Remove CSRF protection from username/password login and from OpenID login.

[quix0rs-gnu-social.git] / actions / newmessage.php

diff --git a/actions/newmessage.php b/actions/newmessage.php
index 82276ff341c6e6d8ea54d033fe2588aba48e21c3..25e58feab30c294ec6ef7bec4857a29de5316760 100644 (file)
--- a/actions/newmessage.php
+++ b/actions/newmessage.php
@@ -1,6 +1,6 @@
 <?php
 /**
- * Laconica, the distributed open-source microblogging tool
+ * StatusNet, the distributed open-source microblogging tool
  *
  * Handler for posting new messages
  *
@@ -20,16 +20,16 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  *
  * @category  Personal
- * @package   Laconica
- * @author    Evan Prodromou <evan@controlyourself.ca>
- * @author    Zach Copley <zach@controlyourself.ca>
- * @author    Sarven Capadisli <csarven@controlyourself.ca>
- * @copyright 2008-2009 Control Yourself, Inc.
+ * @package   StatusNet
+ * @author    Evan Prodromou <evan@status.net>
+ * @author    Zach Copley <zach@status.net>
+ * @author    Sarven Capadisli <csarven@status.net>
+ * @copyright 2008-2009 StatusNet, Inc.
  * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
- * @link      http://laconi.ca/
+ * @link      http://status.net/
  */
 
-if (!defined('LACONICA')) {
+if (!defined('STATUSNET') && !defined('LACONICA')) {
     exit(1);
 }
 
@@ -37,12 +37,12 @@ if (!defined('LACONICA')) {
  * Action for posting new direct messages
  *
  * @category Personal
- * @package  Laconica
- * @author   Evan Prodromou <evan@controlyourself.ca>
- * @author   Zach Copley <zach@controlyourself.ca>
- * @author   Sarven Capadisli <csarven@controlyourself.ca>
+ * @package  StatusNet
+ * @author   Evan Prodromou <evan@status.net>
+ * @author   Zach Copley <zach@status.net>
+ * @author   Sarven Capadisli <csarven@status.net>
  * @license  http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
- * @link     http://laconi.ca/
+ * @link     http://status.net/
  */
 
 class NewmessageAction extends Action
@@ -99,7 +99,9 @@ class NewmessageAction extends Action
         $user = common_current_user();
 
         if (!$user) {
-            $this->clientError(_('Only logged-in users can send direct messages.'), 403);
+            /* Go log in, and then come back. */
+            common_set_returnto($_SERVER['REQUEST_URI']);
+            common_redirect(common_local_url('login'));
             return false;
         }
 
@@ -111,7 +113,7 @@ class NewmessageAction extends Action
             $this->other = User::staticGet('id', $this->to);
 
             if (!$this->other) {
-                $this->clientError(_('No such user'), 404);
+                $this->clientError(_('No such user.'), 404);
                 return false;
             }
 
@@ -144,9 +146,10 @@ class NewmessageAction extends Action
         } else {
             $content_shortened = common_shorten_links($this->content);
 
-            if (mb_strlen($content_shortened) > 140) {
-                $this->showForm(_('That\'s too long. ' .
-                    'Max message size is 140 chars.'));
+            if (Message::contentTooLong($content_shortened)) {
+                $this->showForm(sprintf(_('That\'s too long. ' .
+                                          'Max message size is %d chars.'),
+                                        Message::maxContent()));
                 return;
             }
         }
@@ -170,18 +173,71 @@ class NewmessageAction extends Action
             return;
         }
 
-        $this->notify($user, $this->other, $message);
+        $message->notify();
+
+        if ($this->boolean('ajax')) {
+            $this->startHTML('text/xml;charset=utf-8');
+            $this->elementStart('head');
+            $this->element('title', null, _('Message sent'));
+            $this->elementEnd('head');
+            $this->elementStart('body');
+            $this->element('p', array('id' => 'command_result'),
+                sprintf(_('Direct message to %s sent.'),
+                    $this->other->nickname));
+            $this->elementEnd('body');
+            $this->elementEnd('html');
+        } else {
+            $url = common_local_url('outbox',
+                array('nickname' => $user->nickname));
+            common_redirect($url, 303);
+        }
+    }
 
-        $url = common_local_url('outbox', array('nickname' => $user->nickname));
+    /**
+     * Show an Ajax-y error message
+     *
+     * Goes back to the browser, where it's shown in a popup.
+     *
+     * @param string $msg Message to show
+     *
+     * @return void
+     */
 
-        common_redirect($url, 303);
+    function ajaxErrorMsg($msg)
+    {
+        $this->startHTML('text/xml;charset=utf-8', true);
+        $this->elementStart('head');
+        $this->element('title', null, _('Ajax Error'));
+        $this->elementEnd('head');
+        $this->elementStart('body');
+        $this->element('p', array('id' => 'error'), $msg);
+        $this->elementEnd('body');
+        $this->elementEnd('html');
     }
 
     function showForm($msg = null)
     {
-        $this->msg = $msg;
+        if ($msg && $this->boolean('ajax')) {
+            $this->ajaxErrorMsg($msg);
+            return;
+        }
 
-        $this->showPage();
+        $this->msg = $msg;
+        if ($this->trimmed('ajax')) {
+            header('Content-Type: text/xml;charset=utf-8');
+            $this->xw->startDocument('1.0', 'UTF-8');
+            $this->elementStart('html');
+            $this->elementStart('head');
+            $this->element('title', null, _('New message'));
+            $this->elementEnd('head');
+            $this->elementStart('body');
+            $this->showNoticeForm();
+            $this->elementEnd('body');
+            $this->endHTML();
+        }
+        else {
+            $this->showPage();
+        }
     }
 
     function showPageNotice()
@@ -191,12 +247,6 @@ class NewmessageAction extends Action
         }
     }
 
-    function notify($from, $to, $message)
-    {
-        mail_notify_message($message, $from, $to);
-        // XXX: Jabber, SMS notifications... probably queued
-    }
-
     // Do nothing (override)
 
     function showNoticeForm()