Merge branch 'master' into testing

diff --git a/actions/all.php b/actions/all.php
index 9c01b63938645484c9ef3d708483aeb889074f71..ac4e321d0f42a53bb3fac9571b6bd327af4dde0a 100644 (file)
--- a/actions/all.php
+++ b/actions/all.php
@@ -143,10 +143,10 @@ class AllAction extends ProfileAction
                 $message .= _('Try subscribing to more people, [join a group](%%action.groups%%) or post something yourself.');
             } else {
                 // TRANS: %1$s is user nickname, %2$s is user nickname, %2$s is user nickname prefixed with "@"
-                $message .= sprintf(_('You can try to [nudge %1$s](../%2$s) from his profile or [post something to his or her attention](%%%%action.newnotice%%%%?status_textarea=%3$s).'), $this->user->nickname, $this->user->nickname, '@' . $this->user->nickname);
+                $message .= sprintf(_('You can try to [nudge %1$s](../%2$s) from their profile or [post something to their attention](%%%%action.newnotice%%%%?status_textarea=%3$s).'), $this->user->nickname, $this->user->nickname, '@' . $this->user->nickname);
             }
         } else {
-            $message .= sprintf(_('Why not [register an account](%%%%action.register%%%%) and then nudge %s or post a notice to his or her attention.'), $this->user->nickname);
+            $message .= sprintf(_('Why not [register an account](%%%%action.register%%%%) and then nudge %s or post a notice to their attention.'), $this->user->nickname);
         }
 
         $this->elementStart('div', 'guide');

diff --git a/actions/favor.php b/actions/favor.php
index 475912fd0b1722ba924a842f85bf9288af36e1ad..01976a38f5999ee89fc2342d5a9aee4d72adae79 100644 (file)
--- a/actions/favor.php
+++ b/actions/favor.php
@@ -104,7 +104,7 @@ class FavorAction extends Action
     }
 
     /**
-     * Notifies a user when his notice is favorited.
+     * Notifies a user when their notice is favorited.
      *
      * @param class $notice favorited notice
      * @param class $user   user declaring a favorite

diff --git a/actions/finishremotesubscribe.php b/actions/finishremotesubscribe.php
index ac51ddec3fbc825a2ad4f824d11d480406b7a239..0325f6adbb512ab78085d25fd4123581d405b956 100644 (file)
--- a/actions/finishremotesubscribe.php
+++ b/actions/finishremotesubscribe.php
@@ -37,7 +37,7 @@ require_once INSTALLDIR.'/lib/omb.php';
  * Handler for remote subscription finish callback
  *
  * When a remote user subscribes a local user, a redirect to this action is
- * issued after the remote user authorized his service to subscribe.
+ * issued after the remote user authorized their service to subscribe.
  *
  * @category Action
  * @package  Laconica

diff --git a/actions/nudge.php b/actions/nudge.php
index cf5f773e71061e7f93600b6b9478ea4797f19528..32ae8587cc5567d6da8fc36a9d5c71e8bb344e99 100644 (file)
--- a/actions/nudge.php
+++ b/actions/nudge.php
@@ -82,7 +82,7 @@ class NudgeAction extends Action
         }
 
         if (!$other->email || !$other->emailnotifynudge) {
-            $this->clientError(_('This user doesn\'t allow nudges or hasn\'t confirmed or set his email yet.'));
+            $this->clientError(_('This user doesn\'t allow nudges or hasn\'t confirmed or set their email yet.'));
             return;
         }
 

diff --git a/actions/replies.php b/actions/replies.php
index 608f71d6e0f4a011d1156e1ceaaa815c2a5a7018..0474a6de04bcb5da58d52feea6c049a253225435 100644 (file)
--- a/actions/replies.php
+++ b/actions/replies.php
@@ -196,18 +196,18 @@ class RepliesAction extends OwnerDesignAction
 
