Bugfix: The contact names had to be escaped

diff --git a/include/conversation.php b/include/conversation.php
index 2397014141f35c8a26c135aaa09b1f8513a274bb..bbb0b921a344051b4668dfe1beac007a51a6a7f6 100644 (file)
--- a/include/conversation.php
+++ b/include/conversation.php
@@ -396,25 +396,25 @@ function conversation(&$a, $items, $mode, $update, $preview = false) {
                $page_writeable = true;
                if(!$update) {
                        // The special div is needed for liveUpdate to kick in for this page.
-                       // We only launch liveUpdate if you aren't filtering in some incompatible 
+                       // We only launch liveUpdate if you aren't filtering in some incompatible
                        // way and also you aren't writing a comment (discovered in javascript).
 
                        $live_update_div = '<div id="live-network"></div>' . "\r\n"
-                               . "<script> var profile_uid = " . $_SESSION['uid'] 
+                               . "<script> var profile_uid = " . $_SESSION['uid']
                                . "; var netargs = '" . substr($a->cmd,8)
                                . '?f='
                                . ((x($_GET,'cid'))    ? '&cid='    . $_GET['cid']    : '')
-                               . ((x($_GET,'search')) ? '&search=' . $_GET['search'] : '') 
-                               . ((x($_GET,'star'))   ? '&star='   . $_GET['star']   : '') 
-                               . ((x($_GET,'order'))  ? '&order='  . $_GET['order']  : '') 
-                               . ((x($_GET,'bmark'))  ? '&bmark='  . $_GET['bmark']  : '') 
-                               . ((x($_GET,'liked'))  ? '&liked='  . $_GET['liked']  : '') 
-                               . ((x($_GET,'conv'))   ? '&conv='   . $_GET['conv']   : '') 
-                               . ((x($_GET,'spam'))   ? '&spam='   . $_GET['spam']   : '') 
-                               . ((x($_GET,'nets'))   ? '&nets='   . $_GET['nets']   : '') 
-                               . ((x($_GET,'cmin'))   ? '&cmin='   . $_GET['cmin']   : '') 
-                               . ((x($_GET,'cmax'))   ? '&cmax='   . $_GET['cmax']   : '') 
-                               . ((x($_GET,'file'))   ? '&file='   . $_GET['file']   : '') 
+                               . ((x($_GET,'search')) ? '&search=' . $_GET['search'] : '')
+                               . ((x($_GET,'star'))   ? '&star='   . $_GET['star']   : '')
+                               . ((x($_GET,'order'))  ? '&order='  . $_GET['order']  : '')
+                               . ((x($_GET,'bmark'))  ? '&bmark='  . $_GET['bmark']  : '')
+                               . ((x($_GET,'liked'))  ? '&liked='  . $_GET['liked']  : '')
+                               . ((x($_GET,'conv'))   ? '&conv='   . $_GET['conv']   : '')
+                               . ((x($_GET,'spam'))   ? '&spam='   . $_GET['spam']   : '')
+                               . ((x($_GET,'nets'))   ? '&nets='   . $_GET['nets']   : '')
+                               . ((x($_GET,'cmin'))   ? '&cmin='   . $_GET['cmin']   : '')
+                               . ((x($_GET,'cmax'))   ? '&cmax='   . $_GET['cmax']   : '')
+                               . ((x($_GET,'file'))   ? '&file='   . $_GET['file']   : '')
 
                                . "'; var profile_page = " . $a->pager['page'] . "; </script>\r\n";
                }
@@ -431,7 +431,7 @@ function conversation(&$a, $items, $mode, $update, $preview = false) {
                                // because browser prefetching might change it on us. We have to deliver it with the page.
 
