Make it impossible to block (and thus unsubscribe from your

self-subscription) via the API.  Additionally, make it impossible
to block yourself or unsubscribe from yourself, period.

I also made User use the subs.php helper function for unsubscribing
during a block.

Hopefully, these changes will get rid of the problem of people
accidentally deleting their self-subscriptions once and for all
(knock on wood).

diff --git a/actions/apiblockcreate.php b/actions/apiblockcreate.php
index 4f941f6c32e3a8f10b0f4d6c82454919ff59c26b..e79dec32d0521ced06d3da89c6a4226ac05e89d0 100644 (file)
--- a/actions/apiblockcreate.php
+++ b/actions/apiblockcreate.php
@@ -98,6 +98,17 @@ class ApiBlockCreateAction extends ApiAuthAction
             return;
         }
 
+        // Don't allow blocking yourself!
+
+        if ($this->user->id == $this->other->id) {
+            $this->clientError(
+                _("You cannot block yourself!"),
+                403,
+                $this->format
+            );
+            return;
+        }
+
         if ($this->user->hasBlocked($this->other)
             || $this->user->block($this->other)
         ) {

diff --git a/classes/User.php b/classes/User.php
index f905ea2b72cf3e0b9c3298c440fe5702787dcb7a..4838fe1c7df632454b010ac5982751083ce6e828 100644 (file)
--- a/classes/User.php
+++ b/classes/User.php
@@ -502,6 +502,19 @@ class User extends Memcached_DataObject
     {
         // Add a new block record
 
+        // no blocking (and thus unsubbing from) yourself
+
+        if ($this->id == $other->id) {
+            common_log(LOG_WARNING,
+                sprintf(
+                    "Profile ID %d (%s) tried to block his or herself.",
+                    $profile->id,
+                    $profile->nickname
+                )
+            );
+            return false;
+        }
+
         $block = new Profile_block();
 
         // Begin a transaction
@@ -520,15 +533,20 @@ class User extends Memcached_DataObject
 
         // Cancel their subscription, if it exists
 
-        $sub = Subscription::pkeyGet(array('subscriber' => $other->id,
-                                           'subscribed' => $this->id));
-
-        if ($sub) {
-            $result = $sub->delete();
-            if (!$result) {
-                common_log_db_error($sub, 'DELETE', __FILE__);
-                return false;
-            }
+        $result = subs_unsubscribe_to($this, $other);
+
+        if ($result !== true) {
+            common_log(LOG_WARNING,
+                sprintf(
+                    "Error trying to unsubscribe profile ID %d (%s) from user ID %d (%s): %s",
+                    $other->id,
+                    $other->nickname,
+                    $this->id,
+                    $this->nickname,
+                    $result
+                )
+            );
+            return false;
         }
 
         $block->query('COMMIT');

diff --git a/lib/subs.php b/lib/subs.php
index 2fc3160dec5e9d01de6a885766706b33587890f0..4b6b03967aee356bccbcd0675dfe3defe1ec0adb 100644 (file)
--- a/lib/subs.php
+++ b/lib/subs.php
@@ -127,6 +127,12 @@ function subs_unsubscribe_to($user, $other)
     if (!$user->isSubscribed($other))
         return _('Not subscribed!');
 
+    // Don't allow deleting self subs
+
+    if ($user->id == $other->id) {
+        return _('Couldn\'t delete self-subscription.');
+    }
+
     $sub = DB_DataObject::factory('subscription');
 
     $sub->subscriber = $user->id;