Select your identity
9 |10 | You may log in to {{client_id}} with any identity you like. 11 |
12 | 13 | 52 | 53 | 54 | -------------------------------------------------------------------------------- /data/templates/auth-index.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 |IndieAuth endpoint
8 |9 | This is an anonymous authentication and authorization 10 | endpoint for the IndieAuth protocol. 11 |
12 |13 | When asked about your website on an IndieAuth login screen, 14 | simply type: 15 |
16 |{{baseurl}}
17 |
18 |
19 |
--------------------------------------------------------------------------------
/data/templates/index.htm:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | {{title}}
14 |15 | Anonymous web comments for the indieweb. 16 |
17 | 18 | 19 |Write a comment
20 |21 | Write a reply to a blog post: 22 |
23 | 33 | 34 | 35 |IndieAuth endpoint
36 |37 | This is an anonymous authentication and authorization 38 | endpoint for the IndieAuth protocol. 39 |
40 |41 | When asked about your website on an IndieAuth login screen, 42 | simply type: 43 |
44 |{{baseurl}}
45 |
46 |
47 | Misc
48 |49 | anoweco is open source. 50 | You may view the 51 | latest posts. 52 |
53 | 54 | 55 | -------------------------------------------------------------------------------- /data/templates/latest-atom.htm: -------------------------------------------------------------------------------- 1 | 2 |Latest comments
12 || Date | 16 |Type | 17 |User | 18 |For domain | 19 |
|---|---|---|---|
| {{comment.comment_published}} | 25 |{{comment.comment_type}} | 26 |{{comment.user.user_name}} | 27 |{{comment.domain}} | 28 |
Like #{{crow.comment_id}}
10 |
11 | {% apply spaceless %}
12 |
13 |
14 | {{author.name}}
15 | {% endapply %}
16 | likes
17 | {{attribute(json, 'like-of').0}}.
19 |
Comment #{{crow.comment_id}}
10 |
11 | {% apply spaceless %}
12 |
13 |
14 | {{author.name}}
15 | {% endapply %}
16 | wrote
17 | the following reply to
18 | :
20 |
{{htmlContent|raw}}
22 | 23 | Reply to this comment 24 |
25 | 26 | 27 | -------------------------------------------------------------------------------- /data/templates/user.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 |{{name}}
12 |
13 | 
14 |
15 |
16 |
17 |
--------------------------------------------------------------------------------
/scripts/dump-schema.sh:
--------------------------------------------------------------------------------
1 | #!/bin/sh
2 | # update data/schema.sql
3 | cd "`dirname "$0"`"
4 | mysqldump\
5 | --skip-add-locks\
6 | --skip-disable-keys\
7 | --skip-add-drop-table\
8 | --no-data\
9 | -uanoweco -panoweco\
10 | anoweco\
11 | | grep -v '^/\\*'\
12 | | grep -v '^--'\
13 | | sed 's/AUTO_INCREMENT=[0-9]* //'\
14 | > ../data/schema.sql
15 |
--------------------------------------------------------------------------------
/src/anoweco/Linkback.php:
--------------------------------------------------------------------------------
1 | lbc = new \PEAR2\Services\Linkback\Client();
11 | $req = $this->lbc->getRequest();
12 | /*
13 | $req->setConfig(
14 | array(
15 | 'ssl_verify_peer' => false,
16 | 'ssl_verify_host' => false
17 | )
18 | );
19 | */
20 | $headers = $req->getHeaders();
21 | $req->setHeader('user-agent', 'anoweco');
22 | $this->lbc->setRequestTemplate($req);
23 | }
24 |
25 | public function ping($postId)
26 | {
27 | $this->initLbc();
28 | $storage = new Storage();
29 | $rowPost = $storage->getJsonComment($postId)->Xrow;
30 |
31 | $from = Urls::full(Urls::comment($postId));
32 | $to = $rowPost->comment_of_url;
33 |
34 | try {
35 | $res = $this->lbc->send($from, $to);
36 | if (!$res->isError()) {
37 | //all ok
38 | $error = false;
39 | } else {
40 | //some error
41 | error_log($res->getMessage());
42 | $error = true;
43 | }
44 | } catch (\Exception $e) {
45 | error_log($e->getMessage());
46 | $error = true;
47 | }
48 |
49 | if ($error) {
50 | $pingState = intval($rowPost->comment_pingstate) + 1;
51 | } else {
52 | $pingState = 'ok';
53 | }
54 | $storage->setPostPingState($postId, $pingState);
55 | }
56 | }
57 | ?>
58 |
--------------------------------------------------------------------------------
/src/anoweco/Storage.php:
--------------------------------------------------------------------------------
1 | db = new \PDO($dbdsn, $dbuser, $dbpass);
10 | $this->db->setAttribute(\PDO::ATTR_ERRMODE, \PDO::ERRMODE_EXCEPTION);
11 | }
12 |
13 | /**
14 | * Store a new comment into the database
15 | *
16 | * @param object $json Micropub create JSON
17 | * @param integer $userId ID of the user whom this comment belongs
