Avoid beeing flooded by invalid requests

[friendica.git] / mod / xrd.php

diff --git a/mod/xrd.php b/mod/xrd.php
index cd72e5018862fae1e12be48a73b6974ee29c811c..921d48fe93708cddf1c66280207cadc5baf6734a 100644 (file)
--- a/mod/xrd.php
+++ b/mod/xrd.php
@@ -7,12 +7,15 @@ use Friendica\App;
 use Friendica\Core\Addon;
 use Friendica\Core\System;
 use Friendica\Database\DBA;
-use Friendica\Database\DBM;
 use Friendica\Protocol\Salmon;
 
 function xrd_init(App $a)
 {
        if ($a->argv[0] == 'xrd') {
+               if (empty($_GET['uri'])) {
+                       System::httpExit(404);
+               }
+
                $uri = urldecode(notags(trim($_GET['uri'])));
                if (defaults($_SERVER, 'HTTP_ACCEPT', '') == 'application/jrd+json') {
                        $mode = 'json';
@@ -20,6 +23,10 @@ function xrd_init(App $a)
                        $mode = 'xml';
                }
        } else {
+               if (empty($_GET['resource'])) {
+                       System::httpExit(404);
+               }
+
                $uri = urldecode(notags(trim($_GET['resource'])));
                if (defaults($_SERVER, 'HTTP_ACCEPT', '') == 'application/xrd+xml') {
                        $mode = 'xml';
@@ -40,8 +47,8 @@ function xrd_init(App $a)
        }
 
        $user = DBA::selectFirst('user', [], ['nickname' => $name]);
-       if (!DBM::is_result($user)) {
-               killme();
+       if (!DBA::isResult($user)) {
+               System::httpExit(404);
        }
 
        $profile_url = System::baseUrl().'/profile/'.$user['nickname'];
@@ -73,6 +80,7 @@ function xrd_json($a, $uri, $alias, $profile_url, $r)
                        ['rel' => NAMESPACE_DFRN, 'href' => $profile_url],
                        ['rel' => NAMESPACE_FEED, 'type' => 'application/atom+xml', 'href' => System::baseUrl().'/dfrn_poll/'.$r['nickname']],
                        ['rel' => 'http://webfinger.net/rel/profile-page', 'type' => 'text/html', 'href' => $profile_url],
+                       ['rel' => 'self', 'type' => 'application/activity+json', 'href' => $profile_url],
                        ['rel' => 'http://microformats.org/profile/hcard', 'type' => 'text/html', 'href' => System::baseUrl().'/hcard/'.$r['nickname']],
                        ['rel' => NAMESPACE_POCO, 'href' => System::baseUrl().'/poco/'.$r['nickname']],
                        ['rel' => 'http://webfinger.net/rel/avatar', 'type' => 'image/jpeg', 'href' => System::baseUrl().'/photo/profile/'.$r['uid'].'.jpg'],
@@ -85,6 +93,7 @@ function xrd_json($a, $uri, $alias, $profile_url, $r)
                        ['rel' => 'http://purl.org/openwebauth/v1', 'type' => 'application/x-dfrn+json', 'href' => System::baseUrl().'/owa']
                ]
        ];
+
        echo json_encode($json);
        killme();
 }