Merge a32ce9f941 into b90a0fa013

VKAPI/Handlers/Audio.php

@@ -21,7 +21,13 @@ final class Audio extends VKAPIRequestHandler
             $this->fail(201, "Access denied to audio(" . $audio->getId() . ")");
         }
 
+        # рофлан ебало
+        $privApi  = $hash && $GLOBALS["csrfCheck"];
         $audioObj = $audio->toVkApiStruct($this->getUser());
+        if (!$privApi) {
+            $audioObj->manifest = false;
+            $audioObj->keys     = false;
+        }
 
         if ($need_user) {
             $user = (new \openvk\Web\Models\Repositories\Users())->get($audio->getOwner()->getId());

Web/Models/Entities/Note.php

@@ -6,42 +6,12 @@ namespace openvk\Web\Models\Entities;
 
 use HTMLPurifier_Config;
 use HTMLPurifier;
-use HTMLPurifier_Filter;
-
-class SecurityFilter extends HTMLPurifier_Filter
-{
-    public function preFilter($html, $config, $context)
-    {
-        $html = preg_replace_callback(
-            '/<img[^>]*src\s*=\s*["\']([^"\']*)["\'][^>]*>/i',
-            function ($matches) {
-                $originalSrc = $matches[1];
-                $src = $originalSrc;
-
-                if (OPENVK_ROOT_CONF["openvk"]["preferences"]["notes"]["disableHotlinking"] ?? true) {
-                    if (!str_contains($src, "/image.php?url=")) {
-                        $src = '/image.php?url=' . base64_encode($originalSrc);
-                    } /*else {
-                        $src = preg_replace_callback('/(.*)\/image\.php\?url=(.*)/i', function ($matches) {
-                            return base64_decode($matches[2]);
-                        }, $src);
-                    }*/
-                }
-
-                return str_replace($originalSrc, $src, $matches[0]);
-            },
-            $html
-        );
-
-        return $html;
-    }
-}
 
 class Note extends Postable
 {
     protected $tableName = "notes";
 
-    protected function renderHTML(?string $content = null): string
+    protected function renderHTML(): string
     {
         $config = HTMLPurifier_Config::createDefault();
         $config->set("Attr.AllowedClasses", []);
@@ -108,10 +78,8 @@ class Note extends Postable
         $config->set("Attr.AllowedClasses", [
             "underline",
         ]);
-        $config->set('Filter.Custom', [new SecurityFilter()]);
 
-        $source = $content;
-        if (!$source) {
+        $source = null;
         if (is_null($this->getRecord())) {
             if (isset($this->changes["source"])) {
                 $source = $this->changes["source"];
@@ -121,7 +89,6 @@ class Note extends Postable
         } else {
             $source = $this->getRecord()->source;
         }
-        }
 
         $purifier = new HTMLPurifier($config);
         return $purifier->purify($source);
@@ -150,7 +117,7 @@ class Note extends Postable
             $this->save();
         }
 
-        return $this->renderHTML($cached);
+        return $cached;
     }
 
     public function getSource(): string

Web/Presenters/InternalAPIPresenter.php

@@ -176,26 +176,4 @@ final class InternalAPIPresenter extends OpenVKPresenter
             exit('');
         }
     }
-
-    public function renderImageFilter()
-    {
-        $is_enabled = OPENVK_ROOT_CONF["openvk"]["preferences"]["notes"]["disableHotlinking"] ?? true;
-        $allowed_hosts = OPENVK_ROOT_CONF["openvk"]["preferences"]["notes"]["allowedHosts"] ?? [];
-
-        $url = $this->requestParam("url");
-        $url = base64_decode($url);
-
-        if (!$is_enabled) {
-            $this->redirect($url);
-        }
-
-        $url_parsed = parse_url($url);
-        $host = $url_parsed['host'];
-
-        if (in_array($host, $allowed_hosts)) {
-            $this->redirect($url);
-        } else {
-            $this->redirect('/assets/packages/static/openvk/img/fn_placeholder.jpg');
-        }
-    }
 }

Web/Presenters/templates/About/Version.xml

@@ -385,8 +385,8 @@
                 <tr>
                     <td class="e">
                         Vladimir Barinov (veselcraft), Celestora, Konstantin Kichulkin (kosfurler),
-                        Daniel Myslivets, Maxim Leshchenko (maksales / maksalees), n1rwana,
-                        Jillian Österreich (Lumaeris) and MrIlyew (V00d00 M4g1c)
+                        Daniel Myslivets, Maxim Leshchenko (maksales / maksalees), n1rwana and
+                        Jillian Österreich (Lumaeris)
                     </td>
                 </tr>
             </tbody>
@@ -472,7 +472,7 @@
             </tbody>
         </table>
 
-        {*<table>
+        <table>
             <tbody>
                 <tr class="h">
                     <th>OpenVK QA Team</th>
@@ -486,7 +486,7 @@
                     </td>
                 </tr>
             </tbody>
-        </table>*}
+        </table>
 
         <hr/>
 

Web/Presenters/templates/components/textArea.xml

@@ -22,8 +22,6 @@
 
                 {if !is_null($thisUser) && !is_null($club ?? NULL) && $owner < 0}
                     {if $club->canBeModifiedBy($thisUser)}
-                        {var $anonHide = true}
-
                         <script>
                             function onWallAsGroupClick(el) {
                                 document.querySelector("#forceSignOpt").style.display = el.checked ? "block" : "none";
@@ -43,7 +41,7 @@
                     {/if}
                 {/if}
                 
-                <label n:if="$anonEnabled" id="octoberAnonOpt" {if $anonHide}style="display: none;"{/if}>
+                <label n:if="$anonEnabled" id="octoberAnonOpt" style="display: none;">
                     <input type="checkbox" name="anon" /> {_as_anonymous}
                 </label>
                 

Web/routes.yml

@@ -413,8 +413,6 @@ routes:
       handler: "InternalAPI->getPhotosFromPost"
     - url: "/iapi/getPostTemplate/{num}_{num}"
       handler: "InternalAPI->getPostTemplate"
-    - url: "/image.php"
-      handler: "InternalAPI->imageFilter"
     - url: "/tour"
       handler: "About->tour"
     - url: "/fave"

openvk-example.yml

@@ -60,9 +60,6 @@ openvk:
             exposeOriginalURLs: true
         newsfeed:
             ignoredSourcesLimit: 50
-        notes:
-            disableHotlinking: true
-            allowedHosts: []
         wall:
             christian: false
             anonymousPosting: