {
  2011. $hostparts = explode('.', $parts['host']);
  2012. // Try to catch common idiom of nickname.service.tld
  2013. if ((count($hostparts) > 2) &&
  2014. (strlen($hostparts[count($hostparts) - 2]) > 3) && # try to skip .co.uk, .com.au
  2015. (strcmp($hostparts[0], 'www') != 0))
  2016. {
  2017. return common_nicknamize($hostparts[0]);
  2018. } else {
  2019. // Do the whole hostname
  2020. return common_nicknamize($parts['host']);
  2021. }
  2022. } else {
  2023. if (array_key_exists('path', $parts)) {
  2024. // Strip starting, ending slashes
  2025. $path = preg_replace('@/$@', '', $parts['path']);
  2026. $path = preg_replace('@^/@', '', $path);
  2027. $path = basename($path);
  2028. // Hack for MediaWiki user pages, in the form:
  2029. // http://example.com/wiki/User:Myname
  2030. // ('User' may be localized.)
  2031. if (strpos($path, ':')) {
  2032. $parts = array_filter(explode(':', $path));
  2033. $path = $parts[count($parts) - 1];
  2034. }
  2035. if ($path) {
  2036. return common_nicknamize($path);
  2037. }
  2038. }
  2039. }
  2040. return null;
  2041. }
  2042. function common_nicknamize($str)
  2043. {
  2044. try {
  2045. return Nickname::normalize($str);
  2046. } catch (NicknameException $e) {
  2047. return null;
  2048. }
  2049. }
  2050. function common_perf_counter($key, $val=null)
  2051. {
  2052. global $_perfCounters;
  2053. if (isset($_perfCounters)) {
  2054. if (common_config('site', 'logperf')) {
  2055. if (array_key_exists($key, $_perfCounters)) {
  2056. $_perfCounters[$key][] = $val;
  2057. } else {
  2058. $_perfCounters[$key] = array($val);
  2059. }
  2060. if (common_config('site', 'logperf_detail')) {
  2061. common_log(LOG_DEBUG, "PERF COUNTER HIT: $key $val");
  2062. }
  2063. }
  2064. }
  2065. }
  2066. function common_log_perf_counters()
  2067. {
  2068. if (common_config('site', 'logperf')) {
  2069. global $_startTime, $_perfCounters;
  2070. if (isset($_startTime)) {
  2071. $endTime = microtime(true);
  2072. $diff = round(($endTime - $_startTime) * 1000);
  2073. common_log(LOG_DEBUG, "PERF runtime: ${diff}ms");
  2074. }
  2075. $counters = $_perfCounters;
  2076. ksort($counters);
  2077. foreach ($counters as $key => $values) {
  2078. $count = count($values);
  2079. $unique = count(array_unique($values));
  2080. common_log(LOG_DEBUG, "PERF COUNTER: $key $count ($unique unique)");
  2081. }
  2082. }
  2083. }
  2084. function common_is_email($str)
  2085. {
  2086. return (strpos($str, '@') !== false);
  2087. }
  2088. function common_init_stats()
  2089. {
  2090. global $_mem, $_ts;
  2091. $_mem = memory_get_usage(true);
  2092. $_ts = microtime(true);
  2093. }
  2094. function common_log_delta($comment=null)
  2095. {
  2096. global $_mem, $_ts;
  2097. $mold = $_mem;
  2098. $told = $_ts;
  2099. $_mem = memory_get_usage(true);
  2100. $_ts = microtime(true);
  2101. $mtotal = $_mem - $mold;
  2102. $ttotal = $_ts - $told;
  2103. if (empty($comment)) {
  2104. $comment = 'Delta';
  2105. }
  2106. common_debug(sprintf("%s: %d %d", $comment, $mtotal, round($ttotal * 1000000)));
  2107. }
  2108. function common_strip_html($html, $trim=true, $save_whitespace=false)
  2109. {
  2110. if (!$save_whitespace) {
  2111. $html = preg_replace('/\s+/', ' ', $html);
  2112. }
  2113. $text = html_entity_decode(strip_tags($html), ENT_QUOTES, 'UTF-8');
  2114. return $trim ? trim($text) : $text;
  2115. }