.gitlab-ci.yml

@@ -9,6 +9,7 @@ stages:
   - prepare
   - review
   - deploy:staging
+  - qa
   - deploy:canary
   - deploy:production
 
@@ -127,6 +128,17 @@ review:stop:
       - master
       - test/gitlab-ci
 
+qa:manual:
+  stage: qa
+  script:
+    - echo "Manually approved"
+  when: manual
+  only:
+    refs:
+      - master
+      - test/gitlab-ci
+  allow_failure: false
+
 staging:fpm:
   stage: deploy:staging
   image: minds/ci:latest

Api/Factory.php

@@ -2,11 +2,12 @@
 
 namespace Minds\Api;
 
+use Minds\Core\Di\Di;
+use Minds\Core\Pro\Domain\Security as ProDomainSecurity;
 use Minds\Interfaces;
 use Minds\Helpers;
 use Minds\Core\Security;
 use Minds\Core\Session;
-use Minds\Core\Di\Di;
 
 /**
  * API Factory
@@ -33,6 +34,7 @@ class Factory
         $loop = count($segments);
         while ($loop >= 0) {
             $offset = $loop -1;
+
             if ($loop < count($segments)) {
                 $slug_length = strlen($segments[$offset+1].'\\');
                 $route_length = strlen($route);
@@ -43,32 +45,51 @@ class Factory
             $actual = str_replace('\\', '/', $route);
             if (isset(Routes::$routes[$actual])) {
                 $class_name = Routes::$routes[$actual];
+
                 if (class_exists($class_name)) {
                     $handler = new $class_name();
+
+                    if (property_exists($handler, 'request')) {
+                        $handler->request = $request;
+                    }
+
                     if ($handler instanceof Interfaces\ApiAdminPam) {
                         self::adminCheck();
                     }
+
                     if (!$handler instanceof Interfaces\ApiIgnorePam) {
                         self::pamCheck($request, $response);
                     }
+
                     $pages = array_splice($segments, $loop) ?: [];
+
                     return $handler->$method($pages);
                 }
             }
 
             //autloaded routes
             $class_name = "\\Minds\\Controllers\api\\$route";
+
             if (class_exists($class_name)) {
                 $handler = new $class_name();
+
+                if (property_exists($handler, 'request')) {
+                    $handler->request = $request;
+                }
+
                 if ($handler instanceof Interfaces\ApiAdminPam) {
                     self::adminCheck();
                 }
+
                 if (!$handler instanceof Interfaces\ApiIgnorePam) {
                     self::pamCheck($request, $response);
                 }
+
                 $pages = array_splice($segments, $loop) ?: [];
+
                 return $handler->$method($pages);
             }
+
             --$loop;
         }
     }
@@ -79,15 +100,18 @@ class Factory
      */
     public static function pamCheck($request, $response)
     {
-        if ($request->getAttribute('oauth_user_id')
-            || Security\XSRF::validateRequest()
+        if (
+            $request->getAttribute('oauth_user_id') ||
+            Security\XSRF::validateRequest()
         ) {
             return true;
         } else {
             //error_log('failed authentication:: OAUTH via API');
             ob_end_clean();
+
+            static::setCORSHeader();
+
             header('Content-type: application/json');
-            header("Access-Control-Allow-Origin: *");
             header('HTTP/1.1 401 Unauthorized', true, 401);
             echo json_encode([
                 'error' => 'Sorry, you are not authenticated',
@@ -109,8 +133,10 @@ class Factory
         } else {
             error_log('security: unauthorized access to admin api');
             ob_end_clean();
+
+            static::setCORSHeader();
+
             header('Content-type: application/json');
-            header("Access-Control-Allow-Origin: *");
             header('HTTP/1.1 401 Unauthorized', true, 401);
             echo json_encode(['error'=>'You are not an admin', 'code'=>401]);
             exit;
@@ -127,8 +153,10 @@ class Factory
             return true;
         } else {
             ob_end_clean();
+
+            static::setCORSHeader();
+
             header('Content-type: application/json');
-            header("Access-Control-Allow-Origin: *");
             header('HTTP/1.1 401 Unauthorized', true, 401);
             echo json_encode([
               'status' => 'error',
@@ -152,11 +180,26 @@ class Factory
 
         ob_end_clean();
 
+        static::setCORSHeader();
+
         header('Content-type: application/json');
-        header("Access-Control-Allow-Origin: *");
         echo json_encode($data);
     }
 
