PHP crypto_encapsulate函数代码示例

/**
 * Sourced and tag-delivered posts are re-targetted for delivery to the connections of the channel
 * receiving the post. This starts the second delivery chain, by resetting permissions and ensuring
 * that ITEM_UPLINK is set on the parent post, and storing the current owner_xchan as the source_xchan.
 * We'll become the new owner. If called without $parent, this *is* the parent post.
 *
 * @param array $channel
 * @param array $item
 * @param int $item_id
 * @param boolean $parent
 */
function start_delivery_chain($channel, $item, $item_id, $parent)
{
    // Change this copy of the post to a forum head message and deliver to all the tgroup members
    // also reset all the privacy bits to the forum default permissions
    $private = $channel['channel_allow_cid'] || $channel['channel_allow_gid'] || $channel['channel_deny_cid'] || $channel['channel_deny_gid'] ? 1 : 0;
    $new_public_policy = map_scope($channel['channel_r_stream'], true);
    if (!$private && $new_public_policy) {
        $private = 1;
    }
    $flag_bits = $item['item_flags'] | ITEM_WALL;
    // The message didn't necessarily originate on this site, (we'll honour it if it did),
    // but the parent post of this thread will be reset as a local post, as it is the top of
    // this delivery chain and is coming from this site, regardless of where the original
    // originated.
    if (!$parent) {
        $flag_bits = $flag_bits | ITEM_ORIGIN;
    }
    // unset the nocomment bit if it's there.
    if ($flag_bits & ITEM_NOCOMMENT) {
        $flag_bits = $flag_bits ^ ITEM_NOCOMMENT;
    }
    // maintain the original source, which will be the original item owner and was stored in source_xchan
    // when we created the delivery fork
    if ($parent) {
        $r = q("update item set source_xchan = '%s' where id = %d", dbesc($parent['source_xchan']), intval($item_id));
    } else {
        $flag_bits = $flag_bits | ITEM_UPLINK;
        $r = q("update item set source_xchan = owner_xchan where id = %d", intval($item_id));
    }
    $title = $item['title'];
    $body = $item['body'];
    if ($private) {
        if (!($flag_bits & ITEM_OBSCURED)) {
            $key = get_config('system', 'pubkey');
            $flag_bits = $flag_bits | ITEM_OBSCURED;
            if ($title) {
                $title = json_encode(crypto_encapsulate($title, $key));
            }
            if ($body) {
                $body = json_encode(crypto_encapsulate($body, $key));
            }
        }
    } else {
        if ($flag_bits & ITEM_OBSCURED) {
            $key = get_config('system', 'prvkey');
            $flag_bits = $flag_bits ^ ITEM_OBSCURED;
            if ($title) {
                $title = crypto_unencapsulate(json_decode($title, true), $key);
            }
            if ($body) {
                $body = crypto_unencapsulate(json_decode($body, true), $key);
            }
        }
    }
    $r = q("update item set item_flags = %d, owner_xchan = '%s', allow_cid = '%s', allow_gid = '%s',\n\t\tdeny_cid = '%s', deny_gid = '%s', item_private = %d, public_policy = '%s', comment_policy = '%s', title = '%s', body = '%s'  where id = %d", intval($flag_bits), dbesc($channel['channel_hash']), dbesc($channel['channel_allow_cid']), dbesc($channel['channel_allow_gid']), dbesc($channel['channel_deny_cid']), dbesc($channel['channel_deny_gid']), intval($private), dbesc($new_public_policy), dbesc(map_scope($channel['channel_w_comment'])), dbesc($title), dbesc($body), intval($item_id));
    if ($r) {
        proc_run('php', 'include/notifier.php', 'tgroup', $item_id);
    } else {
        logger('start_delivery_chain: failed to update item');
    }
}

