Merge pull request #13128 from annando/owa

[friendica.git] / src / Module / Xrd.php

diff --git a/src/Module/Xrd.php b/src/Module/Xrd.php
index ad2b25902567d238f1d5f663366f162140d9f251..6a4c0e860d31be4c12b07e005074a705d3647ba8 100644 (file)
--- a/src/Module/Xrd.php
+++ b/src/Module/Xrd.php
@@ -65,13 +65,19 @@ class Xrd extends BaseModule
 
                if (substr($uri, 0, 4) === 'http') {
                        $name = ltrim(basename($uri), '~');
+                       $host = parse_url($uri, PHP_URL_HOST);
                } else {
                        $local = str_replace('acct:', '', $uri);
                        if (substr($local, 0, 2) == '//') {
                                $local = substr($local, 2);
                        }
 
-                       $name = substr($local, 0, strpos($local, '@'));
+                       list($name, $host) = explode('@', $local);
+               }
+
+               if (!empty($host) && $host !== DI::baseUrl()->getHost()) {
+                       DI::logger()->notice('Invalid host name for xrd query',['host' => $host, 'uri' => $uri]);
+                       throw new NotFoundException('Invalid host name for xrd query: ' . $host);
                }
 
                if ($name == User::getActorName()) {
@@ -105,7 +111,7 @@ class Xrd extends BaseModule
 
        private function printSystemJSON(array $owner)
        {
-               $baseURL = $this->baseUrl->get();
+               $baseURL = (string)$this->baseUrl;
                $json = [
                        'subject' => 'acct:' . $owner['addr'],
                        'aliases' => [$owner['url']],
@@ -151,7 +157,7 @@ class Xrd extends BaseModule
 
        private function printJSON(string $alias, array $owner, array $avatar)
        {
-               $baseURL = $this->baseUrl->get();
+               $baseURL = (string)$this->baseUrl;
 
                $json = [
                        'subject' => 'acct:' . $owner['addr'],
@@ -228,7 +234,7 @@ class Xrd extends BaseModule
 
        private function printXML(string $alias, array $owner, array $avatar)
        {
-               $baseURL = $this->baseUrl->get();
+               $baseURL = (string)$this->baseUrl;
 
                $xmlString = XML::fromArray([
                        'XRD' => [