From a4607f8d1ce10bc27c9fc771dcb74cc32bcb6840 Mon Sep 17 00:00:00 2001
From: Michael <heluecht@pirati.ca>
Date: Tue, 12 Jun 2018 09:05:36 +0000
Subject: [PATCH] More abstraction for the item access

---
 mod/acl.php       | 59 +++++++++++++++++------------------
 mod/poke.php      | 78 ++++++++++++++++++++++-------------------------
 mod/share.php     | 25 ++++++++-------
 mod/subthread.php | 32 ++++++++-----------
 mod/tagger.php    | 24 +++++++--------
 5 files changed, 103 insertions(+), 115 deletions(-)

diff --git a/mod/acl.php b/mod/acl.php
index 817a02655..7f1715689 100644
--- a/mod/acl.php
+++ b/mod/acl.php
@@ -8,6 +8,7 @@ use Friendica\Core\ACL;
 use Friendica\Core\Addon;
 use Friendica\Database\DBM;
 use Friendica\Model\Contact;
+use Friendica\Model\Item;
 
 require_once 'include/dba.php';
 require_once 'mod/proxy.php';
@@ -250,39 +251,39 @@ function acl_content(App $a)
 		 * but first get known contacts url to filter them out
 		 */
 		$known_contacts = array_map(function ($i) {
-			return dbesc($i['link']);
+			return $i['link'];
 		}, $contacts);
 
 		$unknown_contacts = [];
-		$r = q("SELECT `author-link`
-				FROM `item` WHERE `parent` = %d
-					AND (`author-name` LIKE '%%%s%%' OR `author-link` LIKE '%%%s%%')
-					AND `author-link` NOT IN ('%s')
-				GROUP BY `author-link`, `author-avatar`, `author-name`
-				ORDER BY `author-name` ASC
-				",
-			intval($conv_id),
-			dbesc($search),
-			dbesc($search),
-			implode("', '", $known_contacts)
-		);
-		if (DBM::is_result($r)) {
-			foreach ($r as $row) {
-				$contact = Contact::getDetailsByURL($row['author-link']);
 
-				if (count($contact) > 0) {
-					$unknown_contacts[] = [
-						'type'    => 'c',
-						'photo'   => proxy_url($contact['micro'], false, PROXY_SIZE_MICRO),
-						'name'    => htmlentities($contact['name']),
-						'id'      => intval($contact['cid']),
-						'network' => $contact['network'],
-						'link'    => $contact['url'],
-						'nick'    => htmlentities(defaults($contact, 'nick', $contact['addr'])),
-						'addr'    => htmlentities(defaults($contact, 'addr', $contact['url'])),
-						'forum'   => $contact['forum']
-					];
-				}
+		$condition = ["`parent` = ?", $conv_id];
+		$params = ['order' => ['author-name' => true]];
+		$authors = Item::select(local_user(), ['author-link'], $condition, $params);
+		$item_authors = [];
+		while ($author = dba::fetch($authors)) {
+			$item_authors[$author['author-link']] = $author['author-link'];
+		}
+		dba::close($authors);
+
+		foreach ($item_authors as $author) {
+			if (in_array($author, $known_contacts)) {
+				continue;
+			}
+
+			$contact = Contact::getDetailsByURL($author);
+
+			if (count($contact) > 0) {
+				$unknown_contacts[] = [
+					'type'    => 'c',
+					'photo'   => proxy_url($contact['micro'], false, PROXY_SIZE_MICRO),
+					'name'    => htmlentities($contact['name']),
+					'id'      => intval($contact['cid']),
+					'network' => $contact['network'],
+					'link'    => $contact['url'],
+					'nick'    => htmlentities(defaults($contact, 'nick', $contact['addr'])),
+					'addr'    => htmlentities(defaults($contact, 'addr', $contact['url'])),
+					'forum'   => $contact['forum']
+				];
 			}
 		}
 
diff --git a/mod/poke.php b/mod/poke.php
index 3148896bc..73e8e1740 100644
--- a/mod/poke.php
+++ b/mod/poke.php
@@ -26,31 +26,31 @@ require_once 'include/items.php';
 
 function poke_init(App $a) {
 
-	if (! local_user()) {
+	if (!local_user()) {
 		return;
 	}
 
 	$uid = local_user();
 	$verb = notags(trim($_GET['verb']));
 
-	if (! $verb) {
+	if (!$verb) {
 		return;
 	}
 
 	$verbs = get_poke_verbs();
 
-	if (! array_key_exists($verb,$verbs)) {
+	if (!array_key_exists($verb, $verbs)) {
 		return;
 	}
 
 	$activity = ACTIVITY_POKE . '#' . urlencode($verbs[$verb][0]);
 
