From e3c7200b6f75e169b516c78b1f6ae383fd886ae0 Mon Sep 17 00:00:00 2001 From: zotlabs Date: Thu, 25 Jan 2018 16:16:55 -0800 Subject: [PATCH 01/23] don't do any bbcode translation within code blocks (except baseurl, observer, and linefeeds) --- include/bbcode.php | 42 ++++++++++++++++++++++++++++-------------- 1 file changed, 28 insertions(+), 14 deletions(-) diff --git a/include/bbcode.php b/include/bbcode.php index de32bd57a..2b8274c0f 100644 --- a/include/bbcode.php +++ b/include/bbcode.php @@ -610,11 +610,23 @@ function bb_observer($Text) { return $Text; } +function bb_code_protect($s) { + return 'b64.^9e%.' . base64_encode($s) . '.b64.$9e%'; +} + +function bb_code_unprotect($s) { + return preg_replace_callback('|b64\.\^9e\%\.(.*?)\.b64\.\$9e\%|ism','bb_code_unprotect_sub',$s); +} + +function bb_code_unprotect_sub($match) { + return base64_decode($match[1]); +} + function bb_code($match) { if(strpos($match[0], "
")) - return '' . trim($match[1]) . ''; + return '' . bb_code_protect(trim($match[1])) . ''; else - return '' . trim($match[1]) . ''; + return '' . bb_code_protect(trim($match[1])) . ''; } function bb_code_options($match) { @@ -628,11 +640,11 @@ function bb_code_options($match) { } else { $style = ""; } - return '' . trim($match[2]) . ''; + return '' . bb_code_protect(trim($match[2])) . ''; } function bb_highlight($match) { - return text_highlight($match[2],strtolower($match[1])); + return bb_code_protect(text_highlight($match[2],strtolower($match[1]))); } function bb_fixtable_lf($match) { @@ -822,6 +834,17 @@ function bbcode($Text, $options = []) { $Text = str_replace(array("\t", " "), array("    ", "  "), $Text); + + // Check for [code] text + if (strpos($Text,'[code]') !== false) { + $Text = preg_replace_callback("/\[code\](.*?)\[\/code\]/ism", 'bb_code', $Text); + } + + // Check for [code options] text + if (strpos($Text,'[code ') !== false) { + $Text = preg_replace_callback("/\[code(.*?)\](.*?)\[\/code\]/ism", 'bb_code_options', $Text); + } + // Set up the parameters for a URL search string $URLSearchString = "^\[\]"; // Set up the parameters for a MAIL search string @@ -1062,16 +1085,6 @@ function bbcode($Text, $options = []) { $Text = preg_replace("/\[font=(.*?)\](.*?)\[\/font\]/sm", "$2", $Text); } - // Check for [code] text - if (strpos($Text,'[code]') !== false) { - $Text = preg_replace_callback("/\[code\](.*?)\[\/code\]/ism", 'bb_code', $Text); - } - - // Check for [code options] text - if (strpos($Text,'[code ') !== false) { - $Text = preg_replace_callback("/\[code(.*?)\](.*?)\[\/code\]/ism", 'bb_code_options', $Text); - } - if(strpos($Text,'[/summary]') !== false) { $Text = preg_replace_callback("/^(.*?)\[summary\](.*?)\[\/summary\](.*?)$/ism", 'bb_summary', $Text); @@ -1288,6 +1301,7 @@ function bbcode($Text, $options = []) { // replace escaped links in code= blocks $Text = str_replace('%eY9-!','http', $Text); + $Text = bb_code_unprotect($Text); $Text = preg_replace('/\[\&\;([#a-z0-9]+)\;\]/', '&$1;', $Text); From 7c600b03803bfddd2d98084ef5c1976e35b84f9e Mon Sep 17 00:00:00 2001 From: Mario Vavti Date: Fri, 26 Jan 2018 11:44:24 +0100 Subject: [PATCH 02/23] preserve open state of notifications --- view/js/main.js | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/view/js/main.js b/view/js/main.js index 8eb02156b..13d002968 100644 --- a/view/js/main.js +++ b/view/js/main.js @@ -70,11 +70,21 @@ $(document).ready(function() { if(! $('#nav-' + notifyType + '-sub').hasClass('show')) { loadNotificationItems(notifyType); + sessionStorage.setItem('notification_open', notifyType); + } + else { + sessionStorage.removeItem('notification_open'); } $(this).data('clicked', true); }); + if(sessionStorage.getItem('notification_open') !