XSS vulnerability when remote-subscribing

[quix0rs-gnu-social.git] / actions / allrss.php

diff --git a/actions/allrss.php b/actions/allrss.php
index 851cd0ad52d21cf1c6eb57920e1217b809bd3184..4b6df25048645286e97f6c12cb319d9f3e317dfe 100644 (file)
--- a/actions/allrss.php
+++ b/actions/allrss.php
@@ -1,7 +1,18 @@
 <?php
-/*
- * Laconica - a distributed open-source microblogging tool
- * Copyright (C) 2008, Controlez-Vous, Inc.
+/**
+ * RSS feed for user and friends timeline action class.
+ *
+ * PHP version 5
+ *
+ * @category Action
+ * @package  StatusNet
+ * @author   Evan Prodromou <evan@status.net>
+ * @author   Robin Millette <millette@status.net>
+ * @license  http://www.fsf.org/licensing/licenses/agpl.html AGPLv3
+ * @link     http://status.net/
+ *
+ * StatusNet - the distributed open-source microblogging tool
+ * Copyright (C) 2008, 2009, StatusNet, Inc.
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as published by
@@ -17,61 +28,46 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-if (!defined('LACONICA')) { exit(1); }
-
-require_once(INSTALLDIR.'/lib/rssaction.php');
-
-// Formatting of RSS handled by Rss10Action
+if (!defined('GNUSOCIAL')) { exit(1); }
 
-class AllrssAction extends Rss10Action {
-
-    var $user = null;
-
-    function init() {
-        $nickname = $this->trimmed('nickname');
-        $this->user = User::staticGet('nickname', $nickname);
-
-        if (!$this->user) {
-            common_user_error(_('No such user.'));
-            return false;
-        } else {
-            return true;
-        }
-    }
-
-    function get_notices($limit=0) {
-
-        $user = $this->user;
-        
-        $notice = $user->noticesWithFriends(0, $limit);
-                                            
-        while ($notice->fetch()) {
-            $notices[] = clone($notice);
-        }
-
-        return $notices;
+/**
+ * RSS feed for user and friends timeline.
+ *
+ * Formatting of RSS handled by Rss10Action
+ *
+ * @category Action
+ * @package  StatusNet
+ * @author   Evan Prodromou <evan@status.net>
+ * @author   Robin Millette <millette@status.net>
+ * @license  http://www.fsf.org/licensing/licenses/agpl.html AGPLv3
+ * @link     http://status.net/
+ */
+class AllrssAction extends TargetedRss10Action
+{
+    protected function getNotices()
+    {
+        $stream = new InboxNoticeStream($this->target);
+        return $stream->getNotices(0, $this->limit)->fetchAll();
     }
 
-    function get_channel() {
-        $user = $this->user;
-        $c = array('url' => common_local_url('allrss',
+     /**
+     * Get channel.
+     *
+     * @return array associative array on channel information
+     */
+    function getChannel()
+    {
+        $c    = array('url' => common_local_url('allrss',
                                              array('nickname' =>
-                                                   $user->nickname)),
-                   'title' => sprintf(_('%s and friends'), $user->nickname),
+                                                   $this->target->getNickname())),
+                   // TRANS: Message is used as link title. %s is a user nickname.
+                   'title' => sprintf(_('%s and friends'), $this->target->getNickname()),
                    'link' => common_local_url('all',
                                              array('nickname' =>
-                                                   $user->nickname)),
-                   'description' => sprintf(_('Feed for friends of %s'), $user->nickname));
+                                                   $this->target->getNickname())),
+                   // TRANS: Message is used as link description. %1$s is a username, %2$s is a site name.
+                   'description' => sprintf(_('Updates from %1$s and friends on %2$s!'),
+                                            $this->target->getNickname(), common_config('site', 'name')));
         return $c;
     }
-
-    function get_image() {
-        $user = $this->user;
-        $profile = $user->getProfile();
-        if (!$profile) {
-            return null;
-        }
-        $avatar = $profile->getAvatar(AVATAR_PROFILE_SIZE);
-        return ($avatar) ? $avatar->url : null;
-    }
-}
\ No newline at end of file
+}