This commit is contained in:
zotlabs 2019-10-13 20:30:12 -07:00
parent e0a3c735f6
commit 29a4777452

View file

@ -1,6 +1,7 @@
<?php <?php
namespace Zotlabs\Module; namespace Zotlabs\Module;
use Zotlabs\Web\Controller;
use Zotlabs\Lib\Activity; use Zotlabs\Lib\Activity;
use Zotlabs\Lib\ActivityStreams; use Zotlabs\Lib\ActivityStreams;
use Zotlabs\Lib\LDSignatures; use Zotlabs\Lib\LDSignatures;
@ -12,22 +13,22 @@ require_once('include/photo_factory.php');
require_once('include/photos.php'); require_once('include/photos.php');
class Photo extends \Zotlabs\Web\Controller { class Photo extends Controller {
function init() { function init() {
if(ActivityStreams::is_as_request()) { if (ActivityStreams::is_as_request()) {
$observer_xchan = get_observer_hash(); $observer_xchan = get_observer_hash();
$allowed = false; $allowed = false;
$r = q("select * from item where resource_type = 'photo' and resource_id = '%s' limit 1", $r = q("select * from item where resource_type = 'photo' and resource_id = '%s' limit 1",
dbesc(argv(1)) dbesc(argv(1))
); );
if($r) { if ($r) {
$allowed = attach_can_view($r[0]['uid'],$observer_xchan,argv(1)); $allowed = attach_can_view($r[0]['uid'],$observer_xchan,argv(1));
} }
if(! $allowed) { if (! $allowed) {
http_status_exit(404,'Permission denied.'); http_status_exit(404,'Permission denied.');
} }
$channel = channelx_by_n($r[0]['uid']); $channel = channelx_by_n($r[0]['uid']);
@ -62,7 +63,7 @@ class Photo extends \Zotlabs\Web\Controller {
$channel = null; $channel = null;
$person = 0; $person = 0;
switch(argc()) { switch (argc()) {
case 4: case 4:
$person = argv(3); $person = argv(3);
$res = argv(2); $res = argv(2);
@ -74,23 +75,21 @@ class Photo extends \Zotlabs\Web\Controller {
case 1: case 1:
default: default:
killme(); killme();
// NOTREACHED
} }
$observer_xchan = get_observer_hash(); $observer_xchan = get_observer_hash();
$default = z_root() . '/' . get_default_profile_photo(); $default = z_root() . '/' . get_default_profile_photo();
if(isset($type)) { if (isset($type)) {
/** /**
* Profile photos - Access controls on default profile photos are not honoured since they need to be exchanged with remote sites. * Profile photos - Access controls on default profile photos are not honoured since they need to be exchanged with remote sites.
* *
*/ */
if($type === 'profile') { if ($type === 'profile') {
switch($res) { switch ($res) {
case 'm': case 'm':
$resolution = 5; $resolution = 5;
$default = z_root() . '/' . get_default_profile_photo(80); $default = z_root() . '/' . get_default_profile_photo(80);
@ -121,23 +120,24 @@ class Photo extends \Zotlabs\Web\Controller {
$data = $d['data']; $data = $d['data'];
$mimetype = $d['mimetype']; $mimetype = $d['mimetype'];
if(! $data) { if (! $data) {
$r = q("SELECT * FROM photo WHERE imgscale = %d AND uid = %d AND photo_usage = %d LIMIT 1", $r = q("SELECT * FROM photo WHERE imgscale = %d AND uid = %d AND photo_usage = %d LIMIT 1",
intval($resolution), intval($resolution),
intval($uid), intval($uid),
intval(PHOTO_PROFILE) intval(PHOTO_PROFILE)
); );
if($r) { if ($r) {
$data = dbunescbin($r[0]['content']); $data = dbunescbin($r[0]['content']);
$mimetype = $r[0]['mimetype']; $mimetype = $r[0]['mimetype'];
} }
if(intval($r[0]['os_storage'])) if (intval($r[0]['os_storage'])) {
$data = file_get_contents($data); $data = file_get_contents($data);
}
} }
if(! $data) { if (! $data) {
$data = fetch_image_from_url($default,$mimetype); $data = fetch_image_from_url($default,$mimetype);
} }
if(! $mimetype) { if (! $mimetype) {
$mimetype = 'image/png'; $mimetype = 'image/png';
} }
} }
@ -166,38 +166,42 @@ class Photo extends \Zotlabs\Web\Controller {
$resolution = 0; $resolution = 0;
if(strpos($photo,'.') !== false) if (strpos($photo,'.') !== false) {
$photo = substr($photo,0,strpos($photo,'.')); $photo = substr($photo,0,strpos($photo,'.'));
}
if(substr($photo,-2,1) == '-') {
if (substr($photo,-2,1) == '-') {
$resolution = intval(substr($photo,-1,1)); $resolution = intval(substr($photo,-1,1));
$photo = substr($photo,0,-2); $photo = substr($photo,0,-2);
// If viewing on a high-res screen, attempt to serve a higher resolution image: // If viewing on a high-res screen, attempt to serve a higher resolution image:
if ($resolution == 2 && ($cookie_value > 1)) if ($resolution == 2 && ($cookie_value > 1)) {
{
$resolution = 1; $resolution = 1;
} }
} }
$r = q("SELECT uid, photo_usage FROM photo WHERE resource_id = '%s' AND imgscale = %d LIMIT 1", $r = q("SELECT uid, photo_usage FROM photo WHERE resource_id = '%s' AND imgscale = %d LIMIT 1",
dbesc($photo), dbesc($photo),
intval($resolution) intval($resolution)
); );
if($r) { if ($r) {
$allowed = (-1); $allowed = (-1);
if(intval($r[0]['photo_usage'])) { if (intval($r[0]['photo_usage'])) {
$allowed = 1; $allowed = 1;