                                $live_update_div = '<div id="live-profile"></div>' . "\r\n"
-                                       . "<script> var profile_uid = " . $a->profile['profile_uid'] 
+                                       . "<script> var profile_uid = " . $a->profile['profile_uid']
                                        . "; var netargs = '?f='; var profile_page = " . $a->pager['page'] . "; </script>\r\n";
                        }
                }
@@ -441,7 +441,7 @@ function conversation(&$a, $items, $mode, $update, $preview = false) {
                $page_writeable = true;
                if(!$update) {
                        $live_update_div = '<div id="live-notes"></div>' . "\r\n"
-                               . "<script> var profile_uid = " . local_user() 
+                               . "<script> var profile_uid = " . local_user()
                                . "; var netargs = '/?f='; var profile_page = " . $a->pager['page'] . "; </script>\r\n";
                }
        }

diff --git a/include/diaspora.php b/include/diaspora.php
index 3145c52ea3fbb62242c2254aa1728aa547db5077..61a0dfc3cf91d2c804aed06191c8c3b11700b28e 100644 (file)
--- a/include/diaspora.php
+++ b/include/diaspora.php
@@ -110,6 +110,9 @@ function diaspora_dispatch($importer,$msg,$attempt=1) {
        elseif($xmlbase->message) {
                $ret = diaspora_message($importer,$xmlbase->message,$msg);
        }
+       elseif($xmlbase->participation) {
+               $ret = diaspora_participation($importer,$xmlbase->participation);
+       }
        else {
                logger('diaspora_dispatch: unknown message type: ' . print_r($xmlbase,true));
        }
@@ -1834,7 +1837,7 @@ function diaspora_message($importer,$xml,$msg) {
 
        $author_signature = base64_decode($msg_author_signature);
 
-       $person = find_diaspora_person_by_handle($msg_diaspora_handle); 
+       $person = find_diaspora_person_by_handle($msg_diaspora_handle);
        if(is_array($person) && x($person,'pubkey'))
                $key = $person['pubkey'];
        else {
@@ -1881,6 +1884,9 @@ function diaspora_message($importer,$xml,$msg) {
        return;
 }
 
+function diaspora_participation($importer,$xml) {
+       logger("Unsupported message type 'participation' ".print_r($xml, true));
+}
 
 function diaspora_photo($importer,$xml,$msg,$attempt=1) {
 

diff --git a/include/items.php b/include/items.php
index 0d442e317031d2a750f52973ad388447a6e20962..8691ccca495f38f023608d86c15616fb3eac02e8 100644 (file)
--- a/include/items.php
+++ b/include/items.php
@@ -1287,11 +1287,24 @@ function item_store($arr,$force_parent = false, $notify = false, $dontcache = fa
        }
 
        if ($arr['network'] == "") {
-               $r = q("SELECT `network` FROM `contact` WHERE `id` = %d AND `uid` = %d LIMIT 1",
-                       intval($arr['contact-id']),
+               $r = q("SELECT `network` FROM `contact` WHERE `network` IN ('%s', '%s', '%s') AND `nurl` = '%s' AND `uid` = %d LIMIT 1",
+                       dbesc(NETWORK_DFRN), dbesc(NETWORK_DIASPORA), dbesc(NETWORK_OSTATUS),
+                       dbesc(normalise_link($arr['author-link'])),
                        intval($arr['uid'])
                );
 
+               if(!count($r))
+                       $r = q("SELECT `network` FROM `gcontact` WHERE `network` IN ('%s', '%s', '%s') AND `nurl` = '%s' LIMIT 1",
+                               dbesc(NETWORK_DFRN), dbesc(NETWORK_DIASPORA), dbesc(NETWORK_OSTATUS),
+                               dbesc(normalise_link($arr['author-link']))
+                       );
+
+               if(!count($r))
+                       $r = q("SELECT `network` FROM `contact` WHERE `id` = %d AND `uid` = %d LIMIT 1",
+                               intval($arr['contact-id']),
+                               intval($arr['uid'])
+                       );
+
                if(count($r))
                        $arr['network'] = $r[0]["network"];
 

diff --git a/mod/allfriends.php b/mod/allfriends.php
index 1a45775fb2908fb715d87c2c162864231f6d0249..784dfb87711d6053386034d3482e2388dbc06e3e 100644 (file)
--- a/mod/allfriends.php
+++ b/mod/allfriends.php
@@ -21,7 +21,7 @@ function allfriends_content(&$a) {
        );
 