 	$contact_id = intval($_GET['cid']);
-	if (! $contact_id) {
+	if (!$contact_id) {
 		return;
 	}
 
-	$parent = ((x($_GET,'parent')) ? intval($_GET['parent']) : 0);
+	$parent = (x($_GET,'parent') ? intval($_GET['parent']) : 0);
 
 
 	logger('poke: verb ' . $verb . ' contact ' . $contact_id, LOGGER_DEBUG);
@@ -61,49 +61,45 @@ function poke_init(App $a) {
 		intval($uid)
 	);
 
-	if (! DBM::is_result($r)) {
+	if (!DBM::is_result($r)) {
 		logger('poke: no contact ' . $contact_id);
 		return;
 	}
 
 	$target = $r[0];
 
-	if($parent) {
-		$r = q("SELECT `uri`, `private`, `allow_cid`, `allow_gid`, `deny_cid`, `deny_gid`
-			FROM `item` WHERE `id` = %d AND `parent` = %d AND `uid` = %d LIMIT 1",
-			intval($parent),
-			intval($parent),
-			intval($uid)
-		);
-		if (DBM::is_result($r)) {
-			$parent_uri = $r[0]['uri'];
-			$private    = $r[0]['private'];
-			$allow_cid  = $r[0]['allow_cid'];
-			$allow_gid  = $r[0]['allow_gid'];
-			$deny_cid   = $r[0]['deny_cid'];
-			$deny_gid   = $r[0]['deny_gid'];
+	if ($parent) {
+		$fields = ['uri', 'private', 'allow_cid', 'allow_gid', 'deny_cid', 'deny_gid'];
+		$condition = ['id' => $parent, 'parent' => $parent, 'uid' => $uid];
+		$item = Item::selectFirst(local_user(), $fields, $condition);
+
+		if (DBM::is_result($item)) {
+			$parent_uri = $item['uri'];
+			$private    = $item['private'];
+			$allow_cid  = $item['allow_cid'];
+			$allow_gid  = $item['allow_gid'];
+			$deny_cid   = $item['deny_cid'];
+			$deny_gid   = $item['deny_gid'];
 		}
-	}
-	else {
+	} else {
+		$private = (x($_GET,'private') ? intval($_GET['private']) : 0);
 
-		$private = ((x($_GET,'private')) ? intval($_GET['private']) : 0);
-
-		$allow_cid     = (($private) ? '<' . $target['id']. '>' : $a->user['allow_cid']);
-		$allow_gid     = (($private) ? '' : $a->user['allow_gid']);
-		$deny_cid      = (($private) ? '' : $a->user['deny_cid']);
-		$deny_gid      = (($private) ? '' : $a->user['deny_gid']);
+		$allow_cid     = ($private ? '<' . $target['id']. '>' : $a->user['allow_cid']);
+		$allow_gid     = ($private ? '' : $a->user['allow_gid']);
+		$deny_cid      = ($private ? '' : $a->user['deny_cid']);
+		$deny_gid      = ($private ? '' : $a->user['deny_gid']);
 	}
 
 	$poster = $a->contact;
 
-	$uri = item_new_uri($a->get_hostname(),$uid);
+	$uri = item_new_uri($a->get_hostname(), $uid);
 
 	$arr = [];
 
 	$arr['guid']          = get_guid(32);
 	$arr['uid']           = $uid;
 	$arr['uri']           = $uri;
-	$arr['parent-uri']    = (($parent_uri) ? $parent_uri : $uri);
+	$arr['parent-uri']    = ($parent_uri ? $parent_uri : $uri);
 	$arr['type']          = 'activity';
 	$arr['wall']          = 1;
 	$arr['contact-id']    = $poster['id'];
@@ -133,7 +129,7 @@ function poke_init(App $a) {
 	$arr['object'] .= '</link></object>' . "\n";
 
 	$item_id = Item::insert($arr);
-	if($item_id) {
+	if ($item_id) {
 		Worker::add(PRIORITY_HIGH, "Notifier", "tag", $item_id);
 	}
 
@@ -146,7 +142,7 @@ function poke_init(App $a) {
 
 function poke_content(App $a) {
 
-	if (! local_user()) {
+	if (!local_user()) {
 		notice(L10n::t('Permission denied.') . EOL);
 		return;
 	}
@@ -154,14 +150,14 @@ function poke_content(App $a) {
 	$name = '';
 	$id = '';
 
-	if(intval($_GET['c'])) {
+	if (intval($_GET['c'])) {
 		$r = q("SELECT `id`,`name` FROM `contact` WHERE `id` = %d AND `uid` = %d LIMIT 1",
 			intval($_GET['c']),
 			intval(local_user())
 		);
 		if (DBM::is_result($r)) {
-			$name = $r[0]['name'];
-			$id = $r[0]['id'];
+			$name = $item['name'];
+			$id = $item['id'];
 		}
 	}
 
