Merge branch 'foolproof_file_redirection_branch' into 'nightly'

[quix0rs-gnu-social.git] / lib / nickname.php

diff --git a/lib/nickname.php b/lib/nickname.php
index 80be6239c500decb6064920e21f342c924acd36d..5a5b515b4dfceec44f70c3f4b63c7e7b7285ef98 100644 (file)
--- a/lib/nickname.php
+++ b/lib/nickname.php
@@ -48,6 +48,14 @@ class Nickname
      */
     const DISPLAY_FMT = '[0-9a-zA-Z_]{1,64}';
 
+    /**
+     * Simplified regex fragment for acceptable full WebFinger ID of a user
+     *
+     * We could probably use an email regex here, but mainly we are interested
+     * in matching it in our URLs, like https://social.example/user@example.com
+     */
+    const WEBFINGER_FMT = '[0-9a-zA-Z_]{1,64}\@[0-9a-zA-Z_-.]{3,255}';
+
     /**
      * Regex fragment for checking a canonical nickname.
      *
@@ -68,6 +76,16 @@ class Nickname
      */
     const MAX_LEN = 64;
 
+    /**
+     * Regex with non-capturing group that matches whitespace and some
+     * characters which are allowed right before an @ or ! when mentioning
+     * other users. Like: 'This goes out to:@mmn (@chimo too) (!awwyiss).'
+     *
+     * FIXME: Make this so you can have multiple whitespace but not multiple
+     * parenthesis or something. '(((@n_n@)))' might as well be a smiley.
+     */
+    const BEFORE_MENTIONS = '(?:^|[\s\.\,\:\;\[\(]+)';
+
     /**
      * Nice simple check of whether the given string is a valid input nickname,
      * which can be normalized into an internally canonical form.
@@ -172,18 +190,24 @@ class Nickname
         // All directory and file names in site root should be blacklisted
         $d = dir(INSTALLDIR);
         while (false !== ($entry = $d->read())) {
-            $paths[] = $entry;
+            $paths[$entry] = true;
         }
         $d->close();
 
         // All top level names in the router should be blacklisted
         $router = Router::get();
-        foreach (array_keys($router->m->getPaths()) as $path) {
-            if (preg_match('/^\/(.*?)[\/\?]/',$path,$matches)) {
-                $paths[] = $matches[1];
+        foreach ($router->m->getPaths() as $path) {
+            if (preg_match('/^([^\/\?]+)[\/\?]/',$path,$matches) && isset($matches[1])) {
+                $paths[$matches[1]] = true;
             }
         }
-        return in_array($str, $paths);
+
+        // FIXME: this assumes the 'path' is in the first-level directory, though common it's not certain
+        foreach (['avatar', 'attachments'] as $cat) {
+            $paths[basename(common_config($cat, 'path'))] = true;
+        }
+
+        return in_array($str, array_keys($paths));
     }
 
     /**