CSRF protection in user registration

[quix0rs-gnu-social.git] / lib / jabber.php

diff --git a/lib/jabber.php b/lib/jabber.php
index a0f5080d0fb9faeb641010704a3949eee606d02f..1202aa32227505f4d0682389063c695728f6fa73 100644 (file)
--- a/lib/jabber.php
+++ b/lib/jabber.php
@@ -54,7 +54,6 @@ function jabber_normalize_jid($jid) {
        if (preg_match("/(?:([^\@]+)\@)?([^\/]+)(?:\/(.*))?$/", $jid, $matches)) {
                $node = $matches[1];
                $server = $matches[2];
-               $resource = $matches[3];
                return strtolower($node.'@'.$server);
        } else {
                return NULL;
@@ -83,7 +82,8 @@ function jabber_connect($resource=NULL) {
                                                                XMPPHP_Log::LEVEL_VERBOSE :  NULL
                                                                );
                $conn->autoSubscribe();
-
+               $conn->useEncryption(common_config('xmpp', 'encryption'));
+               
                if (!$conn) {
                        return false;
                }
@@ -124,7 +124,7 @@ function jabber_format_entry($profile, $notice) {
        $entry = "\n<entry xmlns='http://www.w3.org/2005/Atom'>\n";
        $entry .= "<source>\n";
        $entry .= "<title>" . $profile->nickname . " - " . common_config('site', 'name') . "</title>\n";
-       $entry .= "<link href='" . $profile->profileurl . "'/>\n";
+       $entry .= "<link href='" . htmlspecialchars($profile->profileurl) . "'/>\n";
        $entry .= "<link rel='self' type='application/rss+xml' href='" . common_local_url('userrss', array('nickname' => $profile->nickname)) . "'/>\n";
        $entry .= "<author><name>" . $profile->nickname . "</name></author>\n";
        $entry .= "<icon>" . common_profile_avatar_url($profile, AVATAR_PROFILE_SIZE) . "</icon>\n";
@@ -205,6 +205,9 @@ function jabber_special_presence($type, $to=NULL, $show=NULL, $status=NULL) {
 }
 
 function jabber_broadcast_notice($notice) {
+       if (!common_config('xmpp', 'enabled')) {
+               return true;
+       }
        $profile = Profile::staticGet($notice->profile_id);
        if (!$profile) {
                common_log(LOG_WARNING, 'Refusing to broadcast notice with ' .
@@ -245,7 +248,7 @@ function jabber_broadcast_notice($notice) {
        if ($sub->find()) {
                while ($sub->fetch()) {
                        $user = User::staticGet($sub->subscriber);
-                       if ($user && $user->jabber && $user->jabbernotify && !$sent_to[$user->id]) {
+                       if ($user && $user->jabber && $user->jabbernotify && !array_key_exists($user->id,$sent_to)) {
                                common_log(LOG_INFO,
                                                   'Sending notice ' . $notice->id . ' to ' . $user->jabber,
                                                   __FILE__);
@@ -268,8 +271,9 @@ function jabber_broadcast_notice($notice) {
        $public = common_config('xmpp', 'public');
        
        # FIXME PRIV don't send out private messages here
+       # XXX: should we send out non-local messages if public,localonly = false? I think not
        
-       if ($public) {
+       if ($public && $notice->is_local) {
                foreach ($public as $address) {
                                common_log(LOG_INFO,
                                                   'Sending notice ' . $notice->id . ' to public listener ' . $address,