Merge pull request #317 from CatoTH/master

[friendica.git] / mod / ping.php

diff --git a/mod/ping.php b/mod/ping.php
index e911aaf1f470765ad815588de28d0cd2d872d544..55dcb26bb5b199c70e7ddab8cb277e8d2f386e5d 100644 (file)
--- a/mod/ping.php
+++ b/mod/ping.php
@@ -10,8 +10,16 @@ function ping_init(&$a) {
                <result>";
 
        $xmlhead="<"."?xml version='1.0' encoding='UTF-8' ?".">";
+
        if(local_user()){
 
+               // Different login session than the page that is calling us. 
+
+               if(intval($_GET['uid']) && intval($_GET['uid']) != local_user()) {
+                       echo '<invalid>1</invalid></result>';
+                       killme();
+               }
+
                $firehose = intval(get_pconfig(local_user(),'system','notify_full'));
 
                $t = q("select count(*) as total from notify where uid = %d and seen = 0",
@@ -134,6 +142,8 @@ function ping_init(&$a) {
 
 
                function xmlize($href, $name, $url, $photo, $date, $seen, $message){
+                       $data = array('href' => &$href, 'name' => &$name, 'url'=>&$url, 'photo'=>&$photo, 'date'=>&$date, 'seen'=>&$seen, 'messsage'=>&$message);
+                       call_hooks('ping_xmlize', $data);
                        $notsxml = '<note href="%s" name="%s" url="%s" photo="%s" date="%s" seen="%s" >%s</note>';
                        return sprintf ( $notsxml,
                                xmlify($href), xmlify($name), xmlify($url), xmlify($photo), xmlify($date), xmlify($seen), xmlify($message)