]> git.mxchange.org Git - quix0rs-gnu-social.git/blob - actions/foaf.php
XSS vulnerability when remote-subscribing
[quix0rs-gnu-social.git] / actions / foaf.php
1 <?php
2 /*
3  * StatusNet - the distributed open-source microblogging tool
4  * Copyright (C) 2008, 2009, StatusNet, Inc.
5  *
6  * This program is free software: you can redistribute it and/or modify
7  * it under the terms of the GNU Affero General Public License as published by
8  * the Free Software Foundation, either version 3 of the License, or
9  * (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  * GNU Affero General Public License for more details.
15  *
16  * You should have received a copy of the GNU Affero General Public License
17  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
18  */
19
20 if (!defined('GNUSOCIAL')) { exit(1); }
21
22 define('LISTENER', 1);
23 define('LISTENEE', -1);
24 define('BOTH', 0);
25
26 // @todo XXX: Documentation missing.
27 class FoafAction extends ManagedAction
28 {
29     function isReadOnly($args)
30     {
31         return true;
32     }
33
34     protected function doPreparation()
35     {
36         $nickname_arg = $this->arg('nickname');
37
38         if (empty($nickname_arg)) {
39             // TRANS: Client error displayed when requesting Friends of a Friend feed without providing a user nickname.
40             $this->clientError(_('No such user.'), 404);
41         }
42
43         $this->nickname = common_canonical_nickname($nickname_arg);
44
45         // Permanent redirect on non-canonical nickname
46
47         if ($nickname_arg != $this->nickname) {
48             common_redirect(common_local_url('foaf',
49                                              array('nickname' => $this->nickname)),
50                             301);
51         }
52
53         $this->user = User::getKV('nickname', $this->nickname);
54
55         if (!$this->user) {
56             // TRANS: Client error displayed when requesting Friends of a Friend feed for an object that is not a user.
57             $this->clientError(_('No such user.'), 404);
58         }
59
60         $this->profile = $this->user->getProfile();
61
62         if (!$this->profile) {
63             // TRANS: Error message displayed when referring to a user without a profile.
64             $this->serverError(_('User has no profile.'), 500);
65         }
66
67         return true;
68     }
69
70     public function showPage()
71     {
72         header('Content-Type: application/rdf+xml');
73
74         $this->startXML();
75         $this->elementStart('rdf:RDF', array('xmlns:rdf' =>
76                                               'http://www.w3.org/1999/02/22-rdf-syntax-ns#',
77                                               'xmlns:rdfs' =>
78                                               'http://www.w3.org/2000/01/rdf-schema#',
79                                               'xmlns:geo' =>
80                                               'http://www.w3.org/2003/01/geo/wgs84_pos#',
81                                               'xmlns:bio' =>
82                                               'http://purl.org/vocab/bio/0.1/',
83                                               'xmlns:sioc' =>
84                                               'http://rdfs.org/sioc/ns#',
85                                               'xmlns' => 'http://xmlns.com/foaf/0.1/'));
86
87         // This is the document about the user
88
89         $this->showPpd('', $this->user->getUri());
90
91         // Would be nice to tell if they were a Person or not (e.g. a #person usertag?)