+    /**
+     * Sets the CORS header, if not already set
+     */
+    public static function setCORSHeader(): void
+    {
+        $wasSet = count(array_filter(headers_list(), function ($header) {
+            return stripos($header, 'Access-Control-Allow-Origin:') === 0;
+        })) > 0;
+
+        if (!$wasSet) {
+            header("Access-Control-Allow-Origin: *");
+        }
+    }
+
     /**
      * Returns the exportable form of the entities
      * @param array $entities - an array of entities

Common/Jwt.php

+<?php
+/**
+ * Jwt
+ * @author edgebal
+ */
+
+namespace Minds\Common;
+
+use Exception;
+use Lcobucci\JWT\Builder;
+use Lcobucci\JWT\Claim;
+use Lcobucci\JWT\Parser;
+use Lcobucci\JWT\Signer\Hmac\Sha256;
+
+class Jwt
+{
+    /** @var string */
+    protected $key;
+
+    /**
+     * @param string $key
+     * @return Jwt
+     */
+    public function setKey(string $key): Jwt
+    {
+        $this->key = $key;
+        return $this;
+    }
+
+    /**
+     * @param object|array $payload
+     * @param int|null $exp
+     * @param int|null $nbf
+     * @return string
+     * @throws Exception
+     */
+    public function encode($payload, $exp = null, $nbf = null): string
+    {
+        if (!$this->key) {
+            throw new Exception('Invalid JWT key');
+        }
+
+        $builder = new Builder();
+
+        foreach ($payload as $key => $value) {
+            $builder->set($key, $value);
+        }
+
+        if ($exp !== null) {
+            $builder->setExpiration($exp);
+        }
+
+        if ($nbf !== null) {
+            $builder->setNotBefore($nbf);
+        }
+
+        $builder->sign(new Sha256(), $this->key);
+
+        return (string) $builder->getToken();
+    }
+
+    /**
+     * @param string $jwt
+     * @return array
+     * @throws Exception
+     */
+    public function decode($jwt): array
+    {
+        if (!$this->key) {
+            throw new Exception('Invalid JWT key');
+        }
+
+        $token = (new Parser())->parse($jwt);
+
+        if (!$token->verify(new Sha256(), $this->key)) {
+            throw new Exception('Invalid JWT');
+        }
+
+        return array_map(function (Claim $claim) {
+            return $claim->getValue();
+        }, $token->getClaims());
+    }
+
+    /**
+     * @return string
+     */
+    public function randomString(): string
+    {
+        $bytes = openssl_random_pseudo_bytes(128);
+        return hash('sha512', $bytes);
+    }
+}

Common/Repository/Response.php

@@ -328,4 +328,13 @@ class Response implements \Iterator, \ArrayAccess, \Countable, \JsonSerializable
     {
         return array_reduce($this->data, $callback, $initialValue);
     }
+
+    /**
+     * Returns the first element of the Response, or null if empty
+     * @return mixed|null
+     */
+    public function first()
+    {
+        return $this->data[0] ?? null;
+    }
 }

Controllers/api/v1/authenticate.php

@@ -16,6 +16,8 @@ use Minds\Entities;
 use Minds\Interfaces;
 use Minds\Api\Factory;
 use Minds\Exceptions\TwoFactorRequired;
+use Minds\Core\Queue;
+use Minds\Core\Subscriptions;
 
 class authenticate implements Interfaces\Api, Interfaces\ApiIgnorePam
 {
@@ -44,6 +46,7 @@ class authenticate implements Interfaces\Api, Interfaces\ApiIgnorePam
         }
 
         $user = new Entities\User(strtolower($_POST['username']));
+
         /** @var Core\Security\LoginAttempts $attempts */
         $attempts = Core\Di\Di::_()->get('Security\LoginAttempts');
 
@@ -116,8 +119,9 @@ class authenticate implements Interfaces\Api, Interfaces\ApiIgnorePam
 
     public function delete($pages)
     {
+        /** @var Core\Sessions\Manager $sessions */
         $sessions = Di::_()->get('Sessions\Manager');
-        
+
         if (isset($pages[0]) && $pages[0] === 'all') {
             $sessions->destroy(true);
         } else {

Controllers/api/v1/blog.php

@@ -362,7 +362,7 @@ class blog implements Interfaces\Api
         }
 
         if ($saved) {
-            if ($blog->isPublished() && $blog->getAccessId() == Access::PUBLIC) {
+            if ($blog->isPublished() && in_array($blog->getAccessId(), [Access::PUBLIC, Access::LOGGED_IN], false)) {
                 if (!$editing || ($editing && !$alreadyPublished) || ($editing && $oldAccessId == Access::UNLISTED)) {
                     (new CreateActivity())->save($blog);
                 }