//.........这里部分代码省略.........
    $ret['address'] = $e['xchan_addr'];
    $ret['photo_mimetype'] = $e['xchan_photo_mimetype'];
    $ret['photo'] = $e['xchan_photo_l'];
    $ret['photo_updated'] = $e['xchan_photo_date'];
    $ret['url'] = $e['xchan_url'];
    $ret['connections_url'] = $e['xchan_connurl'] ? $e['xchan_connurl'] : z_root() . '/poco/' . $e['channel_address'];
    $ret['target'] = $ztarget;
    $ret['target_sig'] = $zsig;
    $ret['searchable'] = $searchable;
    $ret['adult_content'] = $adult_channel;
    $ret['public_forum'] = $public_forum;
    if ($deleted) {
        $ret['deleted'] = $deleted;
    }
    if (intval($e['channel_removed'])) {
        $ret['deleted_locally'] = true;
    }
    // premium or other channel desiring some contact with potential followers before connecting.
    // This is a template - %s will be replaced with the follow_url we discover for the return channel.
    if ($special_channel) {
        $ret['connect_url'] = z_root() . '/connect/' . $e['channel_address'];
    }
    // This is a template for our follow url, %s will be replaced with a webbie
    $ret['follow_url'] = z_root() . '/follow?f=&url=%s';
    $ztarget_hash = $ztarget && $zsig ? make_xchan_hash($ztarget, $zsig) : '';
    $permissions = get_all_perms($e['channel_id'], $ztarget_hash, false);
    if ($ztarget_hash) {
        $permissions['connected'] = false;
        $b = q("select * from abook where abook_xchan = '%s' and abook_channel = %d limit 1", dbesc($ztarget_hash), intval($e['channel_id']));
        if ($b) {
            $permissions['connected'] = true;
        }
    }
    $ret['permissions'] = $ztarget && $zkey ? crypto_encapsulate(json_encode($permissions), $zkey) : $permissions;
    if ($permissions['view_profile']) {
        $ret['profile'] = $profile;
    }
    // array of (verified) hubs this channel uses
    $x = zot_encode_locations($e);
    if ($x) {
        $ret['locations'] = $x;
    }
    $ret['site'] = array();
    $ret['site']['url'] = z_root();
    $ret['site']['url_sig'] = base64url_encode(rsa_sign(z_root(), $e['channel_prvkey']));
    $dirmode = get_config('system', 'directory_mode');
    if ($dirmode === false || $dirmode == DIRECTORY_MODE_NORMAL) {
        $ret['site']['directory_mode'] = 'normal';
    }
    if ($dirmode == DIRECTORY_MODE_PRIMARY) {
        $ret['site']['directory_mode'] = 'primary';
    } elseif ($dirmode == DIRECTORY_MODE_SECONDARY) {
        $ret['site']['directory_mode'] = 'secondary';
    } elseif ($dirmode == DIRECTORY_MODE_STANDALONE) {
        $ret['site']['directory_mode'] = 'standalone';
    }
    if ($dirmode != DIRECTORY_MODE_NORMAL) {
        $ret['site']['directory_url'] = z_root() . '/dirsearch';
    }
    // hide detailed site information if you're off the grid
    if ($dirmode != DIRECTORY_MODE_STANDALONE) {
        $register_policy = intval(get_config('system', 'register_policy'));
        if ($register_policy == REGISTER_CLOSED) {
            $ret['site']['register_policy'] = 'closed';
        }
        if ($register_policy == REGISTER_APPROVE) {

//.........这里部分代码省略.........
        killme();
    }
    if ($orig_post) {
        $datarray['edit'] = true;
    }
    call_hooks('post_local', $datarray);
    if (x($datarray, 'cancel')) {
        logger('mod_item: post cancelled by plugin.');
        if ($return_path) {
            goaway($a->get_baseurl() . "/" . $return_path);
        }
        $json = array('cancel' => 1);
        if (x($_REQUEST, 'jsreload') && strlen($_REQUEST['jsreload'])) {
            $json['reload'] = $a->get_baseurl() . '/' . $_REQUEST['jsreload'];
        }
        echo json_encode($json);
        killme();
    }
    if (mb_strlen($datarray['title']) > 255) {
        $datarray['title'] = mb_substr($datarray['title'], 0, 255);
    }
    if (array_key_exists('item_private', $datarray) && $datarray['item_private']) {
        $datarray['body'] = trim(z_input_filter($datarray['uid'], $datarray['body'], $datarray['mimetype']));
        if ($uid) {
            if ($channel['channel_hash'] === $datarray['author_xchan']) {
                $datarray['sig'] = base64url_encode(rsa_sign($datarray['body'], $channel['channel_prvkey']));
                $datarray['item_flags'] = $datarray['item_flags'] | ITEM_VERIFIED;
            }
        }
        logger('Encrypting local storage');
        $key = get_config('system', 'pubkey');
        $datarray['item_flags'] = $datarray['item_flags'] | ITEM_OBSCURED;
        if ($datarray['title']) {
            $datarray['title'] = json_encode(crypto_encapsulate($datarray['title'], $key));
        }
        if ($datarray['body']) {
            $datarray['body'] = json_encode(crypto_encapsulate($datarray['body'], $key));
        }
    }
    if ($orig_post) {
        $datarray['id'] = $post_id;
        item_store_update($datarray, $execflag);
        update_remote_id($channel, $post_id, $webpage, $pagetitle, $namespace, $remote_id, $mid);
        if (!$nopush) {
            proc_run('php', "include/notifier.php", 'edit_post', $post_id);
        }
        if (x($_REQUEST, 'return') && strlen($return_path)) {
            logger('return: ' . $return_path);
            goaway($a->get_baseurl() . "/" . $return_path);
        }
        killme();
    } else {
        $post_id = 0;
    }
    $post = item_store($datarray, $execflag);
    $post_id = $post['item_id'];
    if ($post_id) {
        logger('mod_item: saved item ' . $post_id);
        if ($parent) {
            // only send comment notification if this is a wall-to-wall comment,
            // otherwise it will happen during delivery
            if ($datarray['owner_xchan'] != $datarray['author_xchan'] && $parent_item['item_flags'] & ITEM_WALL) {
                notification(array('type' => NOTIFY_COMMENT, 'from_xchan' => $datarray['author_xchan'], 'to_xchan' => $datarray['owner_xchan'], 'item' => $datarray, 'link' => $a->get_baseurl() . '/display/' . $datarray['mid'], 'verb' => ACTIVITY_POST, 'otype' => 'item', 'parent' => $parent, 'parent_mid' => $parent_item['mid']));
            }
        } else {
            $parent = $post_id;

