Remove CSRF protection from username/password login and from OpenID login.

[quix0rs-gnu-social.git] / actions / newnotice.php

diff --git a/actions/newnotice.php b/actions/newnotice.php
index ca6355cbffdc64faccee35ae39407458d44451f0..ea832cf4e1300ec0ce75424c40f9f4e8530e1164 100644 (file)
--- a/actions/newnotice.php
+++ b/actions/newnotice.php
@@ -131,6 +131,8 @@ class NewnoticeAction extends Action
         $user = common_current_user();
         assert($user); // XXX: maybe an error instead...
         $content = $this->trimmed('status_textarea');
+        $options = array();
+        Event::handle('StartSaveNewNoticeWeb', array($this, $user, &$content, &$options));
 
         if (!$content) {
             $this->clientError(_('No content!'));
@@ -157,11 +159,9 @@ class NewnoticeAction extends Action
                                        Notice::maxContent()));
         }
 
-        $replyto = $this->trimmed('inreplyto');
-        #If an ID of 0 is wrongly passed here, it will cause a database error,
-        #so override it...
-        if ($replyto == 0) {
-            $replyto = 'false';
+        $replyto = intval($this->trimmed('inreplyto'));
+        if ($replyto) {
+            $options['reply_to'] = $replyto;
         }
 
         $upload = null;
@@ -169,7 +169,10 @@ class NewnoticeAction extends Action
 
         if (isset($upload)) {
 
-            $content_shortened .= ' ' . $upload->shortUrl();
+            if (Event::handle('StartSaveNewNoticeAppendAttachment', array($this, $upload, &$content_shortened, &$options))) {
+                $content_shortened .= ' ' . $upload->shortUrl();
+            }
+            Event::handle('EndSaveNewNoticeAppendAttachment', array($this, $upload, &$content_shortened, &$options));
 
             if (Notice::contentTooLong($content_shortened)) {
                 $upload->delete();
@@ -182,8 +185,6 @@ class NewnoticeAction extends Action
             }
         }
 
-        $options = array('reply_to' => ($replyto == 'false') ? null : $replyto);
-
         if ($user->shareLocation()) {
             // use browser data if checked; otherwise profile data
             if ($this->arg('notice_data-geo')) {
@@ -216,6 +217,7 @@ class NewnoticeAction extends Action
 
             Event::handle('EndNoticeSaveWeb', array($this, $notice));
         }
+        Event::handle('EndSaveNewNoticeWeb', array($this, $user, &$content_shortened, &$options));
 
         if ($this->boolean('ajax')) {
             header('Content-Type: text/xml;charset=utf-8');