Merge pull request #13128 from annando/owa

[friendica.git] / src / Module / Xrd.php

diff --git a/src/Module/Xrd.php b/src/Module/Xrd.php
index 098c1574ea3315c797207c0748f9ae2c6450bafd..6a4c0e860d31be4c12b07e005074a705d3647ba8 100644 (file)
--- a/src/Module/Xrd.php
+++ b/src/Module/Xrd.php
@@ -1,6 +1,6 @@
 <?php
 /**
- * @copyright Copyright (C) 2010-2022, the Friendica project
+ * @copyright Copyright (C) 2010-2023, the Friendica project
  *
  * @license GNU AGPL version 3 or any later version
  *
@@ -65,13 +65,19 @@ class Xrd extends BaseModule
 
                if (substr($uri, 0, 4) === 'http') {
                        $name = ltrim(basename($uri), '~');
+                       $host = parse_url($uri, PHP_URL_HOST);
                } else {
                        $local = str_replace('acct:', '', $uri);
                        if (substr($local, 0, 2) == '//') {
                                $local = substr($local, 2);
                        }
 
-                       $name = substr($local, 0, strpos($local, '@'));
+                       list($name, $host) = explode('@', $local);
+               }
+
+               if (!empty($host) && $host !== DI::baseUrl()->getHost()) {
+                       DI::logger()->notice('Invalid host name for xrd query',['host' => $host, 'uri' => $uri]);
+                       throw new NotFoundException('Invalid host name for xrd query: ' . $host);
                }
 
                if ($name == User::getActorName()) {
@@ -105,7 +111,7 @@ class Xrd extends BaseModule
 
        private function printSystemJSON(array $owner)
        {
-               $baseURL = $this->baseUrl->get();
+               $baseURL = (string)$this->baseUrl;
                $json = [
                        'subject' => 'acct:' . $owner['addr'],
                        'aliases' => [$owner['url']],
@@ -122,7 +128,7 @@ class Xrd extends BaseModule
                                ],
                                [
                                        'rel'      => 'http://ostatus.org/schema/1.0/subscribe',
-                                       'template' => $baseURL . '/follow?url={uri}',
+                                       'template' => $baseURL . '/contact/follow?url={uri}',
                                ],
                                [
                                        'rel'  => ActivityNamespace::FEED,
@@ -151,7 +157,7 @@ class Xrd extends BaseModule
 
        private function printJSON(string $alias, array $owner, array $avatar)
        {
-               $baseURL = $this->baseUrl->get();
+               $baseURL = (string)$this->baseUrl;
 
                $json = [
                        'subject' => 'acct:' . $owner['addr'],
@@ -184,10 +190,6 @@ class Xrd extends BaseModule
                                        'type' => 'text/html',
                                        'href' => $baseURL . '/hcard/' . $owner['nickname'],
                                ],
-                               [
-                                       'rel'  => ActivityNamespace::POCO,
-                                       'href' => $owner['poco'],
-                               ],
                                [
                                        'rel'  => 'http://webfinger.net/rel/avatar',
                                        'type' => $avatar['type'],
@@ -212,7 +214,7 @@ class Xrd extends BaseModule
                                ],
                                [
                                        'rel'      => 'http://ostatus.org/schema/1.0/subscribe',
-                                       'template' => $baseURL . '/follow?url={uri}',
+                                       'template' => $baseURL . '/contact/follow?url={uri}',
                                ],
                                [
                                        'rel'  => 'magic-public-key',
@@ -232,11 +234,9 @@ class Xrd extends BaseModule
 
        private function printXML(string $alias, array $owner, array $avatar)
        {
-               $baseURL = $this->baseUrl->get();
-
-               $xml = null;
+               $baseURL = (string)$this->baseUrl;
 
-               XML::fromArray([
+               $xmlString = XML::fromArray([
                        'XRD' => [
                                '@attributes' => [
                                        'xmlns'    => 'http://docs.oasis-open.org/ns/xri/xrd-1.0',
@@ -272,56 +272,50 @@ class Xrd extends BaseModule
                                        ]
                                ],
                                '5:link' => [
-                                       '@attributes' => [
-                                               'rel'  => 'http://portablecontacts.net/spec/1.0',
-                                               'href' => $owner['poco']
-                                       ]
-                               ],
-                               '6:link' => [
                                        '@attributes' => [
                                                'rel'  => 'http://webfinger.net/rel/avatar',
                                                'type' => $avatar['type'],
                                                'href' => User::getAvatarUrl($owner)
                                        ]
                                ],
-                               '7:link' => [
+                               '6:link' => [
                                        '@attributes' => [
                                                'rel'  => 'http://joindiaspora.com/seed_location',
                                                'type' => 'text/html',
                                                'href' => $baseURL
                                        ]
                                ],
-                               '8:link' => [
+                               '7:link' => [
                                        '@attributes' => [
                                                'rel'  => 'salmon',
                                                'href' => $baseURL . '/salmon/' . $owner['nickname']
                                        ]
                                ],
-                               '9:link' => [
+                               '8:link' => [
                                        '@attributes' => [
                                                'rel'  => 'http://salmon-protocol.org/ns/salmon-replies',
                                                'href' => $baseURL . '/salmon/' . $owner['nickname']
                                        ]
                                ],
-                               '10:link' => [
+                               '9:link' => [
                                        '@attributes' => [
                                                'rel'  => 'http://salmon-protocol.org/ns/salmon-mention',
                                                'href' => $baseURL . '/salmon/' . $owner['nickname'] . '/mention'
                                        ]
                                ],
-                               '11:link' => [
+                               '10:link' => [
                                        '@attributes' => [
                                                'rel'  => 'http://ostatus.org/schema/1.0/subscribe',
-                                               'template' => $baseURL . '/follow?url={uri}'
+                                               'template' => $baseURL . '/contact/follow?url={uri}'
                                        ]
                                ],
-                               '12:link' => [
+                               '11:link' => [
                                        '@attributes' => [
                                                'rel'  => 'magic-public-key',
                                                'href' => 'data:application/magic-public-key,' . Salmon::salmonKey($owner['spubkey'])
                                        ]
                                ],
-                               '13:link' => [
+                               '12:link' => [
                                        '@attributes' => [
                                                'rel'  => 'http://purl.org/openwebauth/v1',
                                                'type' => 'application/x-zot+json',
@@ -329,10 +323,10 @@ class Xrd extends BaseModule
                                        ]
                                ],
                        ],
-               ], $xml);
+               ]);
 
                header('Access-Control-Allow-Origin: *');
 
-               System::httpExit($xml->saveXML(), Response::TYPE_XML, 'application/xrd+xml');
+               System::httpExit($xmlString, Response::TYPE_XML, 'application/xrd+xml');
        }
 }