Remove CSRF protection from username/password login and from OpenID login.

[quix0rs-gnu-social.git] / actions / apistatusesupdate.php

diff --git a/actions/apistatusesupdate.php b/actions/apistatusesupdate.php
index 5f3a447c23867505827e60946fd8c43906fe1e8a..fa3f611c0a8a59a797691de9087a5211da6be2ee 100644 (file)
--- a/actions/apistatusesupdate.php
+++ b/actions/apistatusesupdate.php
@@ -29,6 +29,7 @@
  * @author    Robin Millette <robin@millette.info>
  * @author    Zach Copley <zach@status.net>
  * @copyright 2009-2010 StatusNet, Inc.
+ * @copyright 2009 Free Software Foundation, Inc http://www.fsf.org
  * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
  * @link      http://status.net/
  */
@@ -155,8 +156,6 @@ class ApiStatusesUpdateAction extends ApiAuthAction
     var $lat                   = null;
     var $lon                   = null;
 
-    static $reserved_sources = array('web', 'omb', 'mail', 'xmpp', 'api');
-
     /**
      * Take arguments for running
      *
@@ -171,19 +170,9 @@ class ApiStatusesUpdateAction extends ApiAuthAction
         parent::prepare($args);
 
         $this->status = $this->trimmed('status');
-        $this->source = $this->trimmed('source');
         $this->lat    = $this->trimmed('lat');
         $this->lon    = $this->trimmed('long');
 
-        // try to set the source attr from OAuth app
-        if (empty($this->source)) {
-            $this->source = $this->oauth_source;
-        }
-
-        if (empty($this->source) || in_array($this->source, self::$reserved_sources)) {
-            $this->source = 'api';
-        }
-
         $this->in_reply_to_status_id
             = intval($this->trimmed('in_reply_to_status_id'));
 
@@ -207,7 +196,8 @@ class ApiStatusesUpdateAction extends ApiAuthAction
         if ($_SERVER['REQUEST_METHOD'] != 'POST') {
             $this->clientError(
                 _('This method requires a POST.'),
-                400, $this->format
+                400,
+                $this->format
             );
             return;
         }
@@ -228,7 +218,7 @@ class ApiStatusesUpdateAction extends ApiAuthAction
 
         if (empty($this->status)) {
             $this->clientError(
-                'Client must provide a \'status\' parameter with a value.',
+                _('Client must provide a \'status\' parameter with a value.'),
                 400,
                 $this->format
             );
@@ -302,8 +292,8 @@ class ApiStatusesUpdateAction extends ApiAuthAction
 
             try {
                 $upload = MediaFile::fromUpload('media', $this->auth_user);
-            } catch (ClientException $ce) {
-                $this->clientError($ce->getMessage());
+            } catch (Exception $e) {
+                $this->clientError($e->getMessage(), $e->getCode(), $this->format);
                 return;
             }
 
@@ -316,7 +306,11 @@ class ApiStatusesUpdateAction extends ApiAuthAction
                         'Max notice size is %d chars, ' .
                         'including attachment URL.'
                     );
-                    $this->clientError(sprintf($msg, Notice::maxContent()));
+                    $this->clientError(
+                        sprintf($msg, Notice::maxContent()),
+                        400,
+                        $this->format
+                    );
                 }
             }
 
@@ -343,7 +337,7 @@ class ApiStatusesUpdateAction extends ApiAuthAction
                     $options
                 );
             } catch (Exception $e) {
-                $this->clientError($e->getMessage());
+                $this->clientError($e->getMessage(), $e->getCode(), $this->format);
                 return;
             }