== null) { + var notifyType = sessionStorage.getItem('notification_open'); + $('#nav-' + notifyType + '-sub').addClass('show'); + loadNotificationItems(notifyType); + } + // Allow folks to stop the ajax page updates with the pause/break key $(document).keydown(function(event) { if(event.keyCode == '8') { From 660079bd2a4a6dcb54390a4c2f22bbc7a0633fd4 Mon Sep 17 00:00:00 2001 From: zotlabs Date: Fri, 26 Jan 2018 12:16:47 -0800 Subject: [PATCH 03/23] Issue with configurable site age limit, vagueness when informing about email validation policy; added email validation resend ability and the option to input a verification code at a webpage though both require additional work to provide these abilities. --- Zotlabs/Module/Register.php | 14 +++++++--- include/account.php | 42 +++++++++++++++++++++++------- view/en/register_verify_member.tpl | 7 ++++- 3 files changed, 48 insertions(+), 15 deletions(-) diff --git a/Zotlabs/Module/Register.php b/Zotlabs/Module/Register.php index deaee31bf..1cb3bab91 100644 --- a/Zotlabs/Module/Register.php +++ b/Zotlabs/Module/Register.php @@ -217,6 +217,9 @@ class Register extends \Zotlabs\Web\Controller { $privacy_role = ((x($_REQUEST,'permissions_role')) ? $_REQUEST['permissions_role'] : ""); $perm_roles = \Zotlabs\Access\PermissionRoles::roles(); + + // A new account will not have a techlevel, but accounts can also be created by the administrator. + if((get_account_techlevel() < 4) && $privacy_role !== 'custom') unset($perm_roles[t('Other')]); @@ -231,15 +234,17 @@ class Register extends \Zotlabs\Web\Controller { // Configurable whether to restrict age or not - default is based on international legal requirements // This can be relaxed if you are on a restricted server that does not share with public servers - if(get_config('system','no_age_restriction')) + if(get_config('system','no_age_restriction')) { $label_tos = sprintf( t('I accept the %s for this website'), $toslink); - else + } + else { $age = get_config('system','minimum_age'); if(!$age) { $age = 13; } $label_tos = sprintf( t('I am over %s years of age and accept the %s for this website'), $age, $toslink); - + } + $enable_tos = 1 - intval(get_config('system','no_termsofservice')); $email = array('email', t('Your email address'), ((x($_REQUEST,'email')) ? strip_tags(trim($_REQUEST['email'])) : "")); @@ -255,6 +260,7 @@ class Register extends \Zotlabs\Web\Controller { $auto_create = (get_config('system','auto_channel_create') ? true : false); $default_role = get_config('system','default_permissions_role'); + $email_verify = get_config('system','verify_email'); require_once('include/bbcode.php'); @@ -278,7 +284,7 @@ class Register extends \Zotlabs\Web\Controller { '$pass1' => $password, '$pass2' => $password2, '$submit' => t('Register'), - '$verify_note' => t('This site may require email verification after submitting this form. If you are returned to a login page, please check your email for instructions.') + '$verify_note' => (($email_verify) ? t('This site requires email verification. After completing this form, please check your email for further instructions.') : ''), )); return $o; diff --git a/include/account.php b/include/account.php index 6c6fdece4..3a7b677be 100644 --- a/include/account.php +++ b/include/account.php @@ -262,24 +262,46 @@ function create_account($arr) { function verify_email_address($arr) { - $hash = random_string(); + if(array_key_exists('resend',$arr)) { + $email = $arr['email']; + $a = q("select * from account where account_email = '%s' limit 1", + dbesc($arr['email']) + } + if(! ($a && ($a[0]['account_flags'] & ACCOUNT_UNVERIFIED))) { + return false; + } + $account = $a[0]; + $v = q("select * from