        $vcard_widget .= replace_macros(get_markup_template("vcard-widget.tpl"),array(
-               '$name'  => $c[0]['name'],
+               '$name'  => htmlentities($c[0]['name']),
                '$photo' => $c[0]['photo'],
                'url'    => z_root() . '/contacts/' . $cid
        ));
@@ -34,7 +34,7 @@ function allfriends_content(&$a) {
                return;
 
        $o .= replace_macros(get_markup_template("section_title.tpl"),array(
-               '$title' => sprintf( t('Friends of %s'), $c[0]['name'])
+               '$title' => sprintf( t('Friends of %s'), htmlentities($c[0]['name']))
        ));
 
 
@@ -48,10 +48,10 @@ function allfriends_content(&$a) {
        $tpl = get_markup_template('common_friends.tpl');
 
        foreach($r as $rr) {
-                       
+
                $o .= replace_macros($tpl,array(
                        '$url' => $rr['url'],
-                       '$name' => $rr['name'],
+                       '$name' => htmlentities($rr['name']),
                        '$photo' => $rr['photo'],
                        '$tags' => ''
                ));

diff --git a/mod/common.php b/mod/common.php
index 3118d124790938116b8fb4dc4ffce06d5b55e8c0..1e65137ac693c74dcc125b1e9af213a70bcb2ac3 100644 (file)
--- a/mod/common.php
+++ b/mod/common.php
@@ -16,7 +16,7 @@ function common_content(&$a) {
        if(! $uid)
                return;
 
-       if($cmd === 'loc' && $cid) {    
+       if($cmd === 'loc' && $cid) {
                $c = q("select name, url, photo from contact where id = %d and uid = %d limit 1",
                        intval($cid),
                        intval($uid)
@@ -26,10 +26,10 @@ function common_content(&$a) {
                $c = q("select name, url, photo from contact where self = 1 and uid = %d limit 1",
                        intval($uid)
                );
-       }       
+       }
 
        $vcard_widget .= replace_macros(get_markup_template("vcard-widget.tpl"),array(
-               '$name' => $c[0]['name'],
+               '$name' => htmlentities($c[0]['name']),
                '$photo' => $c[0]['photo'],
                'url' => z_root() . '/contacts/' . $cid
        ));
@@ -97,10 +97,10 @@ function common_content(&$a) {
        $tpl = get_markup_template('common_friends.tpl');
 
        foreach($r as $rr) {
-                       
+
                $o .= replace_macros($tpl,array(
                        '$url' => $rr['url'],
-                       '$name' => $rr['name'],
+                       '$name' => htmlentities($rr['name']),
                        '$photo' => $rr['photo'],
                        '$tags' => ''
                ));

diff --git a/mod/contacts.php b/mod/contacts.php
index 25b22658f2f15a87a2fb2589093b73f878f9f81c..ee62bf3c9e77cf6966101cbe6274c644786901d4 100644 (file)
--- a/mod/contacts.php
+++ b/mod/contacts.php
@@ -33,7 +33,7 @@ function contacts_init(&$a) {
        if($contact_id) {
                        $a->data['contact'] = $r[0];
                        $vcard_widget = replace_macros(get_markup_template("vcard-widget.tpl"),array(
-                               '$name' => $a->data['contact']['name'],
+                               '$name' => htmlentities($a->data['contact']['name']),
                                '$photo' => $a->data['contact']['photo'],
                                '$url' => ($a->data['contact']['network'] == NETWORK_DFRN) ? $a->get_baseurl()."/redir/".$a->data['contact']['id'] : $a->data['contact']['url']
                        ));
@@ -432,7 +432,7 @@ function contacts_content(&$a) {
                                }
 
