Merge pull request #6225 from annando/http-error

[friendica.git] / src / Module / Login.php

diff --git a/src/Module/Login.php b/src/Module/Login.php
index 2e04eb83be8e6b21f3515b72ae4c1572822c8904..82d70498281fc6547a6e7a79520c6bca96793c8b 100644 (file)
--- a/src/Module/Login.php
+++ b/src/Module/Login.php
@@ -10,11 +10,14 @@ use Friendica\Core\Addon;
 use Friendica\Core\Authentication;
 use Friendica\Core\Config;
 use Friendica\Core\L10n;
+use Friendica\Core\Logger;
+use Friendica\Core\Renderer;
 use Friendica\Core\System;
 use Friendica\Database\DBA;
 use Friendica\Model\User;
 use Friendica\Util\DateTimeFormat;
 use Friendica\Util\Network;
+use Friendica\Util\Strings;
 use LightOpenID;
 
 require_once 'boot.php';
@@ -31,11 +34,11 @@ class Login extends BaseModule
        {
                $a = self::getApp();
 
-               if (x($_SESSION, 'theme')) {
+               if (!empty($_SESSION['theme'])) {
                        unset($_SESSION['theme']);
                }
 
-               if (x($_SESSION, 'mobile-theme')) {
+               if (!empty($_SESSION['mobile-theme'])) {
                        unset($_SESSION['mobile-theme']);
                }
 
@@ -43,14 +46,14 @@ class Login extends BaseModule
                        $a->internalRedirect();
                }
 
-               return self::form($_SESSION['return_url'], intval(Config::get('config', 'register_policy')) !== REGISTER_CLOSED);
+               return self::form(defaults($_SESSION, 'return_path', null), intval(Config::get('config', 'register_policy')) !== REGISTER_CLOSED);
        }
 
        public static function post()
        {
-               $return_url = $_SESSION['return_url'];
+               $return_path = $_SESSION['return_path'];
                session_unset();
-               $_SESSION['return_url'] = $return_url;
+               $_SESSION['return_path'] = $return_path;
                
                // OpenId Login
                if (
@@ -65,7 +68,7 @@ class Login extends BaseModule
                        self::openIdAuthentication($openid_url, !empty($_POST['remember']));
                }
 
-               if (x($_POST, 'auth-params') && $_POST['auth-params'] === 'login') {
+               if (!empty($_POST['auth-params']) && $_POST['auth-params'] === 'login') {
                        self::passwordAuthentication(
                                trim($_POST['username']),
                                trim($_POST['password']),
@@ -146,7 +149,7 @@ class Login extends BaseModule
                                );
                        }
                } catch (Exception $e) {
-                       logger('authenticate: failed login attempt: ' . notags($username) . ' from IP ' . $_SERVER['REMOTE_ADDR']);
+                       Logger::log('authenticate: failed login attempt: ' . Strings::escapeTags($username) . ' from IP ' . $_SERVER['REMOTE_ADDR']);
                        info('Login failed. Please check your credentials.' . EOL);
                        $a->internalRedirect();
                }
@@ -160,14 +163,14 @@ class Login extends BaseModule
                $_SESSION['last_login_date'] = DateTimeFormat::utcNow();
                Authentication::setAuthenticatedSessionForUser($record, true, true);
 
-               if (x($_SESSION, 'return_url')) {
-                       $return_url = $_SESSION['return_url'];
-                       unset($_SESSION['return_url']);
+               if (!empty($_SESSION['return_path'])) {
+                       $return_path = $_SESSION['return_path'];
+                       unset($_SESSION['return_path']);
                } else {
-                       $return_url = '';
+                       $return_path = '';
                }
 
-               $a->internalRedirect($return_url);
+               $a->internalRedirect($return_path);
        }
 
        /**
@@ -195,7 +198,7 @@ class Login extends BaseModule
                                );
                                if (DBA::isResult($user)) {
                                        if ($data->hash != Authentication::getCookieHashForUser($user)) {
-                                               logger("Hash for user " . $data->uid . " doesn't fit.");
+                                               Logger::log("Hash for user " . $data->uid . " doesn't fit.");
                                                Authentication::deleteSession();
                                                $a->internalRedirect();
                                        }
@@ -218,20 +221,20 @@ class Login extends BaseModule
                        }
                }
 
-               if (isset($_SESSION) && x($_SESSION, 'authenticated')) {
-                       if (x($_SESSION, 'visitor_id') && !x($_SESSION, 'uid')) {
+               if (!empty($_SESSION['authenticated'])) {
+                       if (!empty($_SESSION['visitor_id']) && empty($_SESSION['uid'])) {
                                $contact = DBA::selectFirst('contact', [], ['id' => $_SESSION['visitor_id']]);
                                if (DBA::isResult($contact)) {
                                        self::getApp()->contact = $contact;
                                }
                        }
 
-                       if (x($_SESSION, 'uid')) {
+                       if (!empty($_SESSION['uid'])) {
                                // already logged in user returning
                                $check = Config::get('system', 'paranoia');
                                // extra paranoia - if the IP changed, log them out
                                if ($check && ($_SESSION['addr'] != $_SERVER['REMOTE_ADDR'])) {
-                                       logger('Session address changed. Paranoid setting in effect, blocking session. ' .
+                                       Logger::log('Session address changed. Paranoid setting in effect, blocking session. ' .
                                                $_SESSION['addr'] . ' != ' . $_SERVER['REMOTE_ADDR']);
                                        Authentication::deleteSession();
                                        $a->internalRedirect();
@@ -269,7 +272,7 @@ class Login extends BaseModule
        /**
         * @brief Wrapper for adding a login box.
         *
-        * @param string $return_url The url relative to the base the user should be sent
+        * @param string $return_path The path relative to the base the user should be sent
         *                                                       back to after login completes
         * @param bool $register If $register == true provide a registration link.
         *                                               This will most always depend on the value of config.register_policy.
@@ -279,7 +282,7 @@ class Login extends BaseModule
         *
         * @hooks 'login_hook' string $o
         */
-       public static function form($return_url = null, $register = false, $hiddens = [])
+       public static function form($return_path = null, $register = false, $hiddens = [])
        {
                $a = self::getApp();
                $o = '';
@@ -293,25 +296,25 @@ class Login extends BaseModule
 
                $noid = Config::get('system', 'no_openid');
 
-               if (is_null($return_url)) {
-                       $return_url = $a->query_string;
+               if (is_null($return_path)) {
+                       $return_path = $a->query_string;
                }
 
                if (local_user()) {
-                       $tpl = get_markup_template('logout.tpl');
+                       $tpl = Renderer::getMarkupTemplate('logout.tpl');
                } else {
-                       $a->page['htmlhead'] .= replace_macros(
-                               get_markup_template('login_head.tpl'),
+                       $a->page['htmlhead'] .= Renderer::replaceMacros(
+                               Renderer::getMarkupTemplate('login_head.tpl'),
                                [
                                        '$baseurl' => $a->getBaseURL(true)
                                ]
                        );
 
-                       $tpl = get_markup_template('login.tpl');
-                       $_SESSION['return_url'] = $return_url;
+                       $tpl = Renderer::getMarkupTemplate('login.tpl');
+                       $_SESSION['return_path'] = $return_path;
                }
 
-               $o .= replace_macros(
+               $o .= Renderer::replaceMacros(
                        $tpl,
                        [
                                '$dest_url'     => self::getApp()->getBaseURL(true) . '/login',