XSS vulnerability when remote-subscribing

[quix0rs-gnu-social.git] / actions / apilists.php

diff --git a/actions/apilists.php b/actions/apilists.php
index f520e329721fc336f6ff4b37a6674331b5b7801d..4134577e099d27a2b4c9aa9368df8aba5f466e24 100644 (file)
--- a/actions/apilists.php
+++ b/actions/apilists.php
@@ -30,8 +30,6 @@ if (!defined('STATUSNET')) {
     exit(1);
 }
 
-require_once INSTALLDIR . '/lib/apibareauth.php';
-
 /**
  * Action handler for Twitter list_memeber methods
  *
@@ -42,7 +40,6 @@ require_once INSTALLDIR . '/lib/apibareauth.php';
  * @link     http://status.net/
  * @see      ApiBareAuthAction
  */
-
 class ApiListsAction extends ApiBareAuthAction
 {
     var $lists   = null;
@@ -64,8 +61,7 @@ class ApiListsAction extends ApiBareAuthAction
      *
      * @return boolean success flag
      */
-
-    function prepare($args)
+    protected function prepare(array $args=array())
     {
         parent::prepare($args);
 
@@ -75,10 +71,11 @@ class ApiListsAction extends ApiBareAuthAction
 
             $this->user = $this->getTargetUser($this->arg('user'));
 
-            if (empty($this->user)) {
-                $this->clientError(_('No such user.'), 404, $this->format);
-                return false;
+            if (!($user instanceof User)) {
+                // TRANS: Client error displayed trying to perform an action related to a non-existing user.
+                $this->clientError(_('No such user.'), 404);
             }
+            $this->target = $user->getProfile();
             $this->getLists();
         }
 
@@ -89,7 +86,6 @@ class ApiListsAction extends ApiBareAuthAction
      * require authentication if it is a write action or user is ambiguous
      *
      */
-
     function requiresAuth()
     {
         return parent::requiresAuth() ||
@@ -101,10 +97,9 @@ class ApiListsAction extends ApiBareAuthAction
      *     Show the lists the user has created if the request method is GET
      *     Create a new list by diferring to handlePost() if it is POST.
      */
-
-    function handle($args)
+    protected function handle()
     {
-        parent::handle($args);
+        parent::handle();
 
         if($this->create) {
             return $this->handlePost();
@@ -119,6 +114,7 @@ class ApiListsAction extends ApiBareAuthAction
             break;
         default:
             $this->clientError(
+                // TRANS: Client error displayed when coming across a non-supported API method.
                 _('API method not found.'),
                 404,
                 $this->format
@@ -132,13 +128,13 @@ class ApiListsAction extends ApiBareAuthAction
      *
      * @return boolean success
      */
-
     function handlePost()
     {
         $name=$this->arg('name');
         if(empty($name)) {
             // mimick twitter
-            print _("A list's name can't be blank.");
+            // TRANS: Client error displayed when trying to create a list without a name.
+            print _("A list must have a name.");
             exit(1);
         }
 
@@ -169,12 +165,8 @@ class ApiListsAction extends ApiBareAuthAction
             $this->showSingleJsonList($list);
             break;
         default:
-            $this->clientError(
-                _('API method not found.'),
-                404,
-                $this->format
-            );
-            break;
+            // TRANS: Client error displayed when coming across a non-supported API method.
+            $this->clientError(_('API method not found.'), 404);
         }
         return true;
     }
@@ -182,7 +174,6 @@ class ApiListsAction extends ApiBareAuthAction
     /**
      * Get lists
      */
-
     function getLists()
     {
         $cursor = (int) $this->arg('cursor', -1);
@@ -190,8 +181,7 @@ class ApiListsAction extends ApiBareAuthAction
         // twitter fixes count at 20
         // there is no argument named count
         $count = 20;
-        $profile = $this->user->getProfile();
-        $fn = array($profile, 'getOwnedTags');
+        $fn = array($this->target, 'getLists');
 
         list($this->lists,
              $this->next_cursor,
@@ -220,7 +210,6 @@ class ApiListsAction extends ApiBareAuthAction
      *
      * @return string etag
      */
-
     function etag()
     {
         if (!$this->create && !empty($this->lists) && (count($this->lists) > 0)) {
@@ -231,7 +220,7 @@ class ApiListsAction extends ApiBareAuthAction
                 ':',
                 array($this->arg('action'),
                       common_language(),
-                      $this->user->id,
+                      $this->target->id,
                       strtotime($this->lists[0]->created),
                       strtotime($this->lists[$last]->created))
             )
@@ -240,5 +229,4 @@ class ApiListsAction extends ApiBareAuthAction
 
         return null;
     }
-
 }