From: Michael <heluecht@pirati.ca>
Date: Sat, 22 Feb 2020 12:29:33 +0000 (+0000)
Subject: Clean the profile URL when follow
X-Git-Url: https://git.mxchange.org/?a=commitdiff_plain;h=9cbea34fa4c389c676ce501a1bc9219e471857f8;p=friendica.git

Clean the profile URL when follow
---

diff --git a/mod/follow.php b/mod/follow.php
index 36eea57194..58419dfd3b 100644
--- a/mod/follow.php
+++ b/mod/follow.php
@@ -41,7 +41,7 @@ function follow_post(App $a)
 	}
 
 	$uid = local_user();
-	$url = Strings::escapeTags(trim($_REQUEST['url']));
+	$url = Probe::cleanURI($_REQUEST['url']);
 	$return_path = 'follow?url=' . urlencode($url);
 
 	// Makes the connection request for friendica contacts easier
diff --git a/src/Module/RemoteFollow.php b/src/Module/RemoteFollow.php
index b261fe7577..8e4da3c63b 100644
--- a/src/Module/RemoteFollow.php
+++ b/src/Module/RemoteFollow.php
@@ -54,7 +54,7 @@ class RemoteFollow extends BaseModule
 			return;
 		}
 		
-		$url = trim($_POST['dfrn_url']);
+		$url = Probe::cleanURI($_POST['dfrn_url']);
 		if (!strlen($url)) {
 			notice(DI::l10n()->t("Invalid locator"));
 			return;
diff --git a/src/Network/Probe.php b/src/Network/Probe.php
index b547c43056..771312f6ec 100644
--- a/src/Network/Probe.php
+++ b/src/Network/Probe.php
@@ -47,6 +47,31 @@ class Probe
 	private static $baseurl;
 	private static $istimeout;
 
+	/**
+	 * Remove stuff from an URI that doesn't belong there
+	 *
+	 * @param string $URI
+	 * @return string Cleaned URI
+	 */
+	public static function cleanURI(string $URI)
+	{
+		// At first remove leading and trailing junk
+		$URI = trim($URI, "@#?:/ \t\n\r\0\x0B");
+
+		$parts = parse_url($URI);
+
+		if (empty($parts['scheme'])) {
+			return $URI;
+		}
+
+		// Remove the URL fragment, since these shouldn't be part of any profile URL
+		unset($parts['fragment']);
+
+		$URI = Network::unparseURL($parts);
+
+		return $URI;
+	}
+
 	/**
 	 * Rearrange the array so that it always has the same order
 	 *