XSS vulnerability when remote-subscribing

[quix0rs-gnu-social.git] / actions / avatarbynickname.php

diff --git a/actions/avatarbynickname.php b/actions/avatarbynickname.php
index 3e615261fefbcd5272ca34433bbf936f607eea9d..10a22e77bc199c61627b836135aaa600e3c0f898 100644 (file)
--- a/actions/avatarbynickname.php
+++ b/actions/avatarbynickname.php
@@ -5,14 +5,14 @@
  * PHP version 5
  *
  * @category Action
- * @package  Laconica
- * @author   Evan Prodromou <evan@controlyourself.ca>
- * @author   Robin Millette <millette@controlyourself.ca>
+ * @package  StatusNet
+ * @author   Evan Prodromou <evan@status.net>
+ * @author   Robin Millette <millette@status.net>
  * @license  http://www.fsf.org/licensing/licenses/agpl.html AGPLv3
- * @link     http://laconi.ca/
+ * @link     http://status.net/
  *
- * Laconica - a distributed open-source microblogging tool
- * Copyright (C) 2008, 2009, Control Yourself, Inc.
+ * StatusNet - the distributed open-source microblogging tool
+ * Copyright (C) 2008, 2009, StatusNet, Inc.
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as published by
@@ -28,19 +28,18 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-if (!defined('LACONICA')) {
-    exit(1);
-}
+if (!defined('GNUSOCIAL')) { exit(1); }
 
 /**
  * Retrieve user avatar by nickname action class.
  *
  * @category Action
- * @package  Laconica
- * @author   Evan Prodromou <evan@controlyourself.ca>
- * @author   Robin Millette <millette@controlyourself.ca>
+ * @package  GNUsocial
+ * @author   Evan Prodromou <evan@status.net>
+ * @author   Robin Millette <millette@status.net>
+ * @author   Mikael Nordfeldth <mmn@hethane.se>
  * @license  http://www.fsf.org/licensing/licenses/agpl.html AGPLv3
- * @link     http://laconi.ca/
+ * @link     http://www.gnu.org/software/social/
  */
 class AvatarbynicknameAction extends Action
 {
@@ -48,53 +47,41 @@ class AvatarbynicknameAction extends Action
      * Class handler.
      *
      * @param array $args query arguments
-     * 
+     *
      * @return boolean false if nickname or user isn't found
      */
-    function handle($args)
+    protected function handle()
     {
-        parent::handle($args);
+        parent::handle();
         $nickname = $this->trimmed('nickname');
         if (!$nickname) {
+            // TRANS: Client error displayed trying to get an avatar without providing a nickname.
             $this->clientError(_('No nickname.'));
-            return;
-        }
-        $size = $this->trimmed('size');
-        if (!$size) {
-            $this->clientError(_('No size.'));
-            return;
-        }
-        $size = strtolower($size);
-        if (!in_array($size, array('original', '96', '48', '24'))) {
-            $this->clientError(_('Invalid size.'));
-            return;
         }
+        $size = $this->trimmed('size') ?: 'original';
 
-        $user = User::staticGet('nickname', $nickname);
+        $user = User::getKV('nickname', $nickname);
         if (!$user) {
+            // TRANS: Client error displayed trying to get an avatar for a non-existing user.
             $this->clientError(_('No such user.'));
-            return;
         }
         $profile = $user->getProfile();
         if (!$profile) {
+            // TRANS: Error message displayed when referring to a user without a profile.
             $this->clientError(_('User has no profile.'));
-            return;
-        }
-        if ($size == 'original') {
-            $avatar = $profile->getOriginal();
-        } else {
-            $avatar = $profile->getAvatar($size+0);
         }
 
-        if ($avatar) {
-            $url = $avatar->url;
-        } else {
-            if ($size == 'original') {
+        if ($size === 'original') {
+            try {
+                $avatar = Avatar::getUploaded($profile);
+                $url = $avatar->displayUrl();
+            } catch (NoAvatarException $e) {
                 $url = Avatar::defaultImage(AVATAR_PROFILE_SIZE);
-            } else {
-                $url = Avatar::defaultImage($size+0);
             }
+        } else {
+            $url = $profile->avatarUrl($size);
         }
+
         common_redirect($url, 302);
     }
 
@@ -103,4 +90,3 @@ class AvatarbynicknameAction extends Action
         return true;
     }
 }
-