     function showEmptyListMessage()
     {
-        $message = sprintf(_('This is the timeline showing replies to %1$s but %2$s hasn\'t received a notice to his attention yet.'), $this->user->nickname, $this->user->nickname) . ' ';
+        $message = sprintf(_('This is the timeline showing replies to %1$s but %2$s hasn\'t received a notice to their attention yet.'), $this->user->nickname, $this->user->nickname) . ' ';
 
         if (common_logged_in()) {
             $current_user = common_current_user();
             if ($this->user->id === $current_user->id) {
                 $message .= _('You can engage other users in a conversation, subscribe to more people or [join groups](%%action.groups%%).');
             } else {
-                $message .= sprintf(_('You can try to [nudge %1$s](../%2$s) or [post something to his or her attention](%%%%action.newnotice%%%%?status_textarea=%3$s).'), $this->user->nickname, $this->user->nickname, '@' . $this->user->nickname);
+                $message .= sprintf(_('You can try to [nudge %1$s](../%2$s) or [post something to their attention](%%%%action.newnotice%%%%?status_textarea=%3$s).'), $this->user->nickname, $this->user->nickname, '@' . $this->user->nickname);
             }
         }
         else {
-            $message .= sprintf(_('Why not [register an account](%%%%action.register%%%%) and then nudge %s or post a notice to his or her attention.'), $this->user->nickname);
+            $message .= sprintf(_('Why not [register an account](%%%%action.register%%%%) and then nudge %s or post a notice to their attention.'), $this->user->nickname);
         }
 
         $this->elementStart('div', 'guide');

diff --git a/actions/showfavorites.php b/actions/showfavorites.php
index 7f3c77ee246dfa8f76f7255532cb86a133cac9fa..d8042e91c7195c93f50b53b6e9f3d9f418494109 100644 (file)
--- a/actions/showfavorites.php
+++ b/actions/showfavorites.php
@@ -119,7 +119,7 @@ class ShowfavoritesAction extends OwnerDesignAction
         if (!empty($cur) && $cur->id == $this->user->id) {
 
             // Show imported/gateway notices as well as local if
-            // the user is looking at his own favorites
+            // the user is looking at their own favorites
 
             $this->notice = $this->user->favoriteNotices(true, ($this->page-1)*NOTICES_PER_PAGE,
                                                    NOTICES_PER_PAGE + 1);
@@ -205,11 +205,11 @@ class ShowfavoritesAction extends OwnerDesignAction
             if ($this->user->id === $current_user->id) {
                 $message = _('You haven\'t chosen any favorite notices yet. Click the fave button on notices you like to bookmark them for later or shed a spotlight on them.');
             } else {
-                $message = sprintf(_('%s hasn\'t added any notices to his favorites yet. Post something interesting they would add to their favorites :)'), $this->user->nickname);
+                $message = sprintf(_('%s hasn\'t added any favorite notices yet. Post something interesting they would add to their favorites :)'), $this->user->nickname);
             }
         }
         else {
-            $message = sprintf(_('%s hasn\'t added any notices to his favorites yet. Why not [register an account](%%%%action.register%%%%) and then post something interesting they would add to their favorites :)'), $this->user->nickname);
+            $message = sprintf(_('%s hasn\'t added any favorite notices yet. Why not [register an account](%%%%action.register%%%%) and then post something interesting they would add to their favorites :)'), $this->user->nickname);
         }
 
         $this->elementStart('div', 'guide');

diff --git a/actions/showstream.php b/actions/showstream.php
index f9407e35a1f7890189b817c39dd8900c2c6a1f33..956c057415d0b27cbc7ecf8c933051efd16b4d24 100644 (file)
--- a/actions/showstream.php
+++ b/actions/showstream.php
@@ -204,11 +204,11 @@ class ShowstreamAction extends ProfileAction
             if ($this->user->id === $current_user->id) {
                 $message .= _('Seen anything interesting recently? You haven\'t posted any notices yet, now would be a good time to start :)');
             } else {
-                $message .= sprintf(_('You can try to nudge %1$s or [post something to his or her attention](%%%%action.newnotice%%%%?status_textarea=%2$s).'), $this->user->nickname, '@' . $this->user->nickname);
+                $message .= sprintf(_('You can try to nudge %1$s or [post something to their attention](%%%%action.newnotice%%%%?status_textarea=%2$s).'), $this->user->nickname, '@' . $this->user->nickname);
             }
         }
         else {
-            $message .= sprintf(_('Why not [register an account](%%%%action.register%%%%) and then nudge %s or post a notice to his or her attention.'), $this->user->nickname);
+            $message .= sprintf(_('Why not [register an account](%%%%action.register%%%%) and then nudge %s or post a notice to their attention.'), $this->user->nickname);
         }
 
