2018-02-09 03:49:49 +00:00
< ? php
2020-02-09 14:45:36 +00:00
/**
2021-03-29 06:40:20 +00:00
* @ copyright Copyright ( C ) 2010 - 2021 , the Friendica project
2020-02-09 14:45:36 +00:00
*
* @ license GNU AGPL version 3 or any later version
*
* This program is free software : you can redistribute it and / or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation , either version 3 of the
* License , or ( at your option ) any later version .
*
* This program is distributed in the hope that it will be useful ,
* but WITHOUT ANY WARRANTY ; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE . See the
* GNU Affero General Public License for more details .
*
* You should have received a copy of the GNU Affero General Public License
* along with this program . If not , see < https :// www . gnu . org / licenses />.
*
*/
2018-02-09 03:49:49 +00:00
namespace Friendica ;
2021-11-19 21:47:49 +00:00
use Friendica\App\Router ;
2021-11-14 19:28:36 +00:00
use Friendica\Capabilities\ICanHandleRequests ;
2021-11-21 19:06:36 +00:00
use Friendica\Capabilities\ICanReadAndWriteToResponds ;
use Friendica\Capabilities\IRespondToRequests ;
2021-11-20 14:38:03 +00:00
use Friendica\Core\Hook ;
2021-11-19 19:18:48 +00:00
use Friendica\Core\L10n ;
2018-10-29 21:20:46 +00:00
use Friendica\Core\Logger ;
2021-08-08 10:14:56 +00:00
use Friendica\Model\User ;
2021-11-21 19:06:36 +00:00
use Friendica\Module\Response ;
2021-11-20 14:38:03 +00:00
use Friendica\Module\Special\HTTPException as ModuleHTTPException ;
use Friendica\Network\HTTPException ;
2021-11-19 21:47:49 +00:00
use Friendica\Util\Profiler ;
use Psr\Log\LoggerInterface ;
2018-10-17 19:30:41 +00:00
2018-02-09 03:49:49 +00:00
/**
* All modules in Friendica should extend BaseModule , although not all modules
* need to extend all the methods described here
*
2018-04-03 14:33:39 +00:00
* The filename of the module in src / Module needs to match the class name
* exactly to make the module available .
*
2018-09-15 23:28:38 +00:00
* @ author Hypolite Petovan < hypolite @ mrpetovan . com >
2018-02-09 03:49:49 +00:00
*/
2021-11-14 19:28:36 +00:00
abstract class BaseModule implements ICanHandleRequests
2018-02-09 03:49:49 +00:00
{
2021-11-14 19:28:36 +00:00
/** @var array */
2021-11-14 22:19:25 +00:00
protected $parameters = [];
2021-11-19 19:18:48 +00:00
/** @var L10n */
protected $l10n ;
2021-11-20 14:38:03 +00:00
/** @var App\BaseURL */
protected $baseUrl ;
/** @var App\Arguments */
protected $args ;
/** @var LoggerInterface */
protected $logger ;
/** @var Profiler */
protected $profiler ;
/** @var array */
protected $server ;
2021-11-21 19:06:36 +00:00
/** @var ICanReadAndWriteToResponds */
protected $response ;
2021-11-19 19:18:48 +00:00
2021-11-21 19:06:36 +00:00
public function __construct ( L10n $l10n , App\BaseURL $baseUrl , App\Arguments $args , LoggerInterface $logger , Profiler $profiler , Response $response , array $server , array $parameters = [])
2018-02-09 03:49:49 +00:00
{
2021-11-17 20:32:57 +00:00
$this -> parameters = $parameters ;
2021-11-19 19:18:48 +00:00
$this -> l10n = $l10n ;
2021-11-20 14:38:03 +00:00
$this -> baseUrl = $baseUrl ;
$this -> args = $args ;
$this -> logger = $logger ;
$this -> profiler = $profiler ;
$this -> server = $server ;
2021-11-21 19:06:36 +00:00
$this -> response = $response ;
2018-09-30 20:47:28 +00:00
}
2018-02-09 03:49:49 +00:00
2021-11-18 20:33:05 +00:00
/**
2021-11-19 19:18:48 +00:00
* Wraps the L10n :: t () function for Modules
*
* @ see L10n :: t ()
*/
protected function t ( string $s , ... $args ) : string
{
2021-11-24 15:57:05 +00:00
return $this -> l10n -> t ( $s , ... $args );
2021-11-19 19:18:48 +00:00
}
/**
* Wraps the L10n :: tt () function for Modules
*
* @ see L10n :: tt ()
2021-11-18 20:33:05 +00:00
*/
2021-11-19 19:18:48 +00:00
protected function tt ( string $singular , string $plurarl , int $count ) : string
2021-11-18 20:33:05 +00:00
{
2021-11-19 19:18:48 +00:00
return $this -> l10n -> tt ( $singular , $plurarl , $count );
2021-11-18 20:33:05 +00:00
}
2018-09-30 20:47:28 +00:00
/**
2021-11-20 14:38:03 +00:00
* Module GET method to display raw content from technical endpoints
*
* Extend this method if the module is supposed to return communication data ,
* e . g . from protocol implementations .
