]> git.mxchange.org Git - quix0rs-gnu-social.git/blobdiff - actions/foaf.php
XSS vulnerability when remote-subscribing
[quix0rs-gnu-social.git] / actions / foaf.php
index 356393304ed5abbc0a243bcd68e8974d395aa05b..260388ba447b72819ea0f908e4da35e9ade80391 100644 (file)
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-if (!defined('STATUSNET') && !defined('LACONICA')) { exit(1); }
+if (!defined('GNUSOCIAL')) { exit(1); }
 
 define('LISTENER', 1);
 define('LISTENEE', -1);
 define('BOTH', 0);
 
-class FoafAction extends Action
+// @todo XXX: Documentation missing.
+class FoafAction extends ManagedAction
 {
     function isReadOnly($args)
     {
         return true;
     }
 
-    function prepare($args)
+    protected function doPreparation()
     {
-        parent::prepare($args);
-
         $nickname_arg = $this->arg('nickname');
 
         if (empty($nickname_arg)) {
+            // TRANS: Client error displayed when requesting Friends of a Friend feed without providing a user nickname.
             $this->clientError(_('No such user.'), 404);
-            return false;
         }
 
         $this->nickname = common_canonical_nickname($nickname_arg);
@@ -49,30 +48,27 @@ class FoafAction extends Action
             common_redirect(common_local_url('foaf',
                                              array('nickname' => $this->nickname)),
                             301);
-            return false;
         }
 
-        $this->user = User::staticGet('nickname', $this->nickname);
+        $this->user = User::getKV('nickname', $this->nickname);
 
         if (!$this->user) {
+            // TRANS: Client error displayed when requesting Friends of a Friend feed for an object that is not a user.
             $this->clientError(_('No such user.'), 404);
-            return false;
         }
 
         $this->profile = $this->user->getProfile();
 
         if (!$this->profile) {
+            // TRANS: Error message displayed when referring to a user without a profile.
             $this->serverError(_('User has no profile.'), 500);
-            return false;
         }
 
         return true;
     }
 
-    function handle($args)
+    public function showPage()
     {
-        parent::handle($args);
-
         header('Content-Type: application/rdf+xml');
 
         $this->startXML();
@@ -90,12 +86,13 @@ class FoafAction extends Action
 
         // This is the document about the user
 
-        $this->showPpd('', $this->user->uri);
+        $this->showPpd('', $this->user->getUri());
 
         // Would be nice to tell if they were a Person or not (e.g. a #person usertag?)
-        $this->elementStart('Agent', array('rdf:about' =>
-                                             $this->user->uri));
-        $this->element('mbox_sha1sum', null, sha1('mailto:' . $this->user->email));
+        $this->elementStart('Agent', array('rdf:about' => $this->user->getUri()));
+        if ($this->user->email) {
+            $this->element('mbox_sha1sum', null, sha1('mailto:' . $this->user->email));
+        }
         if ($this->profile->fullname) {
             $this->element('name', null, $this->profile->fullname);
         }
@@ -108,33 +105,57 @@ class FoafAction extends Action
         if ($this->profile->bio) {
             $this->element('bio:olb', null, $this->profile->bio);
         }
-        // XXX: more structured location data
-        if ($this->profile->location) {
+
+        $location = $this->profile->getLocation();
+        if ($location) {
+            $attr = array();
+            if ($location->getRdfURL()) {
+                $attr['rdf:about'] = $location->getRdfURL();
+            }
+            $location_name = $location->getName();
+
             $this->elementStart('based_near');
-            $this->elementStart('geo:SpatialThing');
-            $this->element('name', null, $this->profile->location);
+            $this->elementStart('geo:SpatialThing', $attr);
+            if ($location_name) {
+                $this->element('name', null, $location_name);
+            }
+            if ($location->lat) {
+                $this->element('geo:lat', null, $location->lat);
+            }
+            if ($location->lon) {
+                $this->element('geo:long', null, $location->lon);
+            }
+            if ($location->getURL()) {
+                $this->element('page', array('rdf:resource'=>$location->getURL()));
+            }
             $this->elementEnd('geo:SpatialThing');
             $this->elementEnd('based_near');
         }
 