18 | *
19 | * @return integer Comment ID
20 | * @throws \Exception
21 | */
22 | public function addComment($json, $userId)
23 | {
24 | $stmt = $this->db->prepare(
25 | 'INSERT INTO comments SET'
26 | . ' comment_user_id = :userId'
27 | . ', comment_published = NOW()'
28 | . ', comment_of_url = :ofUrl'
29 | . ', comment_type = :type'
30 | . ', comment_json = :json'
31 | . ', comment_pingstate = "0"'
32 | );
33 |
34 | $ofUrl = '';
35 | $type = null;
36 | if (isset($json->properties->{'in-reply-to'})) {
37 | $ofUrl = reset($json->properties->{'in-reply-to'});
38 | $type = 'reply';
39 | } else if (isset($json->properties->{'like-of'})) {
40 | $ofUrl = reset($json->properties->{'like-of'});
41 | $type = 'like';
42 | } else {
43 | throw new \Exception(
44 | 'Invalid post type, only reply and like allowed',
45 | 400
46 | );
47 | }
48 |
49 | $stmt->execute(
50 | array(
51 | ':userId' => $userId,
52 | ':ofUrl' => $ofUrl,
53 | ':type' => $type,
54 | ':json' => json_encode($json),
55 | )
56 | );
57 | return $this->db->lastInsertId();
58 | }
59 |
60 | /**
61 | * @return null|object NULL if not found, JSON comment object otherwise
62 | * - "Xrow" property contains the database row object
63 | * - "user" property contains the user db row object
64 | */
65 | public function getJsonComment($id)
66 | {
67 | $stmt = $this->db->prepare(
68 | 'SELECT * FROM comments WHERE comment_id = ?'
69 | );
70 | $stmt->execute([$id]);
71 | $row = $stmt->fetchObject();
72 |
73 | if ($row === false) {
74 | return null;
75 | }
76 |
77 | $json = json_decode($row->comment_json);
78 | $json->Xrow = $row;
79 | //FIXME: load user
80 |
81 | $stmt = $this->db->prepare('SELECT * FROM users WHERE user_id = ?');
82 | $stmt->execute([$row->comment_user_id]);
83 | $rowUser = $stmt->fetchObject();
84 | if ($rowUser === false) {
85 | $rowUser = (object) array(
86 | 'user_id' => 0,
87 | 'user_name' => 'Anonymous',
88 | 'user_imageurl' => '',
89 | );
90 | }
91 |
92 | $json->user = $rowUser;
93 | return $json;
94 | }
95 |
96 | /**
97 | * @return null|object NULL if not found, JSON comment object otherwise
98 | * - "Xrow" property contains the database row object
99 | * - "user" property contains the user db row object
100 | */
101 | public function listLatest()
102 | {
103 | $stmt = $this->db->prepare(
104 | 'SELECT comment_id, comment_user_id, comment_published'
105 | . ', comment_of_url, comment_type'
106 | . ' FROM comments'
107 | . ' ORDER BY comment_published DESC'
108 | . ' LIMIT 20'
109 | );
110 | $stmt->execute();
111 | $rows = $stmt->fetchAll(\PDO::FETCH_OBJ);
112 | if (!count($rows)) {
113 | return [];
114 | }
115 | $userIds = array_values(
116 | array_unique(array_column($rows, 'comment_user_id'))
117 | );
118 |
119 |
120 | $placeholders = implode(',', array_fill(0, count($userIds), '?'));
121 | $stmt = $this->db->prepare(
122 | 'SELECT * FROM users WHERE user_id IN (' . $placeholders . ')'
123 | );
124 | $stmt->execute($userIds);
125 |
126 | $users = $stmt->fetchAll(\PDO::FETCH_OBJ);
127 | $users = array_combine(
128 | array_column($users, 'user_id'),
129 | $users
130 | );
131 |
132 | foreach ($rows as $row) {
133 | $row->user = $users[$row->comment_user_id];
134 | }
135 |
136 | return $rows;
137 | }
138 |
139 | /**
140 | * @return null|object NULL if not found, user database row otherwise
141 | */
142 | public function getUser($id)
143 | {
144 | $stmt = $this->db->prepare(
145 | 'SELECT * FROM users WHERE user_id = ?'
146 | );
147 | $stmt->execute([$id]);
148 | $row = $stmt->fetchObject();
149 |
150 | if ($row === false) {
151 | return null;
152 | }
153 | return $row;
154 | }
155 |
156 | public function findUser($name, $imageurl)
157 | {
158 | $stmt = $this->db->prepare(
159 | 'SELECT user_id FROM users'
160 | . ' WHERE user_name = ? AND user_imageurl = ?'
161 | );
162 | $stmt->execute([$name, $imageurl]);
163 | $row = $stmt->fetchObject();
164 |
165 | if ($row === false) {
166 | return null;
167 | }
168 | return $row->user_id;
169 | }
170 |
171 | public function createUser($name, $imageurl)
172 | {
173 | $stmt = $this->db->prepare(
174 | 'INSERT INTO users SET'
175 | . ' user_name = :name'
176 | . ', user_imageurl = :imageurl'
177 | );
178 | $stmt->execute(
179 | array(
180 | ':name' => $name,
181 | ':imageurl' => $imageurl,
182 | )
183 | );
184 | return $this->db->lastInsertId();
185 | }
186 |
187 | public function setPostPingState($postId, $pingstate)
188 | {
189 | $stmt = $this->db->prepare(
190 | 'UPDATE comments SET comment_pingstate = ? WHERE comment_id = ?'