*
* @ param string [] $request The $_REQUEST content
2018-09-30 20:47:28 +00:00
*/
2021-11-20 14:38:03 +00:00
protected function rawContent ( array $request = [])
2018-09-30 20:47:28 +00:00
{
2019-11-05 22:01:45 +00:00
// echo '';
// exit;
2018-02-09 03:49:49 +00:00
}
/**
2021-11-20 14:38:03 +00:00
* Module GET method to display any content
*
* Extend this method if the module is supposed to return any display
* through a GET request . It can be an HTML page through templating or a
* XML feed or a JSON output .
*
* @ param string [] $request The $_REQUEST content
2018-02-09 03:49:49 +00:00
*/
2021-11-20 14:38:03 +00:00
protected function content ( array $request = []) : string
2018-02-09 03:49:49 +00:00
{
2021-11-14 19:28:36 +00:00
return '' ;
2018-02-09 03:49:49 +00:00
}
2021-05-08 09:14:19 +00:00
/**
2021-11-20 14:38:03 +00:00
* Module DELETE method to process submitted data
*
* Extend this method if the module is supposed to process DELETE requests .
* Doesn ' t display any content
2021-05-08 09:14:19 +00:00
*/
2021-11-20 14:38:03 +00:00
protected function delete ()
2021-05-08 09:14:19 +00:00
{
}
/**
2021-11-20 14:38:03 +00:00
* Module PATCH method to process submitted data
*
* Extend this method if the module is supposed to process PATCH requests .
* Doesn ' t display any content
2021-05-08 09:14:19 +00:00
*/
2021-11-20 14:38:03 +00:00
protected function patch ()
2021-05-08 09:14:19 +00:00
{
}
2018-02-09 03:49:49 +00:00
/**
2021-11-20 14:38:03 +00:00
* Module POST method to process submitted data
*
* Extend this method if the module is supposed to process POST requests .
* Doesn ' t display any content
*
* @ param string [] $request The $_REQUEST content
* @ param string [] $post The $_POST content
*
2018-02-09 03:49:49 +00:00
*/
2021-11-20 14:38:03 +00:00
protected function post ( array $request = [], array $post = [])
2018-02-09 03:49:49 +00:00
{
2021-11-20 14:38:03 +00:00
// $this->baseUrl->redirect('module');
2018-02-09 03:49:49 +00:00
}
2021-05-08 09:14:19 +00:00
/**
2021-11-20 14:38:03 +00:00
* Module PUT method to process submitted data
*
* Extend this method if the module is supposed to process PUT requests .
* Doesn ' t display any content
2021-05-08 09:14:19 +00:00
*/
2021-11-20 14:38:03 +00:00
protected function put ()
2021-05-08 09:14:19 +00:00
{
}
2021-11-14 19:28:36 +00:00
/** Gets the name of the current class */
2021-11-14 22:13:47 +00:00
public function getClassName () : string
2021-11-14 19:28:36 +00:00
{
return static :: class ;
}
2021-11-20 14:38:03 +00:00
/**
* { @ inheritDoc }
*/
2021-11-21 19:06:36 +00:00
public function run ( array $post = [], array $request = []) : IRespondToRequests
2021-11-19 21:47:49 +00:00
{
// @see https://github.com/tootsuite/mastodon/blob/c3aef491d66aec743a3a53e934a494f653745b61/config/initializers/cors.rb
2021-11-20 14:38:03 +00:00
if ( substr ( $request [ 'pagename' ] ? ? '' , 0 , 12 ) == '.well-known/' ) {
2021-11-19 21:47:49 +00:00
header ( 'Access-Control-Allow-Origin: *' );
header ( 'Access-Control-Allow-Headers: *' );
header ( 'Access-Control-Allow-Methods: ' . Router :: GET );
header ( 'Access-Control-Allow-Credentials: false' );
2021-11-20 14:38:03 +00:00
} elseif ( substr ( $request [ 'pagename' ] ? ? '' , 0 , 8 ) == 'profile/' ) {
2021-11-19 21:47:49 +00:00
header ( 'Access-Control-Allow-Origin: *' );
header ( 'Access-Control-Allow-Headers: *' );
header ( 'Access-Control-Allow-Methods: ' . Router :: GET );
header ( 'Access-Control-Allow-Credentials: false' );
2021-11-20 14:38:03 +00:00
} elseif ( substr ( $request [ 'pagename' ] ? ? '' , 0 , 4 ) == 'api/' ) {
2021-11-19 21:47:49 +00:00
header ( 'Access-Control-Allow-Origin: *' );
header ( 'Access-Control-Allow-Headers: *' );
header ( 'Access-Control-Allow-Methods: ' . implode ( ',' , Router :: ALLOWED_METHODS ));
header ( 'Access-Control-Allow-Credentials: false' );
header ( 'Access-Control-Expose-Headers: Link' );
2021-11-20 14:38:03 +00:00
} elseif ( substr ( $request [ 'pagename' ] ? ? '' , 0 , 11 ) == 'oauth/token' ) {