-        $avatar = $this->profile->getOriginalAvatar();
-        if ($avatar) {
+        try {
+            $avatar = Avatar::getUploaded($this->profile);
             $this->elementStart('img');
-            $this->elementStart('Image', array('rdf:about' => $avatar->url));
+            $this->elementStart('Image', array('rdf:about' => $avatar->displayUrl()));
             foreach (array(AVATAR_PROFILE_SIZE, AVATAR_STREAM_SIZE, AVATAR_MINI_SIZE) as $size) {
-                $scaled = $this->profile->getAvatar($size);
-                if (!$scaled->original) { // sometimes the original has one of our scaled sizes
+                try {
+                    $scaled = $this->profile->getAvatar($size);
                     $this->elementStart('thumbnail');
-                    $this->element('Image', array('rdf:about' => $scaled->url));
+                    $this->element('Image', array('rdf:about' => $scaled->displayUrl()));
                     $this->elementEnd('thumbnail');
+                } catch (Exception $e) {
+                    // This avatar did not exist
                 }
             }
             $this->elementEnd('Image');
             $this->elementEnd('img');
+        } catch (NoAvatarException $e) {
+            // No avatar for this user!
         }
 
         $person = $this->showMicrobloggingAccount($this->profile,
-                                     common_root_url(), $this->user->uri, false);
+                                     common_root_url(), $this->user->getUri(),
+                                     /*$fetchSubscriptions*/true,
+                                     /*$isSubscriber*/false);
 
         // Get people who subscribe to user
 
@@ -144,63 +165,52 @@ class FoafAction extends Action
 
         if ($sub->find()) {
             while ($sub->fetch()) {
-                if ($sub->token) {
-                    $other = Remote_profile::staticGet('id', $sub->subscriber);
-                    $profile = Profile::staticGet('id', $sub->subscriber);
-                } else {
-                    $other = User::staticGet('id', $sub->subscriber);
-                    $profile = Profile::staticGet('id', $sub->subscriber);
-                }
-                if (!$other) {
+                $profile = Profile::getKV('id', $sub->subscriber);
+                if (!$profile instanceof Profile) {
                     common_debug('Got a bad subscription: '.print_r($sub,true));
                     continue;
                 }
-                if (array_key_exists($other->uri, $person)) {
-                    $person[$other->uri][0] = BOTH;
+                $other_uri = $profile->getUri();
+                if (array_key_exists($other_uri, $person)) {
+                    $person[$other_uri][0] = BOTH;
                 } else {
-                    $person[$other->uri] = array(LISTENER,
-                                                 $other->id,
-                                                 $profile->nickname,
-                                                 (empty($sub->token)) ? 'User' : 'Remote_profile');
+                    $person[$other_uri] = array(LISTENER,
+                                                $profile->id,
+                                                $profile->nickname,
+                                                $profile->isLocal() ? 'local' : 'remote');
                 }
-                $other->free();
-                $other = null;
-                unset($other);
-                $profile->free();
-                $profile = null;
                 unset($profile);
             }
         }
 
-        $sub->free();
-        $sub = null;
         unset($sub);
 
         foreach ($person as $uri => $p) {
-            list($type, $id, $nickname, $cls) = $p;
+            list($type, $id, $nickname, $local) = $p;
             if ($type == BOTH) {
                 $this->element('knows', array('rdf:resource' => $uri));
             }
         }
-        
+
         $this->elementEnd('Agent');
 
 
         foreach ($person as $uri => $p) {
             $foaf_url = null;
-            list($type, $id, $nickname, $cls) = $p;
-            if ($cls == 'User') {
+            list($type, $id, $nickname, $local) = $p;
+            if ($local == 'local') {
                 $foaf_url = common_local_url('foaf', array('nickname' => $nickname));
             }
-            $profile = Profile::staticGet($id);
+            $profile = Profile::getKV($id);
             $this->elementStart('Agent', array('rdf:about' => $uri));
             if ($type == BOTH) {
-                $this->element('knows', array('rdf:resource' => $this->user->uri));
+                $this->element('knows', array('rdf:resource' => $this->user->getUri()));
             }
             $this->showMicrobloggingAccount($profile,
-                                   ($cls == 'User') ? common_root_url() : null,
+                                   ($local == 'local') ? common_root_url() : null,
                                    $uri,
-                                   true);
+                                   /*$fetchSubscriptions*/false,
+                                   /*$isSubscriber*/($type == LISTENER || $type == BOTH));
             if ($foaf_url) {
                 $this->element('rdfs:seeAlso', array('rdf:resource' => $foaf_url));
             }
@@ -225,7 +235,20 @@ class FoafAction extends Action
         $this->elementEnd('PersonalProfileDocument');
     }
 