//.........这里部分代码省略.........
    		`item`.`contact-id`=`contact`.`id` AND `item`.`mid`='%s';",
    		 dbesc($item['parent_mid']));
    		if(count($r)==0) return;
    		$obj=$r[0];
    		
    		$author	 = '[zrl=' . zid($item['author-link']) . ']' . $item['author-name'] . '[/zrl]';
    		$objauthor =  '[zrl=' . zid($obj['author-link']) . ']' . $obj['author-name'] . '[/zrl]';
    		
    		switch($obj['verb']){
    			case ACTIVITY_POST:
    				switch ($obj['obj_type']){
    					case ACTIVITY_OBJ_EVENT:
    						$post_type = t('event');
    						break;
    					default:
    						$post_type = t('status');
    				}
    				break;
    			default:
    				if($obj['resource_id']){
    					$post_type = t('photo');
    					$m=array(); preg_match("/\[[zu]rl=([^]]*)\]/", $obj['body'], $m);
    					$rr['plink'] = $m[1];
    				} else {
    					$post_type = t('status');
    				}
    		}
    		$plink = '[zrl=' . $obj['plink'] . ']' . $post_type . '[/zrl]';
    
    		$parsedobj = parse_xml_string($xmlhead.$item['object']);
    
    		$tag = sprintf('#[zrl=%s]%s[/zrl]', $parsedobj->id, $parsedobj->content);
    		$item['body'] = sprintf( t('%1$s tagged %2$s\'s %3$s with %4$s'), $author, $objauthor, $plink, $tag );
    
    	}
    
    	if (activity_match($item['verb'],ACTIVITY_FAVORITE)){
    
    		if ($item['obj_type']== "")
    			return;
    
    		$Aname = $item['author']['xchan_name'];
    		$Alink = $item['author']['xchan_url'];
    
    		$xmlhead="<"."?xml version='1.0' encoding='UTF-8' ?".">";
    
    		$obj = parse_xml_string($xmlhead.$item['object']);
    		if(strlen($obj->id)) {
    			$r = q("select * from item where mid = '%s' and uid = %d limit 1",
    					dbesc($obj->id),
    					intval($item['uid'])
    			);
    			if(count($r) && $r[0]['plink']) {
    				$target = $r[0];
    				$Bname = $target['author-name'];
    				$Blink = $target['author-link'];
    				$A = '[zrl=' . zid($Alink) . ']' . $Aname . '[/zrl]';
    				$B = '[zrl=' . zid($Blink) . ']' . $Bname . '[/zrl]';
    				$P = '[zrl=' . $target['plink'] . ']' . t('post/item') . '[/zrl]';
    				$item['body'] = sprintf( t('%1$s marked %2$s\'s %3$s as favorite'), $A, $B, $P)."\n";
    
    			}
    		}
    	}
    */
    /*
    	$matches = null;
    	if(strpos($item['body'],'[zrl') !== false) {
    		if(preg_match_all('/@\[zrl=(.*?)\]/is',$item['body'],$matches,PREG_SET_ORDER)) {
    			foreach($matches as $mtch) {
    				if(! strpos($mtch[1],'zid='))
    					$item['body'] = str_replace($mtch[0],'@[zrl=' . zid($mtch[1]). ']',$item['body']);
    			}
    		}
    	}
    
    	if(strpos($item['body'],'[zmg') !== false) {
    		// add zid's to public images
    		if(preg_match_all('/\[zrl=(.*?)\/photos\/(.*?)\/image\/(.*?)\]\[zmg(.*?)\]h(.*?)\[\/zmg\]\[\/zrl\]/is',$item['body'],$matches,PREG_SET_ORDER)) {
    			foreach($matches as $mtch) {
    				$item['body'] = str_replace($mtch[0],'[zrl=' . zid( $mtch[1] . '/photos/' . $mtch[2] . '/image/' . $mtch[3]) . '][zmg' . $mtch[4] . ']h' . $mtch[5]  . '[/zmg][/zrl]',$item['body']);
    			}
    		}
    	}
    */
    // add sparkle links to appropriate permalinks
    //	$x = stristr($item['plink'],'/display/');
    //	if($x) {
    //		$sparkle = false;
    //		$y = best_link_url($item,$sparkle,true);
    //	if($sparkle)
    //			$item['plink'] = $y . '?f=&url=' . $item['plink'];
    //	}
    // if item body was obscured and we changed it, re-obscure it
    // FIXME - we need a better filter than just the string 'data'; try and
    // match the fact that it's json encoded
    if ($item['item_flags'] & ITEM_OBSCURED && strlen($item['body']) && !strpos($item['body'], 'data')) {
        $item['body'] = json_encode(crypto_encapsulate($item['body'], get_config('system', 'pubkey')));
    }
}