191 | );
192 | $stmt->execute(array($pingstate, $postId));
193 | }
194 | }
195 | ?>
196 |
--------------------------------------------------------------------------------
/src/anoweco/Urls.php:
--------------------------------------------------------------------------------
1 | user_imageurl != '') {
19 | return $rowUser->user_imageurl;
20 | }
21 | return static::full('/img/anonymous.svg');
22 | }
23 |
24 | public static function full($str)
25 | {
26 | if (!isset($_SERVER['REQUEST_SCHEME'])) {
27 | $_SERVER['REQUEST_SCHEME'] = 'http';
28 | }
29 | return $_SERVER['REQUEST_SCHEME'] . '://'
30 | . $_SERVER['HTTP_HOST']
31 | . $str;
32 | }
33 |
34 | public static function userId($url)
35 | {
36 | $userbaseurl = Urls::full('/user/');
37 | if (substr($url, 0, strlen($userbaseurl)) != $userbaseurl) {
38 | return null;
39 | }
40 | //actual user URL - loads his data
41 | $userId = substr($url, strrpos($url, '/') + 1, -4);
42 | if (intval($userId) != $userId) {
43 | return null;
44 | }
45 | return intval($userId);
46 | }
47 |
48 | public static function reply($url)
49 | {
50 | return 'https://quill.p3k.io/'
51 | . '?' . http_build_query(
52 | [
53 | 'dontask' => 1,
54 | 'me' => Urls::full('/'),
55 | 'reply' => $url,
56 | ]
57 | );
58 | }
59 | }
60 | ?>
61 |
--------------------------------------------------------------------------------
/src/anoweco/autoload.php:
--------------------------------------------------------------------------------
1 |
6 | */
7 | if (file_exists(__DIR__ . '/../../lib/PEAR.php')) {
8 | //phing-installed dependencies available ("phing collectdeps")
9 | set_include_path(
10 | __DIR__ . '/../'
11 | . PATH_SEPARATOR . __DIR__ . '/../../lib/'
12 | . PATH_SEPARATOR . '.'
13 | );
14 | } else if (file_exists(__DIR__ . '/../../lib/autoload.php')) {
15 | //composer-installed dependencies available
16 | set_include_path(
17 | __DIR__ . '/../'
18 | . PATH_SEPARATOR . '.'
19 | );
20 | require_once __DIR__ . '/../../lib/autoload.php';
21 | } else {
22 | //use default include path for dependencies
23 | set_include_path(
24 | __DIR__ . '/../'
25 | . PATH_SEPARATOR . get_include_path()
26 | );
27 | }
28 |
29 | require_once __DIR__ . '/../../vendor/autoload.php';
30 | spl_autoload_register(
31 | function ($class) {
32 | $file = str_replace(array('\\', '_'), '/', $class) . '.php';
33 | if (stream_resolve_include_path($file)) {
34 | require $file;
35 | }
36 | }
37 | );
38 | ?>
39 |
--------------------------------------------------------------------------------
/www/.htaccess:
--------------------------------------------------------------------------------
1 | # PHP does not see the "Authorization" header by default
2 | # so we have to manually pass it to PHP
3 | SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
4 |
5 | RewriteEngine On
6 | RewriteBase /
7 | RewriteCond %{REQUEST_FILENAME} !-f
8 | RewriteCond %{REQUEST_FILENAME} !-d
9 | RewriteRule ^comment/([0-9]+).htm$ comment.php?id=$1
10 | RewriteRule ^user/([0-9]+).htm$ user.php?id=$1
11 |
--------------------------------------------------------------------------------
/www/auth.php:
--------------------------------------------------------------------------------
1 |
7 | */
8 | header('HTTP/1.0 500 Internal Server Error');
9 | require 'www-header.php';
10 |
11 | function getOrCreateUser($mode, $name, $imageurl, $email)
12 | {
13 | if ($mode == 'anonymous') {
14 | $name = 'Anonymous';
15 | $email = '';
16 | $imageurl = '';
17 | } else {
18 | if ($name == '') {
19 | $name = 'Anonymous';
20 | }
21 | }
22 | if ($imageurl == '') {
23 | $imageurl = getImageUrl($email);
24 | }
25 |
26 | $storage = new Storage();
27 | $id = $storage->findUser($name, $imageurl);
28 | if ($id !== null) {
29 | return $id;
30 | }
31 | $id = $storage->createUser($name, $imageurl);
32 | return $id;
33 | }
34 |
35 | function getImageUrl($email)
36 | {
37 | //FIXME: libravatar
38 | return Urls::userImg((object)['user_imageurl' => '']);
39 | }
40 |
41 | header('IndieAuth: authorization_endpoint');
42 | if ($_SERVER['REQUEST_METHOD'] == 'GET') {
43 | if (count($_GET) == 0) {
44 | //no parameters - show the index page
45 | header('HTTP/1.0 200 OK');
46 | header('Content-Type: text/html');
47 | render('auth-index', ['baseurl' => Urls::full('/')]);
48 | exit();
49 | }
50 |
51 | $me = verifyUrlParameter($_GET, 'me');
52 | $redirect_uri = verifyUrlParameter($_GET, 'redirect_uri');
53 | $client_id = verifyUrlParameter($_GET, 'client_id');
54 | $state = getOptionalParameter($_GET, 'state', null);
