Fix the following of accounts with "?" in the URL

diff --git a/src/Content/Widget/VCard.php b/src/Content/Widget/VCard.php
index 3f8929946686074b1e121919d9f805efae9ae2b0..8a33ba09e998a0fd53151bd5d795b5cdc71b665e 100644 (file)
--- a/src/Content/Widget/VCard.php
+++ b/src/Content/Widget/VCard.php
@@ -78,7 +78,7 @@ class VCard
                                if (in_array($rel, [Contact::SHARING, Contact::FRIEND])) {
                                        $unfollow_link = 'contact/unfollow?url=' . urlencode($contact_url) . '&auto=1';
                                } elseif (!$pending) {
-                                       $follow_link = 'contact/follow?url=' . urlencode($contact_url) . '&auto=1';
+                                       $follow_link = 'contact/follow?binurl=' . bin2hex($contact_url) . '&auto=1';
                                }
                        }
 

diff --git a/src/Model/Contact.php b/src/Model/Contact.php
index c6bdba2dc0b24601893a01396529f3d4d56bb7f6..cd0d1feca2fef05b2d9a31ad4838a3d3687403f1 100644 (file)
--- a/src/Model/Contact.php
+++ b/src/Model/Contact.php
@@ -1225,7 +1225,7 @@ class Contact
                        if ($contact['uid'] && in_array($contact['rel'], [self::SHARING, self::FRIEND])) {
                                $unfollow_link = 'contact/unfollow?url=' . urlencode($contact['url']) . '&auto=1';
                        } elseif (!$contact['pending']) {
-                               $follow_link = 'contact/follow?url=' . urlencode($contact['url']) . '&auto=1';
+                               $follow_link = 'contact/follow?binurl=' . bin2hex($contact['url']) . '&auto=1';
                        }
                }
 

diff --git a/src/Model/Profile.php b/src/Model/Profile.php
index 8016ce201c0fa21694ffe9a8618f3803640364a8..a27fd9c99e175d03b35a574db39d1f743d3dfc83 100644 (file)
--- a/src/Model/Profile.php
+++ b/src/Model/Profile.php
@@ -325,7 +325,7 @@ class Profile
                                if ($visitor_is_following) {
                                        $unfollow_link = $visitor_base_path . '/contact/unfollow?url=' . urlencode($profile_url) . '&auto=1';
                                } else {
-                                       $follow_link = $visitor_base_path . '/contact/follow?url=' . urlencode($profile_url) . '&auto=1';
+                                       $follow_link = $visitor_base_path . '/contact/follow?binurl=' . bin2hex($profile_url) . '&auto=1';
                                }
                        }
 

diff --git a/src/Module/Contact/Follow.php b/src/Module/Contact/Follow.php
index 23f88d9e2dd40198b1113c554241382042c9cbc0..72c5238184d625aa73a660e4a3cded1568966da9 100644 (file)
--- a/src/Module/Contact/Follow.php
+++ b/src/Module/Contact/Follow.php
@@ -56,11 +56,15 @@ class Follow extends BaseModule
                        throw new ForbiddenException($this->t('Access denied.'));
                }
 
-               if (isset($request['cancel']) || empty($request['url'])) {
-                       $this->baseUrl->redirect('contact');
+               if (!empty($request['follow-url'])) {
+                       $this->baseUrl->redirect('contact/follow?binurl=' . bin2hex($request['follow-url']));
                }
 
-               $url = Probe::cleanURI($request['url']);
+               $url = $this->getUrl($request);
+
+               if (isset($request['cancel']) || empty($url)) {
+                       $this->baseUrl->redirect('contact');
+               }
 
                $this->process($url);
        }
@@ -77,7 +81,7 @@ class Follow extends BaseModule
                $uid = $this->session->getLocalUserId();
 
                // uri is used by the /authorize_interaction Mastodon route
-               $url = Probe::cleanURI(trim($request['uri'] ?? $request['url'] ?? ''));
+               $url = $this->getUrl($request);
 