         $this->elementStart('div', 'guide');

diff --git a/classes/Notice.php b/classes/Notice.php
index ae7e2e54022a2c27e3740b7549b78cfaf4c976a7..8552248bad2c4cc3dfea6290803a4b653733f1f9 100644 (file)
--- a/classes/Notice.php
+++ b/classes/Notice.php
@@ -42,10 +42,10 @@ if (!defined('STATUSNET') && !defined('LACONICA')) {
  */
 require_once INSTALLDIR.'/classes/Memcached_DataObject.php';
 
-/* We keep the first three 20-notice pages, plus one for pagination check,
+/* We keep 200 notices, the max number of notices available per API request,
  * in the memcached cache. */
 
-define('NOTICE_CACHE_WINDOW', 61);
+define('NOTICE_CACHE_WINDOW', 200);
 
 define('MAX_BOXCARS', 128);
 

diff --git a/classes/User.php b/classes/User.php
index 2abb7eeb69319ae8956e2dc64882f32c9b39a2fb..cf8d4527b8fc9ee2fd2891420e61e04bb7179af0 100644 (file)
--- a/classes/User.php
+++ b/classes/User.php
@@ -524,7 +524,7 @@ class User extends Memcached_DataObject
         if ($this->id == $other->id) {
             common_log(LOG_WARNING,
                 sprintf(
-                    "Profile ID %d (%s) tried to block his or herself.",
+                    "Profile ID %d (%s) tried to block themself.",
                     $this->id,
                     $this->nickname
                 )

diff --git a/extlib/Auth/OpenID/Association.php b/extlib/Auth/OpenID/Association.php
index d1ac1ed9b9d9618767b73df9ca54b2311acfc18f..7fdf399a3c9e6309ce39a304208d47a8a3b15e75 100644 (file)
--- a/extlib/Auth/OpenID/Association.php
+++ b/extlib/Auth/OpenID/Association.php
@@ -374,7 +374,42 @@ class Auth_OpenID_Association {
         }
 
         $calculated_sig = $this->getMessageSignature($message);
-        return $calculated_sig == $sig;
+
+        return $this->constantTimeCompare($calculated_sig, $sig);
+    }
+
+    /**
+     * String comparison function which will complete in a constant time
+     * for strings of any given matching length, to help prevent an attacker
+     * from distinguishing how much of a signature token they have guessed
+     * correctly.
+     *
+     * For this usage, it's assumed that the length of the string is known,
+     * so we may safely short-circuit on mismatched lengths which will be known
+     * to be invalid by the attacker.
+     *
+     * http://lists.openid.net/pipermail/openid-security/2010-July/001156.html
+     * http://rdist.root.org/2010/01/07/timing-independent-array-comparison/
+     */
+    private function constantTimeCompare($a, $b)
+    {
+        $len = strlen($a);
+        if (strlen($b) !== $len) {
+            // Short-circuit on length mismatch; attackers will already know
+            // the correct target length so this is safe.
+            return false;
+        }
+        if ($len == 0) {
+            // 0-length valid input shouldn't really happen. :)
+            return true;
+        }
+        $result = 0;
+        for ($i = 0; $i < strlen($a); $i++) {
+            // We use scary bitwise operations to avoid logical short-circuits
+            // in lower-level code.
+            $result |= ord($a{$i}) ^ ord($b{$i});
+        }
+        return ($result == 0);
     }
 }
 