                                $a->page['aside'] = '';
-                               
+
                                return replace_macros(get_markup_template('contact_drop_confirm.tpl'), array(
                                        '$contact' =>  _contact_detail_for_template($orig_record[0]),
                                        '$method' => 'get',
@@ -509,7 +509,7 @@ function contacts_content(&$a) {
                if(!in_array($contact['network'], array(NETWORK_DFRN, NETWORK_OSTATUS, NETWORK_DIASPORA)))
                                $relation_text = "";
 
-               $relation_text = sprintf($relation_text,$contact['name']);
+               $relation_text = sprintf($relation_text,htmlentities($contact['name']));
 
                if(($contact['network'] === NETWORK_DFRN) && ($contact['rel'])) {
                        $url = "redir/{$contact['id']}";
@@ -632,7 +632,7 @@ function contacts_content(&$a) {
                        '$ffi_keyword_blacklist' => $contact['ffi_keyword_blacklist'],
                        '$ffi_keyword_blacklist' => array('ffi_keyword_blacklist', t('Blacklisted keywords'), $contact['ffi_keyword_blacklist'], t('Comma separated list of keywords that should not be converted to hashtags, when "Fetch information and keywords" is selected')),
                        '$photo' => $contact['photo'],
-                       '$name' => $contact['name'],
+                       '$name' => htmlentities($contact['name']),
                        '$dir_icon' => $dir_icon,
                        '$alt_text' => $alt_text,
                        '$sparkle' => $sparkle,
@@ -842,8 +842,8 @@ function _contact_detail_for_template($rr){
                'alt_text' => $alt_text,
                'dir_icon' => $dir_icon,
                'thumb' => proxy_url($rr['thumb'], false, PROXY_SIZE_THUMB),
-               'name' => $rr['name'],
-               'username' => $rr['name'],
+               'name' => htmlentities($rr['name']),
+               'username' => htmlentities($rr['name']),
                'sparkle' => $sparkle,
                'itemurl' => $rr['url'],
                'url' => $url,

diff --git a/mod/crepair.php b/mod/crepair.php
index 457a06685db35df037ebfd41c2796b961caf0195..686be3948f26ac2ffcbe55fdc9859dd54e47bff7 100644 (file)
--- a/mod/crepair.php
+++ b/mod/crepair.php
@@ -24,7 +24,7 @@ function crepair_init(&$a) {
                        $a->data['contact'] = $r[0];
                         $tpl = get_markup_template("vcard-widget.tpl");
                         $vcard_widget .= replace_macros($tpl, array(
-                                '$name' => $a->data['contact']['name'],
+                                '$name' => htmlentities($a->data['contact']['name']),
                                 '$photo' => $a->data['contact']['photo']
                         ));
                        $a->page['aside'] .= $vcard_widget;
@@ -179,8 +179,8 @@ function crepair_content(&$a) {
                '$label_remote_self' => t('Remote Self'),
                '$allow_remote_self' => $allow_remote_self,
                '$remote_self' => array('remote_self', t('Mirror postings from this contact'), $contact['remote_self'], t('Mark this contact as remote_self, this will cause friendica to repost new entries from this contact.'), $remote_self_options),
-               '$contact_name' => $contact['name'],
-               '$contact_nick' => $contact['nick'],
+               '$contact_name' => htmlentities($contact['name']),
+               '$contact_nick' => htmlentities($contact['nick']),
                '$contact_id'   => $contact['id'],
                '$contact_url'  => $contact['url'],
                '$request'      => $contact['request'],

