XSS vulnerability when remote-subscribing

[quix0rs-gnu-social.git] / plugins / Mapstraction / actions / map.php

diff --git a/plugins/Mapstraction/actions/map.php b/plugins/Mapstraction/actions/map.php
index 15f3b941d703be0de8a9216b62a84258c8a192b6..48861af9942605295b9b81bf775ed9c7032420c3 100644 (file)
--- a/plugins/Mapstraction/actions/map.php
+++ b/plugins/Mapstraction/actions/map.php
@@ -63,7 +63,6 @@ class MapAction extends Action
                 $args['page'] = $this->arg['page'];
             }
             common_redirect(common_local_url($this->trimmed('action'), $args), 301);
-            return false;
         }
 
         $this->user = User::getKV('nickname', $nickname);
@@ -71,7 +70,6 @@ class MapAction extends Action
         if (!$this->user) {
             // TRANS: Client error displayed when referring to a non-existing user.
             $this->clientError(_m('No such user.'), 404);
-            return false;
         }
 
         $this->profile = $this->user->getProfile();
@@ -79,7 +77,6 @@ class MapAction extends Action
         if (!$this->profile) {
             // TRANS: Error message displayed when referring to a user without a profile.
             $this->serverError(_m('User has no profile.'));
-            return false;
         }
 
         $page = $this->trimmed('page');
@@ -123,9 +120,11 @@ class MapAction extends Action
         $jsonArray = array();
 
         while ($this->notice->fetch()) {
-            if (!empty($this->notice->lat) && !empty($this->notice->lon)) {
-                $jsonNotice = $this->noticeAsJson($this->notice);
-                $jsonArray[] = $jsonNotice;
+            try {
+                $notloc = Notice_location::locFromStored($this->notice);
+                $jsonArray[] = $this->noticeAsJson($this->notice);
+            } catch (ServerException $e) {
+                // no location data
             }
         }
 
@@ -146,14 +145,14 @@ class MapAction extends Action
         $act = new ApiAction('/dev/null');
 
         $arr = $act->twitterStatusArray($notice, true);
-        $arr['url'] = $notice->bestUrl();
+        $arr['url'] = $notice->getUrl(true);
         $arr['html'] = $notice->rendered;
         $arr['source'] = $arr['source'];
 
         if (!empty($notice->reply_to)) {
             $reply_to = Notice::getKV('id', $notice->reply_to);
             if (!empty($reply_to)) {
-                $arr['in_reply_to_status_url'] = $reply_to->bestUrl();
+                $arr['in_reply_to_status_url'] = $reply_to->getUrl(true);
             }
             $reply_to = null;
         }