removed Profile_block::get, changed to use pkeyGet

[quix0rs-gnu-social.git] / actions / remotesubscribe.php

diff --git a/actions/remotesubscribe.php b/actions/remotesubscribe.php
index 4cadd1496def067c02e07b6785a146e59e9dd414..0adcc08481a30038f6d2c6ec139bce3350e22776 100644 (file)
--- a/actions/remotesubscribe.php
+++ b/actions/remotesubscribe.php
@@ -28,11 +28,19 @@ class RemotesubscribeAction extends Action {
                parent::handle($args);
 
                if (common_logged_in()) {
-                       common_user_error(_t('You can use the local subscription!'));
+                       common_user_error(_('You can use the local subscription!'));
                    return;
                }
 
                if ($_SERVER['REQUEST_METHOD'] == 'POST') {
+                       
+                       # CSRF protection
+                       $token = $this->trimmed('token');
+                       if (!$token || $token != common_session_token()) {
+                               $this->show_form(_('There was a problem with your session token. Try again, please.'));
+                               return;
+                       }
+                       
                        $this->remote_subscription();
                } else {
                        $this->show_form();
@@ -40,10 +48,10 @@ class RemotesubscribeAction extends Action {
        }
 
        function get_instructions() {
-               return _t('To subscribe, you can [login](%%action.login%%),' .
+               return _('To subscribe, you can [login](%%action.login%%),' .
                          ' or [register](%%action.register%%) a new ' .
                          ' account. If you already have an account ' .
-                         ' on another microblogging site, ' .
+                         ' on a [compatible microblogging site](%%doc.openmublog%%), ' .
                          ' enter your profile URL below.');
        }
 
@@ -53,7 +61,7 @@ class RemotesubscribeAction extends Action {
                } else {
                        $instructions = $this->get_instructions();
                        $output = common_markup_to_html($instructions);
-                       common_element_start('p', 'instructions');
+                       common_element_start('div', 'instructions');
                        common_raw($output);
                        common_element_end('p');
                }
@@ -62,15 +70,18 @@ class RemotesubscribeAction extends Action {
        function show_form($err=NULL) {
                $nickname = $this->trimmed('nickname');
                $profile = $this->trimmed('profile_url');
-               common_show_header(_t('Remote subscribe'), NULL, $err,
+               common_show_header(_('Remote subscribe'), NULL, $err,
                                                   array($this, 'show_top'));
-               common_element_start('form', array('id' => 'remotesubscribe', 'method' => 'POST',
+               # id = remotesubscribe conflicts with the
+               # button on profile page
+               common_element_start('form', array('id' => 'remsub', 'method' => 'post',
                                                                                   'action' => common_local_url('remotesubscribe')));
-               common_input('nickname', _t('User nickname'), $nickname,
-                                        _t('Nickname of the user you want to follow'));
-               common_input('profile_url', _t('Profile URL'), $profile,
-                                        _t('URL of your profile on another compatible microblogging service'));
-               common_submit('submit', _t('Subscribe'));
+               common_hidden('token', common_session_token());
+               common_input('nickname', _('User nickname'), $nickname,
+                                        _('Nickname of the user you want to follow'));
+               common_input('profile_url', _('Profile URL'), $profile,
+                                        _('URL of your profile on another compatible microblogging service'));
+               common_submit('submit', _('Subscribe'));
                common_element_end('form');
                common_show_footer();
        }
@@ -79,19 +90,19 @@ class RemotesubscribeAction extends Action {
                $user = $this->get_user();
 
                if (!$user) {
-                       $this->show_form(_t('No such user!'));
+                       $this->show_form(_('No such user.'));
                        return;
                }
 
                $profile = $this->trimmed('profile_url');
 
                if (!$profile) {
-                       $this->show_form(_t('No such user!'));
+                       $this->show_form(_('No such user.'));
                        return;
                }
 
                if (!Validate::uri($profile, array('allowed_schemes' => array('http', 'https')))) {
-                       $this->show_form(_t('Invalid profile URL (bad format)'));
+                       $this->show_form(_('Invalid profile URL (bad format)'));
                        return;
                }
 
@@ -99,28 +110,42 @@ class RemotesubscribeAction extends Action {
                $yadis = Auth_Yadis_Yadis::discover($profile, $fetcher);
 
                if (!$yadis || $yadis->failed) {
-                       $this->show_form(_t('Not a valid profile URL (no YADIS document).'));
+                       $this->show_form(_('Not a valid profile URL (no YADIS document).'));
                        return;
                }
 
-        $xrds =& Auth_Yadis_XRDS::parseXRDS($yadis->response_text);
+               # XXX: a little liberal for sites that accidentally put whitespace before the xml declaration
+               
+        $xrds =& Auth_Yadis_XRDS::parseXRDS(trim($yadis->response_text));
 
                if (!$xrds) {
-                       $this->show_form(_t('Not a valid profile URL (no XRDS defined).'));
+                       $this->show_form(_('Not a valid profile URL (no XRDS defined).'));
                        return;
                }
 
                $omb = $this->getOmb($xrds);
 
                if (!$omb) {
-                       $this->show_form(_t('Not a valid profile URL (incorrect services).'));
+                       $this->show_form(_('Not a valid profile URL (incorrect services).'));
                        return;
                }
 
+               if (omb_service_uri($omb[OAUTH_ENDPOINT_REQUEST]) ==
+                       common_local_url('requesttoken'))
+               {
+                       $this->show_form(_('That\'s a local profile! Login to subscribe.'));
+                       return;
+               }
+
+               if (User::staticGet('uri', omb_local_id($omb[OAUTH_ENDPOINT_REQUEST]))) {
+                       $this->show_form(_('That\'s a local profile! Login to subscribe.'));
+                       return;
+               }
+               
                list($token, $secret) = $this->request_token($omb);
 
                if (!$token || !$secret) {
-                       $this->show_form(_t('Couldn\'t get a request token.'));
+                       $this->show_form(_('Couldn\'t get a request token.'));
                        return;
                }
 
@@ -300,7 +325,14 @@ class RemotesubscribeAction extends Action {
                $req->set_parameter('omb_listenee_profile', common_profile_url($user->nickname));
                $req->set_parameter('omb_listenee_nickname', $user->nickname);
                $req->set_parameter('omb_listenee_license', $config['license']['url']);
+
                $profile = $user->getProfile();
+               if (!$profile) {
+                       common_log_db_error($user, 'SELECT', __FILE__);
+                       $this->server_error(_('User without matching profile'));
+                       return;
+               }
+               
                if ($profile->fullname) {
                        $req->set_parameter('omb_listenee_fullname', $profile->fullname);
                }
@@ -337,6 +369,8 @@ class RemotesubscribeAction extends Action {
                $omb['post_notice_url'] = omb_service_uri($omb[OMB_ENDPOINT_POSTNOTICE]);
                $omb['update_profile_url'] = omb_service_uri($omb[OMB_ENDPOINT_UPDATEPROFILE]);
 
+               common_ensure_session();
+               
                $_SESSION['oauth_authorization_request'] = $omb;
 
                # Redirect to authorization service