55 | $response_type = getOptionalParameter($_GET, 'response_type', 'id');
56 | $scope = getOptionalParameter($_GET, 'scope', null);
57 |
58 | $id = array(
59 | 'mode' => 'anonymous',
60 | 'name' => '',
61 | 'imageurl' => '',
62 | );
63 | $userId = Urls::userId($me);
64 | if ($userId !== null) {
65 | $storage = new Storage();
66 | $rowUser = $storage->getUser($userId);
67 | if ($rowUser !== null) {
68 | $id['mode'] = 'data';
69 | $id['name'] = $rowUser->user_name;
70 | $id['imageurl'] = $rowUser->user_imageurl;
71 | if ($id['imageurl'] == Urls::userImg()) {
72 | $id['imageurl'] = '';
73 | }
74 | }
75 | }
76 |
77 | //let the user choose his identity
78 | header('HTTP/1.0 200 OK');
79 | render(
80 | 'auth-choose',
81 | array(
82 | 'auth' => array(
83 | 'redirect_uri' => $redirect_uri,
84 | 'client_id' => $client_id,
85 | 'state' => $state,
86 | 'response_type' => $response_type,
87 | 'scope' => $scope,
88 | ),
89 | 'id' => $id,
90 | 'formaction' => '/auth.php?action=login',
91 | )
92 | );
93 | exit();
94 | } else if ($_SERVER['REQUEST_METHOD'] == 'POST') {
95 | if (isset($_GET['action']) && $_GET['action'] == 'login') {
96 | //log the user in
97 | $auth = $_POST['auth'];
98 | $redirect_uri = verifyUrlParameter($auth, 'redirect_uri');
99 | $client_id = verifyUrlParameter($auth, 'client_id');
100 | $state = getOptionalParameter($auth, 'state', null);
101 | $response_type = getOptionalParameter($auth, 'response_type', 'id');
102 | $scope = getOptionalParameter($auth, 'scope', null);
103 |
104 | $id = $_POST['id'];
105 | verifyParameter($id, 'mode');
106 |
107 | $userId = getOrCreateUser(
108 | $id['mode'], trim($id['name']), trim($id['imageurl']),
109 | trim($id['email'])
110 | );
111 | $me = Urls::full(Urls::user($userId));
112 |
113 | $code = base64_encode(
114 | http_build_query(
115 | [
116 | 'emoji' => '\360\237\222\251',
117 | 'me' => $me,
118 | 'scope' => $scope,
119 | 'signature' => 'FIXME',
120 | ]
121 | )
122 | );
123 |
124 | //redirect back to client
125 | $url = new \Net_URL2($redirect_uri);
126 | $url->setQueryVariable('code', $code);
127 | $url->setQueryVariable('me', $me);
128 | $url->setQueryVariable('state', $state);
129 | header('Location: ' . $url->getURL());
130 | exit();
131 | } else {
132 | //auth code verification
133 | $code = base64_decode(verifyParameter($_POST, 'code'));
134 | $redirect_uri = verifyUrlParameter($_POST, 'redirect_uri');
135 | $client_id = verifyUrlParameter($_POST, 'client_id');
136 | $state = getOptionalParameter($_POST, 'state', null);
137 |
138 | parse_str($code, $codeParts);
139 | $emoji = verifyParameter($codeParts, 'emoji');
140 | $signature = verifyParameter($codeParts, 'signature');
141 | $me = verifyUrlParameter($codeParts, 'me');
142 | if ($emoji != '\360\237\222\251') {
143 | error('Dog poo missing');
144 | }
145 | if ($signature != 'FIXME') {
146 | error('Invalid signature');
147 | }
148 | header('HTTP/1.0 200 OK');
149 | header('Content-type: application/json');
150 | echo json_encode(['me' => $me]);
151 | exit();
152 | }
153 | } else if ($_SERVER['REQUEST_METHOD'] == 'HEAD') {
154 | //indieauth.com makes a HEAD request at first
155 | header('HTTP/1.0 200 OK');
156 | exit();
157 | } else {
158 | error('Unsupported HTTP request method');
159 | }
160 | ?>
161 |
--------------------------------------------------------------------------------
/www/comment.php:
--------------------------------------------------------------------------------
1 | getJsonComment($id);
22 | if ($comment === null) {
23 | header('HTTP/1.0 404 Not Found');
24 | header('Content-Type: text/plain');
25 | echo "Comment not found\n";
26 | exit(1);
27 | }
28 |
29 | $rowComment = $comment->Xrow;
30 | $rowUser = $comment->user;
31 |
32 | $vars = array(
33 | 'json' => $comment->properties,
34 | 'crow' => $rowComment,
35 | 'comment' => $comment,
36 | 'author' => array(
37 | 'name' => $rowUser->user_name,
38 | 'url' => Urls::full(Urls::user($rowUser->user_id)),
39 | 'imageurl' => Urls::userImg($rowUser),
40 | ),
41 | 'postUrl' => Urls::full(Urls::comment($rowComment->comment_id)),
42 | 'replyUrl' => Urls::reply(
43 | Urls::full(Urls::comment($rowComment->comment_id))
44 | ),
45 | );
46 |
47 | if ($rowComment->comment_type == 'like') {
48 | $template = 'post-like';
49 | } else {
50 | //reply
51 | $template = 'post-reply';
52 | if (isset($comment->properties->content['html'])) {
53 | $htmlContent = $comment->properties->content['html'];
54 | } else {