-    function showMicrobloggingAccount($profile, $service=null, $useruri=null, $isSubscriber=false)
+    /**
+     * Output FOAF <account> bit for the given profile.
+     *
+     * @param Profile $profile
+     * @param mixed $service Root URL of this StatusNet instance for a local
+     *                       user, otherwise null.
+     * @param mixed $useruri URI string for the referenced profile..
+     * @param boolean $fetchSubscriptions Should we load and list all their subscriptions?
+     * @param boolean $isSubscriber if not fetching subs, we can still mark the user as following the current page.
+     *
+     * @return array if $fetchSubscribers is set, return a list of info on those
+     *               subscriptions.
+     */
+    function showMicrobloggingAccount($profile, $service=null, $useruri=null, $fetchSubscriptions=false, $isSubscriber=false)
     {
         $attr = array();
         if ($useruri) {
@@ -233,7 +256,7 @@ class FoafAction extends Action
         }
 
         // Their account
-        $this->elementStart('holdsAccount');
+        $this->elementStart('account');
         $this->elementStart('OnlineAccount', $attr);
         if ($service) {
             $this->element('accountServiceHomepage', array('rdf:resource' =>
@@ -247,9 +270,7 @@ class FoafAction extends Action
 
         $person = array();
 
-        if ($isSubscriber) {
-             $this->element('sioc:follows', array('rdf:resource'=>$this->user->uri . '#acct'));
-        } else {
+        if ($fetchSubscriptions) {
             // Get people user is subscribed to
             $sub = new Subscription();
             $sub->subscriber = $profile->id;
@@ -257,38 +278,29 @@ class FoafAction extends Action
 
             if ($sub->find()) {
                 while ($sub->fetch()) {
-                    if (!empty($sub->token)) {
-                        $other = Remote_profile::staticGet('id', $sub->subscribed);
-                        $profile = Profile::staticGet('id', $sub->subscribed);
-                    } else {
-                        $other = User::staticGet('id', $sub->subscribed);
-                        $profile = Profile::staticGet('id', $sub->subscribed);
-                    }
-                    if (empty($other)) {
+                    $profile = Profile::getKV('id', $sub->subscribed);
+                    if (empty($profile)) {
                         common_debug('Got a bad subscription: '.print_r($sub,true));
                         continue;
                     }
-                    $this->element('sioc:follows', array('rdf:resource' => $other->uri.'#acct'));
-                    $person[$other->uri] = array(LISTENEE,
-                                                 $other->id,
-                                                 $profile->nickname,
-                                                 (empty($sub->token)) ? 'User' : 'Remote_profile');
-                    $other->free();
-                    $other = null;
-                    unset($other);
-                    $profile->free();
-                    $profile = null;
+                    $other_uri = $profile->getUri();
+                    $this->element('sioc:follows', array('rdf:resource' => $other_uri.'#acct'));
+                    $person[$other_uri] = array(LISTENEE,
+                                                $profile->id,
+                                                $profile->nickname,
+                                                $profile->isLocal() ? 'local' : 'remote');
                     unset($profile);
                 }
             }
 
-            $sub->free();
-            $sub = null;
             unset($sub);
+        } else if ($isSubscriber) {
+            // Just declare that they follow the user whose FOAF we're showing.
+            $this->element('sioc:follows', array('rdf:resource' => $this->user->getUri() . '#acct'));
         }
 
         $this->elementEnd('OnlineAccount');
-        $this->elementEnd('holdsAccount');
+        $this->elementEnd('account');
 
         return $person;
     }