XSS vulnerability when remote-subscribing

[quix0rs-gnu-social.git] / actions / pluginenable.php

diff --git a/actions/pluginenable.php b/actions/pluginenable.php
index 2dbb3e3956ce0cff6e711b19a7faf8beaca365cc..707cbdecaab45870995a43d0d08c2354e1c9a9b1 100644 (file)
--- a/actions/pluginenable.php
+++ b/actions/pluginenable.php
@@ -52,7 +52,6 @@ if (!defined('STATUSNET')) {
  * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html AGPLv3
  * @link      http://status.net/
  */
-
 class PluginEnableAction extends Action
 {
     var $user;
@@ -65,7 +64,6 @@ class PluginEnableAction extends Action
      *
      * @return boolean success flag
      */
-
     function prepare($args)
     {
         parent::prepare($args);
@@ -75,8 +73,9 @@ class PluginEnableAction extends Action
         // Only allow POST requests
 
         if ($_SERVER['REQUEST_METHOD'] != 'POST') {
+            // TRANS: Client error displayed when trying to use another method than POST.
+            // TRANS: Do not translate POST.
             $this->clientError(_('This action only accepts POST requests.'));
-            return false;
         }
 
         // CSRF protection
@@ -84,9 +83,9 @@ class PluginEnableAction extends Action
         $token = $this->trimmed('token');
 
         if (!$token || $token != common_session_token()) {
+            // TRANS: Client error displayed when the session token does not match or is not given.
             $this->clientError(_('There was a problem with your session token.'.
                                  ' Try again, please.'));
-            return false;
         }
 
         // Only for logged-in users
@@ -94,20 +93,20 @@ class PluginEnableAction extends Action
         $this->user = common_current_user();
 
         if (empty($this->user)) {
+            // TRANS: Error message displayed when trying to perform an action that requires a logged in user.
             $this->clientError(_('Not logged in.'));
-            return false;
         }
 
         if (!AdminPanelAction::canAdmin('plugins')) {
+            // TRANS: Client error displayed when trying to enable or disable a plugin without access rights.
             $this->clientError(_('You cannot administer plugins.'));
-            return false;
         }
 
         $this->plugin = $this->arg('plugin');
         $defaultPlugins = common_config('plugins', 'default');
         if (!array_key_exists($this->plugin, $defaultPlugins)) {
+            // TRANS: Client error displayed when trying to enable or disable a non-existing plugin.
             $this->clientError(_('No such plugin.'));
-            return false;
         }
 
         return true;
@@ -122,7 +121,6 @@ class PluginEnableAction extends Action
      *
      * @return void
      */
-
     function handle($args)
     {
         $key = 'disable-' . $this->plugin;
@@ -138,7 +136,7 @@ class PluginEnableAction extends Action
             $form = $this->successNextForm();
             $form->show();
             $this->elementEnd('body');
-            $this->elementEnd('html');
+            $this->endHTML();
         } else {
             $url = common_local_url('pluginsadminpanel');
             common_redirect($url, 303);