diff --git a/mod/network.php b/mod/network.php
index a92e0c691b497ccdef8b88062407ee985c5d9620..3d14455cdf634c8ba3c96da1429a3b31f1114705 100644 (file)
--- a/mod/network.php
+++ b/mod/network.php
@@ -568,14 +568,14 @@ function network_content(&$a, $update = 0) {
                        intval($cid)
                );
                if(count($r)) {
-                       $sql_post_table = " INNER JOIN (SELECT DISTINCT(`parent`) FROM `item` 
-                                           WHERE 1 $sql_options AND `contact-id` = ".intval($cid)." and deleted = 0 
-                                           ORDER BY `item`.`received` DESC) AS `temp1` 
+                       $sql_post_table = " INNER JOIN (SELECT DISTINCT(`parent`) FROM `item`
+                                           WHERE 1 $sql_options AND `contact-id` = ".intval($cid)." and deleted = 0
+                                           ORDER BY `item`.`received` DESC) AS `temp1`
                                            ON $sql_table.$sql_parent = `temp1`.`parent` ";
                        $sql_extra = "";
 
                        $o = replace_macros(get_markup_template("section_title.tpl"),array(
-                               '$title' => sprintf( t('Contact: %s'), $r[0]['name'])
+                               '$title' => sprintf( t('Contact: %s'), htmlentities($r[0]['name']))
                        )) . $o;
 
                        if($r[0]['network'] === NETWORK_OSTATUS && $r[0]['writable'] && (! get_pconfig(local_user(),'system','nowarn_insecure'))) {

diff --git a/mod/viewcontacts.php b/mod/viewcontacts.php
index 19bf0415c7f86b5daece0b5696250452ee24f8d1..a6bf74b2885df20042a8de26186029a12db00917 100644 (file)
--- a/mod/viewcontacts.php
+++ b/mod/viewcontacts.php
@@ -63,8 +63,8 @@ function viewcontacts_content(&$a) {
                        'id' => $rr['id'],
                        'img_hover' => sprintf( t('Visit %s\'s profile [%s]'), $rr['name'], $rr['url']),
                        'thumb' => proxy_url($rr['thumb'], false, PROXY_SIZE_THUMB),
-                       'name' => substr($rr['name'],0,20),
-                       'username' => $rr['name'],
+                       'name' => htmlentities(substr($rr['name'],0,20)),
+                       'username' => htmlentities($rr['name']),
                        'url' => $url,
                        'sparkle' => '',
                        'itemurl' => $rr['url'],

diff --git a/object/Item.php b/object/Item.php
index 0dc4f41985a3f82cbfc71b2ea7f57598c4752453..cc6d08ec2b4e3e7e23d91fdd51b35e9e2d28389b 100644 (file)
--- a/object/Item.php
+++ b/object/Item.php
@@ -134,7 +134,7 @@ class Item extends BaseObject {
                $filer = (($conv->get_profile_owner() == local_user()) ? t("save to folder") : false);
 
                $diff_author    = ((link_compare($item['url'],$item['author-link'])) ? false : true);
-               $profile_name   = (((strlen($item['author-name']))   && $diff_author) ? $item['author-name']   : $item['name']);
+               $profile_name   = htmlentities(((strlen($item['author-name']))   && $diff_author) ? $item['author-name']   : $item['name']);
                if($item['author-link'] && (! $item['author-name']))
                        $profile_name = $item['author-link'];
 

diff --git a/view/theme/vier/theme.php b/view/theme/vier/theme.php
index ff06b6303059b13ecb10e27ced3141e9fb90cb7f..e1a75b9512b380a80c18b242ca586780dede0f5f 100644 (file)
--- a/view/theme/vier/theme.php
+++ b/view/theme/vier/theme.php
@@ -84,7 +84,8 @@ function cmtBbClose(id) {
 EOT;
 
        // Hide the left menu bar
-       if (($a->page['aside'] == "") AND in_array($a->argv[0], array("community", "events", "help", "manage", "notifications", "probe", "webfinger", "login")))
+       if (($a->page['aside'] == "") AND in_array($a->argv[0], array("community", "events", "help", "manage", "notifications",
+                                                                       "probe", "webfinger", "login", "invite")))
                $a->page['htmlhead'] .= "<link rel='stylesheet' href='view/theme/vier/hide.css' />";
 }