#2503 Push notifications privacy issue

inc/classes/BxDolPush.php

@@ -43,6 +43,35 @@ class BxDolPush extends BxDolFactory implements iBxDolSingleton
         return $GLOBALS['bxDolClasses'][__CLASS__];
     }
     
+    /**
+     * Get tags to send to PUSH server
+     * @param $iProfileId - profile ID
+     * @return array of tags
+     */
+    public static function getTags($iProfileId = false)
+    {
+        if (false === $iProfileId)
+            $iProfileId = bx_get_logged_profile_id();
+
+        $oProfile = BxDolProfile::getInstance($iProfileId);
+        $oAccount = $oProfile->getAccountObject();
+        if (!$oProfile || !$oAccount)
+            return false;
+
+        $sEmail = $oAccount->getEmail();
+        $a = array (
+            'user' => $iProfileId,
+            'user_hash' => encryptUserId($iProfileId),
+            'real_name' => $oProfile->getDisplayName(),
+            'email' => $sEmail,
+            'email_hash' => $sEmail ? hash_hmac('sha256', $sEmail, getParam('sys_push_app_id')) : '',
+        );
+
+        bx_alert('system', 'push_tags', $iProfileId, $iProfileId, array('tags' => &$a));
+
+        return $a;
+    }
+
     /**
      * @param $a - array to fill with notification counter per module
      * @return total number of notifications
@@ -105,7 +134,7 @@ class BxDolPush extends BxDolFactory implements iBxDolSingleton
 		$aFields = array(
 			'app_id' => $this->_sAppId,
 			'filters' => array(
-		        array('field' => 'tag', 'key' => 'user', 'relation' => '=', 'value' => $iProfileId)
+		        array('field' => 'tag', 'key' => 'user_hash', 'relation' => '=', 'value' => encryptUserId($iProfileId))
             ),
 			'contents' => !empty($aMessage['contents']) && is_array($aMessage['contents']) ? $aMessage['contents'] : array(),
 			'headings' => !empty($aMessage['headings']) && is_array($aMessage['headings']) ? $aMessage['headings'] : array(),

inc/js/classes/BxDolPush.js

@@ -1,7 +1,7 @@
 function BxDolPush(oOptions) {
     this._sObjName = oOptions.sObjName == undefined ? 'oBxDolPush' : oOptions.sObjName;
     this._sSiteName = oOptions.sSiteName == undefined ? '' : oOptions.sSiteName;
-    this._iProfileId = oOptions.iProfileId == undefined ? 0 : oOptions.iProfileId;
+    this._aTags = oOptions.aTags == undefined ? {} : oOptions.aTags;
     this._sAppId = oOptions.sAppId == undefined ? '' : oOptions.sAppId;
     this._sShortName = oOptions.sShortName == undefined ? '' : oOptions.sShortName;
     this._sSafariWebId = oOptions.sSafariWebId == undefined ? '' : oOptions.sSafariWebId;
@@ -55,16 +55,20 @@ BxDolPush.prototype.init = function() {
 	OneSignal.push(function() {
 		var isPushSupported = OneSignal.isPushNotificationsSupported();
 		OneSignal.setDefaultNotificationUrl($this._sNotificationUrl);
-		OneSignal.isPushNotificationsEnabled().then(function(isEnabled) {								
-			OneSignal.sendTag('user', $this._iProfileId); // set tag for onesiganl, this tag will be used to send notification
+		OneSignal.isPushNotificationsEnabled().then(function(isEnabled) {
+            if ('undefined' !== typeof($this._aTags['email'])) {
+                OneSignal.setEmail($this._aTags['email'], $this._aTags['email_hash']);
+                delete $this._aTags['email'];
+                delete $this._aTags['email_hash'];
+            }
+			OneSignal.sendTags($this._aTags); // set tags for onesiganl, some of these tags will be used to send notification
 			if(!isEnabled && isPushSupported)
 				OneSignal.showHttpPermissionRequest();													
 		});
 	});
 
     if (navigator.userAgent.indexOf('gonative') > -1) {
-        var data = {user: $this._iProfileId};
-        var json = JSON.stringify(data);
+        var json = JSON.stringify($this._aTags);
         $(document).ready(function () {
             window.location.href='gonative://registration/send?customData=' + encodeURIComponent(json);        
         });

inc/utils.inc.php

@@ -1100,6 +1100,21 @@ function encryptUserPwd($sPwd, $sSalt)
     }
 }
 
+/**
+ * Hash profile ID
+ */
+function encryptUserId($sId)
+{
+    if (!($oProfile = BxDolProfile::getInstance($sId)))
+        return false;
+
+    if (!($oAccount = $oProfile->getAccountObject()))
+        return false;
+
+    $aAccountInfo = $oAccount->getInfo();
+    return sha1(md5($sId) . md5($aAccountInfo['salt']) . BX_DOL_SECRET);
+}
+
 function bx_get ($sName, $sMethod = false)
 {
     if (isset($_GET[$sName]) && ('get' == $sMethod || !$sMethod))

modules/boonex/nexus/classes/BxNexusModule.php

@@ -52,7 +52,7 @@ class BxNexusModule extends BxDolModule
                 'loggedin' => isLogged(),                
                 'bubbles_num' => $iBubbles ? $iBubbles : '',
                 'bubbles' => $aBubbles,
-                'push_tags' => array('user' => bx_get_logged_profile_id())
+                'push_tags' => BxDolPush::getTags(),
             )),
             'txt_pull_to_refresh' => bx_js_string(_t('_bx_nexus_pull_to_refresh')),
             'txt_release_to_refresh' => bx_js_string(_t('_bx_nexus_release_to_refresh')),

template/scripts/BxBaseFunctions.php

@@ -560,6 +560,10 @@ class BxBaseFunctions extends BxDolFactory implements iBxDolSingleton
         if(empty($sAppId))
             return '';
 
+        $aTags = BxDolPush::getTags($iProfileId);
+        if (!$aTags)
+            return '';
+
         $sShortName = getParam('sys_push_short_name');
         $sSafariWebId = getParam('sys_push_safari_id');
 
@@ -582,15 +586,15 @@ class BxBaseFunctions extends BxDolFactory implements iBxDolSingleton
         $sContent = "var " . $sJsObject . " = new " . $sJsClass . "(" . json_encode(array(
             'sObjName' => $sJsObject,
             'sSiteName' => getParam('site_title'),
-            'iProfileId' => $iProfileId,
+            'aTags' => $aTags,
             'sAppId' => $sAppId,
             'sShortName' => $sShortName,
             'sSafariWebId' => $sSafariWebId,
             'sSubfolder' => $sSubfolder,
             'sNotificationUrl' => BX_DOL_URL_ROOT,
-            'sTxtNotificationRequest' => bx_js_string(_t('_sys_push_notification_request', getParam('site_title'))),
-            'sTxtNotificationRequestYes' => bx_js_string(_t('_sys_push_notification_request_yes')),
-            'sTxtNotificationRequestNo' => bx_js_string(_t('_sys_push_notification_request_no')),
+            'sTxtNotificationRequest' => _t('_sys_push_notification_request', getParam('site_title')),
+            'sTxtNotificationRequestYes' => _t('_sys_push_notification_request_yes'),
+            'sTxtNotificationRequestNo' => _t('_sys_push_notification_request_no'),
         )) . ");";
 
         return $this->_oTemplate->_wrapInTagJsCode($sContent);