XSS vulnerability when remote-subscribing

[quix0rs-gnu-social.git] / actions / apilists.php

diff --git a/actions/apilists.php b/actions/apilists.php
index c5dbd7f290b6020f9e81066ba7261e6d4e8e5fb5..4134577e099d27a2b4c9aa9368df8aba5f466e24 100644 (file)
--- a/actions/apilists.php
+++ b/actions/apilists.php
@@ -30,8 +30,6 @@ if (!defined('STATUSNET')) {
     exit(1);
 }
 
-require_once INSTALLDIR . '/lib/apibareauth.php';
-
 /**
  * Action handler for Twitter list_memeber methods
  *
@@ -63,7 +61,7 @@ class ApiListsAction extends ApiBareAuthAction
      *
      * @return boolean success flag
      */
-    function prepare($args)
+    protected function prepare(array $args=array())
     {
         parent::prepare($args);
 
@@ -73,11 +71,11 @@ class ApiListsAction extends ApiBareAuthAction
 
             $this->user = $this->getTargetUser($this->arg('user'));
 
-            if (empty($this->user)) {
+            if (!($user instanceof User)) {
                 // TRANS: Client error displayed trying to perform an action related to a non-existing user.
-                $this->clientError(_('No such user.'), 404, $this->format);
-                return false;
+                $this->clientError(_('No such user.'), 404);
             }
+            $this->target = $user->getProfile();
             $this->getLists();
         }
 
@@ -99,9 +97,9 @@ class ApiListsAction extends ApiBareAuthAction
      *     Show the lists the user has created if the request method is GET
      *     Create a new list by diferring to handlePost() if it is POST.
      */
-    function handle($args)
+    protected function handle()
     {
-        parent::handle($args);
+        parent::handle();
 
         if($this->create) {
             return $this->handlePost();
@@ -167,13 +165,8 @@ class ApiListsAction extends ApiBareAuthAction
             $this->showSingleJsonList($list);
             break;
         default:
-            $this->clientError(
-                // TRANS: Client error displayed when coming across a non-supported API method.
-                _('API method not found.'),
-                404,
-                $this->format
-            );
-            break;
+            // TRANS: Client error displayed when coming across a non-supported API method.
+            $this->clientError(_('API method not found.'), 404);
         }
         return true;
     }
@@ -188,8 +181,7 @@ class ApiListsAction extends ApiBareAuthAction
         // twitter fixes count at 20
         // there is no argument named count
         $count = 20;
-        $profile = $this->user->getProfile();
-        $fn = array($profile, 'getOwnedTags');
+        $fn = array($this->target, 'getLists');
 
         list($this->lists,
              $this->next_cursor,
@@ -228,7 +220,7 @@ class ApiListsAction extends ApiBareAuthAction
                 ':',
                 array($this->arg('action'),
                       common_language(),
-                      $this->user->id,
+                      $this->target->id,
                       strtotime($this->lists[0]->created),
                       strtotime($this->lists[$last]->created))
             )