From bf252d238888480cdadd1df8ced2928831d48e64 Mon Sep 17 00:00:00 2001
From: Waitman Gobble <waitman@waitman.net>
Date: Mon, 18 Sep 2017 05:54:38 -0500
Subject: [PATCH 1/5] add remote login to login form

This exists in nav login but not login.tpl
---
 view/tpl/login.tpl | 1 +
 1 file changed, 1 insertion(+)

diff --git a/view/tpl/login.tpl b/view/tpl/login.tpl
index 3d3faa41c..5e6d48eb0 100755
--- a/view/tpl/login.tpl
+++ b/view/tpl/login.tpl
@@ -6,6 +6,7 @@
 			{{include file="field_password.tpl" field=$lpassword}}
 			{{include file="field_checkbox.tpl" field=$remember_me}}
 			<button type="submit" name="submit" class="btn btn-block btn-primary">{{$login}}</button>
+			<a href="rmagic" class="btn btn-block btn-success rmagic-button">{{$remote_login}}</a>
 		</div>
 		<div id="login-extra-links">
 			{{if $register}}<a href="{{$register.link}}" title="{{$register.title}}" id="register-link" class="pull-right">{{$register.desc}}</a>{{/if}}

From d31c91c9d37a58642c767e2b3deb7ba6442ea7bf Mon Sep 17 00:00:00 2001
From: Waitman Gobble <waitman@waitman.net>
Date: Mon, 18 Sep 2017 05:57:18 -0500
Subject: [PATCH 2/5] add remote login to login.tpl

Add Remote login option to login.tpl, this exists in nav login.
---
 boot.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/boot.php b/boot.php
index 2b290862b..fd3155528 100755
--- a/boot.php
+++ b/boot.php
@@ -1605,6 +1605,7 @@ function login($register = false, $form_id = 'main-login', $hiddens=false, $logi
 		'$login_page'   => $login_page,
 		'$logout'       => t('Logout'),
 		'$login'        => t('Login'),
+		'$remote_login' => t('Remote Authentication'),
 		'$form_id'      => $form_id,
 		'$lname'        => array('username', t('Login/Email') , '', ''),
 		'$lpassword'    => array('password', t('Password'), '', ''),

From b3c805d7d0f62cf322de21f09ba066b418d8712d Mon Sep 17 00:00:00 2001
From: Waitman Gobble <waitman@waitman.net>
Date: Mon, 18 Sep 2017 06:02:14 -0500
Subject: [PATCH 3/5] prevent 'my_address' being set with bogus info

After a user has authenticated, it is possible to set my_address in $_SESSION to 'anything' using zid= parameter in URL - if user is authenticated then zid is never set. This change kills the authenticated switch if a person sends a new zid through for processing, which will trigger remote authentication.
---
 Zotlabs/Web/WebServer.php | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/Zotlabs/Web/WebServer.php b/Zotlabs/Web/WebServer.php
index 8431a2e0e..d517eda49 100644
--- a/Zotlabs/Web/WebServer.php
+++ b/Zotlabs/Web/WebServer.php
@@ -58,7 +58,11 @@ class WebServer {
 		if((x($_GET,'zid')) && (! \App::$install)) {
 			\App::$query_string = strip_zids(\App::$query_string);
 			if(! local_channel()) {
-				$_SESSION['my_address'] = $_GET['zid'];
+                                if ($_SESSION['my_address']!=$_GET['zid'])
+                                {
+                                        $_SESSION['my_address'] = $_GET['zid'];
+                                        $_SESSION['authenticated'] = 0;
+                                }
 				zid_init();
 			}
 		}

From 617f2863c47ba306e8d866ea76f7120ae4465427 Mon Sep 17 00:00:00 2001
From: zotlabs <mike@macgirvin.com>
Date: Wed, 27 Sep 2017 21:13:53 -0700
Subject: [PATCH 4/5] process activity deletes from OStatus which for whatever
 reason do not use the industry standard tombstone mechanism