2021-11-19 21:47:49 +00:00
header ( 'Access-Control-Allow-Origin: *' );
header ( 'Access-Control-Allow-Headers: *' );
header ( 'Access-Control-Allow-Methods: ' . Router :: POST );
header ( 'Access-Control-Allow-Credentials: false' );
}
$placeholder = '' ;
2021-11-20 14:38:03 +00:00
$this -> profiler -> set ( microtime ( true ), 'ready' );
2021-11-19 21:47:49 +00:00
$timestamp = microtime ( true );
2021-11-20 14:38:03 +00:00
Core\Hook :: callAll ( $this -> args -> getModuleName () . '_mod_init' , $placeholder );
2021-11-19 21:47:49 +00:00
2021-11-20 14:38:03 +00:00
$this -> profiler -> set ( microtime ( true ) - $timestamp , 'init' );
2021-11-21 19:06:36 +00:00
$this -> response -> setType ( IRespondToRequests :: TYPE_CONTENT );
2021-11-19 21:47:49 +00:00
2021-11-21 19:06:36 +00:00
switch ( $this -> server [ 'REQUEST_METHOD' ]) {
case Router :: DELETE :
$this -> response -> setType ( IRespondToRequests :: TYPE_DELETE );
$this -> delete ();
break ;
case Router :: PATCH :
$this -> response -> setType ( IRespondToRequests :: TYPE_PATCH );
$this -> patch ();
break ;
case Router :: POST :
Core\Hook :: callAll ( $this -> args -> getModuleName () . '_mod_post' , $post );
$this -> response -> setType ( IRespondToRequests :: TYPE_POST );
$this -> post ( $request , $post );
break ;
case Router :: PUT :
$this -> response -> setType ( IRespondToRequests :: TYPE_PUT );
$this -> put ();
break ;
default :
// "rawContent" is especially meant for technical endpoints.
// This endpoint doesn't need any theme initialization or other comparable stuff.
$this -> rawContent ( $request );
2021-11-19 21:47:49 +00:00
2021-11-21 19:06:36 +00:00
try {
$arr = [ 'content' => '' ];
Hook :: callAll ( static :: class . '_mod_content' , $arr );
$this -> response -> addContent ( $arr [ 'content' ]);
$this -> response -> addContent ( $this -> content ( $_REQUEST ));
} catch ( HTTPException $e ) {
$this -> response -> addContent (( new ModuleHTTPException ()) -> content ( $e ));
}
break ;
2021-11-19 21:47:49 +00:00
}
2021-11-21 19:06:36 +00:00
return $this -> response ;
2021-11-19 21:47:49 +00:00
}
2018-10-17 19:30:41 +00:00
/*
* Functions used to protect against Cross - Site Request Forgery
* The security token has to base on at least one value that an attacker can 't know - here it' s the session ID and the private key .
* In this implementation , a security token is reusable ( if the user submits a form , goes back and resubmits the form , maybe with small changes ;
2020-07-09 19:08:09 +00:00
* or if the security token is used for ajax - calls that happen several times ), but only valid for a certain amount of time ( 3 hours ) .
* The " typename " separates the security tokens of different types of forms . This could be relevant in the following case :
* A security token is used to protect a link from CSRF ( e . g . the " delete this profile " - link ) .
2018-10-17 19:30:41 +00:00
* If the new page contains by any chance external elements , then the used security token is exposed by the referrer .
2020-07-09 19:08:09 +00:00
* Actually , important actions should not be triggered by Links / GET - Requests at all , but sometimes they still are ,
2018-10-17 19:30:41 +00:00
* so this mechanism brings in some damage control ( the attacker would be able to forge a request to a form of this type , but not to forms of other types ) .
*/
public static function getFormSecurityToken ( $typename = '' )
{
2021-11-21 19:06:36 +00:00
$user = User :: getById ( DI :: app () -> getLoggedInUserId (), [ 'guid' , 'prvkey' ]);
2018-10-17 19:30:41 +00:00
$timestamp = time ();
2021-11-21 19:06:36 +00:00
$sec_hash = hash ( 'whirlpool' , ( $user [ 'guid' ] ? ? '' ) . ( $user [ 'prvkey' ] ? ? '' ) . session_id () . $timestamp . $typename );
2018-10-17 19:30:41 +00:00
return $timestamp . '.' . $sec_hash ;
}
public static function checkFormSecurityToken ( $typename = '' , $formname = 'form_security_token' )
{
$hash = null ;
if ( ! empty ( $_REQUEST [ $formname ])) {
/// @TODO Careful, not secured!