/**
 * @brief
 *
 * We received a notification packet (in mod/post.php) that a message is waiting for us, and we've verified the sender.
 * Now send back a pickup message, using our message tracking ID ($arr['secret']), which we will sign with our site private key.
 * The entire pickup message is encrypted with the remote site's public key.
 * If everything checks out on the remote end, we will receive back a packet containing one or more messages,
 * which will be processed and delivered before this function ultimately returns.
 *
 * @see zot_import()
 *
 * @param array $arr
 *     decrypted and json decoded notify packet from remote site
 * @return array from zot_import()
 */
function zot_fetch($arr)
{
    logger('zot_fetch: ' . print_r($arr, true), LOGGER_DATA);
    $url = $arr['sender']['url'] . $arr['callback'];
    // set $multiple param on zot_gethub() to return all matching hubs
    // This allows us to recover from re-installs when a redundant (but invalid) hubloc for
    // this identity is widely dispersed throughout the network.
    $ret_hubs = zot_gethub($arr['sender'], true);
    if (!$ret_hubs) {
        logger('zot_fetch: no hub: ' . print_r($arr['sender'], true));
        return;
    }
    foreach ($ret_hubs as $ret_hub) {
        $data = array('type' => 'pickup', 'url' => z_root(), 'callback_sig' => base64url_encode(rsa_sign(z_root() . '/post', get_config('system', 'prvkey'))), 'callback' => z_root() . '/post', 'secret' => $arr['secret'], 'secret_sig' => base64url_encode(rsa_sign($arr['secret'], get_config('system', 'prvkey'))));
        $datatosend = json_encode(crypto_encapsulate(json_encode($data), $ret_hub['hubloc_sitekey']));
        $fetch = zot_zot($url, $datatosend);
        $result = zot_import($fetch, $arr['sender']['url']);
        if ($result) {
            return $result;
        }
    }
    return;
}

function send_message($uid = 0, $recipient = '', $body = '', $subject = '', $replyto = '', $expires = '')
{
    $ret = array('success' => false);
    $a = get_app();
    if (!$recipient) {
        $ret['message'] = t('No recipient provided.');
        return $ret;
    }
    if (!strlen($subject)) {
        $subject = t('[no subject]');
    }
    //	if(! $expires)
    //		$expires = NULL_DATE;
    //	else
    //		$expires = datetime_convert(date_default_timezone_get(),'UTC',$expires);
    if ($uid) {
        $r = q("select * from channel where channel_id = %d limit 1", intval($uid));
        if ($r) {
            $channel = $r[0];
        }
    } else {
        $channel = get_app()->get_channel();
    }
    if (!$channel) {
        $ret['message'] = t('Unable to determine sender.');
        return $ret;
    }
    // generate a unique message_id
    do {
        $dups = false;
        $hash = random_string();
        $mid = $hash . '@' . get_app()->get_hostname();
        $r = q("SELECT id FROM mail WHERE mid = '%s' LIMIT 1", dbesc($mid));
        if (count($r)) {
            $dups = true;
        }
    } while ($dups == true);
    if (!strlen($replyto)) {
        $replyto = $mid;
    }
    /**
     *
     * When a photo was uploaded into the message using the (profile wall) ajax 
     * uploader, The permissions are initially set to disallow anybody but the
     * owner from seeing it. This is because the permissions may not yet have been
     * set for the post. If it's private, the photo permissions should be set
     * appropriately. But we didn't know the final permissions on the post until
     * now. So now we'll look for links of uploaded messages that are in the
     * post and set them to the same permissions as the post itself.
     *
     */
    $match = null;
    $images = null;
    if (preg_match_all("/\\[zmg\\](.*?)\\[\\/zmg\\]/", strpos($body, '[/crypt]') ? $_POST['media_str'] : $body, $match)) {
        $images = $match[1];
    }
    $match = false;
    if (preg_match_all("/\\[attachment\\](.*?)\\[\\/attachment\\]/", strpos($body, '[/crypt]') ? $_POST['media_str'] : $body, $match)) {
        $attaches = $match[1];
    }
    $attachments = '';
    if (preg_match_all('/(\\[attachment\\](.*?)\\[\\/attachment\\])/', $body, $match)) {
        $attachments = array();
        foreach ($match[2] as $mtch) {
            $hash = substr($mtch, 0, strpos($mtch, ','));
            $rev = intval(substr($mtch, strpos($mtch, ',')));
            $r = attach_by_hash_nodata($hash, $rev);
            if ($r['success']) {
                $attachments[] = array('href' => $a->get_baseurl() . '/attach/' . $r['data']['hash'], 'length' => $r['data']['filesize'], 'type' => $r['data']['filetype'], 'title' => urlencode($r['data']['filename']), 'revision' => $r['data']['revision']);
            }
            $body = str_replace($match[1], '', $body);
        }
    }
    $jattach = $attachments ? json_encode($attachments) : '';
    $key = get_config('system', 'pubkey');
    if ($subject) {
        $subject = json_encode(crypto_encapsulate($subject, $key));
    }
    if ($body) {
        $body = json_encode(crypto_encapsulate($body, $key));
    }
    $r = q("INSERT INTO mail ( account_id, mail_flags, channel_id, from_xchan, to_xchan, title, body, attach, mid, parent_mid, created, expires )\n\t\tVALUES ( %d, %d, %d, '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s' )", intval($channel['channel_account_id']), intval(MAIL_OBSCURED), intval($channel['channel_id']), dbesc($channel['channel_hash']), dbesc($recipient), dbesc($subject), dbesc($body), dbesc($jattach), dbesc($mid), dbesc($replyto), dbesc(datetime_convert()), dbesc($expires));
    // verify the save
    $r = q("SELECT * FROM mail WHERE mid = '%s' and channel_id = %d LIMIT 1", dbesc($mid), intval($channel['channel_id']));
    if ($r) {
        $post_id = $r[0]['id'];
    } else {
        $ret['message'] = t('Stored post could not be verified.');
        return $ret;
    }
    if (count($images)) {
        foreach ($images as $image) {
            if (!stristr($image, $a->get_baseurl() . '/photo/')) {
                continue;
            }
            $image_uri = substr($image, strrpos($image, '/') + 1);
            $image_uri = substr($image_uri, 0, strpos($image_uri, '-'));
            $r = q("UPDATE photo SET allow_cid = '%s' WHERE resource_id = '%s' AND uid = %d and allow_cid = '%s'", dbesc('<' . $recipient . '>'), dbesc($image_uri), intval($channel['channel_id']), dbesc('<' . $channel['channel_hash'] . '>'));
        }
    }
//.........这里部分代码省略.........

