Merge pull request #6224 from annando/dba-delete-contact

[friendica.git] / mod / pubsubhubbub.php

diff --git a/mod/pubsubhubbub.php b/mod/pubsubhubbub.php
index d38cbe227d5eac6e935d08e05ce6ffcc5936f733..11fbf2cf5f3af52f7bc4919fbbb68e7776bc6178 100644 (file)
--- a/mod/pubsubhubbub.php
+++ b/mod/pubsubhubbub.php
@@ -10,7 +10,7 @@ use Friendica\Util\Network;
 use Friendica\Util\Strings;
 
 function post_var($name) {
-       return (x($_POST, $name)) ? Strings::escapeTags(trim($_POST[$name])) : '';
+       return !empty($_POST[$name]) ? Strings::escapeTags(trim($_POST[$name])) : '';
 }
 
 function pubsubhubbub_init(App $a) {
@@ -50,13 +50,15 @@ function pubsubhubbub_init(App $a) {
 
                Logger::log("$hub_mode request from " . $_SERVER['REMOTE_ADDR']);
 
-               // get the nick name from the topic, a bit hacky but needed as a fallback
-               $nick = substr(strrchr($hub_topic, "/"), 1);
-
-               // Normally the url should now contain the nick name as last part of the url
                if ($a->argc > 1) {
+                       // Normally the url should now contain the nick name as last part of the url
                        $nick = $a->argv[1];
+               } else {
+                       // Get the nick name from the topic as a fallback
+                       $nick = $hub_topic;
                }
+               // Extract nick name and strip any .atom extension
+               $nick = basename($nick, '.atom');
 
                if (!$nick) {
                        Logger::log('Bad hub_topic=$hub_topic, ignoring.');
@@ -65,7 +67,7 @@ function pubsubhubbub_init(App $a) {
 
                // fetch user from database given the nickname
                $condition = ['nickname' => $nick, 'account_expired' => false, 'account_removed' => false];
-               $owner = DBA::selectFirst('user', ['uid', 'hidewall'], $condition);
+               $owner = DBA::selectFirst('user', ['uid', 'hidewall', 'nickname'], $condition);
                if (!DBA::isResult($owner)) {
                        Logger::log('Local account not found: ' . $nick . ' - topic: ' . $hub_topic . ' - callback: ' . $hub_callback);
                        System::httpExit(404);
@@ -88,25 +90,32 @@ function pubsubhubbub_init(App $a) {
 
                // sanity check that topic URLs are the same
                $hub_topic2 = str_replace('/feed/', '/dfrn_poll/', $hub_topic);
-               if (!Strings::compareLink($hub_topic, $contact['poll']) && !Strings::compareLink($hub_topic2, $contact['poll'])) {
+               $self = System::baseUrl() . '/api/statuses/user_timeline/' . $owner['nickname'] . '.atom';
+
+               if (!Strings::compareLink($hub_topic, $contact['poll']) && !Strings::compareLink($hub_topic2, $contact['poll']) && !Strings::compareLink($hub_topic, $self)) {
                        Logger::log('Hub topic ' . $hub_topic . ' != ' . $contact['poll']);
                        System::httpExit(404);
                }
 
                // do subscriber verification according to the PuSH protocol
                $hub_challenge = Strings::getRandomHex(40);
-               $params = 'hub.mode=' .
-                       ($subscribe == 1 ? 'subscribe' : 'unsubscribe') .
-                       '&hub.topic=' . urlencode($hub_topic) .
-                       '&hub.challenge=' . $hub_challenge .
-                       '&hub.lease_seconds=604800' .
-                       '&hub.verify_token=' . $hub_verify_token;
-
-               // lease time is hard coded to one week (in seconds)
-               // we don't actually enforce the lease time because GNU
-               // Social/StatusNet doesn't honour it (yet)
-
-               $fetchResult = Network::fetchUrlFull($hub_callback . "?" . $params);
+
+               $params = http_build_query([
+                       'hub.mode' => $subscribe == 1 ? 'subscribe' : 'unsubscribe',
+                       'hub.topic' => $hub_topic,
+                       'hub.challenge' => $hub_challenge,
+                       'hub.verify_token' => $hub_verify_token,
+
+                       // lease time is hard coded to one week (in seconds)
+                       // we don't actually enforce the lease time because GNU
+                       // Social/StatusNet doesn't honour it (yet)
+                       'hub.lease_seconds' => 604800,
+               ]);
+
+               $hub_callback = rtrim($hub_callback, ' ?&#');
+               $separator = parse_url($hub_callback, PHP_URL_QUERY) === null ? '?' : '&';
+
+               $fetchResult = Network::fetchUrlFull($hub_callback . $separator . $params);
                $body = $fetchResult->getBody();
                $ret = $fetchResult->getReturnCode();