parse url: Characters like < and > has to be escaped when showing the parsed output.

[friendica.git] / mod / parse_url.php

diff --git a/mod/parse_url.php b/mod/parse_url.php
index a2b4c9e28a179c44b997a31602f6c0e2587e638f..66ad1e57cec88b05e1dada78a3fb94dcb07eefb3 100644 (file)
--- a/mod/parse_url.php
+++ b/mod/parse_url.php
@@ -33,7 +33,7 @@ function completeurl($url, $scheme) {
 
         $complete = $schemearr["scheme"]."://".$schemearr["host"];
 
-        if ($schemearr["port"] != "")
+        if (@$schemearr["port"] != "")
                 $complete .= ":".$schemearr["port"];
 
                if(strpos($urlarr['path'],'/') !== 0)
@@ -41,29 +41,53 @@ function completeurl($url, $scheme) {
 
         $complete .= $urlarr["path"];
 
-        if ($urlarr["query"] != "")
+        if (@$urlarr["query"] != "")
                 $complete .= "?".$urlarr["query"];
 
-        if ($urlarr["fragment"] != "")
+        if (@$urlarr["fragment"] != "")
                 $complete .= "#".$urlarr["fragment"];
 
         return($complete);
 }
 
-function parseurl_getsiteinfo($url) {
+function parseurl_getsiteinfo($url, $no_guessing = false) {
        $siteinfo = array();
-
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_HEADER, 1);
        curl_setopt($ch, CURLOPT_NOBODY, 0);
        curl_setopt($ch, CURLOPT_TIMEOUT, 3);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
-       curl_setopt($ch,CURLOPT_USERAGENT,'Opera/9.64(Windows NT 5.1; U; de) Presto/2.1.1');
+       //curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
+       curl_setopt($ch,CURLOPT_USERAGENT,' Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Firefox/24.0');
 
        $header = curl_exec($ch);
+       $curl_info = @curl_getinfo($ch);
+        $http_code = $curl_info['http_code'];
        curl_close($ch);
 
+       if ((($curl_info['http_code'] == "301") OR ($curl_info['http_code'] == "302"))
+               AND (($curl_info['redirect_url'] != "") OR ($curl_info['location'] != ""))) {
+               if ($curl_info['redirect_url'] != "")
+                       $siteinfo = parseurl_getsiteinfo($curl_info['redirect_url']);
+               else
+                       $siteinfo = parseurl_getsiteinfo($curl_info['location']);
+               return($siteinfo);
+       }
+
+       require_once("include/oembed.php");
+
+       $oembed_data = oembed_fetch_url($url);
+
+       if ($oembed_data->type == "link") {
+               if (isset($oembed_data->title))
+                       $siteinfo["title"] = $oembed_data->title;
+               if (isset($oembed_data->description))
+                       $siteinfo["text"] = $oembed_data->description;
+               if (isset($oembed_data->thumbnail_url))
+                       $siteinfo["image"] = $oembed_data->thumbnail_url;
+       }
+
        // Fetch the first mentioned charset. Can be in body or header
        if (preg_match('/charset=(.*?)['."'".'"\s\n]/', $header, $matches))
                $charset = trim(array_pop($matches));
@@ -97,6 +121,28 @@ function parseurl_getsiteinfo($url) {
 
        $xpath = new DomXPath($doc);
 
+       $list = $xpath->query("//meta[@content]");
+        foreach ($list as $node) {
+                $attr = array();
+                if ($node->attributes->length)
+                        foreach ($node->attributes as $attribute)
+                                $attr[$attribute->name] = $attribute->value;
+
+                if (@$attr["http-equiv"] == 'refresh') {
+                        $path = $attr["content"];
+                        $pathinfo = explode(";", $path);
+                        $content = "";
+                        foreach ($pathinfo AS $value) {
+                                if (substr(strtolower($value), 0, 4) == "url=")
+                                        $content = substr($value, 4);
+                        }
+                        if ($content != "") {
+                                $siteinfo = parseurl_getsiteinfo($content);
+                                return($siteinfo);
+                        }
+                }
+       }
+
        //$list = $xpath->query("head/title");
        $list = $xpath->query("//title");
        foreach ($list as $node)
@@ -151,7 +197,7 @@ function parseurl_getsiteinfo($url) {
                }
        }
 
-       if ($siteinfo["image"] == "") {
+       if ((@$siteinfo["image"] == "") AND !$no_guessing) {
             $list = $xpath->query("//img[@src]");
             foreach ($list as $node) {
                 $attr = array();
@@ -190,7 +236,7 @@ function parseurl_getsiteinfo($url) {
                                                        "height"=>$photodata[1]);
        }
 
-       if ($siteinfo["text"] == "") {
+       if ((@$siteinfo["text"] == "") AND (@$siteinfo["title"] != "") AND !$no_guessing) {
                $text = "";
 
                $list = $xpath->query("//div[@class='article']");
@@ -265,9 +311,9 @@ function parse_url_content(&$a) {
        logger('parse_url: ' . $url);
 
        if($textmode)
-               $template = $br . '[bookmark=%s]%s[/bookmark]%s' . $br;
+               $template = '[bookmark=%s]%s[/bookmark]%s' . $br;
        else
-               $template = "<br /><a class=\"bookmark\" href=\"%s\" >%s</a>%s<br />";
+               $template = "<a class=\"bookmark\" href=\"%s\" >%s</a>%s<br />";
 
        $arr = array('url' => $url, 'text' => '');
 
@@ -281,13 +327,15 @@ function parse_url_content(&$a) {
 
        if($url && $title && $text) {
 
-               if($textmode)
-                       $text = $br . '[quote]' . trim($text) . '[/quote]' . $br;
-               else
-                       $text = '<br /><blockquote>' . trim($text) . '</blockquote><br />';
-
                $title = str_replace(array("\r","\n"),array('',''),$title);
 
+               if($textmode)
+                       $text = '[quote]' . trim($text) . '[/quote]' . $br;
+               else {
+                       $text = '<blockquote>' . htmlspecialchars(trim($text)) . '</blockquote><br />';
+                       $title = htmlspecialchars($title);
+               }
+
                $result = sprintf($template,$url,($title) ? $title : $url,$text) . $str_tags;
 
                logger('parse_url (unparsed): returns: ' . $result);
@@ -298,8 +346,10 @@ function parse_url_content(&$a) {
 
        $siteinfo = parseurl_getsiteinfo($url);
 
+       $sitedata = "";
+
        if($siteinfo["title"] == "") {
-               echo sprintf($template,$url,$url,'') . $str_tags;
+               $sitedata .= sprintf($template,$url,$url,'') . $str_tags;
                killme();
        } else {
                $text = $siteinfo["text"];
@@ -331,20 +381,24 @@ function parse_url_content(&$a) {
 
        if(strlen($text)) {
                if($textmode)
-                       $text = $br.'[quote]'.trim($text).'[/quote]'.$br ;
+                       $text = '[quote]'.trim($text).'[/quote]';
                else
-                       $text = '<br /><blockquote>'.trim($text).'</blockquote><br />';
+                       $text = '<blockquote>'.htmlspecialchars(trim($text)).'</blockquote>';
        }
 
        if($image) {
                $text = $br.$br.$image.$text;
        }
+
        $title = str_replace(array("\r","\n"),array('',''),$title);
 
        $result = sprintf($template,$url,($title) ? $title : $url,$text) . $str_tags;
 
        logger('parse_url: returns: ' . $result);
 
-       echo trim($result);
+       $sitedata .=  trim($result);
+
+       echo "[class=type-link]".$sitedata."[/class]";
+
        killme();
 }