if(intval($r[0]['photo_usage']) === PHOTO_COVER) if (intval($r[0]['photo_usage']) === PHOTO_COVER) {
if($resolution < PHOTO_RES_COVER_1200) if ($resolution < PHOTO_RES_COVER_1200) {
$allowed = (-1); $allowed = (-1);
if(intval($r[0]['photo_usage']) === PHOTO_PROFILE) }
if(! in_array($resolution,[4,5,6])) }
if (intval($r[0]['photo_usage']) === PHOTO_PROFILE) {
if (! in_array($resolution,[4,5,6])) {
$allowed = (-1); $allowed = (-1);
}
}
} }
if($allowed === (-1)) { if ($allowed === (-1)) {
$allowed = attach_can_view($r[0]['uid'],$observer_xchan,$photo); $allowed = attach_can_view($r[0]['uid'],$observer_xchan,$photo);
} }
@ -211,32 +215,30 @@ class Photo extends \Zotlabs\Web\Controller {
$exists = (($e) ? true : false); $exists = (($e) ? true : false);
if($exists && $allowed) { if ($exists && $allowed) {
$data = dbunescbin($e[0]['content']); $data = dbunescbin($e[0]['content']);
$mimetype = $e[0]['mimetype']; $mimetype = $e[0]['mimetype'];
if(intval($e[0]['os_storage'])) { if (intval($e[0]['os_storage'])) {
$streaming = $data; $streaming = $data;
} }
if($e[0]['allow_cid'] != '' || $e[0]['allow_gid'] != '' || $e[0]['deny_gid'] != '' || $e[0]['deny_gid'] != '') if ($e[0]['allow_cid'] != '' || $e[0]['allow_gid'] != '' || $e[0]['deny_gid'] != '' || $e[0]['deny_gid'] != '')
$prvcachecontrol = 'no-store, no-cache, must-revalidate'; $prvcachecontrol = 'no-store, no-cache, must-revalidate';
} }
else { else {
if(! $allowed) { if (! $allowed) {
http_status_exit(403,'forbidden'); http_status_exit(403,'forbidden');
} }
if(! $exists) { if (! $exists) {
http_status_exit(404,'not found'); http_status_exit(404,'not found');
} }
} }
} }
} }
if(! isset($data)) { if (! isset($data)) {
if(isset($resolution)) { if (isset($resolution)) {
switch($resolution) { switch ($resolution) {
case 4: case 4:
$data = fetch_image_from_url(z_root() . '/' . get_default_profile_photo(),$mimetype); $data = fetch_image_from_url(z_root() . '/' . get_default_profile_photo(),$mimetype);
break; break;
@ -248,29 +250,27 @@ class Photo extends \Zotlabs\Web\Controller {
break; break;
default: default:
killme(); killme();
// NOTREACHED
break;
} }
} }
} }
if(isset($res) && intval($res) && $res < 500) { if (isset($res) && intval($res) && $res < 500) {
$ph = photo_factory($data, $mimetype); $ph = photo_factory($data, $mimetype);
if($ph->is_valid()) { if ($ph->is_valid()) {
$ph->scaleImageSquare($res); $ph->scaleImageSquare($res);
$data = $ph->imageString(); $data = $ph->imageString();
$mimetype = $ph->getType(); $mimetype = $ph->getType();
} }
} }
if(function_exists('header_remove')) { if (function_exists('header_remove')) {
header_remove('Pragma'); header_remove('Pragma');
header_remove('pragma'); header_remove('pragma');
} }
header("Content-type: " . $mimetype); header("Content-type: " . $mimetype);
if($prvcachecontrol) { if ($prvcachecontrol) {
// it is a private photo that they have permission to view. // it is a private photo that they have permission to view.
// tell the browser and infrastructure caches not to cache it, // tell the browser and infrastructure caches not to cache it,
@ -290,9 +290,9 @@ class Photo extends \Zotlabs\Web\Controller {
// leave it alone. // leave it alone.
$cache = get_config('system','photo_cache_time'); $cache = get_config('system','photo_cache_time');
if(! $cache) if (! $cache) {
$cache = (3600 * 24); // 1 day $cache = (3600 * 24); // 1 day
}
header("Expires: " . gmdate("D, d M Y H:i:s", time() + $cache) . " GMT"); header("Expires: " . gmdate("D, d M Y H:i:s", time() + $cache) . " GMT");
// Set browser cache age as $cache. But set timeout of 'shared caches' // Set browser cache age as $cache. But set timeout of 'shared caches'
// much lower in some cases in the event that infrastructure caching is present. // much lower in some cases in the event that infrastructure caching is present.
@ -305,13 +305,15 @@ class Photo extends \Zotlabs\Web\Controller {
// If it's a file resource, stream it. // If it's a file resource, stream it.
if($streaming && $channel) { if ($streaming && $channel) {
if(strpos($streaming,'store') !== false) if (strpos($streaming,'store') !== false) {
$istream = fopen($streaming,'rb'); $istream = fopen($streaming,'rb');
else }
else {
$istream = fopen('store/' . $channel['channel_address'] . '/' . $streaming,'rb'); $istream = fopen('store/' . $channel['channel_address'] . '/' . $streaming,'rb');
}
$ostream = fopen('php://output','wb'); $ostream = fopen('php://output','wb');
if($istream && $ostream) { if ($istream && $ostream) {
pipe_streams($istream,$ostream); pipe_streams($istream,$ostream);
fclose($istream); fclose($istream);
fclose($ostream); fclose($ostream);
@ -320,7 +322,6 @@ class Photo extends \Zotlabs\Web\Controller {
else { else {
echo $data; echo $data;
} }
killme(); killme();
} }