Merge pull request #6285 from MrPetovan/task/6208-escape-html-true

[friendica.git] / mod / pubsub.php

diff --git a/mod/pubsub.php b/mod/pubsub.php
index e14d500865573d8bfce1f60e3918f3a82f91ece7..cd2f21dd67904907cc73646688442e1e14c4498f 100644 (file)
--- a/mod/pubsub.php
+++ b/mod/pubsub.php
@@ -6,6 +6,8 @@ use Friendica\Core\Protocol;
 use Friendica\Database\DBA;
 use Friendica\Model\Contact;
 use Friendica\Protocol\OStatus;
+use Friendica\Util\Strings;
+use Friendica\Core\System;
 
 require_once 'include/items.php';
 
@@ -15,7 +17,7 @@ function hub_return($valid, $body)
                header($_SERVER["SERVER_PROTOCOL"] . ' 200 OK');
                echo $body;
        } else {
-               header($_SERVER["SERVER_PROTOCOL"] . ' 404 Not Found');
+               System::httpExit(404);
        }
        killme();
 }
@@ -24,21 +26,20 @@ function hub_return($valid, $body)
 
 function hub_post_return()
 {
-       header($_SERVER["SERVER_PROTOCOL"] . ' 200 OK');
-       killme();
+       System::httpExit(200);
 }
 
 function pubsub_init(App $a)
 {
-       $nick       = (($a->argc > 1) ? notags(trim($a->argv[1])) : '');
+       $nick       = (($a->argc > 1) ? Strings::escapeTags(trim($a->argv[1])) : '');
        $contact_id = (($a->argc > 2) ? intval($a->argv[2])       : 0 );
 
        if ($_SERVER['REQUEST_METHOD'] === 'GET') {
-               $hub_mode      = notags(trim(defaults($_GET, 'hub_mode', '')));
-               $hub_topic     = notags(trim(defaults($_GET, 'hub_topic', '')));
-               $hub_challenge = notags(trim(defaults($_GET, 'hub_challenge', '')));
-               $hub_lease     = notags(trim(defaults($_GET, 'hub_lease_seconds', '')));
-               $hub_verify    = notags(trim(defaults($_GET, 'hub_verify_token', '')));
+               $hub_mode      = Strings::escapeTags(trim(defaults($_GET, 'hub_mode', '')));
+               $hub_topic     = Strings::escapeTags(trim(defaults($_GET, 'hub_topic', '')));
+               $hub_challenge = Strings::escapeTags(trim(defaults($_GET, 'hub_challenge', '')));
+               $hub_lease     = Strings::escapeTags(trim(defaults($_GET, 'hub_lease_seconds', '')));
+               $hub_verify    = Strings::escapeTags(trim(defaults($_GET, 'hub_verify_token', '')));
 
                Logger::log('Subscription from ' . $_SERVER['REMOTE_ADDR'] . ' Mode: ' . $hub_mode . ' Nick: ' . $nick);
                Logger::log('Data: ' . print_r($_GET,true), Logger::DATA);
@@ -63,7 +64,7 @@ function pubsub_init(App $a)
                        hub_return(false, '');
                }
 
-               if (!empty($hub_topic) && !link_compare($hub_topic, $contact['poll'])) {
+               if (!empty($hub_topic) && !Strings::compareLink($hub_topic, $contact['poll'])) {
                        Logger::log('Hub topic ' . $hub_topic . ' != ' . $contact['poll']);
                        hub_return(false, '');
                }
@@ -91,7 +92,7 @@ function pubsub_post(App $a)
        Logger::log('Feed arrived from ' . $_SERVER['REMOTE_ADDR'] . ' for ' .  $a->cmd . ' with user-agent: ' . $_SERVER['HTTP_USER_AGENT']);
        Logger::log('Data: ' . $xml, Logger::DATA);
 
-       $nick       = (($a->argc > 1) ? notags(trim($a->argv[1])) : '');
+       $nick       = (($a->argc > 1) ? Strings::escapeTags(trim($a->argv[1])) : '');
        $contact_id = (($a->argc > 2) ? intval($a->argv[2])       : 0 );
 
        $importer = DBA::selectFirst('user', [], ['nickname' => $nick, 'account_expired' => false, 'account_removed' => false]);