Remove CSRF protection from username/password login and from OpenID login.

[quix0rs-gnu-social.git] / actions / newnotice.php

diff --git a/actions/newnotice.php b/actions/newnotice.php
index 78480ababb069849508550141ee4c5df9862b78c..ea832cf4e1300ec0ce75424c40f9f4e8530e1164 100644 (file)
--- a/actions/newnotice.php
+++ b/actions/newnotice.php
@@ -131,6 +131,8 @@ class NewnoticeAction extends Action
         $user = common_current_user();
         assert($user); // XXX: maybe an error instead...
         $content = $this->trimmed('status_textarea');
+        $options = array();
+        Event::handle('StartSaveNewNoticeWeb', array($this, $user, &$content, &$options));
 
         if (!$content) {
             $this->clientError(_('No content!'));
@@ -157,11 +159,9 @@ class NewnoticeAction extends Action
                                        Notice::maxContent()));
         }
 
-        $replyto = $this->trimmed('inreplyto');
-        #If an ID of 0 is wrongly passed here, it will cause a database error,
-        #so override it...
-        if ($replyto == 0) {
-            $replyto = 'false';
+        $replyto = intval($this->trimmed('inreplyto'));
+        if ($replyto) {
+            $options['reply_to'] = $replyto;
         }
 
         $upload = null;
@@ -169,7 +169,10 @@ class NewnoticeAction extends Action
 
         if (isset($upload)) {
 
-            $content_shortened .= ' ' . $upload->shortUrl();
+            if (Event::handle('StartSaveNewNoticeAppendAttachment', array($this, $upload, &$content_shortened, &$options))) {
+                $content_shortened .= ' ' . $upload->shortUrl();
+            }
+            Event::handle('EndSaveNewNoticeAppendAttachment', array($this, $upload, &$content_shortened, &$options));
 
             if (Notice::contentTooLong($content_shortened)) {
                 $upload->delete();
@@ -182,26 +185,39 @@ class NewnoticeAction extends Action
             }
         }
 
-        $options = array('reply_to' => ($replyto == 'false') ? null : $replyto);
-
-        if ($user->shareLocation() && $this->arg('notice_data-geo')) {
-
-            $locOptions = Notice::locationOptions($this->trimmed('lat'),
-                                                  $this->trimmed('lon'),
-                                                  $this->trimmed('location_id'),
-                                                  $this->trimmed('location_ns'),
-                                                  $user->getProfile());
+        if ($user->shareLocation()) {
+            // use browser data if checked; otherwise profile data
+            if ($this->arg('notice_data-geo')) {
+                $locOptions = Notice::locationOptions($this->trimmed('lat'),
+                                                      $this->trimmed('lon'),
+                                                      $this->trimmed('location_id'),
+                                                      $this->trimmed('location_ns'),
+                                                      $user->getProfile());
+            } else {
+                $locOptions = Notice::locationOptions(null,
+                                                      null,
+                                                      null,
+                                                      null,
+                                                      $user->getProfile());
+            }
 
             $options = array_merge($options, $locOptions);
         }
 
-        $notice = Notice::saveNew($user->id, $content_shortened, 'web', $options);
+        $author_id = $user->id;
+        $text      = $content_shortened;
 
-        if (isset($upload)) {
-            $upload->attachToNotice($notice);
-        }
+        if (Event::handle('StartNoticeSaveWeb', array($this, &$author_id, &$text, &$options))) {
 
+            $notice = Notice::saveNew($user->id, $content_shortened, 'web', $options);
 
+            if (isset($upload)) {
+                $upload->attachToNotice($notice);
+            }
+
+            Event::handle('EndNoticeSaveWeb', array($this, $notice));
+        }
+        Event::handle('EndSaveNewNoticeWeb', array($this, $user, &$content_shortened, &$options));
 
         if ($this->boolean('ajax')) {
             header('Content-Type: text/xml;charset=utf-8');
@@ -294,6 +310,9 @@ class NewnoticeAction extends Action
             if ($profile) {
                 $content = '@' . $profile->nickname . ' ';
             }
+        } else {
+            // @fixme most of these bits above aren't being passed on above
+            $inreplyto = null;
         }
 
         $notice_form = new NoticeForm($this, '', $content, null, $inreplyto);