55 | $htmlContent = nl2br($comment->properties->content[0]);
56 | }
57 | $vars['htmlContent'] = $htmlContent;
58 | }
59 |
60 | if (isset($linkbackEndpoint) && $linkbackEndpoint) {
61 | header('X-Pingback: ' . $linkbackEndpoint);
62 | header('Link: <' . $linkbackEndpoint . '>; rel="webmention"');
63 | }
64 |
65 | render($template, $vars);
66 | ?>
67 |
--------------------------------------------------------------------------------
/www/css/auth-choose.css:
--------------------------------------------------------------------------------
1 | body {
2 | max-width: 60ex;
3 | margin-left: auto;
4 | margin-right: auto;
5 | background-color: #EEE;
6 | }
7 |
8 | label.mode {
9 | display: block;
10 | padding: 2ex;
11 | background-color: #DDD;
12 | border-top: 1px solid #EEE;
13 | }
14 | div.data-mode {
15 | margin-left: 5ex;
16 | background-color: #DDD;
17 | }
18 | div.data-mode label {
19 | display: inline-block;
20 | width: 20ex;
21 | }
22 | div.data-mode div {
23 | padding: 2ex 2ex;
24 | border-top: 1px solid #EEE;
25 | }
26 | div.data-mode input {
27 | width: 34ex;
28 | }
29 | button {
30 | margin: 2ex;
31 | width: 20ex;
32 | height: 5ex;
33 | display: block;
34 | margin-left: auto;
35 | margin-right: auto;
36 | }
37 | p.note {
38 | text-align: center;
39 | color: #444;
40 | }
--------------------------------------------------------------------------------
/www/css/index.css:
--------------------------------------------------------------------------------
1 | body {
2 | max-width: 60ex;
3 | margin-left: auto;
4 | margin-right: auto;
5 | background-color: #EEE;
6 | }
7 |
8 | pre {
9 | background-color: #DDD;
10 | padding: 2ex;
11 | border-radius: 1ex;
12 | }
--------------------------------------------------------------------------------
/www/css/latest.css:
--------------------------------------------------------------------------------
1 | table {
2 | border: 1px solid grey;
3 | border-collapse: collapse;
4 | }
5 | td, th {
6 | border: 1px solid grey;
7 | padding: 0.5ex 1ex;
8 | }
9 |
--------------------------------------------------------------------------------
/www/css/user.css:
--------------------------------------------------------------------------------
1 | * {
2 | box-sizing: border-box;
3 | }
4 | body {
5 | display: flex;
6 | height: 100%;
7 | margin: 0px;
8 | background-color: #EEF;
9 | }
10 | h1 {
11 | flex: 1 1 50%;
12 | align-self: stretch;
13 | text-align: right;
14 | margin-top: auto;
15 | margin-bottom: auto;
16 | order: 1;
17 | }
18 | #img {
19 | flex: 1 1 50%;
20 | align-self: stretch;
21 | text-align: center;
22 | margin: auto;
23 | order: 2;
24 | }
25 | img {
26 | width: 100%;
27 | height: auto;
28 | max-width: 50%;
29 | max-height: 50%;
30 | }
31 |
32 | @media all and (max-width: 640px) {
33 | body {
34 | flex-flow: column;
35 | }
36 | h1 {
37 | text-align: center;
38 | }
39 | #img {
40 | order: 0;
41 | }
42 | img {
43 | height: 50%;
44 | width: auto;
45 | margin-top: 13%;
46 | }
47 | }
48 |
--------------------------------------------------------------------------------
/www/favicon.ico:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/cweiske/anoweco/77cb769b94d16b424ec7a0b1a8186000dd397b30/www/favicon.ico
--------------------------------------------------------------------------------
/www/img/anonymous.svg:
--------------------------------------------------------------------------------
1 |
2 |
3 |
--------------------------------------------------------------------------------
/www/img/logo.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/cweiske/anoweco/77cb769b94d16b424ec7a0b1a8186000dd397b30/www/img/logo.png
--------------------------------------------------------------------------------
/www/index.php:
--------------------------------------------------------------------------------
1 | $title,
10 | 'baseurl' => Urls::full('/'),
11 | )
12 | );
13 | ?>
--------------------------------------------------------------------------------
/www/latest-atom.php:
--------------------------------------------------------------------------------
1 | listLatest();
7 |
8 | foreach ($comments as $comment) {
9 | $comment->url = Urls::comment($comment->comment_id);
10 | $comment->domain = parse_url($comment->comment_of_url, PHP_URL_HOST);
11 | }
12 |
13 | $vars = [
14 | 'baseUrl' => getBaseUrl(),
15 | 'comments' => $comments,
16 | 'lastComment' => $comments[0],
17 | ];
18 | header('Content-Type: application/atom+xml');
19 | render('latest-atom', $vars);
20 | ?>
21 |
