XSS vulnerability when remote-subscribing

[quix0rs-gnu-social.git] / actions / allrss.php

diff --git a/actions/allrss.php b/actions/allrss.php
index bbef401dc6d5da10ae5044af0df47463a5e55e7c..4b6df25048645286e97f6c12cb319d9f3e317dfe 100644 (file)
--- a/actions/allrss.php
+++ b/actions/allrss.php
@@ -1,19 +1,18 @@
 <?php
-
 /**
  * RSS feed for user and friends timeline action class.
  *
  * PHP version 5
  *
  * @category Action
- * @package  Laconica
- * @author   Evan Prodromou <evan@controlyourself.ca>
- * @author   Robin Millette <millette@controlyourself.ca>
+ * @package  StatusNet
+ * @author   Evan Prodromou <evan@status.net>
+ * @author   Robin Millette <millette@status.net>
  * @license  http://www.fsf.org/licensing/licenses/agpl.html AGPLv3
- * @link     http://laconi.ca/
+ * @link     http://status.net/
  *
- * Laconica - a distributed open-source microblogging tool
- * Copyright (C) 2008, Control Yourself, Inc.
+ * StatusNet - the distributed open-source microblogging tool
+ * Copyright (C) 2008, 2009, StatusNet, Inc.
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as published by
@@ -29,11 +28,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-if (!defined('LACONICA')) {
-    exit(1);
-}
-
-require_once INSTALLDIR.'/lib/rssaction.php';
+if (!defined('GNUSOCIAL')) { exit(1); }
 
 /**
  * RSS feed for user and friends timeline.
@@ -41,63 +36,18 @@ require_once INSTALLDIR.'/lib/rssaction.php';
  * Formatting of RSS handled by Rss10Action
  *
  * @category Action
- * @package  Laconica
- * @author   Evan Prodromou <evan@controlyourself.ca>
- * @author   Robin Millette <millette@controlyourself.ca>
+ * @package  StatusNet
+ * @author   Evan Prodromou <evan@status.net>
+ * @author   Robin Millette <millette@status.net>
  * @license  http://www.fsf.org/licensing/licenses/agpl.html AGPLv3
- * @link     http://laconi.ca/
+ * @link     http://status.net/
  */
-class AllrssAction extends Rss10Action
+class AllrssAction extends TargetedRss10Action
 {
-    var $user = null;
-
-    /**
-     * Initialization.
-     *
-     * @param array $args Web and URL arguments
-     *
-     * @return boolean false if user doesn't exist
-     */
-    function prepare($args)
+    protected function getNotices()
     {
-        parent::prepare($args);
-        $nickname   = $this->trimmed('nickname');
-        $this->user = User::staticGet('nickname', $nickname);
-
-        if (!$this->user) {
-            $this->clientError(_('No such user.'));
-            return false;
-        } else {
-            return true;
-        }
-    }
-
-    /**
-     * Get notices
-     *
-     * @param integer $limit max number of notices to return
-     *
-     * @return array notices
-     */
-    function getNotices($limit=0)
-    {
-        $cur = common_current_user();
-
-        if (!empty($cur) && $cur->id == $user->id) {
-            $notice = $this->user->noticeInbox(0, $limit);
-        } else {
-            $notice = $this->user->noticesWithFriends(0, $limit);
-        }
-
-        $user    = $this->user;
-        $notice  = $user->noticesWithFriends(0, $limit);
-        $notices = array();
-
-        while ($notice->fetch()) {
-            $notices[] = clone($notice);
-        }
-
-        return $notices;
+        $stream = new InboxNoticeStream($this->target);
+        return $stream->getNotices(0, $this->limit)->fetchAll();
     }
 
      /**
@@ -107,33 +57,17 @@ class AllrssAction extends Rss10Action
      */
     function getChannel()
     {
-        $user = $this->user;
         $c    = array('url' => common_local_url('allrss',
                                              array('nickname' =>
-                                                   $user->nickname)),
-                   'title' => sprintf(_('%s and friends'), $user->nickname),
+                                                   $this->target->getNickname())),
+                   // TRANS: Message is used as link title. %s is a user nickname.
+                   'title' => sprintf(_('%s and friends'), $this->target->getNickname()),
                    'link' => common_local_url('all',
                                              array('nickname' =>
-                                                   $user->nickname)),
-                   'description' => sprintf(_('Feed for friends of %s'),
-                                            $user->nickname));
+                                                   $this->target->getNickname())),
+                   // TRANS: Message is used as link description. %1$s is a username, %2$s is a site name.
+                   'description' => sprintf(_('Updates from %1$s and friends on %2$s!'),
+                                            $this->target->getNickname(), common_config('site', 'name')));
         return $c;
     }
-
-    /**
-     * Get image.
-     *
-     * @return string user avatar URL or null
-    */
-    function getImage()
-    {
-        $user    = $this->user;
-        $profile = $user->getProfile();
-        if (!$profile) {
-            return null;
-        }
-        $avatar = $profile->getAvatar(AVATAR_PROFILE_SIZE);
-        return $avatar ? $avatar->url : null;
-    }
 }
-