function zot_reply_pickup($data)
{
    $ret = array('success' => false);
    /*
     * The 'pickup' message arrives with a tracking ID which is associated with a particular outq_hash
     * First verify that that the returned signatures verify, then check that we have an outbound queue item
     * with the correct hash.
     * If everything verifies, find any/all outbound messages in the queue for this hubloc and send them back
     */
    if (!$data['secret'] || !$data['secret_sig']) {
        $ret['message'] = 'no verification signature';
        logger('mod_zot: pickup: ' . $ret['message'], LOGGER_DEBUG);
        json_return_and_die($ret);
    }
    $r = q("select distinct hubloc_sitekey from hubloc where hubloc_url = '%s' and hubloc_callback = '%s' and hubloc_sitekey != '' group by hubloc_sitekey ", dbesc($data['url']), dbesc($data['callback']));
    if (!$r) {
        $ret['message'] = 'site not found';
        logger('mod_zot: pickup: ' . $ret['message']);
        json_return_and_die($ret);
    }
    foreach ($r as $hubsite) {
        // verify the url_sig
        // If the server was re-installed at some point, there could be multiple hubs with the same url and callback.
        // Only one will have a valid key.
        $forgery = true;
        $secret_fail = true;
        $sitekey = $hubsite['hubloc_sitekey'];
        logger('mod_zot: Checking sitekey: ' . $sitekey, LOGGER_DATA, LOG_DEBUG);
        if (rsa_verify($data['callback'], base64url_decode($data['callback_sig']), $sitekey)) {
            $forgery = false;
        }
        if (rsa_verify($data['secret'], base64url_decode($data['secret_sig']), $sitekey)) {
            $secret_fail = false;
        }
        if (!$forgery && !$secret_fail) {
            break;
        }
    }
    if ($forgery) {
        $ret['message'] = 'possible site forgery';
        logger('mod_zot: pickup: ' . $ret['message']);
        json_return_and_die($ret);
    }
    if ($secret_fail) {
        $ret['message'] = 'secret validation failed';
        logger('mod_zot: pickup: ' . $ret['message']);
        json_return_and_die($ret);
    }
    /*
     * If we made it to here, the signatures verify, but we still don't know if the tracking ID is valid.
     * It wouldn't be an error if the tracking ID isn't found, because we may have sent this particular
     * queue item with another pickup (after the tracking ID for the other pickup  was verified). 
     */
    $r = q("select outq_posturl from outq where outq_hash = '%s' and outq_posturl = '%s' limit 1", dbesc($data['secret']), dbesc($data['callback']));
    if (!$r) {
        $ret['message'] = 'nothing to pick up';
        logger('mod_zot: pickup: ' . $ret['message']);
        json_return_and_die($ret);
    }
    /*
     * Everything is good if we made it here, so find all messages that are going to this location
     * and send them all.
     */
    $r = q("select * from outq where outq_posturl = '%s'", dbesc($data['callback']));
    if ($r) {
        logger('mod_zot: successful pickup message received from ' . $data['callback'] . ' ' . count($r) . ' message(s) picked up', LOGGER_DEBUG);
        $ret['success'] = true;
        $ret['pickup'] = array();
        foreach ($r as $rr) {
            if ($rr['outq_msg']) {
                $x = json_decode($rr['outq_msg'], true);
                if (!$x) {
                    continue;
                }
                if (is_array($x) && array_key_exists('message_list', $x)) {
                    foreach ($x['message_list'] as $xx) {
                        $ret['pickup'][] = array('notify' => json_decode($rr['outq_notify'], true), 'message' => $xx);
                    }
                } else {
                    $ret['pickup'][] = array('notify' => json_decode($rr['outq_notify'], true), 'message' => $x);
                }
                remove_queue_item($rr['outq_hash']);
            }
        }
    }
    $encrypted = crypto_encapsulate(json_encode($ret), $sitekey);
    json_return_and_die($encrypted);
    /* pickup: end */
}

