add some extra checks to avoid remote subscriptions to local users

darcs-hash:20081118180644-84dde-ab152249ac0844a482029b7e0f8db2780a0f15d6.gz

diff --git a/actions/finishremotesubscribe.php b/actions/finishremotesubscribe.php
index ae62fe4b32eabcff2d0463243ba075c379ce3855..cacf545b5f8f6c1f2fce7bf3d90de17f98cb45a1 100644 (file)
--- a/actions/finishremotesubscribe.php
+++ b/actions/finishremotesubscribe.php
@@ -80,6 +80,11 @@ class FinishremotesubscribeAction extends Action {
                        return;
                }
 
+               if ($profile_url == common_local_url('showstream', array('nickname' => $nickname))) {
+                       common_user_error(_('You can use the local subscription!'));
+                   return;
+               }
+                       
                common_debug('listenee: "'.$omb['listenee'].'"', __FILE__);
 
                $user = User::staticGet('nickname', $omb['listenee']);
@@ -89,6 +94,13 @@ class FinishremotesubscribeAction extends Action {
                        return;
                }
 
+               $other = User::staticGet('uri', $omb['listener']);
+               
+               if ($other) {
+                       common_user_error(_('You can use the local subscription!'));
+                       return;
+               }
+                       
                $fullname = $req->get_parameter('omb_listener_fullname');
                $homepage = $req->get_parameter('omb_listener_homepage');
                $bio = $req->get_parameter('omb_listener_bio');

diff --git a/actions/remotesubscribe.php b/actions/remotesubscribe.php
index 7137b42a26f79749a881c72b6999f5b8f73e2da1..2c932178fa2576dd35ecdbb6917e5a39da5109bf 100644 (file)
--- a/actions/remotesubscribe.php
+++ b/actions/remotesubscribe.php
@@ -130,6 +130,13 @@ class RemotesubscribeAction extends Action {
                        return;
                }
 
+               if (omb_service_uri($omb[OAUTH_ENDPOINT_REQUEST]) ==
+                       common_local_url('requesttoken'))
+               {
+                       $this->show_form(_('That\'s a local profile! Login to subscribe.'));
+                       return;
+               }
+               
                list($token, $secret) = $this->request_token($omb);
 
                if (!$token || !$secret) {

diff --git a/actions/userauthorization.php b/actions/userauthorization.php
index 680f55094c7916da8a8aca6576056ba80bfe4577..11e2d7135956d7fa1ae097c6bcb2f1f5ec8e553b 100644 (file)
--- a/actions/userauthorization.php
+++ b/actions/userauthorization.php
@@ -415,6 +415,12 @@ class UserauthorizationAction extends Action {
                if (strlen($listenee) > 255) {
                        throw new OAuthException("Listenee URI '$listenee' too long");
                }
+               
+               $other = User::staticGet('uri', $listenee);
+               if ($other) {
+                       throw new OAuthException("Listenee URI '$listenee' is local user");
+               }
+               
                $remote = Remote_profile::staticGet('uri', $listenee);
                if ($remote) {
                        $sub = new Subscription();
@@ -434,6 +440,11 @@ class UserauthorizationAction extends Action {
                if (!common_valid_http_url($profile)) {
                        throw new OAuthException("Invalid profile URL '$profile'.");
                }
+               
+               if ($profile == common_local_url('showstream', array('nickname' => $nickname))) {
+                       throw new OAuthException("Profile URL '$profile' is for a local user.");
+               }
+               
                $license = $req->get_parameter('omb_listenee_license');
                if (!common_valid_http_url($license)) {
                        throw new OAuthException("Invalid license URL '$license'.");
@@ -476,6 +487,9 @@ class UserauthorizationAction extends Action {
                if ($callback && !common_valid_http_url($callback)) {
                        throw new OAuthException("Invalid callback URL '$callback'");
                }
+               if ($callback && $callback == common_local_url('finishremotesubscribe')) {
+                       throw new OAuthException("Callback URL '$callback' is for local site.");
+               }
        }
 
        # Snagged from OAuthServer