Controllers/api/v1/channel.php

@@ -92,6 +92,19 @@ class channel implements Interfaces\Api
         $block = Core\Security\ACL\Block::_();
         $response['channel']['blocked'] = $block->isBlocked($user);
 
+        if ($user->isPro()) {
+            /** @var Core\Pro\Manager $manager */
+            $manager = Core\Di\Di::_()->get('Pro\Manager');
+            $manager
+                ->setUser($user);
+
+            $proSettings = $manager->get();
+
+            if ($proSettings) {
+                $response['channel']['pro_settings'] = $proSettings;
+            }
+        }
+
         return Factory::response($response);
     }
 

Controllers/api/v1/newsfeed.php

@@ -514,9 +514,6 @@ class newsfeed implements Interfaces\Api
                     $activity->indexes = ["activity:$activity->owner_guid:edits"]; //don't re-index on edit
                     (new Core\Translation\Storage())->purge($activity->guid);
 
-                    $attachmentPaywallDelegate = new Core\Feeds\Activity\Delegates\AttachmentPaywallDelegate();
-                    $attachmentPaywallDelegate->onUpdate($activity);
-
                     if (isset($_POST['time_created']) && ($_POST['time_created'] != $activity->getTimeCreated())) {
                         try {
                             $timeCreatedDelegate = new Core\Feeds\Activity\Delegates\TimeCreatedDelegate();
@@ -532,6 +529,8 @@ class newsfeed implements Interfaces\Api
                     $save->setEntity($activity)
                         ->save();
 
+                    (new Core\Entities\PropagateProperties())->from($activity);
+
                     $activity->setExportContext(true);
                     return Factory::response(['guid' => $activity->guid, 'activity' => $activity->export(), 'edited' => true]);
                 }

Controllers/api/v1/register.php

@@ -5,14 +5,14 @@
  * @version 1
  * @author Mark Harding
  */
+
 namespace Minds\Controllers\api\v1;
 
+use Minds\Api\Factory;
 use Minds\Core;
 use Minds\Core\Di\Di;
-use Minds\Entities;
+use Minds\Entities\User;
 use Minds\Interfaces;
-use Minds\Api\Factory;
-use Minds\Helpers;
 
 class register implements Interfaces\Api, Interfaces\ApiIgnorePam
 {
@@ -21,7 +21,7 @@ class register implements Interfaces\Api, Interfaces\ApiIgnorePam
      */
     public function get($pages)
     {
-        return Factory::response(['status'=>'error', 'message'=>'GET is not supported for this endpoint']);
+        return Factory::response(['status' => 'error', 'message' => 'GET is not supported for this endpoint']);
     }
 
     /**
@@ -37,11 +37,11 @@ class register implements Interfaces\Api, Interfaces\ApiIgnorePam
     public function post($pages)
     {
         if (!isset($_POST['username']) || !isset($_POST['password']) || !isset($_POST['username']) || !isset($_POST['email'])) {
-            return Factory::response(['status'=>'error']);
+            return Factory::response(['status' => 'error']);
         }
 
         if (!$_POST['username'] || !$_POST['password'] || !$_POST['username'] || !$_POST['email']) {
-            return Factory::response(['status'=>'error', 'message' => "Please fill out all the fields"]);
+            return Factory::response(['status' => 'error', 'message' => "Please fill out all the fields"]);
         }
 
         try {
@@ -119,11 +119,11 @@ class register implements Interfaces\Api, Interfaces\ApiIgnorePam
             $sessions->save(); // Save to db and cookie
 
             $response = [
-              'guid' => $guid,
-              'user' => $user->export()
+                'guid' => $guid,
+                'user' => $user->export(),
             ];
         } catch (\Exception $e) {
-            $response = ['status'=>'error', 'message'=>$e->getMessage()];
+            $response = ['status' => 'error', 'message' => $e->getMessage()];
         }
         return Factory::response($response);
     }

Controllers/api/v1/settings.php

@@ -69,10 +69,6 @@ class settings implements Interfaces\Api
     {
         Factory::isLoggedIn();
 
-        if (!Core\Security\XSRF::validateRequest()) {
-            //return false;
-        }
-
         if (Core\Session::getLoggedInUser()->isAdmin() && isset($pages[0])) {
             $user = new entities\User($pages[0]);
         } else {

