]> git.mxchange.org Git - quix0rs-gnu-social.git/blob - actions/twitapiaccount.php
CSRF protection in user registration
[quix0rs-gnu-social.git] / actions / twitapiaccount.php
1 <?php
2 /*
3  * Laconica - a distributed open-source microblogging tool
4  * Copyright (C) 2008, Controlez-Vous, Inc.
5  *
6  * This program is free software: you can redistribute it and/or modify
7  * it under the terms of the GNU Affero General Public License as published by
8  * the Free Software Foundation, either version 3 of the License, or
9  * (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  * GNU Affero General Public License for more details.
15  *
16  * You should have received a copy of the GNU Affero General Public License
17  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
18  */
19
20 if (!defined('LACONICA')) { exit(1); }
21
22 require_once(INSTALLDIR.'/lib/twitterapi.php');
23
24 class TwitapiaccountAction extends TwitterapiAction {
25
26         function is_readonly() {
27                 
28                 static $write_methods = array(  'update_location',
29                                                                                 'update_delivery_device');
30                 
31                 $cmdtext = explode('.', $this->arg('method'));          
32                 
33                 if (in_array($cmdtext[0], $write_methods)) {                    
34                         return false;
35                 }
36                                 
37                 return true;
38         }
39
40         function verify_credentials($args, $apidata) {
41
42                 if ($apidata['content-type'] == 'xml') {
43                         header('Content-Type: application/xml; charset=utf-8');         
44                         print '<authorized>true</authorized>';
45                 } elseif ($apidata['content-type'] == 'json') {
46                         header('Content-Type: application/json; charset=utf-8');                
47                         print '{"authorized":true}';
48                 } else {
49                         common_user_error(_('API method not found!'), $code=404);
50                 }
51                         
52                 exit();
53         }
54         
55         function end_session($args, $apidata) {
56                 parent::handle($args);
57                 common_server_error(_('API method under construction.'), $code=501);
58                 exit();
59         }
60         
61         function update_location($args, $apidata) {
62                 parent::handle($args);
63
64                 if ($_SERVER['REQUEST_METHOD'] != 'POST') {
65                         $this->client_error(_('This method requires a POST.'), 400, $apidata['content-type']);
66                         exit();
67                 }
68
69                 $location = trim($this->arg('location'));
70
71                 if (!is_null($location) && strlen($location) > 255) {
72                         
73                         // XXX: But Twitter just truncates and runs with it. -- Zach                    
74                         $this->client_error(_('That\'s too long. Max notice size is 255 chars.'), 406, $apidate['content-type']);
75                         exit();
76                 }
77                 
78                 $user = $apidata['user'];
79                 $profile = $user->getProfile();
80                 
81                 if (!$profile) {
82                         common_server_error(_('User has no profile.'));
83                         exit();
84                 }
85                 
86                 $orig_profile = clone($profile);
87                 $profile->location = $location;
88                 
89                 common_debug('Old profile: ' . common_log_objstring($orig_profile), __FILE__);
90                 common_debug('New profile: ' . common_log_objstring($profile), __FILE__);
91
92                 $result = $profile->update($orig_profile);
93
94                 if (!$result) {
95                         common_log_db_error($profile, 'UPDATE', __FILE__);
96                         common_server_error(_('Couldn\'t save profile.'));
97                         exit();
98                 }
99
100                 common_broadcast_profile($profile);
101                 $type = $apidata['content-type'];
102                 
103                 $this->init_document($type);
104                 $this->show_profile($profile, $type);
105                 $this->end_document($type);
106                 
107                 exit();
108         }
109
110
111         function update_delivery_device($args, $apidata) {
112                 parent::handle($args);
113                 common_server_error(_('API method under construction.'), $code=501);
114                 exit();
115         }
116         
117         function rate_limit_status($args, $apidata) {
118                 parent::handle($args);
119                 common_server_error(_('API method under construction.'), $code=501);
120                 exit();
121         }
122 }