//.........这里部分代码省略.........
    /* How Diaspora performs "like" signature checking:
    
    	   - If an item has been sent by the like author to the top-level post owner to relay on
    	     to the rest of the contacts on the top-level post, the top-level post owner should check
    	     the author_signature, then create a parent_author_signature before relaying the like on
    	   - If an item has been relayed on by the top-level post owner, the contacts who receive it
    	     check only the parent_author_signature. Basically, they trust that the top-level post
    	     owner has already verified the authenticity of anything he/she sends out
    	   - In either case, the signature that get checked is the signature created by the person
    	     who sent the salmon
    	*/
    // 2014-09-10 let's try this: signatures are failing. I'll try and make a signable string from
    // the parameters in the order they were presented in the post. This is how D* creates the signable string.
    $signed_data = $positive . ';' . $guid . ';' . $target_type . ';' . $parent_guid . ';' . $diaspora_handle;
    $key = $msg['key'];
    if ($parent_author_signature) {
        // If a parent_author_signature exists, then we've received the like
        // relayed from the top-level post owner. There's no need to check the
        // author_signature if the parent_author_signature is valid
        $parent_author_signature = base64_decode($parent_author_signature);
        if (!rsa_verify($signed_data, $parent_author_signature, $key, 'sha256')) {
            if (intval(get_config('system', 'ignore_diaspora_like_signature'))) {
                logger('diaspora_like: top-level owner verification failed. Proceeding anyway.');
            } else {
                logger('diaspora_like: top-level owner verification failed.');
                return;
            }
        }
    } else {
        // If there's no parent_author_signature, then we've received the like
        // from the like creator. In that case, the person is "like"ing
        // our post, so he/she must be a contact of ours and his/her public key
        // should be in $msg['key']
        $author_signature = base64_decode($author_signature);
        if (!rsa_verify($signed_data, $author_signature, $key, 'sha256')) {
            if (intval(get_config('system', 'ignore_diaspora_like_signature'))) {
                logger('diaspora_like: like creator verification failed. Proceeding anyway');
            } else {
                logger('diaspora_like: like creator verification failed.');
                return;
            }
        }
    }
    logger('diaspora_like: signature check complete.', LOGGER_DEBUG);
    // Phew! Everything checks out. Now create an item.
    // Find the original comment author information.
    // We need this to make sure we display the comment author
    // information (name and avatar) correctly.
    if (strcasecmp($diaspora_handle, $msg['author']) == 0) {
        $person = $contact;
    } else {
        $person = find_diaspora_person_by_handle($diaspora_handle);
        if (!is_array($person)) {
            logger('diaspora_like: unable to find author details');
            return;
        }
    }
    $uri = $diaspora_handle . ':' . $guid;
    $activity = ACTIVITY_LIKE;
    $post_type = $parent_item['resource_type'] === 'photo' ? t('photo') : t('status');
    $links = array(array('rel' => 'alternate', 'type' => 'text/html', 'href' => $parent_item['plink']));
    $objtype = $parent_item['resource_type'] === 'photo' ? ACTIVITY_OBJ_PHOTO : ACTIVITY_OBJ_NOTE;
    $body = $parent_item['body'];
    $object = json_encode(array('type' => $post_type, 'id' => $parent_item['mid'], 'parent' => $parent_item['thr_parent'] ? $parent_item['thr_parent'] : $parent_item['parent_mid'], 'link' => $links, 'title' => $parent_item['title'], 'content' => $parent_item['body'], 'created' => $parent_item['created'], 'edited' => $parent_item['edited'], 'author' => array('name' => $item_author['xchan_name'], 'address' => $item_author['xchan_addr'], 'guid' => $item_author['xchan_guid'], 'guid_sig' => $item_author['xchan_guid_sig'], 'link' => array(array('rel' => 'alternate', 'type' => 'text/html', 'href' => $item_author['xchan_url']), array('rel' => 'photo', 'type' => $item_author['xchan_photo_mimetype'], 'href' => $item_author['xchan_photo_m'])))));
    $bodyverb = t('%1$s likes %2$s\'s %3$s');
    $arr = array();
    $arr['uid'] = $importer['channel_id'];
    $arr['aid'] = $importer['channel_account_id'];
    $arr['mid'] = $guid;
    $arr['parent_mid'] = $parent_item['mid'];
    $arr['owner_xchan'] = $parent_item['owner_xchan'];
    $arr['author_xchan'] = $person['xchan_hash'];
    $ulink = '[url=' . $contact['url'] . ']' . $contact['name'] . '[/url]';
    $alink = '[url=' . $parent_item['author-link'] . ']' . $parent_item['author-name'] . '[/url]';
    $plink = '[url=' . z_root() . '/display/' . $guid . ']' . $post_type . '[/url]';
    $arr['body'] = sprintf($bodyverb, $ulink, $alink, $plink);
    $arr['app'] = 'Diaspora';
    // set the route to that of the parent so downstream hubs won't reject it.
    $arr['route'] = $parent_item['route'];
    $arr['item_private'] = $parent_item['item_private'];
    $arr['verb'] = $activity;
    $arr['obj_type'] = $objtype;
    $arr['object'] = $object;
    if (!$parent_author_signature) {
        $key = get_config('system', 'pubkey');
        $x = array('signer' => $diaspora_handle, 'body' => $text, 'signed_text' => $signed_data, 'signature' => base64_encode($author_signature));
        $arr['diaspora_meta'] = json_encode(crypto_encapsulate(json_encode($x), $key));
    }
    $x = item_store($arr);
    if ($x) {
        $message_id = $x['item_id'];
    }
    // if the message isn't already being relayed, notify others
    // the existence of parent_author_signature means the parent_author or owner
    // is already relaying. The parent_item['origin'] indicates the message was created on our system
    if ($parent_item['item_flags'] & ITEM_ORIGIN && !$parent_author_signature) {
        proc_run('php', 'include/notifier.php', 'comment-import', $message_id);
    }
    return;
}

