Remove CSRF protection from username/password login and from OpenID login.

[quix0rs-gnu-social.git] / actions / apistatusesdestroy.php

diff --git a/actions/apistatusesdestroy.php b/actions/apistatusesdestroy.php
index ae0f4c4532fd60a3aa2c4dc096e2dd4a16ad26ff..0dfeb48122df5e8efa43992e5408f26d411aa59e 100644 (file)
--- a/actions/apistatusesdestroy.php
+++ b/actions/apistatusesdestroy.php
@@ -21,8 +21,15 @@
  *
  * @category  API
  * @package   StatusNet
+ * @author    Craig Andrews <candrews@integralblue.com>
+ * @author    Evan Prodromou <evan@status.net>
+ * @author    Jeffery To <jeffery.to@gmail.com>
+ * @author    Tom Blankenship <mac65@mac65.com>
+ * @author    Mike Cochrane <mikec@mikenz.geek.nz>
+ * @author    Robin Millette <robin@millette.info>
  * @author    Zach Copley <zach@status.net>
  * @copyright 2009 StatusNet, Inc.
+ * @copyright 2009 Free Software Foundation, Inc http://www.fsf.org
  * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
  * @link      http://status.net/
  */
@@ -31,13 +38,19 @@ if (!defined('STATUSNET')) {
     exit(1);
 }
 
-require_once INSTALLDIR.'/lib/apiauth.php';
+require_once INSTALLDIR . '/lib/apiauth.php';
 
 /**
  * Deletes one of the authenticating user's statuses (notices).
  *
  * @category API
  * @package  StatusNet
+ * @author   Craig Andrews <candrews@integralblue.com>
+ * @author   Evan Prodromou <evan@status.net>
+ * @author   Jeffery To <jeffery.to@gmail.com>
+ * @author   Tom Blankenship <mac65@mac65.com>
+ * @author   Mike Cochrane <mikec@mikenz.geek.nz>
+ * @author   Robin Millette <robin@millette.info>
  * @author   Zach Copley <zach@status.net>
  * @license  http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
  * @link     http://status.net/
@@ -45,10 +58,7 @@ require_once INSTALLDIR.'/lib/apiauth.php';
 
 class ApiStatusesDestroyAction extends ApiAuthAction
 {
-
-    var $user                  = null;
-    var $status                = null;
-    var $format                = null;
+    var $status = null;
 
     /**
      * Take arguments for running
@@ -63,12 +73,6 @@ class ApiStatusesDestroyAction extends ApiAuthAction
     {
         parent::prepare($args);
 
-        if ($this->requiresAuth()) {
-            if ($this->checkBasicAuthUser() == false) {
-                return false;
-            }
-        }
-
         $this->user = $this->auth_user;
         $this->notice_id = (int)$this->trimmed('id');
 
@@ -76,7 +80,6 @@ class ApiStatusesDestroyAction extends ApiAuthAction
             $this->notice_id = (int)$this->arg('id');
         }
 
-        $this->format = $this->arg('format');
         $this->notice = Notice::staticGet((int)$this->notice_id);
 
         return true;
@@ -97,39 +100,43 @@ class ApiStatusesDestroyAction extends ApiAuthAction
         parent::handle($args);
 
         if (!in_array($this->format, array('xml', 'json'))) {
-             $this->clientError(_('API method not found!'), $code = 404);
-             return;
+            $this->clientError(
+                _('API method not found.'),
+                404
+            );
+            return;
         }
 
-         if (!in_array($_SERVER['REQUEST_METHOD'], array('POST', 'DELETE'))) {
-             $this->clientError(_('This method requires a POST or DELETE.'),
-                 400, $this->format);
-             return;
-         }
-
-         if (empty($this->notice)) {
-             $this->clientError(_('No status found with that ID.'),
-                 404, $this->format);
-             return;
-         }
-
-         if ($this->user->id == $this->notice->profile_id) {
-             $replies = new Reply;
-             $replies->get('notice_id', $this->notice_id);
-             $replies->delete();
-             $this->notice->delete();
-
-             if ($this->format == 'xml') {
-                 $this->show_single_xml_status($this->notice);
-             } elseif ($this->format == 'json') {
-                 $this->show_single_json_status($this->notice);
-             }
-         } else {
-             $this->clientError(_('You may not delete another user\'s status.'),
-                 403, $this->format);
-         }
-
-        $this->showNotice();
+        if (!in_array($_SERVER['REQUEST_METHOD'], array('POST', 'DELETE'))) {
+            $this->clientError(
+                _('This method requires a POST or DELETE.'),
+                400,
+                $this->format
+            );
+            return;
+        }
+
+        if (empty($this->notice)) {
+            $this->clientError(
+                _('No status found with that ID.'),
+                404, $this->format
+            );
+            return;
+        }
+
+        if ($this->user->id == $this->notice->profile_id) {
+            $replies = new Reply;
+            $replies->get('notice_id', $this->notice_id);
+            $replies->delete();
+            $this->notice->delete();
+               $this->showNotice();
+        } else {
+            $this->clientError(
+                _('You may not delete another user\'s status.'),
+                403,
+                $this->format
+            );
+        }
     }
 
     /**
@@ -142,7 +149,7 @@ class ApiStatusesDestroyAction extends ApiAuthAction
     {
         if (!empty($this->notice)) {
             if ($this->format == 'xml') {
-                $this->show_single_xml_status($this->notice);
+                $this->showSingleXmlStatus($this->notice);
             } elseif ($this->format == 'json') {
                 $this->show_single_json_status($this->notice);
             }