Controllers/api/v2/admin/pro.php

+<?php
+/**
+ * pro
+ *
+ * @author edgebal
+ */
+
+namespace Minds\Controllers\api\v2\admin;
+
+use Minds\Api\Factory;
+use Minds\Core\Pro\Manager;
+use Minds\Entities\User as UserEntity;
+use Minds\Interfaces;
+use Minds\Core\Di\Di;
+
+class pro implements Interfaces\Api, Interfaces\ApiAdminPam
+{
+    /**
+     * Equivalent to HTTP GET method
+     * @param array $pages
+     * @return mixed|null
+     */
+    public function get($pages)
+    {
+        return Factory::response([]);
+    }
+
+    /**
+     * Equivalent to HTTP POST method
+     * @param array $pages
+     * @return mixed|null
+     */
+    public function post($pages)
+    {
+        return Factory::response([]);
+    }
+
+    /**
+     * Equivalent to HTTP PUT method
+     * @param array $pages
+     * @return mixed|null
+     */
+    public function put($pages)
+    {
+        if (!($pages[0] ?? null)) {
+            return Factory::response([
+                'status' => 'error',
+                'message' => 'Emtpy target',
+            ]);
+        }
+
+        $target = new UserEntity($pages[0]);
+
+        if (!$target || !$target->guid) {
+            return Factory::response([
+                'status' => 'error',
+                'message' => 'Invalid target',
+            ]);
+        }
+
+        /** @var Manager $manager */
+        $manager = Di::_()->get('Pro\Manager');
+        $manager
+            ->setUser($target);
+
+        $success = $manager->enable(time() + (365 * 86400));
+
+        if (!$success) {
+            return Factory::response([
+                'status' => 'error',
+                'message' => 'Error disabling Pro',
+            ]);
+        }
+
+        return Factory::response([]);
+    }
+
+    /**
+     * Equivalent to HTTP DELETE method
+     * @param array $pages
+     * @return mixed|null
+     */
+    public function delete($pages)
+    {
+        if (!($pages[0] ?? null)) {
+            return Factory::response([
+                'status' => 'error',
+                'message' => 'Emtpy target',
+            ]);
+        }
+
+        $target = new UserEntity($pages[0]);
+
+        if (!$target || !$target->guid) {
+            return Factory::response([
+                'status' => 'error',
+                'message' => 'Invalid target',
+            ]);
+        }
+
+        /** @var Manager $manager */
+        $manager = Di::_()->get('Pro\Manager');
+        $manager
+            ->setUser($target);
+
+        $success = $manager->disable();
+
+        if (!$success) {
+            return Factory::response([
+                'status' => 'error',
+                'message' => 'Error disabling Pro',
+            ]);
+        }
+
+        return Factory::response([]);
+    }
+}

Controllers/api/v2/analytics/views.php

@@ -67,46 +67,49 @@ class views implements Interfaces\Api
                 ]);
                 break;
             case 'activity':
-                $activity = new Entities\Activity($pages[1]);
+            case 'entity':
+                $entity = Entities\Factory::build($pages[1]);
 
-                if (!$activity->guid) {
+                if (!$entity) {
                     return Factory::response([
                         'status' => 'error',
-                        'message' => 'Could not find activity post'
+                        'message' => 'Could not the entity'
                     ]);
                 }
 
-                try {
-                    Core\Analytics\App::_()
+                if ($entity->type === 'activity') {
+                    try {
+                        Core\Analytics\App::_()
                         ->setMetric('impression')
-                        ->setKey($activity->guid)
+                        ->setKey($entity->guid)
                         ->increment();
 
-                    if ($activity->remind_object) {
-                        Core\Analytics\App::_()
+                        if ($entity->remind_object) {
+                            Core\Analytics\App::_()
                             ->setMetric('impression')
-                            ->setKey($activity->remind_object['guid'])
+                            ->setKey($entity->remind_object['guid'])
                             ->increment();
 
-                        Core\Analytics\App::_()
+                            Core\Analytics\App::_()
                             ->setMetric('impression')
-                            ->setKey($activity->remind_object['owner_guid'])
+                            ->setKey($entity->remind_object['owner_guid'])
                             ->increment();
-                    }
+                        }
 