//.........这里部分代码省略.........
            logger('mod_zot: pickup: ' . $ret['message']);
            json_return_and_die($ret);
        }
        if ($secret_fail) {
            $ret['message'] = 'secret validation failed';
            logger('mod_zot: pickup: ' . $ret['message']);
            json_return_and_die($ret);
        }
        /**
         * If we made it to here, the signatures verify, but we still don't know if the tracking ID is valid.
         * It wouldn't be an error if the tracking ID isn't found, because we may have sent this particular
         * queue item with another pickup (after the tracking ID for the other pickup  was verified). 
         */
        $r = q("select outq_posturl from outq where outq_hash = '%s' and outq_posturl = '%s' limit 1", dbesc($data['secret']), dbesc($data['callback']));
        if (!$r) {
            $ret['message'] = 'nothing to pick up';
            logger('mod_zot: pickup: ' . $ret['message']);
            json_return_and_die($ret);
        }
        /**
         * Everything is good if we made it here, so find all messages that are going to this location
         * and send them all.
         */
        $r = q("select * from outq where outq_posturl = '%s'", dbesc($data['callback']));
        if ($r) {
            logger('mod_zot: succesful pickup message received from ' . $data['callback'] . ' ' . count($r) . ' message(s) picked up', LOGGER_DEBUG);
            $ret['success'] = true;
            $ret['pickup'] = array();
            foreach ($r as $rr) {
                $ret['pickup'][] = array('notify' => json_decode($rr['outq_notify'], true), 'message' => json_decode($rr['outq_msg'], true));
                $x = q("delete from outq where outq_hash = '%s' limit 1", dbesc($rr['outq_hash']));
            }
        }
        $encrypted = crypto_encapsulate(json_encode($ret), $sitekey);
        json_return_and_die($encrypted);
        /** pickup: end */
    }
    /**
     * All other message types require us to verify the sender. This is a generic check, so we 
     * will do it once here and bail if anything goes wrong.
     */
    if (array_key_exists('sender', $data)) {
        $sender = $data['sender'];
    }
    /** Check if the sender is already verified here */
    $hub = zot_gethub($sender);
    if (!$hub) {
        /** Have never seen this guid or this guid coming from this location. Check it and register it. */
        // (!!) this will validate the sender
        $result = zot_register_hub($sender);
        if (!$result['success'] || !($hub = zot_gethub($sender))) {
            $ret['message'] = 'Hub not available.';
            logger('mod_zot: no hub');
            json_return_and_die($ret);
        }
    }
    // Update our DB to show when we last communicated successfully with this hub
    // This will allow us to prune dead hubs from using up resources
    $r = q("update hubloc set hubloc_connected = '%s' where hubloc_id = %d limit 1", dbesc(datetime_convert()), intval($hub['hubloc_id']));
    // a dead hub came back to life - reset any tombstones we might have
    if ($hub['hubloc_status'] & HUBLOC_OFFLINE) {
        q("update hubloc set hubloc_status = (hubloc_status ^ %d) where hubloc_id = %d limit 1", intval(HUBLOC_OFFLINE), intval($hub['hubloc_id']));
        if ($r[0]['hubloc_flags'] & HUBLOC_FLAGS_ORPHANCHECK) {
            q("update hubloc set hubloc_flags = (hubloc_flags ^ %d) where hubloc_id = %d limit 1", intval(HUBLOC_FLAGS_ORPHANCHECK), intval($hub['hubloc_id']));
        }
        q("update xchan set xchan_flags = (xchan_flags ^ %d) where (xchan_flags & %d) and xchan_hash = '%s' limit 1", intval(XCHAN_FLAGS_ORPHAN), intval(XCHAN_FLAGS_ORPHAN), dbesc($hub['hubloc_hash']));

