From: Michael Date: Sat, 22 Feb 2020 12:29:33 +0000 (+0000) Subject: Clean the profile URL when follow X-Git-Url: https://git.mxchange.org/?a=commitdiff_plain;h=9cbea34fa4c389c676ce501a1bc9219e471857f8;p=friendica.git Clean the profile URL when follow --- diff --git a/mod/follow.php b/mod/follow.php index 36eea57194..58419dfd3b 100644 --- a/mod/follow.php +++ b/mod/follow.php @@ -41,7 +41,7 @@ function follow_post(App $a) } $uid = local_user(); - $url = Strings::escapeTags(trim($_REQUEST['url'])); + $url = Probe::cleanURI($_REQUEST['url']); $return_path = 'follow?url=' . urlencode($url); // Makes the connection request for friendica contacts easier diff --git a/src/Module/RemoteFollow.php b/src/Module/RemoteFollow.php index b261fe7577..8e4da3c63b 100644 --- a/src/Module/RemoteFollow.php +++ b/src/Module/RemoteFollow.php @@ -54,7 +54,7 @@ class RemoteFollow extends BaseModule return; } - $url = trim($_POST['dfrn_url']); + $url = Probe::cleanURI($_POST['dfrn_url']); if (!strlen($url)) { notice(DI::l10n()->t("Invalid locator")); return; diff --git a/src/Network/Probe.php b/src/Network/Probe.php index b547c43056..771312f6ec 100644 --- a/src/Network/Probe.php +++ b/src/Network/Probe.php @@ -47,6 +47,31 @@ class Probe private static $baseurl; private static $istimeout; + /** + * Remove stuff from an URI that doesn't belong there + * + * @param string $URI + * @return string Cleaned URI + */ + public static function cleanURI(string $URI) + { + // At first remove leading and trailing junk + $URI = trim($URI, "@#?:/ \t\n\r\0\x0B"); + + $parts = parse_url($URI); + + if (empty($parts['scheme'])) { + return $URI; + } + + // Remove the URL fragment, since these shouldn't be part of any profile URL + unset($parts['fragment']); + + $URI = Network::unparseURL($parts); + + return $URI; + } + /** * Rearrange the array so that it always has the same order *