-                    Core\Analytics\User::_()
+                        Core\Analytics\User::_()
                         ->setMetric('impression')
-                        ->setKey($activity->owner_guid)
+                        ->setKey($entity->owner_guid)
                         ->increment();
-                } catch (\Exception $e) {
-                    error_log($e->getMessage());
+                    } catch (\Exception $e) {
+                        error_log($e->getMessage());
+                    }
                 }
 
                 try {
                     $viewsManager->record(
                         (new Core\Analytics\Views\View())
-                            ->setEntityUrn($activity->getUrn())
-                            ->setOwnerGuid((string) $activity->getOwnerGuid())
+                            ->setEntityUrn($entity->getUrn())
+                            ->setOwnerGuid((string) $entity->getOwnerGuid())
                             ->setClientMeta($_POST['client_meta'] ?? [])
                     );
                 } catch (\Exception $e) {
@@ -114,7 +117,7 @@ class views implements Interfaces\Api
                 }
 
                 Di::_()->get('Referrals\Cookie')
-                    ->setEntity($activity)
+                    ->setEntity($entity)
                     ->create();
 
                 break;

Controllers/api/v2/boost/feed.php

@@ -124,10 +124,14 @@ class feed implements Interfaces\Api
                     //     $next = 0;
                     // }
                     $len = count($boosts);
-                    $next = $boosts[$len -1]->getTimestamp();
+                    if ($boosts[$len -1]) {
+                        $next = $boosts[$len -1]->getTimestamp();
+                    }
                 } elseif ($isBoostFeed) {
                     $len = count($boosts);
-                    $next = $boosts[$len -1]->getTimestamp();
+                    if ($boosts[$len -1]) {
+                        $next = $boosts[$len -1]->getTimestamp();
+                    }
                 }
 
                 // $ttl = 1800; // 30 minutes

Controllers/api/v2/pro.php

+<?php
+/**
+ * pro
+ * @author edgebal
+ */
+
+namespace Minds\Controllers\api\v2;
+
+use Exception;
+use Minds\Core\Di\Di;
+use Minds\Core\Pro\Manager;
+use Minds\Core\Session;
+use Minds\Interfaces;
+use Minds\Api\Factory;
+
+class pro implements Interfaces\Api
+{
+    /**
+     * Equivalent to HTTP GET method
+     * @param array $pages
+     * @return mixed|null
+     * @throws Exception
+     */
+    public function get($pages)
+    {
+        /** @var Manager $manager */
+        $manager = Di::_()->get('Pro\Manager');
+        $manager
+            ->setUser(Session::getLoggedinUser());
+
+        return Factory::response([
+            'isActive' => $manager->isActive(),
+        ]);
+    }
+
+    /**
+     * Equivalent to HTTP POST method
+     * @param array $pages
+     * @return mixed
+     */
+    public function post($pages)
+    {
+        return Factory::response([
+            'status' => 'error',
+            'message' => 'Minds Pro is not yet publicly available.',
+        ]);
+
+        // /** @var Manager $manager */
+        // $manager = Di::_()->get('Pro\Manager');
+        // $manager
+        //     ->setUser(Session::getLoggedinUser());
+        //
+        // // TODO: Send and process payment data
+        // $success = $manager->enable(time() + (365 * 86400));
+        //
+        // if (!$success) {
+        //     return Factory::response([
+        //         'status' => 'error',
+        //         'message' => 'Error activating Pro',
+        //     ]);
+        // }
+        //
+        // return Factory::response([
+        //     'isActive' => $manager->isActive(),
+        //     'settings' => $manager->get(),
+        // ]);
+    }
+
+    /**
+     * Equivalent to HTTP PUT method
+     * @param array $pages
+     * @return mixed|null
+     */
+    public function put($pages)
+    {
+        return Factory::response([]);
+    }
+
+    /**
+     * Equivalent to HTTP DELETE method
+     * @param array $pages
+     * @return mixed
+     */
+    public function delete($pages)
+    {
+        /** @var Manager $manager */
+        $manager = Di::_()->get('Pro\Manager');
+        $manager
+            ->setUser(Session::getLoggedinUser());
+
+        $success = $manager->disable();
+
+        if (!$success) {
+            return Factory::response([
+                'status' => 'error',
+                'message' => 'Error disabling Pro',
+            ]);
+        }
+
+        return Factory::response([]);
+    }
+}

