Merge pull request #7060 from annando/ap-connect

[friendica.git] / view / theme / frio / style.php

diff --git a/view/theme/frio/style.php b/view/theme/frio/style.php
index 30f8a0d77145e88627925bc1cb999d56ee48bc90..6a8aaf2c2819fcd06e1e292573c4b1934b421be1 100644 (file)
--- a/view/theme/frio/style.php
+++ b/view/theme/frio/style.php
@@ -2,19 +2,21 @@
 /**
  * @file view/theme/frio/style.php
  */
+
 use Friendica\Core\Config;
 use Friendica\Core\PConfig;
-use Friendica\Model\Profile;
+use Friendica\Util\Strings;
 
 require_once 'view/theme/frio/php/PHPColors/Color.php';
 
+$scheme = '';
 $schemecss = '';
 $schemecssfile = false;
 $scheme_modified = 0;
 
 if ($a->module !== 'install') {
        // Get the UID of the profile owner.
-       $uid = Profile::getThemeUid();
+       $uid = defaults($_REQUEST, 'puid', 0);
        if ($uid) {
                PConfig::load($uid, 'frio');
 
@@ -63,13 +65,11 @@ if ($a->module !== 'install') {
 // Setting $scheme to '' wasn't working for some reason, so we'll check it's
 // not --- like the mobile theme does instead.
 // Allow layouts to over-ride the scheme.
-if (x($_REQUEST, 'scheme')) {
+if (!empty($_REQUEST['scheme'])) {
        $scheme = $_REQUEST['scheme'];
 }
 
-// Sanitize the data.
-$scheme = !empty($scheme) ? basename($scheme) : '';
-
+$scheme = Strings::sanitizeFilePathItem($scheme);
 
 if (($scheme) && ($scheme != '---')) {
        if (file_exists('view/theme/frio/scheme/' . $scheme . '.php')) {
@@ -225,7 +225,8 @@ header('ETag: "' . $etag . '"');
 header('Last-Modified: ' . $modified);
 
 // Only send the CSS file if it was changed.
-if (isset($_SERVER['HTTP_IF_MODIFIED_SINCE']) || isset($_SERVER['HTTP_IF_NONE_MATCH'])) {
+/// @todo Check if this works at all (possibly clients are sending only the one or the other header) - compare with mod/photo.php
+if (isset($_SERVER['HTTP_IF_MODIFIED_SINCE']) && isset($_SERVER['HTTP_IF_NONE_MATCH'])) {
        $cached_modified = gmdate('r', strtotime($_SERVER['HTTP_IF_MODIFIED_SINCE']));
        $cached_etag = str_replace(['"', '-gzip'], ['', ''],
                                stripslashes($_SERVER['HTTP_IF_NONE_MATCH']));