X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=src%2FModule%2FXrd.php;h=6a4c0e860d31be4c12b07e005074a705d3647ba8;hb=4246ffc892d13fc7dd0057d8358fcacc44da5048;hp=098d69e23cb2b579879977f5b97bbf585470c666;hpb=41b5ec0262142811e5499ae004b821e64b59a9c8;p=friendica.git

diff --git a/src/Module/Xrd.php b/src/Module/Xrd.php
index 098d69e23c..6a4c0e860d 100644
--- a/src/Module/Xrd.php
+++ b/src/Module/Xrd.php
@@ -65,13 +65,19 @@ class Xrd extends BaseModule
 
 		if (substr($uri, 0, 4) === 'http') {
 			$name = ltrim(basename($uri), '~');
+			$host = parse_url($uri, PHP_URL_HOST);
 		} else {
 			$local = str_replace('acct:', '', $uri);
 			if (substr($local, 0, 2) == '//') {
 				$local = substr($local, 2);
 			}
 
-			$name = substr($local, 0, strpos($local, '@'));
+			list($name, $host) = explode('@', $local);
+		}
+
+		if (!empty($host) && $host !== DI::baseUrl()->getHost()) {
+			DI::logger()->notice('Invalid host name for xrd query',['host' => $host, 'uri' => $uri]);
+			throw new NotFoundException('Invalid host name for xrd query: ' . $host);
 		}
 
 		if ($name == User::getActorName()) {
@@ -105,7 +111,7 @@ class Xrd extends BaseModule
 
 	private function printSystemJSON(array $owner)
 	{
-		$baseURL = $this->baseUrl;
+		$baseURL = (string)$this->baseUrl;
 		$json = [
 			'subject' => 'acct:' . $owner['addr'],
 			'aliases' => [$owner['url']],
@@ -151,7 +157,7 @@ class Xrd extends BaseModule
 
 	private function printJSON(string $alias, array $owner, array $avatar)
 	{
-		$baseURL = $this->baseUrl;
+		$baseURL = (string)$this->baseUrl;
 
 		$json = [
 			'subject' => 'acct:' . $owner['addr'],
@@ -228,7 +234,7 @@ class Xrd extends BaseModule
 
 	private function printXML(string $alias, array $owner, array $avatar)
 	{
-		$baseURL = $this->baseUrl;
+		$baseURL = (string)$this->baseUrl;
 
 		$xmlString = XML::fromArray([
 			'XRD' => [