@@ -175,16 +171,17 @@ function poke_content(App $a) {
 	]);
 
 
-	$parent = ((x($_GET,'parent')) ? intval($_GET['parent']) : '0');
+	$parent = (x($_GET,'parent') ? intval($_GET['parent']) : '0');
 
 
 	$verbs = get_poke_verbs();
 
 	$shortlist = [];
-	foreach($verbs as $k => $v)
-		if($v[1] !== 'NOTRANSLATION')
-			$shortlist[] = [$k,$v[1]];
-
+	foreach ($verbs as $k => $v) {
+		if ($v[1] !== 'NOTRANSLATION') {
+			$shortlist[] = [$k, $v[1]];
+		}
+	}
 
 	$tpl = get_markup_template('poke_content.tpl');
 
@@ -202,5 +199,4 @@ function poke_content(App $a) {
 	]);
 
 	return $o;
-
 }
diff --git a/mod/share.php b/mod/share.php
index 555273443..ac708c40f 100644
--- a/mod/share.php
+++ b/mod/share.php
@@ -2,6 +2,7 @@
 
 use Friendica\App;
 use Friendica\Database\DBM;
+use Friendica\Model\Item;
 
 function share_init(App $a) {
 	$post_id = (($a->argc > 1) ? intval($a->argv[1]) : 0);
@@ -10,27 +11,25 @@ function share_init(App $a) {
 		killme();
 	}
 
-	$r = q("SELECT item.*, contact.network FROM `item`
-		INNER JOIN `contact` ON `item`.`contact-id` = `contact`.`id`
-		WHERE `item`.`id` = %d LIMIT 1",
-		intval($post_id)
-	);
+	$fields = ['private', 'body', 'author-name', 'author-link', 'author-avatar',
+		'guid', 'created', 'plink', 'title'];
+        $item = Item::selectFirst(local_user(), $fields, ['id' => $post_id]);
 
-	if (!DBM::is_result($r) || ($r[0]['private'] == 1)) {
+	if (!DBM::is_result($item) || $item['private']) {
 		killme();
 	}
 
-	if (strpos($r[0]['body'], "[/share]") !== false) {
-		$pos = strpos($r[0]['body'], "[share");
-		$o = substr($r[0]['body'], $pos);
+	if (strpos($item['body'], "[/share]") !== false) {
+		$pos = strpos($item['body'], "[share");
+		$o = substr($item['body'], $pos);
 	} else {
-		$o = share_header($r[0]['author-name'], $r[0]['author-link'], $r[0]['author-avatar'], $r[0]['guid'], $r[0]['created'], $r[0]['plink']);
+		$o = share_header($item['author-name'], $item['author-link'], $item['author-avatar'], $item['guid'], $item['created'], $item['plink']);
 
-		if ($r[0]['title']) {
-			$o .= '[b]'.$r[0]['title'].'[/b]'."\n";
+		if ($item['title']) {
+			$o .= '[b]'.$item['title'].'[/b]'."\n";
 		}
 
-		$o .= $r[0]['body'];
+		$o .= $item['body'];
 		$o .= "[/share]";
 	}
 
diff --git a/mod/subthread.php b/mod/subthread.php
index df44df6ef..db8b9ba4f 100644
--- a/mod/subthread.php
+++ b/mod/subthread.php
@@ -14,7 +14,7 @@ require_once 'include/items.php';
 
 function subthread_content(App $a) {
 
-	if(! local_user() && ! remote_user()) {
+	if (!local_user() && !remote_user()) {
 		return;
 	}
 
@@ -22,36 +22,32 @@ function subthread_content(App $a) {
 
 	$item_id = (($a->argc > 1) ? notags(trim($a->argv[1])) : 0);
 
-	$r = q("SELECT * FROM `item` WHERE `parent` = '%s' OR `parent-uri` = '%s' and parent = id LIMIT 1",
-		dbesc($item_id),
-		dbesc($item_id)
-	);
+	$condition = ["`parent` = ? OR `parent-uri` = ? AND `parent` = `id`", $item_id, $item_id];
+	$item = Item::selectFirst(local_user(), [], $condition);
 
-	if(! $item_id || (! DBM::is_result($r))) {
+	if (empty($item_id) || !DBM::is_result($item)) {
 		logger('subthread: no item ' . $item_id);
 		return;
 	}
 
-	$item = $r[0];
-
 	$owner_uid = $item['uid'];
 
