Strip out the special 'p' paramter added by index.php from

$_SERVER['QUERY_STRING'] before doing OAuth requests. Required by the
latest version of the OAuth lib.

diff --git a/lib/apioauth.php b/lib/apioauth.php
index 1c87e42324a9f2cdbfb3ed5c41d5921a6b3bb074..3f71de0c353fab1d79d413e89a855e055f89ce1e 100644 (file)
--- a/lib/apioauth.php
+++ b/lib/apioauth.php
@@ -86,11 +86,18 @@ class ApiOauthAction extends Action
         }
 
         // strip out the p param added in index.php
-
-        // XXX: should we strip anything else?  Or alternatively
-        // only allow a known list of params?
         unset($_GET['p']);
         unset($_POST['p']);
+        unset($_REQUEST['p']);
+
+        $queryArray = explode('&', $_SERVER['QUERY_STRING']);
+        for ($i = 0; $i < sizeof($queryArray); $i++) {
+            if (substr($queryArray[$i], 0, 1) == 'p=') {
+                unset($queryArray[$i]);
+            }
+        }
+
+        $_SERVER['QUERY_STRING'] = implode('&', $queryString);
     }
 
     function getCallback($url, $params)