XSS vulnerability when remote-subscribing

[quix0rs-gnu-social.git] / lib / profileaction.php

diff --git a/lib/profileaction.php b/lib/profileaction.php
index 5a5d526e42065f6bd5974c535e4c0e516000c644..bdcd575b6b6b946cb5fa2ce2390960b4b60cd0f9 100644 (file)
--- a/lib/profileaction.php
+++ b/lib/profileaction.php
@@ -48,6 +48,36 @@ abstract class ProfileAction extends ManagedAction
 
     protected $target  = null;    // Profile that we're showing
 
+    protected function doPreparation()
+    {
+        // showstream requires a nickname
+        $nickname_arg = $this->trimmed('nickname');
+        $nickname     = common_canonical_nickname($nickname_arg);
+
+        // Permanent redirect on non-canonical nickname
+        if ($nickname_arg != $nickname) {
+            $args = array('nickname' => $nickname);
+            if ($this->arg('page') && $this->arg('page') != 1) {
+                $args['page'] = $this->arg['page'];
+            }
+            common_redirect(common_local_url($this->getActionName(), $args), 301);
+        }
+
+        try {
+            $user = User::getByNickname($nickname);
+        } catch (NoSuchUserException $e) {
+            $group = Local_group::getKV('nickname', $nickname);
+            if ($group instanceof Local_group) {
+                common_redirect($group->getProfile()->getUrl());
+            }
+
+            // No user nor group found, throw the NoSuchUserException again
+            throw $e;
+        }
+
+        $this->target = $user->getProfile();
+    }
+
     protected function prepare(array $args=array())
     {
         // this will call ->doPreparation() which child classes use to set $this->target
@@ -65,11 +95,6 @@ abstract class ProfileAction extends ManagedAction
         return true;
     }
 
-    protected function profileActionPreparation()
-    {
-        // Nothing to do by default.
-    }
-
     public function getTarget()
     {
         if (!$this->target instanceof Profile) {
@@ -290,7 +315,7 @@ abstract class ProfileAction extends ManagedAction
                         $url = $lists->mainpage;
                     } else {
                         $url = common_local_url('showprofiletag',
-                                                array('tagger' => $this->target->getNickname(),
+                                                array('nickname' => $this->target->getNickname(),
                                                       'tag'    => $lists->tag));
                     }
                     if (!$first) {