]> git.mxchange.org Git - quix0rs-gnu-social.git/blob - actions/apiatomservice.php
XSS vulnerability when remote-subscribing
[quix0rs-gnu-social.git] / actions / apiatomservice.php
1 <?php
2 /**
3  * StatusNet, the distributed open-source microblogging tool
4  *
5  * An AtomPub service document for a user
6  *
7  * PHP version 5
8  *
9  * LICENCE: This program is free software: you can redistribute it and/or modify
10  * it under the terms of the GNU Affero General Public License as published by
11  * the Free Software Foundation, either version 3 of the License, or
12  * (at your option) any later version.
13  *
14  * This program is distributed in the hope that it will be useful,
15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17  * GNU Affero General Public License for more details.
18  *
19  * You should have received a copy of the GNU Affero General Public License
20  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
21  *
22  * @category  API
23  * @package   StatusNet
24  * @author    Evan Prodromou <evan@status.net>
25  * @copyright 2010 StatusNet, Inc.
26  * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html AGPLv3
27  * @link      http://status.net/
28  */
29
30 if (!defined('STATUSNET')) {
31     exit(1);
32 }
33
34 /**
35  * Shows an AtomPub service document for a user
36  *
37  * @category  API
38  * @package   StatusNet
39  * @author    Evan Prodromou <evan@status.net>
40  * @copyright 2010 StatusNet, Inc.
41  * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html AGPLv3
42  * @link      http://status.net/
43  */
44 class ApiAtomServiceAction extends ApiBareAuthAction
45 {
46     /**
47      * Take arguments for running
48      *
49      * @param array $args $_REQUEST args
50      *
51      * @return boolean success flag
52      *
53      */
54     function prepare($args)
55     {
56         parent::prepare($args);
57         $this->user = $this->getTargetUser($this->arg('id'));
58
59         if (empty($this->user)) {
60             // TRANS: Client error displayed when making an Atom API request for an unknown user.
61             $this->clientError(_('No such user.'), 404);
62         }
63
64         return true;
65     }
66
67     /**
68      * Handle the arguments. In our case, show a service document.
69      *
70      * @param Array $args unused.
71      *
72      * @return void
73      */
74     function handle($args)
75     {
76         parent::handle($args);
77
78         header('Content-Type: application/atomsvc+xml');
79
80         $this->startXML();
81         $this->elementStart('service', array('xmlns' => 'http://www.w3.org/2007/app',
82                                              'xmlns:atom' => 'http://www.w3.org/2005/Atom',
83                                              'xmlns:activity' => 'http://activitystrea.ms/spec/1.0/'));
84         $this->elementStart('workspace');
85         // TRANS: Title for Atom feed.
86         $this->element('atom:title', null, _m('ATOM','Main'));
87         $this->elementStart('collection',
88                             array('href' => common_local_url('ApiTimelineUser',
89                                                              array('id' => $this->user->id,
90                                                                    'format' => 'atom'))));
91         $this->element('atom:title',
92                        null,
93                        // TRANS: Title for Atom feed. %s is a user nickname.
94                        sprintf(_("%s timeline"),
95                                $this->user->nickname));
96         $this->element('accept', null, 'application/atom+xml;type=entry');
97         $this->element('activity:verb', null, ActivityVerb::POST);
98         $this->elementEnd('collection');
99         $this->elementStart('collection',
100                             array('href' => common_local_url('AtomPubSubscriptionFeed',
101                                                              array('subscriber' => $this->user->id))));
102         $this->element('atom:title',
103                        null,
104                        // TRANS: Title for Atom feed with a user's subscriptions. %s is a user nickname.
105                        sprintf(_("%s subscriptions"),
106                                $this->user->nickname));
107         $this->element('accept', null, 'application/atom+xml;type=entry');
108         $this->element('activity:verb', null, ActivityVerb::FOLLOW);
109         $this->elementEnd('collection');
110         $this->elementStart('collection',
111                             array('href' => common_local_url('AtomPubFavoriteFeed',
112                                                              array('profile' => $this->user->id))));
113         $this->element('atom:title',
114                        null,
115                        // TRANS: Title for Atom feed with a user's favorite notices. %s is a user nickname.
116                        sprintf(_("%s favorites"),
117                                $this->user->nickname));
118         $this->element('accept', null, 'application/atom+xml;type=entry');
119         $this->element('activity:verb', null, ActivityVerb::FAVORITE);
120         $this->elementEnd('collection');
121         $this->elementStart('collection',
122                             array('href' => common_local_url('AtomPubMembershipFeed',
123                                                              array('profile' => $this->user->id))));
124         $this->element('atom:title',
125                        null,
126                        // TRANS: Title for Atom feed with a user's memberships. %s is a user nickname.
127                        sprintf(_("%s memberships"),
128                                $this->user->nickname));
129         $this->element('accept', null, 'application/atom+xml;type=entry');
130         $this->element('activity:verb', null, ActivityVerb::JOIN);
131         $this->elementEnd('collection');
132         $this->elementEnd('workspace');
133         $this->elementEnd('service');
134         $this->endXML();
135     }
136 }