register where uid = %d and password = 'verify' limit 1", + intval($account['account_id']) + ); + if($v) { + $hash = $v[0]['hash']; + } + else { + return false; + } + } + else { + $hash = random_string(24); - $r = q("INSERT INTO register ( hash, created, uid, password, lang ) VALUES ( '%s', '%s', %d, '%s', '%s' ) ", - dbesc($hash), - dbesc(datetime_convert()), - intval($arr['account']['account_id']), - dbesc('verify'), - dbesc($arr['account']['account_language']) - ); + $r = q("INSERT INTO register ( hash, created, uid, password, lang ) VALUES ( '%s', '%s', %d, '%s', '%s' ) ", + dbesc($hash), + dbesc(datetime_convert()), + intval($arr['account']['account_id']), + dbesc('verify'), + dbesc($arr['account']['account_language']) + ); + $account = $arr['account']; + } - push_lang(($arr['account']['account_language']) ? $arr['account']['account_language'] : 'en'); + push_lang(($account['account_language']) ? $account['account_language'] : 'en'); $email_msg = replace_macros(get_intltext_template('register_verify_member.tpl'), [ '$sitename' => get_config('system','sitename'), '$siteurl' => z_root(), '$email' => $arr['email'], - '$uid' => $arr['account']['account_id'], + '$uid' => $account['account_id'], '$hash' => $hash, '$details' => $details ] diff --git a/view/en/register_verify_member.tpl b/view/en/register_verify_member.tpl index 71f0964d4..9bdd7fa51 100644 --- a/view/en/register_verify_member.tpl +++ b/view/en/register_verify_member.tpl @@ -10,7 +10,12 @@ Login with the password you chose at registration. We need to verify your email address in order to give you full access. -If you registered this account, please visit the following link: +Your validation code is + +{{$hash}} + + +If you registered this account, please enter the validation code when requested or visit the following link: {{$siteurl}}/regver/allow/{{$hash}} From 4eead1c688f57bdf04091675fa38c5eed9f6acde Mon Sep 17 00:00:00 2001 From: zotlabs Date: Fri, 26 Jan 2018 13:42:53 -0800 Subject: [PATCH 04/23] typo from previous checkin and partial fix to hubzilla #965 - show any connection without comment permission as archived in contact_block(). --- include/account.php | 2 +- include/text.php | 9 ++++++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/include/account.php b/include/account.php index 3a7b677be..3ac485974 100644 --- a/include/account.php +++ b/include/account.php @@ -266,7 +266,7 @@ function verify_email_address($arr) { $email = $arr['email']; $a = q("select * from account where account_email = '%s' limit 1", dbesc($arr['email']) - } + ); if(! ($a && ($a[0]['account_flags'] & ACCOUNT_UNVERIFIED))) { return false; } diff --git a/include/text.php b/include/text.php index 956f42f7d..8ec6ebace 100644 --- a/include/text.php +++ b/include/text.php @@ -973,7 +973,14 @@ function contact_block() { $contacts = t('Connections'); $micropro = Array(); foreach($r as $rr) { - $rr['archived'] = (intval($rr['abook_archived']) ? true : false); + + // There is no setting to discover if you are bi-directionally connected + // Use the ability to post comments as an indication that this relationship is more + // than wishful thinking; even though soapbox channels and feeds will disable it. + + if(! intval(get_abconfig(App::$profile['uid'],$rr['xchan_hash'],'their_perms','post_comments'))) { + $rr['archived'] = true; + } $micropro[] = micropro($rr,true,'mpfriend'); } } From bd0f63980ba0d0e606f2dd7a65313f7e150d330a Mon Sep 17 00:00:00 2001 From: zotlabs Date: Sat, 27 Jan 2018 12:51:48 -0800 Subject: [PATCH 05/23] Usability improvements to registration/verification workflow. This requires additional testing. --- Zotlabs/Module/Email_resend.php | 48 +++++++++++++++++++++++++++++ Zotlabs/Module/Email_validation.php | 38 +++++++++++++++++++++++ Zotlabs/Module/Register.php | 6 ++-- view/tpl/email_validation.tpl | 16 ++++++++++ 4 files changed, 106 insertions(+), 2 deletions(-) create mode 100644 Zotlabs/Module/Email_resend.php create mode 100644 Zotlabs/Module/Email_validation.php create mode 100644 view/tpl/email_validation.tpl diff --git a/Zotlabs/Module/Email_resend.php b/Zotlabs/Module/Email_resend.php new file mode 100644 index 000000000..367593b55 --- /dev/null +++ b/Zotlabs/Module/Email_resend.php @@ -0,0 +1,48 @@ + 1) { + $result = false; + $email = hex2bin(argv(1)); + + if($email) { + $result = verify_email_address( [ 'resend' => true, 'email' => $email ] ); + } + + if($result) { + notice(t('Email verification resent')); + } + else { + notice(t('Unable to resend email verification message.')); + } + + return; + + } + + // @todo - one can provide a form here to resend the mail + // after directing to here if a succesful login was attempted from an unverified address. + + + } + +} \ No newline at end of file diff --git a/Zotlabs/Module/Email_validation.php b/Zotlabs/Module/Email_validation.php new file mode 100644 index 000000000..4cc016847 --- /dev/null +++ b/Zotlabs/Module/Email_validation.php @@ -0,0 +1,38 @@ + 1) { + $email = hex2bin(argv(1)); + } + + $o = replace_macros(get_markup_template('email_validation.tpl'), [ + '$title' => t('Email Verification Required'), + '$desc' => sprintf( t('A verification token was sent to your email address [%s]. Enter that token here to complete the account verification step. Please allow a few minutes for delivery, and check your spam folder if you do not see the message.'),$email), + '$resend' => t('Resend Email'), + '$email' => bin2hex($email), + '$submit' => t('Submit'), + '$token' => [ 'token', t('Validation token'),'','' ], + ]); + + return $o; + + } + +} \ No newline at end of file diff --git a/Zotlabs/Module/Register.php b/Zotlabs/Module/Register.php index 1cb3bab91..c7fa1cee8 100644 --- a/Zotlabs/Module/Register.php +++ b/Zotlabs/Module/Register.php @@ -150,9 +150,11 @@ class Register extends \Zotlabs\Web\Controller { } if($email_verify) { - goaway(z_root()); + goaway(z_root() . '/email_validation/' . bin2hex($result['email'])); } - + + // fall through and authenticate if no approvals or verifications were required. + authenticate_success($result['account'],null,true,false,true); $new_channel = false; diff --git a/view/tpl/email_validation.tpl b/view/tpl/email_validation.tpl new file mode 100644 index 000000000..f049a040f --- /dev/null +++ b/view/tpl/email_validation.tpl @@ -0,0 +1,16 @@ +

{{$title}}

+ +

{{$desc}}

+ +
+{{include file="field_input.tpl" field=$token}} + +
+ {{$resend}} +
+
+ +
+
+
+ From 2e4e56f7cc696b2c52014f0050294826caa74d7d Mon Sep 17 00:00:00 2001 From: Mario Vavti Date: Sat, 27 Jan 2018 22:23:47 +0100 Subject: [PATCH 06/23] if startpage is /hq redirect all notifications links to /hq and minor notifications and hq fixes --- Zotlabs/Module/Hq.php | 2 + Zotlabs/Widget/Notifications.php | 3 +- boot.php | 2 +- view/js/main.js | 8 +--- view/tpl/hq.tpl | 10 ----- view/tpl/notifications_widget.tpl | 63 +++++++++++++++++-------------- 6 files changed, 42 insertions(+), 46 deletions(-) diff --git a/Zotlabs/Module/Hq.php b/Zotlabs/Module/Hq.php index a9c3bb8e2..c305fdb3b 100644 --- a/Zotlabs/Module/Hq.php +++ b/Zotlabs/Module/Hq.php @@ -29,6 +29,8 @@ class Hq extends \Zotlabs\Web\Controller { ); } + killme(); + } function get($update = 0, $load = false) { diff --git a/Zotlabs/Widget/Notifications.php b/Zotlabs/Widget/Notifications.php index 5a0c1f3d5..322a7b60a 100644 --- a/Zotlabs/Widget/Notifications.php +++ b/Zotlabs/Widget/Notifications.php @@ -145,7 +145,8 @@ class Notifications { '$module' => \App::$module, '$notifications' => $notifications, '$no_notifications' => t('Sorry, you have got no notifications at the moment'), - '$loading' => t('Loading') + '$loading' => t('Loading'), + '$startpage' => get_pconfig(local_channel(), 'system', 'startpage') )); return $o; diff --git a/boot.php b/boot.php index cb682de31..c4c4dbc5b 100755 --- a/boot.php +++ b/boot.php @@ -51,7 +51,7 @@ require_once('include/attach.php'); require_once('include/bbcode.php'); define ( 'PLATFORM_NAME', 'hubzilla' ); -define ( 'STD_VERSION', '3.1.4' ); +define ( 'STD_VERSION', '3.1.5' ); define ( 'ZOT_REVISION', '1.3' ); define ( 'DB_UPDATE_VERSION', 1198 ); diff --git a/view/js/main.js b/view/js/main.js index 13d002968..35f723a58 100644 --- a/view/js/main.js +++ b/view/js/main.js @@ -456,11 +456,7 @@ function handleNotificationsItems(notifyType, data) { notify_menu.append(html); }); - $(".dropdown-menu img[data-src], .notification img[data-src]").each(function(i, el){ - // Replace data-src attribute with src attribute for every image - $(el).attr('src', $(el).data("src")); - $(el).removeAttr("data-src"); - }); + datasrc2src('#notifications .notification img[data-src]'); if($('#tt-' + notifyType + '-only').hasClass('active')) $('#nav-' + notifyType + '-menu [data-thread_top=false]').hide(); @@ -834,7 +830,7 @@ function liveUpdate(notify_id) { // else data was valid - reset the recursion counter liveRecurse = 0; - if(typeof notify_id !== 'undefined') { + if(typeof notify_id !== 'undefined' && notify_id !== 'undefined') { $.post( "hq", { diff --git a/view/tpl/hq.tpl b/view/tpl/hq.tpl index fce11ff83..099d892bb 100755 --- a/view/tpl/hq.tpl +++ b/view/tpl/hq.tpl @@ -1,13 +1,3 @@ -{{if $no_messages}} - -{{/if}}
{{$editor}}
diff --git a/view/tpl/notifications_widget.tpl b/view/tpl/notifications_widget.tpl index 69e5e15bc..e10062aed 100644 --- a/view/tpl/notifications_widget.tpl +++ b/view/tpl/notifications_widget.tpl @@ -21,7 +21,7 @@ }; }); - {{if $module == 'display' || $module == 'hq'}} + {{if $module == 'display' || $module == 'hq' || $startpage == 'hq'}} $(document).on('click', '.notification', function(e) { var b64mid = $(this).data('b64mid'); var notify_id = $(this).data('notify_id'); @@ -31,30 +31,37 @@ if(b64mid === 'undefined' && notify_id === 'undefined') return; - {{if $module == 'display'}} - history.pushState(stateObj, '', 'display/' + b64mid); - {{/if}} - {{if $module == 'hq'}} - history.pushState(stateObj, '', 'hq/' + b64mid); - {{/if}} - - {{if $module == 'hq'}} - if(b64mid !== 'undefined') { - {{else}} - if(path === 'display' && b64mid) { - {{/if}} + {{if $module != 'hq' && $startpage == 'hq'}} e.preventDefault(); + window.location.href = 'hq/' + b64mid; + return; + {{else}} + {{if $module == 'display'}} + history.pushState(stateObj, '', 'display/' + b64mid); + {{/if}} - if(! page_load) { - if($(this).parent().attr('id') !== 'nav-pubs-menu') - $(this).fadeOut(); + {{if $module == 'hq'}} + history.pushState(stateObj, '', 'hq/' + b64mid); + {{/if}} - getData(b64mid, notify_id); + {{if $module == 'hq'}} + if(b64mid !== 'undefined') { + {{else}} + if(path === 'display' && b64mid) { + {{/if}} + e.preventDefault(); + + if(! page_load) { + if($(this).parent().attr('id') !== 'nav-pubs-menu') + $(this).fadeOut(); + + getData(b64mid, notify_id); + } + + if($('#notifications_wrapper').hasClass('fs')) + $('#notifications_wrapper').prependTo('#' + notifications_parent).removeClass('fs'); } - - if($('#notifications_wrapper').hasClass('fs')) - $('#notifications_wrapper').prependTo('#' + notifications_parent).removeClass('fs'); - } + {{/if}} }); {{/if}} @@ -115,14 +122,14 @@
{{$no_notifications}}...
-