Merge pull request #6260 from annando/issue-6257

[friendica.git] / mod / subthread.php

diff --git a/mod/subthread.php b/mod/subthread.php
index 0082021df575c8376fa27c56b4885d6ab735ddf7..90ab5a3aabbddf46c0db8d1f26ea98655ee3c7fe 100644 (file)
--- a/mod/subthread.php
+++ b/mod/subthread.php
@@ -5,10 +5,13 @@
 use Friendica\App;
 use Friendica\Core\Addon;
 use Friendica\Core\L10n;
+use Friendica\Core\Logger;
 use Friendica\Core\System;
 use Friendica\Database\DBA;
 use Friendica\Model\Item;
 use Friendica\Util\Security;
+use Friendica\Util\Strings;
+use Friendica\Util\XML;
 
 require_once 'include/items.php';
 
@@ -20,13 +23,13 @@ function subthread_content(App $a) {
 
        $activity = ACTIVITY_FOLLOW;
 
-       $item_id = (($a->argc > 1) ? notags(trim($a->argv[1])) : 0);
+       $item_id = (($a->argc > 1) ? Strings::escapeTags(trim($a->argv[1])) : 0);
 
        $condition = ["`parent` = ? OR `parent-uri` = ? AND `parent` = `id`", $item_id, $item_id];
        $item = Item::selectFirst([], $condition);
 
        if (empty($item_id) || !DBA::isResult($item)) {
-               logger('subthread: no item ' . $item_id);
+               Logger::log('subthread: no item ' . $item_id);
                return;
        }
 
@@ -62,7 +65,7 @@ function subthread_content(App $a) {
        }
 
        if (!$owner) {
-               logger('like: no owner');
+               Logger::log('like: no owner');
                return;
        }
 
@@ -86,7 +89,7 @@ function subthread_content(App $a) {
 
        $post_type = (($item['resource-id']) ? L10n::t('photo') : L10n::t('status'));
        $objtype = (($item['resource-id']) ? ACTIVITY_OBJ_IMAGE : ACTIVITY_OBJ_NOTE );
-       $link = xmlify('<link rel="alternate" type="text/html" href="' . System::baseUrl() . '/display/' . $owner['nickname'] . '/' . $item['id'] . '" />' . "\n") ;
+       $link = XML::escape('<link rel="alternate" type="text/html" href="' . System::baseUrl() . '/display/' . $owner['nickname'] . '/' . $item['id'] . '" />' . "\n");
        $body = $item['body'];
 
        $obj = <<< EOT