Clean the profile URL when follow

diff --git a/mod/follow.php b/mod/follow.php
index 36eea571945928da11c1b0db815915fcb2a082b9..58419dfd3ba54836f144ae3b3ff2d3148df98c50 100644 (file)
--- a/mod/follow.php
+++ b/mod/follow.php
@@ -41,7 +41,7 @@ function follow_post(App $a)
        }
 
        $uid = local_user();
-       $url = Strings::escapeTags(trim($_REQUEST['url']));
+       $url = Probe::cleanURI($_REQUEST['url']);
        $return_path = 'follow?url=' . urlencode($url);
 
        // Makes the connection request for friendica contacts easier

diff --git a/src/Module/RemoteFollow.php b/src/Module/RemoteFollow.php
index b261fe7577fbbe781c515e1ffeb67ef8ce64d603..8e4da3c63ba3acab4c9bfe969db26583e5717bcf 100644 (file)
--- a/src/Module/RemoteFollow.php
+++ b/src/Module/RemoteFollow.php
@@ -54,7 +54,7 @@ class RemoteFollow extends BaseModule
                        return;
                }
                
-               $url = trim($_POST['dfrn_url']);
+               $url = Probe::cleanURI($_POST['dfrn_url']);
                if (!strlen($url)) {
                        notice(DI::l10n()->t("Invalid locator"));
                        return;

diff --git a/src/Network/Probe.php b/src/Network/Probe.php
index b547c430564e9977e69e2f13e88faa8869bab271..771312f6ec8498b3d64712d41d9052e86fa3328f 100644 (file)
--- a/src/Network/Probe.php
+++ b/src/Network/Probe.php
@@ -47,6 +47,31 @@ class Probe
        private static $baseurl;
        private static $istimeout;
 
+       /**
+        * Remove stuff from an URI that doesn't belong there
+        *
+        * @param string $URI
+        * @return string Cleaned URI
+        */
+       public static function cleanURI(string $URI)
+       {
+               // At first remove leading and trailing junk
+               $URI = trim($URI, "@#?:/ \t\n\r\0\x0B");
+
+               $parts = parse_url($URI);
+
+               if (empty($parts['scheme'])) {
+                       return $URI;
+               }
+
+               // Remove the URL fragment, since these shouldn't be part of any profile URL
+               unset($parts['fragment']);
+
+               $URI = Network::unparseURL($parts);
+
+               return $URI;
+       }
+
        /**
         * Rearrange the array so that it always has the same order
         *