mirror of
https://framagit.org/hubzilla/core.git
synced 2026-06-21 00:52:33 -04:00
104 lines
2.5 KiB
PHP
104 lines
2.5 KiB
PHP
<?php
|
|
|
|
namespace Zotlabs\Module;
|
|
|
|
use App;
|
|
use Zotlabs\Web\Controller;
|
|
use Zotlabs\Lib\Activity;
|
|
use Zotlabs\Lib\ActivityStreams;
|
|
use Zotlabs\Lib\Config;
|
|
use Zotlabs\Web\HTTPSig;
|
|
|
|
require_once('include/security.php');
|
|
require_once('include/attach.php');
|
|
require_once('include/photo/photo_driver.php');
|
|
require_once('include/photos.php');
|
|
|
|
|
|
class Album extends Controller {
|
|
|
|
function init() {
|
|
|
|
if (ActivityStreams::is_as_request()) {
|
|
$sigdata = HTTPSig::verify(EMPTY_STR);
|
|
if ($sigdata['portable_id'] && $sigdata['header_valid']) {
|
|
$portable_id = $sigdata['portable_id'];
|
|
if (!check_channelallowed($portable_id)) {
|
|
http_status_exit(403, 'Permission denied');
|
|
}
|
|
if (!check_siteallowed($sigdata['signer'])) {
|
|
http_status_exit(403, 'Permission denied');
|
|
}
|
|
observer_auth($portable_id);
|
|
}
|
|
elseif (Config::get('system', 'require_authenticated_fetch', false)) {
|
|
http_status_exit(403, 'Permission denied');
|
|
}
|
|
|
|
$observer_xchan = get_observer_hash();
|
|
$allowed = false;
|
|
|
|
$bear = Activity::token_from_request();
|
|
if ($bear) {
|
|
logger('bear: ' . $bear, LOGGER_DEBUG);
|
|
}
|
|
|
|
$channel = null;
|
|
|
|
if (argc() > 1) {
|
|
$channel = channelx_by_nick(argv(1));
|
|
}
|
|
if (!$channel) {
|
|
http_status_exit(404, 'Not found.');
|
|
}
|
|
|
|
$sql_extra = permissions_sql($channel['channel_id'], $observer_xchan);
|
|
|
|
if (argc() > 2) {
|
|
$folder = argv(2);
|
|
$r = q("select * from attach where is_dir = 1 and hash = '%s' and uid = %d $sql_extra limit 1",
|
|
dbesc($folder),
|
|
intval($channel['channel_id'])
|
|
);
|
|
$allowed = (($r) ? attach_can_view($channel['channel_id'], $observer_xchan, $r[0]['hash'] /*,$bear */) : false);
|
|
}
|
|
else {
|
|
$folder = EMPTY_STR;
|
|
$allowed = perm_is_allowed($channel['channel_id'], $observer_xchan, 'view_storage');
|
|
}
|
|
|
|
if (!$allowed) {
|
|
http_status_exit(403, 'Permission denied.');
|
|
}
|
|
|
|
$x = q("select * from attach where folder = '%s' and uid = %d $sql_extra",
|
|
dbesc($folder),
|
|
intval($channel['channel_id'])
|
|
);
|
|
|
|
$contents = [];
|
|
|
|
if ($x) {
|
|
foreach ($x as $xv) {
|
|
if (intval($xv['is_dir'])) {
|
|
continue;
|
|
}
|
|
if (!attach_can_view($channel['channel_id'], $observer_xchan, $xv['hash'] /*,$bear*/)) {
|
|
continue;
|
|
}
|
|
if (intval($xv['is_photo'])) {
|
|
$contents[] = z_root() . '/photo/' . $xv['hash'];
|
|
}
|
|
}
|
|
}
|
|
|
|
$obj = Activity::encode_simple_collection($contents, App::$query_string, 'OrderedCollection', count($contents));
|
|
as_return_and_die($obj, $channel);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|