Avoid possible problems with numeric nicknames and GNU Social

diff --git a/include/Probe.php b/include/Probe.php
index c2136eec8b6e64e5718043612dc2657ece3c17f1..f67a821f9dc04b3854570b881189ca98aa527ea8 100644 (file)
--- a/include/Probe.php
+++ b/include/Probe.php
@@ -364,9 +364,9 @@ class Probe {
                                return self::mail($uri, $uid);
                        }
 
-                       if ($network == NETWORK_MAIL)
+                       if ($network == NETWORK_MAIL) {
                                return self::mail($uri, $uid);
-
+                       }
                        // Remove "acct:" from the URI
                        $uri = str_replace('acct:', '', $uri);
 
@@ -391,37 +391,37 @@ class Probe {
                /// @todo Do we need the prefix "acct:" or "acct://"?
 
                foreach ($lrdd AS $key => $link) {
-                       if ($webfinger)
+                       if ($webfinger) {
                                continue;
-
-                       if (!in_array($key, array("lrdd", "lrdd-xml", "lrdd-json")))
+                       }
+                       if (!in_array($key, array("lrdd", "lrdd-xml", "lrdd-json"))) {
                                continue;
-
-                       // Try webfinger with the address (user@domain.tld)
-                       $path = str_replace('{uri}', urlencode($addr), $link);
+                       }
+                       // At first try it with the given uri
+                       $path = str_replace('{uri}', urlencode($uri), $link);
                        $webfinger = self::webfinger($path);
 
-                       // Mastodon needs to have it with "acct:"
+                       // We cannot be sure that the detected address was correct, so we don't use the values
+                       if ($webfinger AND ($uri != $addr)) {
+                               $nick = "";
+                               $addr = "";
+                       }
+
+                       // Try webfinger with the address (user@domain.tld)
                        if (!$webfinger) {
-                               $path = str_replace('{uri}', urlencode("acct:".$addr), $link);
+                               $path = str_replace('{uri}', urlencode($addr), $link);
                                $webfinger = self::webfinger($path);
                        }
 
-                       // If webfinger wasn't successful then try it with the URL - possibly in the format https://...
-                       if (!$webfinger AND ($uri != $addr)) {
-                               $path = str_replace('{uri}', urlencode($uri), $link);
+                       // Mastodon needs to have it with "acct:"
+                       if (!$webfinger) {
+                               $path = str_replace('{uri}', urlencode("acct:".$addr), $link);
                                $webfinger = self::webfinger($path);
-
-                               // Since the detection with the address wasn't successful, we delete it.
-                               if ($webfinger) {
-                                       $nick = "";
-                                       $addr = "";
-                               }
                        }
-
                }
-               if (!$webfinger)
+               if (!$webfinger) {
                        return self::feed($uri);
+               }
 
                $result = false;
 

diff --git a/mod/probe.php b/mod/probe.php
index 95f856bfa1499b77c495119196b6fd4ede39eebe..8c951a7fcfd62f63f9c3fbe5bda5a02af735ad65 100644 (file)
--- a/mod/probe.php
+++ b/mod/probe.php
@@ -4,6 +4,13 @@ require_once('include/Scrape.php');
 
 function probe_content(App $a) {
 
+       if (!local_user()) {
+               http_status_exit(403,
+                               array("title" => t("Public access denied."),
+                                       "description" => t("Only logged in users are permitted to perform a probing.")));
+               killme();
+       }
+
        $o .= '<h3>Probe Diagnostic</h3>';
 
        $o .= '<form action="probe" method="get">';

diff --git a/mod/webfinger.php b/mod/webfinger.php
index eee0580e3178c8b8a492ecf73fcbd1c718bb82fa..d823bd2dc217b988c8f5d41839ee22f77bfde8a8 100644 (file)
--- a/mod/webfinger.php
+++ b/mod/webfinger.php
@@ -3,6 +3,13 @@ require_once("include/Probe.php");
 
 function webfinger_content(App $a) {
 
+       if (!local_user()) {
+               http_status_exit(403,
+                               array("title" => t("Public access denied."),
+                                       "description" => t("Only logged in users are permitted to perform a probing.")));
+               killme();
+       }
+
        $o .= '<h3>Webfinger Diagnostic</h3>';
 
        $o .= '<form action="webfinger" method="get">';