block injection vector

[friendica.git] / include / items.php

diff --git a/include/items.php b/include/items.php
index 94835d7ad1443dc368cbc3517fce8d74ef12b361..b7be27932f6a1c215b136356bdf8977b63cdec66 100755 (executable)
--- a/include/items.php
+++ b/include/items.php
@@ -8,6 +8,7 @@ require_once('include/Photo.php');
 require_once('include/tags.php');
 require_once('include/text.php');
 require_once('include/email.php');
+require_once('include/ostatus_conversation.php');
 
 function get_feed_for(&$a, $dfrn_id, $owner_nick, $last_update, $direction = 0) {
 
@@ -834,14 +835,16 @@ function get_atom_elements($feed,$item) {
        // Search for ostatus conversation url
        $links = $item->feed->data["child"][SIMPLEPIE_NAMESPACE_ATOM_10]["feed"][0]["child"][SIMPLEPIE_NAMESPACE_ATOM_10]["entry"][0]["child"]["http://www.w3.org/2005/Atom"]["link"];
 
-       foreach ($links as $link) {
-               $conversation = array_shift($link["attribs"]);
+       if (is_array($links)) {
+               foreach ($links as $link) {
+                       $conversation = array_shift($link["attribs"]);
 
-               if ($conversation["rel"] == "ostatus:conversation") {
-                       $res["ostatus_conversation"] = $conversation["href"];
-                       logger('get_atom_elements: found conversation url '.$res["ostatus_conversation"]);
-               }
-       };
+                       if ($conversation["rel"] == "ostatus:conversation") {
+                               $res["ostatus_conversation"] = $conversation["href"];
+                               logger('get_atom_elements: found conversation url '.$res["ostatus_conversation"]);
+                       }
+               };
+       }
 
        $arr = array('feed' => $feed, 'item' => $item, 'result' => $res);
 
@@ -1098,7 +1101,6 @@ function item_store($arr,$force_parent = false) {
                $current_post = $r[0]['id'];
                logger('item_store: created item ' . $current_post);
                create_tags_from_item($r[0]['id']);
-               // ostatus_conversation
        } else {
                logger('item_store: could not locate created item');
                return 0;
@@ -1135,6 +1137,10 @@ function item_store($arr,$force_parent = false) {
        );
        create_tags_from_item($current_post);
 
+       // Complete ostatus threads
+       if ($ostatus_conversation)
+               complete_conversation($current_post, $ostatus_conversation);
+
         $arr['id'] = $current_post;
         $arr['parent'] = $parent_id;
         $arr['allow_cid'] = $allow_cid;
@@ -3661,7 +3667,7 @@ function fix_private_photos($s, $uid, $item = null, $cid = 0) {
                        // Only embed locally hosted photos
                        $replace = false;
                        $i = basename($image);
-                       $i = str_replace(array('.jpg','.png'),array('',''),$i);
+                       $i = str_replace(array('.jpg','.png','.gif'),array('','',''),$i);
                        $x = strpos($i,'-');
 
                        if($x) {
@@ -3672,7 +3678,7 @@ function fix_private_photos($s, $uid, $item = null, $cid = 0) {
                                        intval($res),
                                        intval($uid)
                                );
-                               if(count($r)) {
+                               if($r) {
 
                                        // Check to see if we should replace this photo link with an embedded image
                                        // 1. No need to do so if the photo is public
@@ -3941,6 +3947,34 @@ function drop_item($id,$interactive = true) {
 
        if((local_user() == $item['uid']) || ($cid) || (! $interactive)) {
 
+               // Check if we should do HTML-based delete confirmation
+               if($_REQUEST['confirm']) {
+                       // <form> can't take arguments in its "action" parameter
+                       // so add any arguments as hidden inputs
+                       $query = explode_querystring($a->query_string);
+                       $inputs = array();
+                       foreach($query['args'] as $arg) {
+                               if(strpos($arg, 'confirm=') === false) {
+                                       $arg_parts = explode('=', $arg);
+                                       $inputs[] = array('name' => $arg_parts[0], 'value' => $arg_parts[1]);
+                               }
+                       }
+
+                       return replace_macros(get_markup_template('confirm.tpl'), array(
+                               '$method' => 'get',
+                               '$message' => t('Do you really want to delete this item?'),
+                               '$extra_inputs' => $inputs,
+                               '$confirm' => t('Yes'),
+                               '$confirm_url' => $query['base'],
+                               '$confirm_name' => 'confirmed',
+                               '$cancel' => t('Cancel'),
+                       ));
+               }
+               // Now check how the user responded to the confirmation query
+               if($_REQUEST['canceled']) {
+                       goaway($a->get_baseurl() . '/' . $_SESSION['return_url']);
+               }
+
                logger('delete item: ' . $item['id'], LOGGER_DEBUG);
                // delete the item