---
 boot.php              |  1 +
 include/feedutils.php | 95 ++++++++++++++++++++++++++-----------------
 2 files changed, 59 insertions(+), 37 deletions(-)

diff --git a/boot.php b/boot.php
index ce3218cd7..0eae3ad20 100755
--- a/boot.php
+++ b/boot.php
@@ -497,6 +497,7 @@ define ( 'ACTIVITY_TAG',         NAMESPACE_ACTIVITY_SCHEMA . 'tag' );
 define ( 'ACTIVITY_SHARE',       NAMESPACE_ACTIVITY_SCHEMA . 'share' );
 define ( 'ACTIVITY_FAVORITE',    NAMESPACE_ACTIVITY_SCHEMA . 'favorite' );
 define ( 'ACTIVITY_CREATE',      NAMESPACE_ACTIVITY_SCHEMA . 'create' );
+define ( 'ACTIVITY_DELETE',      NAMESPACE_ACTIVITY_SCHEMA . 'delete' );
 define ( 'ACTIVITY_WIN',         NAMESPACE_ACTIVITY_SCHEMA . 'win' );
 define ( 'ACTIVITY_LOSE',        NAMESPACE_ACTIVITY_SCHEMA . 'lose' );
 define ( 'ACTIVITY_TIE',         NAMESPACE_ACTIVITY_SCHEMA . 'tie' );
diff --git a/include/feedutils.php b/include/feedutils.php
index 451946114..217da8188 100644
--- a/include/feedutils.php
+++ b/include/feedutils.php
@@ -900,6 +900,41 @@ function encode_rel_links($links) {
 	return $o;
 }
 
+
+function process_feed_tombstones($feed,$importer,$contact,$pass) {
+
+	$arr_deleted = [];
+
+	$del_entries = $feed->get_feed_tags(NAMESPACE_TOMB, 'deleted-entry');
+	if(is_array($del_entries) && count($del_entries) && $pass != 2) {
+		foreach($del_entries as $dentry) {
+			if(isset($dentry['attribs']['']['ref'])) {
+				$arr_deleted[] = normalise_id($dentry['attribs']['']['ref']);
+			}
+		}
+	}
+
+	if($arr_deleted && is_array($contact)) {
+		foreach($arr_deleted as $mid) {
+			$r = q("SELECT * from item where mid = '%s' and author_xchan = '%s' and uid = %d limit 1",
+				dbesc($mid),
+				dbesc($contact['xchan_hash']),
+				intval($importer['channel_id'])
+			);
+
+			if($r) {
+				$item = $r[0];
+
+				if(! intval($item['item_deleted'])) {
+					logger('deleting item ' . $item['id'] . ' mid=' . $item['mid'], LOGGER_DEBUG);
+					drop_item($item['id'],false);
+				}
+			}
+		}
+	}
+}
+
+
 /**
  * @brief Process atom feed and update anything/everything we might need to update.
  *
@@ -955,43 +990,11 @@ function consume_feed($xml, $importer, &$contact, $pass = 0) {
 
 	$permalink = $feed->get_permalink();
 
-	// Check at the feed level for updated contact name and/or photo
 
-	// process any deleted entries
+	// Check at the feed level for tombstones
 
-	$del_entries = $feed->get_feed_tags(NAMESPACE_TOMB, 'deleted-entry');
-	if(is_array($del_entries) && count($del_entries) && $pass != 2) {
-		foreach($del_entries as $dentry) {
-			$deleted = false;
-			if(isset($dentry['attribs']['']['ref'])) {
-				$mid = normalise_id($dentry['attribs']['']['ref']);
-				$deleted = true;
-				if(isset($dentry['attribs']['']['when'])) {
-					$when = $dentry['attribs']['']['when'];
-					$when = datetime_convert('UTC','UTC', $when, 'Y-m-d H:i:s');
-				}
-				else
-					$when = datetime_convert('UTC','UTC','now','Y-m-d H:i:s');
-			}
+	process_feed_tombstones($feed,$importer,$contact,$pass);
 
-			if($deleted && is_array($contact)) {
-				$r = q("SELECT * from item where mid = '%s' and author_xchan = '%s' and uid = %d limit 1",
-					dbesc($mid),
-					dbesc($contact['xchan_hash']),
-					intval($importer['channel_id'])
-				);
-
-				if($r) {
-					$item = $r[0];
-
-					if(! intval($item['item_deleted'])) {
-						logger('deleting item ' . $item['id'] . ' mid=' . $item['mid'], LOGGER_DEBUG);
-						drop_item($item['id'],false);
-					}
-				}
-			}
-		}
-	}
 
 	// Now process the feed
 
@@ -1033,6 +1036,7 @@ function consume_feed($xml, $importer, &$contact, $pass = 0) {
 				if(! $datarray['mid'])
 					continue;
 
+
 				$item_parent_mid = q("select parent_mid from item where mid = '%s' and uid = %d limit 1",
 					dbesc($parent_mid),
 					intval($importer['channel_id'])
@@ -1090,7 +1094,7 @@ function consume_feed($xml, $importer, &$contact, $pass = 0) {
 