                // Issue 6874: Allow remote following from Peertube
                if (strpos($url, 'acct:') === 0) {
@@ -182,7 +186,7 @@ class Follow extends BaseModule
 
        protected function process(string $url)
        {
-               $returnPath = 'contact/follow?url=' . urlencode($url);
+               $returnPath = 'contact/follow?binurl=' . bin2hex($url);
 
                $result = Contact::createFromProbeForUser($this->session->getLocalUserId(), $url);
 
@@ -227,4 +231,14 @@ class Follow extends BaseModule
                        return;
                }
        }
+
+       private function getUrl(array $request): string
+       {
+               if (!empty($request['binurl']) && Strings::isHex($request['binurl'])) {
+                       $url = hex2bin($request['binurl']);
+               } else {
+                       $url = $request['url'] ?? '';
+               }
+               return Probe::cleanURI($url);
+       }
 }

diff --git a/src/Module/Contact/Profile.php b/src/Module/Contact/Profile.php
index efd7c5cdb60929266d50743c6765bb4e8d98d7ea..71369c6de695d32099f291c4e6822c8bac48a5cf 100644 (file)
--- a/src/Module/Contact/Profile.php
+++ b/src/Module/Contact/Profile.php
@@ -477,7 +477,7 @@ class Profile extends BaseModule
                } else {
                        $contact_actions['follow'] = [
                                'label' => $this->t('Follow'),
-                               'url'   => 'contact/follow?url=' . urlencode($contact['url']) . '&auto=1',
+                               'url'   => 'contact/follow?binurl=' . bin2hex($contact['url']) . '&auto=1',
                                'title' => '',
                                'sel'   => '',
                                'id'    => 'follow',

diff --git a/view/templates/widget/follow.tpl b/view/templates/widget/follow.tpl
index ae3f32d62244135f8ae062c4662f0cbd1175735b..f980dacd3a0253958428cc2048260ac2b1e80451 100644 (file)
--- a/view/templates/widget/follow.tpl
+++ b/view/templates/widget/follow.tpl
@@ -8,8 +8,8 @@
 <div id="follow-sidebar" class="widget">
        <h3>{{$connect}}</h3>
        <div id="connect-desc">{{$desc nofilter}}</div>
-       <form action="contact/follow" method="get">
-               <input id="side-follow-url" type="text" name="url" value="{{$value}}" size="24" placeholder="{{$hint}}" title="{{$hint}}" /><input id="side-follow-submit" type="submit" name="submit" value="{{$follow}}" />
+       <form action="contact/follow" method="post">
+               <input id="side-follow-url" type="text" name="follow-url" value="{{$value}}" size="24" placeholder="{{$hint}}" title="{{$hint}}" /><input id="side-follow-submit" type="submit" name="submit" value="{{$follow}}" />
        </form>
 </div>
 

diff --git a/view/theme/frio/templates/widget/follow.tpl b/view/theme/frio/templates/widget/follow.tpl
index 9e96196459de8439b1f3030ed5d2785bbbdbb57a..2e679f9f5db3ea2293920dca4038cea738bc0542 100644 (file)
--- a/view/theme/frio/templates/widget/follow.tpl
+++ b/view/theme/frio/templates/widget/follow.tpl
@@ -8,10 +8,10 @@
 <div id="follow-sidebar" class="widget">
        <h3>{{$connect}}</h3>
 
-       <form action="contact/follow" method="get">
+       <form action="contact/follow" method="post">
                {{* The input field - For visual consistence we are using a search input field*}}
                <div class="form-group form-group-search">
-                       <input id="side-follow-url" class="search-input form-control form-search" type="text" name="url" value="{{$value}}" placeholder="{{$hint}}" data-toggle="tooltip" title="{{$hint}}" />
+                       <input id="side-follow-url" class="search-input form-control form-search" type="text" name="follow-url" value="{{$value}}" placeholder="{{$hint}}" data-toggle="tooltip" title="{{$hint}}" />
                        <button id="side-follow-submit" class="btn btn-default btn-sm form-button-search" type="submit">{{$follow}}</button>
                </div>
        </form>