$hash = $_REQUEST [ $formname ];
}
if ( ! empty ( $_SERVER [ 'HTTP_X_CSRF_TOKEN' ])) {
/// @TODO Careful, not secured!
$hash = $_SERVER [ 'HTTP_X_CSRF_TOKEN' ];
}
if ( empty ( $hash )) {
return false ;
}
$max_livetime = 10800 ; // 3 hours
2021-08-09 20:33:46 +00:00
$user = User :: getById ( DI :: app () -> getLoggedInUserId (), [ 'guid' , 'prvkey' ]);
2018-10-17 19:30:41 +00:00
$x = explode ( '.' , $hash );
2019-10-07 18:10:30 +00:00
if ( time () > ( intval ( $x [ 0 ]) + $max_livetime )) {
2018-10-17 19:30:41 +00:00
return false ;
}
2021-08-08 10:14:56 +00:00
$sec_hash = hash ( 'whirlpool' , ( $user [ 'guid' ] ? ? '' ) . ( $user [ 'prvkey' ] ? ? '' ) . session_id () . $x [ 0 ] . $typename );
2018-10-17 19:30:41 +00:00
return ( $sec_hash == $x [ 1 ]);
}
public static function getFormSecurityStandardErrorMessage ()
{
2020-01-18 19:52:34 +00:00
return DI :: l10n () -> t ( " The form security token was not correct. This probably happened because the form has been opened for too long \x28 >3 hours \x29 before submitting it. " ) . EOL ;
2018-10-17 19:30:41 +00:00
}
public static function checkFormSecurityTokenRedirectOnError ( $err_redirect , $typename = '' , $formname = 'form_security_token' )
{
if ( ! self :: checkFormSecurityToken ( $typename , $formname )) {
2021-10-20 18:53:52 +00:00
Logger :: notice ( 'checkFormSecurityToken failed: user ' . DI :: app () -> getLoggedInUserNickname () . ' - form element ' . $typename );
Logger :: debug ( 'checkFormSecurityToken failed' , [ 'request' => $_REQUEST ]);
2018-10-19 08:03:52 +00:00
notice ( self :: getFormSecurityStandardErrorMessage ());
2019-12-15 23:28:31 +00:00
DI :: baseUrl () -> redirect ( $err_redirect );
2018-10-17 19:30:41 +00:00
}
}
public static function checkFormSecurityTokenForbiddenOnError ( $typename = '' , $formname = 'form_security_token' )
{
if ( ! self :: checkFormSecurityToken ( $typename , $formname )) {
2021-10-20 18:53:52 +00:00
Logger :: notice ( 'checkFormSecurityToken failed: user ' . DI :: app () -> getLoggedInUserNickname () . ' - form element ' . $typename );
Logger :: debug ( 'checkFormSecurityToken failed' , [ 'request' => $_REQUEST ]);
2018-12-26 05:40:12 +00:00
2019-05-02 03:16:10 +00:00
throw new \Friendica\Network\HTTPException\ForbiddenException ();
2018-10-17 19:30:41 +00:00
}
}
2020-08-06 14:34:11 +00:00
protected static function getContactFilterTabs ( string $baseUrl , string $current , bool $displayCommonTab )
{
$tabs = [
[
'label' => DI :: l10n () -> t ( 'All contacts' ),
'url' => $baseUrl . '/contacts' ,
'sel' => ! $current || $current == 'all' ? 'active' : '' ,
],
[
'label' => DI :: l10n () -> t ( 'Followers' ),
'url' => $baseUrl . '/contacts/followers' ,
'sel' => $current == 'followers' ? 'active' : '' ,
],
[
'label' => DI :: l10n () -> t ( 'Following' ),
'url' => $baseUrl . '/contacts/following' ,
'sel' => $current == 'following' ? 'active' : '' ,
],
[
'label' => DI :: l10n () -> t ( 'Mutual friends' ),
'url' => $baseUrl . '/contacts/mutuals' ,
'sel' => $current == 'mutuals' ? 'active' : '' ,
],
];
if ( $displayCommonTab ) {
$tabs [] = [
'label' => DI :: l10n () -> t ( 'Common' ),
'url' => $baseUrl . '/contacts/common' ,
'sel' => $current == 'common' ? 'active' : '' ,
];
}
return $tabs ;
}
2018-02-09 03:49:49 +00:00
}