Test in Ostatus_profile if avatar is an image before writing to filesystem

This clears one FIXME...

We also fix HTTPClient::quickGet() (and a related call in OStatus testfeed.php).

diff --git a/lib/httpclient.php b/lib/httpclient.php
index 3e9f5d3ea746c562c9e5f6d42767d02cf389379b..6016f89314400e90059a1b93eaf232a9a482219c 100644 (file)
--- a/lib/httpclient.php
+++ b/lib/httpclient.php
@@ -177,10 +177,12 @@ class HTTPClient extends HTTP_Request2
     /**
      * Quick static function to GET a URL
      */
-    public static function quickGet($url, $accept='text/html,application/xhtml+xml')
+    public static function quickGet($url, $accept=null)
     {
         $client = new HTTPClient();
-        $client->setHeader('Accept', $accept);
+        if (!is_null($accept)) {
+            $client->setHeader('Accept', $accept);
+        }
         $response = $client->get($url);
         if (!$response->isOk()) {
             // TRANS: Exception. %s is a profile URL.

diff --git a/plugins/OStatus/classes/Ostatus_profile.php b/plugins/OStatus/classes/Ostatus_profile.php
index f99852ef174c487180a43c695f356995eed36244..f5433ef159498a0f0a08bdfeb98cd87744144148 100644 (file)
--- a/plugins/OStatus/classes/Ostatus_profile.php
+++ b/plugins/OStatus/classes/Ostatus_profile.php
@@ -1261,15 +1261,13 @@ class Ostatus_profile extends Managed_DataObject
         // ripped from oauthstore.php (for old OMB client)
         $temp_filename = tempnam(sys_get_temp_dir(), 'listener_avatar');
         try {
-            $client = new HTTPClient();
-            $response = $client->get($url);
-
-            if (!$response->isOk()) {
-                // TRANS: Server exception. %s is a URL.
-                throw new ServerException(sprintf(_m('Unable to fetch avatar from %s.'), $url));
+            $imgData = HTTPClient::quickGet($url);
+            // Make sure it's at least an image file. ImageFile can do the rest.
+            if (false === getimagesizefromstring($imgData)) {
+                throw new UnsupportedMediaException(_('Downloaded group avatar was not an image.'));
             }
-            // FIXME: make sure it's an image here instead of _after_ writing to a file?
-            file_put_contents($temp_filename, $response->getBody());
+            file_put_contents($temp_filename, $imgData);
+            unset($imgData);    // No need to carry this in memory.
 
             if ($this->isGroup()) {
                 $id = $this->group_id;

diff --git a/plugins/OStatus/scripts/testfeed.php b/plugins/OStatus/scripts/testfeed.php
index 4dd5dfa370d1b832cd8ac58583d0d0663d968d6c..84b470c3b251dbfc1f31bfe7823fa628d1657643 100644 (file)
--- a/plugins/OStatus/scripts/testfeed.php
+++ b/plugins/OStatus/scripts/testfeed.php
@@ -53,7 +53,7 @@ if (!$sub) {
 
 // Fetch the URL
 try {
-    $xml = HTTPClient::quickGet($feedurl);
+    $xml = HTTPClient::quickGet($feedurl, 'text/html,application/xhtml+xml');
 } catch (Exception $e) {
     echo sprintf("Could not fetch feedurl %s (%d).\n", $e->getMessage(), $e->getCode());
     exit(1);