CSRF protection for subscription/unsubscription

[quix0rs-gnu-social.git] / actions / shownotice.php

diff --git a/actions/shownotice.php b/actions/shownotice.php
index 7805242379a58be962cdd70b1e399e934f1539f6..f9531b3c40378bf27cd4e5fc13c4896a0f1381f4 100644 (file)
--- a/actions/shownotice.php
+++ b/actions/shownotice.php
@@ -19,7 +19,7 @@
 
 if (!defined('LACONICA')) { exit(1); }
 
-require_once(INSTALLDIR.'lib/stream.php');
+require_once(INSTALLDIR.'/lib/stream.php');
 
 class ShownoticeAction extends StreamAction {
 
@@ -29,16 +29,22 @@ class ShownoticeAction extends StreamAction {
                $notice = Notice::staticGet($id);
 
                if (!$notice) {
-                       $this->no_such_notice();
+                       $this->client_error(_('No such notice.'), 404);
+                       return;
                }
 
-               if (!$notice->getProfile()) {
-                       $this->no_such_notice();
+               $profile = $notice->getProfile();
+
+               if (!$profile) {
+                       $this->server_error(_('Notice has no profile'), 500);
+                       return;
                }
 
                # Looks like we're good; show the header
 
-               common_show_header($profile->nickname."'s status on ".common_date_string($notice->created));
+               common_show_header(sprintf(_('%1$s\'s status on %2$s'), $profile->nickname, common_exact_date($notice->created)),
+                                                  array($this, 'show_header'), $notice,
+                                                  array($this, 'show_top'));
 
                common_element_start('ul', array('id' => 'notices'));
                $this->show_notice($notice);
@@ -47,7 +53,33 @@ class ShownoticeAction extends StreamAction {
                common_show_footer();
        }
 
+       function show_header($notice)
+       {
+               $profile = $notice->getProfile();
+               $user = User::staticGet($profile->id);
+               if (!$user) {
+                       return;
+               }
+               if ($user->emailmicroid && $user->email && $notice->uri) {
+                       common_element('meta', array('name' => 'microid',
+                                                                                'content' => "mailto+http:sha1:" . sha1(sha1('mailto:' . $user->email) . sha1($notice->uri))));
+               }
+               if ($user->jabbermicroid && $user->jabber && $notice->uri) {
+                       common_element('meta', array('name' => 'microid',
+                                                                                'content' => "xmpp+http:sha1:" . sha1(sha1('xmpp:' . $user->jabber) . sha1($notice->uri))));
+               }
+       }
+
+       function show_top($notice) {
+               $user = $notice->getProfile();
+               $cur = common_current_user();
+
+               if ($cur && $cur->id == $user->id) {
+                       common_notice_form();
+               }
+       }
+
        function no_such_notice() {
-               common_user_error('No such notice.');
+               common_user_error(_('No such notice.'));
        }
 }