}
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
+
+ # CSRF protection
+ $token = $this->trimmed('token');
+ if (!$token || $token != common_session_token()) {
+ $this->show_form(_('There was a problem with your session token. Try again, please.'));
+ return;
+ }
+
$this->remote_subscription();
} else {
$this->show_form();
# button on profile page
common_element_start('form', array('id' => 'remsub', 'method' => 'post',
'action' => common_local_url('remotesubscribe')));
+ common_hidden('token', common_session_token());
common_input('nickname', _('User nickname'), $nickname,
_('Nickname of the user you want to follow'));
common_input('profile_url', _('Profile URL'), $profile,
return;
}
- $xrds =& Auth_Yadis_XRDS::parseXRDS($yadis->response_text);
+ # XXX: a little liberal for sites that accidentally put whitespace before the xml declaration
+
+ $xrds =& Auth_Yadis_XRDS::parseXRDS(trim($yadis->response_text));
if (!$xrds) {
$this->show_form(_('Not a valid profile URL (no XRDS defined).'));
$req->set_parameter('omb_listenee_profile', common_profile_url($user->nickname));
$req->set_parameter('omb_listenee_nickname', $user->nickname);
$req->set_parameter('omb_listenee_license', $config['license']['url']);
+
$profile = $user->getProfile();
+ if (!$profile) {
+ common_log_db_error($user, 'SELECT', __FILE__);
+ $this->server_error(_('User without matching profile'));
+ return;
+ }
+
if ($profile->fullname) {
$req->set_parameter('omb_listenee_fullname', $profile->fullname);
}