Controllers/api/v2/pro/channel.php

+<?php
+/**
+ * channel
+ * @author edgebal
+ */
+
+namespace Minds\Controllers\api\v2\pro;
+
+use Exception;
+use Minds\Core\Di\Di;
+use Minds\Core\Pro\Channel\Manager as ChannelManager;
+use Minds\Core\Pro\Manager;
+use Minds\Core\Session;
+use Minds\Entities\User;
+use Minds\Helpers\Campaigns\Referrals;
+use Minds\Interfaces;
+use Minds\Api\Factory;
+
+class channel implements Interfaces\Api
+{
+    public $request;
+
+    /**
+     * Equivalent to HTTP GET method
+     * @param array $pages
+     * @return mixed|null
+     * @throws Exception
+     */
+    public function get($pages)
+    {
+        $currentUser = Session::getLoggedinUser();
+
+        $channel = new User($pages[0]);
+        $channel->fullExport = true; //get counts
+        $channel->exportCounts = true;
+
+        if (!$channel->isPro()) {
+            return Factory::response([
+                'status' => 'error',
+                'message' => 'E_NOT_PRO'
+            ]);
+        }
+
+        /** @var Manager $manager */
+        $manager = Di::_()->get('Pro\Manager');
+        $manager->setUser($channel);
+
+        /** @var ChannelManager $manager */
+        $channelManager = Di::_()->get('Pro\Channel\Manager');
+        $channelManager->setUser($channel);
+
+        switch ($pages[1] ?? '') {
+            case 'content':
+                return Factory::response([
+                    'content' => $channelManager->getAllCategoriesContent(),
+                ]);
+
+            default:
+                $proSettings = $manager->get();
+
+                $exportedChannel = $channel->export();
+                $exportedChannel['pro_settings'] = $proSettings;
+
+                $origin = strtolower($this->request->getServerParams()['HTTP_X_MINDS_ORIGIN'] ?? '');
+                $domain = strtolower($proSettings->getDomain());
+
+                if ($domain === $origin) {
+                    Referrals::register($channel->username);
+                }
+
+                return Factory::response([
+                    'channel' => $exportedChannel,
+                    'me' => $currentUser ? $currentUser->export() : null,
+                ]);
+        }
+    }
+
+    /**
+     * Equivalent to HTTP POST method
+     * @param array $pages
+     * @return mixed|null
+     */
+    public function post($pages)
+    {
+        return Factory::response([]);
+    }
+
+    /**
+     * Equivalent to HTTP PUT method
+     * @param array $pages
+     * @return mixed|null
+     */
+    public function put($pages)
+    {
+        return Factory::response([]);
+    }
+
+    /**
+     * Equivalent to HTTP DELETE method
+     * @param array $pages
+     * @return mixed|null
+     */
+    public function delete($pages)
+    {
+        return Factory::response([]);
+    }
+}

