Qvitter API changes (thanks hannes2peer)

[quix0rs-gnu-social.git] / lib / htmloutputter.php

diff --git a/lib/htmloutputter.php b/lib/htmloutputter.php
index b341d14958b44c04615924644d36fd73a1513afe..578518ea411a7ae219500d3439e4fd1835379276 100644 (file)
--- a/lib/htmloutputter.php
+++ b/lib/htmloutputter.php
@@ -108,10 +108,17 @@ class HTMLOutputter extends XMLOutputter
 
         header('Content-Type: '.$type);
 
+       // Output anti-framing headers to prevent clickjacking (respected by newer
+        // browsers).
+       if (common_config('javascript', 'bustframes')) {
+            header('X-XSS-Protection: 1; mode=block'); // detect XSS Reflection attacks
+            header('X-Frame-Options: SAMEORIGIN'); // no rendering if origin mismatch
+        }
+
         $this->extraHeaders();
         if (preg_match("/.*\/.*xml/", $type)) {
             // Required for XML documents
-            $this->xw->startDocument('1.0', 'UTF-8');
+            $this->startXML();
         }
         $this->xw->writeDTD('html',
                             '-//W3C//DTD XHTML 1.0 Strict//EN',
@@ -170,21 +177,22 @@ class HTMLOutputter extends XMLOutputter
      * @param string $label        text of label for the element
      * @param string $value        value of the element, default null
      * @param string $instructions instructions for valid input
+     * @param string $name         name of the element; if null, the id will
+     *                             be used
      *
-     * @todo add a $name parameter
      * @todo add a $maxLength parameter
      * @todo add a $size parameter
      *
      * @return void
      */
 
-    function input($id, $label, $value=null, $instructions=null)
+    function input($id, $label, $value=null, $instructions=null, $name=null)
     {
         $this->element('label', array('for' => $id), $label);
-        $attrs = array('name' => $id,
-                       'type' => 'text',
-                       'id' => $id);
-        if ($value) {
+        $attrs = array('type' => 'text',
+                       'id'   => $id);
+        $attrs['name'] = is_null($name) ? $id : $name;
+        if (!is_null($value)) { // value can be 0 or ''
             $attrs['value'] = $value;
         }
         $this->element('input', $attrs);
@@ -516,28 +524,48 @@ class HTMLOutputter extends XMLOutputter
      * @param string $label        text of label for the element
      * @param string $content      content of the textarea, default none
      * @param string $instructions instructions for valid input
+     * @param string $name         name of textarea; if null, $id will be used
+     * @param int    $cols         number of columns
+     * @param int    $rows         number of rows
      *
      * @return void
-     *
-     * @todo add a $name parameter
-     * @todo add a $cols parameter
-     * @todo add a $rows parameter
      */
 
-    function textarea($id, $label, $content=null, $instructions=null)
-    {
+    function textarea(
+        $id,
+        $label,
+        $content      = null,
+        $instructions = null,
+        $name         = null,
+        $cols         = null,
+        $rows         = null
+    ) {
         $this->element('label', array('for' => $id), $label);
-        $this->element('textarea', array('rows' => 3,
-                                         'cols' => 40,
-                                         'name' => $id,
-                                         'id' => $id),
-                       ($content) ? $content : '');
+        $attrs = array(
+            'rows' => 3,
+            'cols' => 40,
+            'id' => $id
+        );
+        $attrs['name'] = is_null($name) ? $id : $name;
+
+        if ($cols != null) {
+            $attrs['cols'] = $cols;
+
+        }
+        if ($rows != null) {
+            $attrs['rows'] = $rows;
+        }
+        $this->element(
+            'textarea',
+            $attrs,
+            is_null($content) ? '' : $content
+        );
         if ($instructions) {
             $this->element('p', 'form_guide', $instructions);
         }
     }
 
-    /**
+   /**
     * Internal script to autofocus the given element on page onload.
     *
     * @param string $id element ID, must refer to an existing element