--------------------------------------------------------------------------------
/www/latest.php:
--------------------------------------------------------------------------------
1 | listLatest();
7 |
8 | foreach ($comments as $comment) {
9 | $comment->url = Urls::comment($comment->comment_id);
10 | $comment->domain = parse_url($comment->comment_of_url, PHP_URL_HOST);
11 | }
12 |
13 | $vars = [
14 | 'comments' => $comments,
15 | ];
16 | render('latest', $vars);
17 | ?>
18 |
--------------------------------------------------------------------------------
/www/micropub.php:
--------------------------------------------------------------------------------
1 |
7 | */
8 | header('HTTP/1.0 500 Internal Server Error');
9 | require 'www-header.php';
10 |
11 | /**
12 | * Send out a micropub error
13 | *
14 | * @param string $status HTTP status code line
15 | * @param string $code One of the allowed status types:
16 | * - forbidden
17 | * - insufficient_scope
18 | * - invalid_request
19 | * - not_found
20 | * @param string $description
21 | */
22 | function mpError($status, $code, $description)
23 | {
24 | header($status);
25 | header('Content-Type: application/json');
26 | echo json_encode(
27 | ['error' => $code, 'error_description' => $description]
28 | ) . "\n";
29 | exit(1);
30 | }
31 |
32 | function validateToken($token)
33 | {
34 | $ctx = stream_context_create(
35 | array(
36 | 'http' => array(
37 | 'header' => array(
38 | 'Authorization: Bearer ' . $token,
39 | 'Accept: application/json',
40 | ),
41 | 'ignore_errors' => true,
42 | ),
43 | )
44 | );
45 | //FIXME: make hard-coded token server URL configurable
46 | $res = @file_get_contents(Urls::full('/token.php'), false, $ctx);
47 | list($dummy, $code, $msg) = explode(' ', $http_response_header[0]);
48 | if ($code != 200) {
49 | mpError(
50 | 'HTTP/1.0 403 Forbidden',
51 | 'forbidden',
52 | 'Error verifying bearer token: ' . trim($res)
53 | );
54 | }
55 |
56 | $data = json_decode($res, true);
57 | //FIXME: they spit out non-micropub json error responess
58 | verifyParameter($data, 'me');
59 | verifyParameter($data, 'client_id');
60 | verifyParameter($data, 'scope');
61 |
62 | return [$data['me'], $data['client_id'], $data['scope']];
63 | }
64 |
65 | function handleCreate($json, $token)
66 | {
67 | list($me, $client_id, $scope) = validateToken($token);
68 | $userId = Urls::userId($me);
69 | if ($userId === null) {
70 | mpError(
71 | 'HTTP/1.0 403 Forbidden',
72 | 'forbidden',
73 | 'Invalid user URL'
74 | );
75 | }
76 | $storage = new Storage();
77 | $rowUser = $storage->getUser($userId);
78 | if ($rowUser === null) {
79 | mpError(
80 | 'HTTP/1.0 403 Forbidden',
81 | 'forbidden',
82 | 'User not found: ' . $userId
83 | );
84 | }
85 |
86 | $storage = new Storage();
87 | $lb = new Linkback();
88 | try {
89 | $id = $storage->addComment($json, $userId);
90 | $lb->ping($id);
91 |
92 | header('HTTP/1.0 201 Created');
93 | header('Location: ' . Urls::full(Urls::comment($id)));
94 | exit();
95 | } catch (\Exception $e) {
96 | if ($e->getCode() == 400) {
97 | mpError(
98 | 'HTTP/1.0 400 Bad Request',
99 | 'invalid_request',
100 | $e->getMessage()
101 | );
102 | }
103 |
104 | mpError(
105 | 'HTTP/1.0 500 Internal Server Error',
106 | 'this_violates_the_spec',
107 | $e->getMessage()
108 | );
109 | exit();
110 | }
111 | }
112 |
113 | function getTokenFromHeader()
114 | {
115 | if (isset($_SERVER['HTTP_AUTHORIZATION'])
116 | && $_SERVER['HTTP_AUTHORIZATION'] != ''
117 | ) {
118 | $auth = $_SERVER['HTTP_AUTHORIZATION'];
119 | } else if (isset($_SERVER['REDIRECT_HTTP_AUTHORIZATION'])
120 | && $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] != ''
121 | ) {
122 | //php-cgi has it there
123 | $auth = $_SERVER['REDIRECT_HTTP_AUTHORIZATION'];
124 | } else {
125 | mpError(
126 | 'HTTP/1.0 403 Forbidden', 'forbidden',
127 | 'Authorization HTTP header missing'
128 | );
129 | }
130 | if (strpos($auth, ' ') === false) {
131 | mpError(
132 | 'HTTP/1.0 403 Forbidden', 'forbidden',
133 | 'Authorization header must start with "Bearer "'
134 | );
135 | }
136 | list($bearer, $token) = explode(' ', $auth, 2);
137 | if ($bearer !== 'Bearer') {
138 | mpError(
139 | 'HTTP/1.0 403 Forbidden', 'forbidden',
140 | 'Authorization header must start with "Bearer "'
141 | );
142 | }
143 | return trim($token);
144 | }
145 |
146 |
147 | if ($_SERVER['REQUEST_METHOD'] == 'GET') {
148 | if (!isset($_GET['q'])) {
149 | mpError(
150 | 'HTTP/1.1 400 Bad Request',
151 | 'invalid_request',
152 | 'Parameter "q" missing.'