Controllers/api/v2/pro/content.php

+<?php
+/**
+ * @author: eiennohi.
+ */
+
+namespace Minds\Controllers\api\v2\pro;
+
+use Minds\Api\Exportable;
+use Minds\Api\Factory;
+use Minds\Common\Repository\Response;
+use Minds\Core;
+use Minds\Core\Di\Di;
+use Minds\Entities\Factory as EntitiesFactory;
+use Minds\Entities\User;
+use Minds\Interfaces;
+
+class content implements Interfaces\Api
+{
+    const MIN_COUNT = 6;
+
+    public function get($pages)
+    {
+        /** @var User $currentUser */
+        $currentUser = Core\Session::getLoggedinUser();
+
+        $container_guid = $pages[0] ?? null;
+        $owner_guid = null;
+
+        if (!$container_guid) {
+            return Factory::response([
+                'status' => 'error',
+                'message' => 'Invalid container',
+            ]);
+        }
+
+        $container = EntitiesFactory::build($container_guid);
+
+        if (!$container || !Core\Security\ACL::_()->read($container, $currentUser)) {
+            return Factory::response([
+                'status' => 'error',
+                'message' => 'Forbidden',
+            ]);
+        }
+
+        $type = '';
+        switch ($pages[1]) {
+            case 'activities':
+                $type = 'activity';
+                break;
+            case 'images':
+                $type = 'object:image';
+                break;
+            case 'videos':
+                $type = 'object:video';
+                break;
+            case 'blogs':
+                $type = 'object:blog';
+                break;
+            case 'groups':
+                $type = 'group';
+                $container_guid = null;
+                $owner_guid = $pages[0];
+                break;
+            case 'all':
+                $type = 'all';
+                break;
+        }
+
+        $hardLimit = 5000;
+        $offset = 0;
+
+        if (isset($_GET['offset'])) {
+            $offset = intval($_GET['offset']);
+        }
+
+        $limit = 12;
+
+        if (isset($_GET['limit'])) {
+            $limit = abs(intval($_GET['limit']));
+        }
+
+        if (($offset + $limit) > $hardLimit) {
+            $limit = $hardLimit - $offset;
+        }
+
+        if ($limit <= 0) {
+            return Factory::response([
+                'status' => 'success',
+                'entities' => [],
+                'load-next' => $hardLimit,
+                'overflow' => true,
+            ]);
+        }
+
+        $sync = (bool) ($_GET['sync'] ?? false);
+
+        $fromTimestamp = $_GET['from_timestamp'] ?? 0;
+
+        $exclude = explode(',', $_GET['exclude'] ?? '');
+
+        $forcePublic = (bool) ($_GET['force_public'] ?? false);
+
+        $asActivities = (bool) ($_GET['as_activities'] ?? true);
+
+        $query = null;
+
+        if (isset($_GET['query'])) {
+            $query = $_GET['query'];
+        }
+
+        /** @var Core\Feeds\Top\Entities $entities */
+        $entities = new Core\Feeds\Top\Entities();
+        $entities->setActor($currentUser);
+
+        $isOwner = false;
+
+        if ($currentUser) {
+            $entities->setActor($currentUser);
+            $isOwner = $currentUser->guid == $container_guid;
+        }
+
+        $opts = [
+            'cache_key' => $currentUser ? $currentUser->guid : null,
+            'container_guid' => $container_guid,
+            'owner_guid' => $owner_guid,
+            'access_id' => $isOwner && !$forcePublic ? [0, 1, 2, $container_guid] : [2, $container_guid],
+            'custom_type' => null,
+            'limit' => $limit,
+            'type' => $type,
+            'algorithm' => 'top',
+            'period' => '7d',
+            'sync' => $sync,
+            'from_timestamp' => $fromTimestamp,
+            'query' => $query,
+            'single_owner_threshold' => 0,
+            'pinned_guids' => $type === 'activity' ? array_reverse($container->getPinnedPosts()) : null,
+            'exclude' => $exclude,
+        ];
+
+        if (isset($_GET['nsfw'])) {
+            $nsfw = $_GET['nsfw'] ?? '';
+            $opts['nsfw'] = explode(',', $nsfw);
+        }
+
+        $hashtag = null;
+
+        if (isset($_GET['hashtag'])) {
+            $hashtag = strtolower($_GET['hashtag']);
+        }
+
+        if ($hashtag) {
+            $opts['hashtags'] = [$hashtag];
+            $opts['filter_hashtags'] = true;
+        } elseif (isset($_GET['hashtags']) && $_GET['hashtags']) {
+            $opts['hashtags'] = explode(',', $_GET['hashtags']);
+            $opts['filter_hashtags'] = true;
+        }
+
+        try {
+            $result = $this->getData($entities, $opts, $asActivities, $sync);
+
+            if ($result->count() <= static::MIN_COUNT) {
+                $opts['algorithm'] = 'latest';
+                $result = $this->getData($entities, $opts, $asActivities, $sync);
+            }
+
+            $response = [
+                'status' => 'success',
+                'entities' => Exportable::_($result),
+                'load-next' => $result->getPagingToken(),
+            ];
+
+            return Factory::response($response);
+        } catch (\Exception $e) {
+            error_log($e);
+            return Factory::response(['status' => 'error', 'message' => $e->getMessage()]);
+        }
+    }
+
+    /**
+     * @param Core\Feeds\Top\Entities $entities
+     * @param array $opts
+     * @param bool $asActivities
+     * @param bool $sync
+     * @return Response
+     * @throws \Exception
+     */
+    private function getData($entities, $opts, $asActivities, $sync)
+    {
+
+        /** @var Core\Feeds\Top\Manager $manager */
+        $manager = Di::_()->get('Feeds\Top\Manager');
+        $result = $manager->getList($opts);
+
+        if (!$sync) {
+            // Remove all unlisted content, if ES document is not in sync, it'll
+            // also remove pending activities
+            $result = $result->filter([$entities, 'filter']);
+
+            if ($asActivities) {
+                // Cast to ephemeral Activity entities, if another type
+                $result = $result->map([$entities, 'cast']);
+            }
+        }
+
+        return $result;
+    }
+
+    public function post($pages)
+    {
+        return Factory::response([]);
+    }
+
+    public function put($pages)
+    {
+        return Factory::response([]);
+    }
+
+    public function delete($pages)
+    {
+        return Factory::response([]);
+    }
+}