 				$datarray['owner_xchan'] = $contact['xchan_hash'];
 
-				$r = q("SELECT id, edited FROM item WHERE mid = '%s' AND uid = %d LIMIT 1",
+				$r = q("SELECT id, edited, author_xchan, item_deleted FROM item WHERE mid = '%s' AND uid = %d LIMIT 1",
 					dbesc($datarray['mid']),
 					intval($importer['channel_id'])
 				);
@@ -1099,6 +1103,15 @@ function consume_feed($xml, $importer, &$contact, $pass = 0) {
 				// Update content if 'updated' changes
 
 				if($r) {
+					if(activity_match($datarray['verb'],ACTIVITY_DELETE) 
+						&& $datarray['author_xchan'] === $r[0]['author_xchan']) {
+						if(! intval($r[0]['item_deleted'])) {
+							logger('deleting item ' . $r[0]['id'] . ' mid=' . $datarray['mid'], LOGGER_DEBUG);
+							drop_item($r[0]['id'],false);
+						}
+						continue;
+					}
+
 					if((x($datarray,'edited') !== false)
 						&& (datetime_convert('UTC','UTC',$datarray['edited']) !== $r[0]['edited'])) {
 
@@ -1343,8 +1356,7 @@ function consume_feed($xml, $importer, &$contact, $pass = 0) {
 					}
 				}
 
-
-				$r = q("SELECT id, edited FROM item WHERE mid = '%s' AND uid = %d LIMIT 1",
+				$r = q("SELECT id, edited, author_xchan, item_deleted FROM item WHERE mid = '%s' AND uid = %d LIMIT 1",
 					dbesc($datarray['mid']),
 					intval($importer['channel_id'])
 				);
@@ -1352,6 +1364,15 @@ function consume_feed($xml, $importer, &$contact, $pass = 0) {
 				// Update content if 'updated' changes
 
 				if($r) {
+					if(activity_match($datarray['verb'],ACTIVITY_DELETE) 
+						&& $datarray['author_xchan'] === $r[0]['author_xchan']) {
+						if(! intval($r[0]['item_deleted'])) {
+							logger('deleting item ' . $r[0]['id'] . ' mid=' . $datarray['mid'], LOGGER_DEBUG);
+							drop_item($r[0]['id'],false);
+						}
+						continue;
+					}
+
 					if((x($datarray,'edited') !== false)
 						&& (datetime_convert('UTC','UTC',$datarray['edited']) !== $r[0]['edited'])) {
 

From bdecb61bfa170412c7db513e6b58a13d0b0930f3 Mon Sep 17 00:00:00 2001
From: Mario Vavti <mario@mariovavti.com>
Date: Thu, 28 Sep 2017 11:31:36 +0200
Subject: [PATCH 5/5] remove double remote login button and slightly change
 appearence

---
 view/tpl/login.tpl     | 3 ++-
 view/tpl/nav_login.tpl | 1 -
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/view/tpl/login.tpl b/view/tpl/login.tpl
index 5e6d48eb0..492149abb 100755
--- a/view/tpl/login.tpl
+++ b/view/tpl/login.tpl
@@ -6,12 +6,13 @@
 			{{include file="field_password.tpl" field=$lpassword}}
 			{{include file="field_checkbox.tpl" field=$remember_me}}
 			<button type="submit" name="submit" class="btn btn-block btn-primary">{{$login}}</button>
-			<a href="rmagic" class="btn btn-block btn-success rmagic-button">{{$remote_login}}</a>
 		</div>
 		<div id="login-extra-links">
 			{{if $register}}<a href="{{$register.link}}" title="{{$register.title}}" id="register-link" class="pull-right">{{$register.desc}}</a>{{/if}}
 			<a href="lostpass" title="{{$lostpass}}" id="lost-password-link" >{{$lostlink}}</a>
 		</div>
+		<hr>
+		<a href="rmagic" class="btn btn-block btn-outline-success rmagic-button">{{$remote_login}}</a>
 	</div>
 	{{foreach $hiddens as $k=>$v}}
 		<input type="hidden" name="{{$k}}" value="{{$v}}" />
diff --git a/view/tpl/nav_login.tpl b/view/tpl/nav_login.tpl
index b361b1a14..4a94908f0 100644
--- a/view/tpl/nav_login.tpl
+++ b/view/tpl/nav_login.tpl
@@ -9,7 +9,6 @@
 			<div class="modal-body">
 				<div class="form-group">
 					{{$nav.login}}
-					{{$nav.remote_login}}
 				</div>
 			</div>
 		</div>