153 | );
154 | } else if ($_GET['q'] === 'config') {
155 | header('HTTP/1.0 200 OK');
156 | header('Content-Type: application/json');
157 | echo '{}';
158 | exit();
159 | } else if ($_GET['q'] === 'syndicate-to') {
160 | header('HTTP/1.0 200 OK');
161 | header('Content-Type: application/json');
162 | echo '{}';
163 | exit();
164 | } else {
165 | //FIXME: maybe implement $q=source
166 | header('HTTP/1.1 501 Not Implemented');
167 | header('Content-Type: text/plain');
168 | echo 'Unsupported "q" value: ' . $_GET['q'] . "\n";
169 | exit();
170 | }
171 | } else if ($_SERVER['REQUEST_METHOD'] == 'POST') {
172 | if (!isset($_SERVER['CONTENT_TYPE'])) {
173 | mpError(
174 | 'HTTP/1.1 400 Bad Request',
175 | 'invalid_request',
176 | 'Content-Type header missing.'
177 | );
178 | }
179 | list($ctype) = explode(';', $_SERVER['CONTENT_TYPE'], 2);
180 | $ctype = trim($ctype);
181 | if ($ctype == 'application/x-www-form-urlencoded'
182 | || $ctype == 'multipart/form-data'
183 | ) {
184 | if (!isset($_POST['action'])) {
185 | $_POST['action'] = 'create';
186 | }
187 | if ($_POST['action'] != 'create') {
188 | header('HTTP/1.1 501 Not Implemented');
189 | header('Content-Type: text/plain');
190 | echo "Creation of posts supported only\n";
191 | exit();
192 | }
193 |
194 | $data = $_POST;
195 | $base = (object) [
196 | 'type' => ['h-entry'],
197 | ];
198 | if (isset($data['h'])) {
199 | $base->type = ['h-' . $data['h']];
200 | unset($data['h']);
201 | }
202 | if (isset($data['access_token'])) {
203 | $token = $data['access_token'];
204 | unset($data['access_token']);
205 | } else {
206 | $token = getTokenFromHeader();
207 | }
208 | //reserved properties
209 | foreach (['q', 'url', 'action'] as $key) {
210 | if (isset($data[$key])) {
211 | $base->$key = $data[$key];
212 | unset($data[$key]);
213 | }
214 | }
215 | //"mp-" reserved for future use
216 | foreach ($data as $key => $value) {
217 | if (substr($key, 0, 3) == 'mp-') {
218 | $base->$key = $value;
219 | unset($data[$key]);
220 | } else if (!is_array($value)) {
221 | //convert to array
222 | $data[$key] = [$value];
223 | }
224 | }
225 | $json = $base;
226 | $json->properties = (object) $data;
227 | handleCreate($json, $token);
228 | } else if ($ctype == 'application/json') {
229 | $input = file_get_contents('php://input');
230 | $json = json_decode($input);
231 | if ($json === null) {
232 | mpError(
233 | 'HTTP/1.1 400 Bad Request',
234 | 'invalid_request',
235 | 'Invalid JSON'
236 | );
237 | }
238 | $token = getTokenFromHeader();
239 | handleCreate($json, $token);
240 | } else {
241 | mpError(
242 | 'HTTP/1.1 400 Bad Request',
243 | 'invalid_request',
244 | 'Unsupported POST content type'
245 | );
246 | }
247 | } else {
248 | mpError(
249 | 'HTTP/1.0 400 Bad Request',
250 | 'invalid_request',
251 | 'Unsupported HTTP request method'
252 | );
253 | }
254 | ?>
--------------------------------------------------------------------------------
/www/robots.txt:
--------------------------------------------------------------------------------
1 | User-agent: *
2 | Disallow: /auth.php
3 | Disallow: /micropub.php
4 | Disallow: /token.php
5 |
--------------------------------------------------------------------------------
/www/token.php:
--------------------------------------------------------------------------------
1 | $me,
86 | 'client_id' => $client_id,
87 | 'scope' => $scope,
88 | )
89 | );
90 |
91 | } else if ($_SERVER['REQUEST_METHOD'] == 'POST') {
92 | //generate token
93 | //we ignore the "me" parameter; it's for proxies only
94 | // see https://github.com/cweiske/anoweco/issues/3
95 | $redirect_uri = verifyUrlParameter($_POST, 'redirect_uri');
96 | $client_id = verifyUrlParameter($_POST, 'client_id');
97 | $code = verifyParameter($_POST, 'code');//auth token
98 | $state = getOptionalParameter($_POST, 'state', null);
99 |
100 | //verify auth code
101 | parse_str(base64_decode($code), $codeParts);
102 | $emoji = verifyParameter($codeParts, 'emoji');
103 | $signature = verifyParameter($codeParts, 'signature');
104 | $me = verifyUrlParameter($codeParts, 'me');
105 | if ($emoji != '\360\237\222\251') {
106 | error('Auth token: Dog poo missing');
107 | }
108 | if ($signature != 'FIXME') {
109 | error('Auth token: Invalid signature');
110 | }
111 |
112 | //FIXME: check if state are set
113 | //FIXME: check auth endpoint if parameters are valid
114 | // and to get the scope
115 | $scope = 'post';
116 |
117 | //FIXME: use real encryption
118 | $access_token = base64_encode(
119 | http_build_query(
120 | array(
121 | 'emoji' => '\360\237\222\251',
122 | 'me' => $me,
123 | 'client_id' => $client_id,
124 | 'scope' => $scope,
125 | 'signature' => 'FIXME',
126 | )
127 | )
128 | );
129 | header('HTTP/1.0 200 OK');
130 | header('Content-type: application/json');
131 | echo json_encode(
132 | array(
133 | 'access_token' => $access_token,
134 | 'token_type' => 'Bearer',
135 | 'me' => $me,
136 | 'scope' => $scope
137 | )
138 | );
139 | }
140 | ?>
141 |
--------------------------------------------------------------------------------
/www/user.php:
--------------------------------------------------------------------------------
1 | getUser($id);
22 | if ($rowUser === null) {
23 | header('HTTP/1.0 404 Not Found');
24 | header('Content-Type: text/plain');
25 | echo "User not found\n";
26 | exit(1);
27 | }
28 |
29 | render(
30 | 'user',
31 | array(
32 | 'baseurl' => Urls::full('/'),
33 | 'name' => $rowUser->user_name,
34 | 'url' => Urls::full(Urls::user($rowUser->user_id)),
35 | 'imageurl' => Urls::userImg($rowUser),
36 | )
37 | );
38 | ?>
39 |
--------------------------------------------------------------------------------
/www/www-header.php:
--------------------------------------------------------------------------------
1 | '/path/to/compilation_cache',
12 | 'debug' => true
13 | )
14 | );
15 | //$twig->addExtension(new Twig_Extension_Debug());
16 |
17 | function verifyParameter($givenParams, $paramName)
18 | {
19 | if (!isset($givenParams[$paramName])) {
20 | error('"' . $paramName . '" parameter missing');
21 | }
22 | return $givenParams[$paramName];
23 | }
24 |
25 | function verifyUrlParameter($givenParams, $paramName)
26 | {
27 | verifyParameter($givenParams, $paramName);
28 | $url = parse_url($givenParams[$paramName]);
29 | if (!isset($url['scheme'])) {
30 | error('Invalid URL in "' . $paramName . '" parameter: scheme missing');
31 | }
32 | if (!isset($url['host'])) {
33 | error('Invalid URL in "' . $paramName . '" parameter: host missing');
34 | }
35 |
36 | return $givenParams[$paramName];
37 | }
38 |
39 | function getOptionalParameter($givenParams, $paramName, $default)
40 | {
41 | if (!isset($givenParams[$paramName])) {
42 | return $default;
43 | }
44 | return $givenParams[$paramName];
45 | }
46 |
47 | /**
48 | * Send out an error
49 | *
50 | * @param string $status HTTP status code line
51 | * @param string $code One of the allowed status types:
52 | * - forbidden
53 | * - insufficient_scope
54 | * - invalid_request
55 | * - not_found
56 | * @param string $description
57 | */
58 | function error($description, $status = 'HTTP/1.0 400 Bad Request')
59 | {
60 | header($status);
61 | header('Content-Type: text/plain');
62 | echo $description . "\n";
63 | exit(1);
64 | }
65 |
66 | function render($tplname, $vars = array(), $return = false)
67 | {
68 | $template = $GLOBALS['twig']->load($tplname . '.htm');
69 |
70 | if ($return) {
71 | return $template->render($vars);
72 | } else {
73 | echo $template->render($vars);
74 | }
75 | }
76 |
77 | /**
78 | * No trailing slash
79 | */
80 | function getBaseUrl()
81 | {
82 | return $_SERVER['REQUEST_SCHEME']
83 | . '://' . $_SERVER['HTTP_HOST'];
84 | }
85 | ?>
86 |
--------------------------------------------------------------------------------