Controllers/api/v2/pro/settings.php

+<?php
+/**
+ * settings
+ * @author edgebal
+ */
+
+namespace Minds\Controllers\api\v2\pro;
+
+use Exception;
+use Minds\Core\Di\Di;
+use Minds\Core\Pro\Manager;
+use Minds\Core\Session;
+use Minds\Entities\User;
+use Minds\Interfaces;
+use Minds\Api\Factory;
+
+class settings implements Interfaces\Api
+{
+    /**
+     * Equivalent to HTTP GET method
+     * @param array $pages
+     * @return mixed|null
+     */
+    public function get($pages)
+    {
+        $user = Session::getLoggedinUser();
+
+        if (isset($pages[0]) && $pages[0]) {
+            if (!Session::isAdmin()) {
+                return Factory::response([
+                    'status' => 'error',
+                    'message' => 'You are not authorized',
+                ]);
+            }
+
+            $user = new User($pages[0]);
+        }
+
+        /** @var Manager $manager */
+        $manager = Di::_()->get('Pro\Manager');
+        $manager
+            ->setUser($user)
+            ->setActor(Session::getLoggedinUser());
+
+        return Factory::response([
+            'isActive' => $manager->isActive(),
+            'settings' => $manager->get(),
+        ]);
+    }
+
+    /**
+     * Equivalent to HTTP POST method
+     * @param array $pages
+     * @return mixed|null
+     */
+    public function post($pages)
+    {
+        $user = Session::getLoggedinUser();
+
+        if (isset($pages[0]) && $pages[0]) {
+            if (!Session::isAdmin()) {
+                return Factory::response([
+                    'status' => 'error',
+                    'message' => 'You are not authorized',
+                ]);
+            }
+
+            $user = new User($pages[0]);
+        }
+
+        /** @var Manager $manager */
+        $manager = Di::_()->get('Pro\Manager');
+        $manager
+            ->setUser($user)
+            ->setActor(Session::getLoggedinUser());
+
+        if (!$manager->isActive()) {
+            return Factory::response([
+                'status' => 'error',
+                'message' => 'You are not Pro',
+            ]);
+        }
+
+        try {
+            $success = $manager->set($_POST);
+
+            if (!$success) {
+                throw new Exception('Cannot save Pro settings');
+            }
+        } catch (\Exception $e) {
+            return Factory::response([
+                'status' => 'error',
+                'message' => $e->getMessage(),
+            ]);
+        }
+
+        return Factory::response([]);
+    }
+
+    /**
+     * Equivalent to HTTP PUT method
+     * @param array $pages
+     * @return mixed|null
+     */
+    public function put($pages)
+    {
+        return Factory::response([]);
+    }
+
+    /**
+     * Equivalent to HTTP DELETE method
+     * @param array $pages
+     * @return mixed|null
+     */
+    public function delete($pages)
+    {
+        return Factory::response([]);
+    }
+}

Controllers/api/v2/settings/emails.php

@@ -13,6 +13,12 @@ class emails implements Interfaces\Api
     public function get($pages)
     {
         $user = Core\Session::getLoggedInUser();
+        if (!$user) {
+            return Factory::response([
+                'status' => 'error',
+                'message' => 'User must be logged in.'
+            ]);
+        }
 
         $campaigns = [ 'when', 'with', 'global' ];
 

Controllers/fs/v1/thumbnail.php

@@ -46,7 +46,15 @@ class thumbnail extends Core\page implements Interfaces\page
                 $contents = $thumbnail->read();
             }
 
-            header('Content-type: image/jpeg');
+            try {
+                $finfo = new \finfo(FILEINFO_MIME);
+                $contentType = $finfo->buffer($contents) ?: 'image/jpeg';
+            } catch (\Exception $e) {
+                error_log($e);
+                $contentType = 'image/jpeg';
+            }
+
+            header('Content-type: ' . $contentType);
             header('Expires: ' . date('r', strtotime('today + 6 months')), true);
             header('Pragma: public');
             header('Cache-Control: public');

Core/Blockchain/Wallets/OffChain/Sums.php

@@ -78,6 +78,9 @@ class Sums
 
     public function getContractBalance($contract = '', $onlySpend = false)
     {
+        if (!$this->user) {
+            return 0;
+        }
         $cql = "SELECT SUM(amount) as balance from blockchain_transactions_mainnet WHERE user_guid = ? AND wallet_address = ?";
         $values = [
             new Varint($this->user->guid),