-	if(! can_write_wall($owner_uid)) {
+	if (!can_write_wall($owner_uid)) {
 		return;
 	}
 
 	$remote_owner = null;
 
-	if(! $item['wall']) {
+	if (!$item['wall']) {
 		// The top level post may have been written by somebody on another system
 		$r = q("SELECT * FROM `contact` WHERE `id` = %d AND `uid` = %d LIMIT 1",
 			intval($item['contact-id']),
 			intval($item['uid'])
 		);
-		if (! DBM::is_result($r)) {
+		if (!DBM::is_result($r)) {
 			return;
 		}
-		if (! $r[0]['self']) {
+		if (!$r[0]['self']) {
 			$remote_owner = $r[0];
 		}
 	}
@@ -68,19 +64,19 @@ function subthread_content(App $a) {
 		$owner = $r[0];
 	}
 
-	if (! $owner) {
+	if (!$owner) {
 		logger('like: no owner');
 		return;
 	}
 
-	if (! $remote_owner) {
+	if (!$remote_owner) {
 		$remote_owner = $owner;
 	}
 
 	$contact = null;
 	// This represents the person posting
 
-	if ((local_user()) && (local_user() == $owner_uid)) {
+	if (local_user() && (local_user() == $owner_uid)) {
 		$contact = $owner;
 	} else {
 		$r = q("SELECT * FROM `contact` WHERE `id` = %d AND `uid` = %d LIMIT 1",
@@ -92,7 +88,7 @@ function subthread_content(App $a) {
 			$contact = $r[0];
 		}
 	}
-	if (! $contact) {
+	if (!$contact) {
 		return;
 	}
 
@@ -116,7 +112,7 @@ function subthread_content(App $a) {
 EOT;
 	$bodyverb = L10n::t('%1$s is following %2$s\'s %3$s');
 
-	if (! isset($bodyverb)) {
+	if (!isset($bodyverb)) {
 		return;
 	}
 
@@ -168,5 +164,3 @@ EOT;
 	killme();
 
 }
-
-
diff --git a/mod/tagger.php b/mod/tagger.php
index 211e2ffa1..fa8dc3530 100644
--- a/mod/tagger.php
+++ b/mod/tagger.php
@@ -15,7 +15,7 @@ require_once 'include/items.php';
 
 function tagger_content(App $a) {
 
-	if(! local_user() && ! remote_user()) {
+	if (!local_user() && !remote_user()) {
 		return;
 	}
 
@@ -23,25 +23,22 @@ function tagger_content(App $a) {
 	// no commas allowed
 	$term = str_replace([',',' '],['','_'],$term);
 
-	if(! $term)
+	if (!$term) {
 		return;
+	}
 
 	$item_id = (($a->argc > 1) ? notags(trim($a->argv[1])) : 0);
 
 	logger('tagger: tag ' . $term . ' item ' . $item_id);
 
 
-	$r = q("SELECT * FROM `item` WHERE `id` = '%s' LIMIT 1",
-		dbesc($item_id)
-	);
+	$item = Item::selectFirst(local_user(), [], ['id' => $item_id]);
 
-	if(! $item_id || (! DBM::is_result($r))) {
+	if (!$item_id || !DBM::is_result($item)) {
 		logger('tagger: no item ' . $item_id);
 		return;
 	}
 
-	$item = $r[0];
-
 	$owner_uid = $item['uid'];
 	$owner_nick = '';
 	$blocktags = 0;
@@ -54,15 +51,16 @@ function tagger_content(App $a) {
 		$blocktags = $r[0]['blocktags'];
 	}
 
-	if(local_user() != $owner_uid)
+	if (local_user() != $owner_uid) {
 		return;
+	}
 
 	$r = q("select * from contact where self = 1 and uid = %d limit 1",
 		intval(local_user())
 	);
-	if (DBM::is_result($r))
+	if (DBM::is_result($r)) {
 			$contact = $r[0];
-	else {
+	} else {
 		logger('tagger: no contact_id');
 		return;
 	}
@@ -109,7 +107,7 @@ EOT;
 
 	$bodyverb = L10n::t('%1$s tagged %2$s\'s %3$s with %4$s');
 
-	if (! isset($bodyverb)) {
+	if (!isset($bodyverb)) {
 		return;
 	}
 
@@ -165,7 +163,7 @@ EOT;
 		dbesc($term)
 	);
 
-	if ((!$blocktags) && $t[0]['tcount'] == 0 ) {
+	if (!$blocktags && $t[0]['tcount'] == 0) {
 		q("INSERT INTO term (oid, otype, type, term, url, uid) VALUE (%d, %d, %d, '%s', '%s', %d)",
 		   intval($item['id']),
 		   $term_objtype,