diff --git a/extlib/OAuth.php b/extlib/OAuth.php
index 648627b57637f34ed93ea66d226c9244cc396931..04984d5fa0327defc0c6f1b1fe6f4c770254b96d 100644 (file)
--- a/extlib/OAuth.php
+++ b/extlib/OAuth.php
@@ -54,6 +54,24 @@ class OAuthSignatureMethod {/*{{{*/
   public function check_signature(&$request, $consumer, $token, $signature) {
     $built = $this->build_signature($request, $consumer, $token);
     return $built == $signature;
+
+    // Check for zero length, although unlikely here
+    if (strlen($built) == 0 || strlen($signature) == 0) {
+      return false;
+    }
+
+    if (strlen($built) != strlen($signature)) {
+      return false;
+    }
+
+    $result = 0;
+
+    // Avoid a timing leak with a (hopefully) time insensitive compare
+    for ($i = 0; $i < strlen($signature); $i++) {
+      $result |= ord($built{$i}) ^ ord($signature{$i});
+    }
+
+    return $result == 0;
   }
 }/*}}}*/
 

diff --git a/lib/activityutils.php b/lib/activityutils.php
index 401fd7fc283ff92b9b5d5a021ecbd6e74780fa74..dd38d4e14222b8da15030918d8d2ef187d5bdb8d 100644 (file)
--- a/lib/activityutils.php
+++ b/lib/activityutils.php
@@ -257,6 +257,12 @@ class ActivityUtils
      */
     static function validateUri($uri)
     {
+        // Check mailto: URIs first
+
+        if (preg_match('/^mailto:(.*)$/', $uri, $match)) {
+            return Validate::email($match[1], common_config('email', 'check_domain'));
+        }
+
         if (Validate::uri($uri)) {
             return true;
         }

diff --git a/theme/biz/css/display.css b/theme/biz/css/display.css
index ea09ef4c0fcc6ac458f0a1538a536c8bc9cb6661..e735d8683fff24b3a949669ce653fec38a049544 100644 (file)
--- a/theme/biz/css/display.css
+++ b/theme/biz/css/display.css
@@ -7,7 +7,7 @@
  * @link      http://status.net/
  */
 
-@import url(base.css) screen, projection, tv, print;
+@import url(base.css);
 
 @media screen, projection, tv {
 html {

diff --git a/theme/default/css/display.css b/theme/default/css/display.css
index 5e3748cb7abed2b22fded0a6e70008365fc63dcc..9a1dabb51546c906ad87305c1aa67686e92be582 100644 (file)
--- a/theme/default/css/display.css
+++ b/theme/default/css/display.css
@@ -7,7 +7,7 @@
  * @link      http://status.net/
  */
 
-@import url(../../base/css/display.css) screen, projection, tv, print;
+@import url(../../base/css/display.css);
 
 @media screen, projection, tv {
 body,

diff --git a/theme/identica/css/display.css b/theme/identica/css/display.css
index 440dd8be22404cf5c3d3cc8cafda134fef1361f5..d7f150bcb0ad9c17974966f904e830acc6a5de85 100644 (file)
--- a/theme/identica/css/display.css
+++ b/theme/identica/css/display.css
@@ -7,7 +7,7 @@
  * @link      http://status.net/
  */
 
-@import url(../../base/css/display.css) screen, projection, tv, print;
+@import url(../../base/css/display.css);
 
 @media screen, projection, tv {
 body,

diff --git a/theme/pigeonthoughts/css/display.css b/theme/pigeonthoughts/css/display.css
index e584683fcdcd686ab3f9a6283804669337bc936a..3d6db00e142e1f84a5cab460891501ed01bb8de4 100644 (file)
--- a/theme/pigeonthoughts/css/display.css
+++ b/theme/pigeonthoughts/css/display.css
@@ -7,7 +7,7 @@
  * @link      http://status.net/
  */
 
-@import url(base.css) screen, projection, tv, print;
+@import url(base.css);
 
 @media screen, projection, tv {
 html {