//.........这里部分代码省略.........
    $ret['guid_sig'] = $e['xchan_guid_sig'];
    $ret['key'] = $e['xchan_pubkey'];
    $ret['name'] = $e['xchan_name'];
    $ret['name_updated'] = $e['xchan_name_date'];
    $ret['address'] = $e['xchan_addr'];
    $ret['photo_mimetype'] = $e['xchan_photo_mimetype'];
    $ret['photo'] = $e['xchan_photo_l'];
    $ret['photo_updated'] = $e['xchan_photo_date'];
    $ret['url'] = $e['xchan_url'];
    $ret['connections_url'] = $e['xchan_connurl'] ? $e['xchan_connurl'] : z_root() . '/poco/' . $e['channel_address'];
    $ret['target'] = $ztarget;
    $ret['target_sig'] = $zsig;
    $ret['searchable'] = $searchable;
    $ret['adult_content'] = $adult_channel;
    if ($deleted) {
        $ret['deleted'] = $deleted;
    }
    // premium or other channel desiring some contact with potential followers before connecting.
    // This is a template - %s will be replaced with the follow_url we discover for the return channel.
    if ($special_channel) {
        $ret['connect_url'] = z_root() . '/connect/' . $e['channel_address'];
    }
    // This is a template for our follow url, %s will be replaced with a webbie
    $ret['follow_url'] = z_root() . '/follow?f=&url=%s';
    $ztarget_hash = $ztarget && $zsig ? make_xchan_hash($ztarget, $zsig) : '';
    $permissions = get_all_perms($e['channel_id'], $ztarget_hash, false);
    if ($ztarget_hash) {
        $permissions['connected'] = false;
        $b = q("select * from abook where abook_xchan = '%s' and abook_channel = %d limit 1", dbesc($ztarget_hash), intval($e['channel_id']));
        if ($b) {
            $permissions['connected'] = true;
        }
    }
    $ret['permissions'] = $ztarget && $zkey ? crypto_encapsulate(json_encode($permissions), $zkey) : $permissions;
    if ($permissions['view_profile']) {
        $ret['profile'] = $profile;
    }
    // array of (verified) hubs this channel uses
    $ret['locations'] = array();
    $x = zot_get_hublocs($e['channel_hash']);
    if ($x && count($x)) {
        foreach ($x as $hub) {
            if (!($hub['hubloc_flags'] & HUBLOC_FLAGS_UNVERIFIED)) {
                $ret['locations'][] = array('host' => $hub['hubloc_host'], 'address' => $hub['hubloc_addr'], 'primary' => $hub['hubloc_flags'] & HUBLOC_FLAGS_PRIMARY ? true : false, 'url' => $hub['hubloc_url'], 'url_sig' => $hub['hubloc_url_sig'], 'callback' => $hub['hubloc_callback'], 'sitekey' => $hub['hubloc_sitekey'], 'deleted' => $hub['hubloc_flags'] & HUBLOC_FLAGS_DELETED ? true : false);
            }
        }
    }
    $ret['site'] = array();
    $ret['site']['url'] = z_root();
    $ret['site']['url_sig'] = base64url_encode(rsa_sign(z_root(), $e['channel_prvkey']));
    $dirmode = get_config('system', 'directory_mode');
    if ($dirmode === false || $dirmode == DIRECTORY_MODE_NORMAL) {
        $ret['site']['directory_mode'] = 'normal';
    }
    if ($dirmode == DIRECTORY_MODE_PRIMARY) {
        $ret['site']['directory_mode'] = 'primary';
    } elseif ($dirmode == DIRECTORY_MODE_SECONDARY) {
        $ret['site']['directory_mode'] = 'secondary';
    } elseif ($dirmode == DIRECTORY_MODE_STANDALONE) {
        $ret['site']['directory_mode'] = 'standalone';
    }
    if ($dirmode != DIRECTORY_MODE_NORMAL) {
        $ret['site']['directory_url'] = z_root() . '/dirsearch';
    }
    // hide detailed site information if you're off the grid
    if ($dirmode != DIRECTORY_MODE_STANDALONE) {

/**
 * @brief
 *
 * We received a notification packet (in mod/post.php) that a message is waiting for us, and we've verified the sender.
 * Now send back a pickup message, using our message tracking ID ($arr['secret']), which we will sign with our site private key.
 * The entire pickup message is encrypted with the remote site's public key.
 * If everything checks out on the remote end, we will receive back a packet containing one or more messages,
 * which will be processed and delivered before this function ultimately returns.
 *
 * @see zot_import()
 *
 * @param array $arr
 *     decrypted and json decoded notify packet from remote site
 * @return array from zot_import()
 */
function zot_fetch($arr)
{
    logger('zot_fetch: ' . print_r($arr, true), LOGGER_DATA);
    $url = $arr['sender']['url'] . $arr['callback'];
    $ret_hub = zot_gethub($arr['sender']);
    if (!$ret_hub) {
        logger('zot_fetch: no hub: ' . print_r($arr['sender'], true));
        return;
    }
    $data = array('type' => 'pickup', 'url' => z_root(), 'callback_sig' => base64url_encode(rsa_sign(z_root() . '/post', get_config('system', 'prvkey'))), 'callback' => z_root() . '/post', 'secret' => $arr['secret'], 'secret_sig' => base64url_encode(rsa_sign($arr['secret'], get_config('system', 'prvkey'))));
    $datatosend = json_encode(crypto_encapsulate(json_encode($data), $ret_hub['hubloc_sitekey']));
    $fetch = zot_zot($url, $datatosend);
    $result = zot_import($fetch, $arr['sender']['url']);
    return $result;
}