Remove CSRF protection from username/password login and from OpenID login.

[quix0rs-gnu-social.git] / actions / apitimelinefavorites.php

diff --git a/actions/apitimelinefavorites.php b/actions/apitimelinefavorites.php
index b8ae74f1377077c62739a46c4895308bb4363b0d..7228960c0b48bfef8262366987ad7a3954a75407 100644 (file)
--- a/actions/apitimelinefavorites.php
+++ b/actions/apitimelinefavorites.php
@@ -23,7 +23,9 @@
  * @package   StatusNet
  * @author    Craig Andrews <candrews@integralblue.com>
  * @author    Evan Prodromou <evan@status.net>
- * @author    Zach Copley <zach@status.net> * @copyright 2009 StatusNet, Inc.
+ * @author    Zach Copley <zach@status.net>
+ * @copyright 2009-2010 StatusNet, Inc.
+ * @copyright 2009 Free Software Foundation, Inc http://www.fsf.org
  * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
  * @link      http://status.net/
  */
@@ -67,7 +69,7 @@ class ApiTimelineFavoritesAction extends ApiBareAuthAction
         $this->user = $this->getTargetUser($this->arg('id'));
 
         if (empty($this->user)) {
-            $this->clientError(_('No such user!'), 404, $this->format);
+            $this->clientError(_('No such user.'), 404, $this->format);
             return;
         }
 
@@ -100,48 +102,76 @@ class ApiTimelineFavoritesAction extends ApiBareAuthAction
 
     function showTimeline()
     {
-        $profile = $this->user->getProfile();
+        $profile  = $this->user->getProfile();
+        $avatar   = $profile->getAvatar(AVATAR_PROFILE_SIZE);
 
-        $sitename   = common_config('site', 'name');
-        $title      = sprintf(
-            _('%s / Favorites from %s'),
+        $sitename = common_config('site', 'name');
+        $title    = sprintf(
+            _('%1$s / Favorites from %2$s'),
             $sitename,
             $this->user->nickname
         );
 
-        $taguribase = common_config('integration', 'taguri');
+        $taguribase = TagURI::base();
         $id         = "tag:$taguribase:Favorites:" . $this->user->id;
-        $link       = common_local_url(
-            'favorites',
-            array('nickname' => $this->user->nickname)
-        );
-        $subtitle   = sprintf(
-            _('%s updates favorited by %s / %s.'),
+
+        $subtitle = sprintf(
+            _('%1$s updates favorited by %2$s / %2$s.'),
             $sitename,
             $profile->getBestName(),
             $this->user->nickname
         );
+        $logo = !empty($avatar)
+            ? $avatar->displayUrl()
+            : Avatar::defaultImage(AVATAR_PROFILE_SIZE);
+
+        $link = common_local_url(
+            'showfavorites',
+            array('nickname' => $this->user->nickname)
+        );
+
+        $self = $this->getSelfUri();
 
         switch($this->format) {
         case 'xml':
             $this->showXmlTimeline($this->notices);
             break;
         case 'rss':
-            $this->showRssTimeline($this->notices, $title, $link, $subtitle);
+            $this->showRssTimeline(
+                $this->notices,
+                $title,
+                $link,
+                $subtitle,
+                null,
+                $logo,
+                $self
+            );
             break;
         case 'atom':
-            $selfuri = common_root_url() .
-                ltrim($_SERVER['QUERY_STRING'], 'p=');
-            $this->showAtomTimeline(
-                $this->notices, $title, $id, $link, $subtitle,
-                null, $selfuri
-            );
+
+            header('Content-Type: application/atom+xml; charset=utf-8');
+
+            $atom = new AtomNoticeFeed($this->auth_user);
+
+            $atom->setId($id);
+            $atom->setTitle($title);
+            $atom->setSubtitle($subtitle);
+            $atom->setLogo($logo);
+            $atom->setUpdated('now');
+
+            $atom->addLink($link);
+            $atom->setSelfLink($self);
+
+            $atom->addEntryFromNotices($this->notices);
+
+            $this->raw($atom->getString());
+
             break;
         case 'json':
             $this->showJsonTimeline($this->notices);
             break;
         default:
-            $this->clientError(_('API method not found!'), $code = 404);
+            $this->clientError(_('API method not found.'), $code = 404);
             break;
         }
     }
@@ -156,17 +186,23 @@ class ApiTimelineFavoritesAction extends ApiBareAuthAction
     {
         $notices = array();
 
+        common_debug("since id = " . $this->since_id . " max id = " . $this->max_id);
+
         if (!empty($this->auth_user) && $this->auth_user->id == $this->user->id) {
             $notice = $this->user->favoriteNotices(
+                true,
                 ($this->page-1) * $this->count,
                 $this->count,
-                true
+                $this->since_id,
+                $this->max_id
             );
         } else {
             $notice = $this->user->favoriteNotices(
+                false,
                 ($this->page-1) * $this->count,
                 $this->count,
-                false
+                $this->since_id,
+                $this->max_id
             );
         }