92         $this->elementStart('Agent', array('rdf:about' => $this->user->getUri()));
93         if ($this->user->email) {
94             $this->element('mbox_sha1sum', null, sha1('mailto:' . $this->user->email));
95         }
96         if ($this->profile->fullname) {
97             $this->element('name', null, $this->profile->fullname);
98         }
99         if ($this->profile->homepage) {
100             $this->element('homepage', array('rdf:resource' => $this->profile->homepage));
101         }
102         if ($this->profile->profileurl) {
103             $this->element('weblog', array('rdf:resource' => $this->profile->profileurl));
104         }
105         if ($this->profile->bio) {
106             $this->element('bio:olb', null, $this->profile->bio);
107         }
108
109         $location = $this->profile->getLocation();
110         if ($location) {
111             $attr = array();
112             if ($location->getRdfURL()) {
113                 $attr['rdf:about'] = $location->getRdfURL();
114             }
115             $location_name = $location->getName();
116
117             $this->elementStart('based_near');
118             $this->elementStart('geo:SpatialThing', $attr);
119             if ($location_name) {
120                 $this->element('name', null, $location_name);
121             }
122             if ($location->lat) {
123                 $this->element('geo:lat', null, $location->lat);
124             }
125             if ($location->lon) {
126                 $this->element('geo:long', null, $location->lon);
127             }
128             if ($location->getURL()) {
129                 $this->element('page', array('rdf:resource'=>$location->getURL()));
130             }
131             $this->elementEnd('geo:SpatialThing');
132             $this->elementEnd('based_near');
133         }
134
135         try {
136             $avatar = Avatar::getUploaded($this->profile);
137             $this->elementStart('img');
138             $this->elementStart('Image', array('rdf:about' => $avatar->displayUrl()));
139             foreach (array(AVATAR_PROFILE_SIZE, AVATAR_STREAM_SIZE, AVATAR_MINI_SIZE) as $size) {
140                 try {
141                     $scaled = $this->profile->getAvatar($size);
142                     $this->elementStart('thumbnail');
143                     $this->element('Image', array('rdf:about' => $scaled->displayUrl()));
144                     $this->elementEnd('thumbnail');
145                 } catch (Exception $e) {
146                     // This avatar did not exist
147                 }
148             }
149             $this->elementEnd('Image');
150             $this->elementEnd('img');
151         } catch (NoAvatarException $e) {
152             // No avatar for this user!
153         }
154
155         $person = $this->showMicrobloggingAccount($this->profile,
156                                      common_root_url(), $this->user->getUri(),
157                                      /*$fetchSubscriptions*/true,
158                                      /*$isSubscriber*/false);
159
160         // Get people who subscribe to user
161
162         $sub = new Subscription();
163         $sub->subscribed = $this->profile->id;
164         $sub->whereAdd('subscriber != subscribed');
165
166         if ($sub->find()) {
167             while ($sub->fetch()) {
168                 $profile = Profile::getKV('id', $sub->subscriber);
169                 if (!$profile instanceof Profile) {
170                     common_debug('Got a bad subscription: '.print_r($sub,true));
171                     continue;
172                 }
173                 $other_uri = $profile->getUri();
174                 if (array_key_exists($other_uri, $person)) {
175                     $person[$other_uri][0] = BOTH;
176                 } else {
177                     $person[$other_uri] = array(LISTENER,
178                                                 $profile->id,
179                                                 $profile->nickname,
180                                                 $profile->isLocal() ? 'local' : 'remote');
181                 }
182                 unset($profile);
183             }
184         }
185
186         unset($sub);
187
188         foreach ($person as $uri => $p) {
189             list($type, $id, $nickname, $local) = $p;
190             if ($type == BOTH) {
191                 $this->element('knows', array('rdf:resource' => $uri));
192             }
193         }
194
195         $this->elementEnd('Agent');
196
197
198         foreach ($person as $uri => $p) {
199             $foaf_url = null;
200             list($type, $id, $nickname, $local) = $p;
201             if ($local == 'local') {
202                 $foaf_url = common_local_url('foaf', array('nickname' => $nickname));
203             }
204             $profile = Profile::getKV($id);
205             $this->elementStart('Agent', array('rdf:about' => $uri));
206             if ($type == BOTH) {
207                 $this->element('knows', array('rdf:resource' => $this->user->getUri()));
208             }
209             $this->showMicrobloggingAccount($profile,
210                                    ($local == 'local') ? common_root_url() : null,
211                                    $uri,
212                                    /*$fetchSubscriptions*/false,
213                                    /*$isSubscriber*/($type == LISTENER || $type == BOTH));
214             if ($foaf_url) {
215                 $this->element('rdfs:seeAlso', array('rdf:resource' => $foaf_url));
216             }
217             $this->elementEnd('Agent');
218             if ($foaf_url) {
219                 $this->showPpd($foaf_url, $uri);
220             }
221             $profile->free();
222             $profile = null;
223             unset($profile);
224         }
225
226         $this->elementEnd('rdf:RDF');
227         $this->endXML();
228     }
229
230     function showPpd($foaf_url, $person_uri)
231     {
232         $this->elementStart('PersonalProfileDocument', array('rdf:about' => $foaf_url));
233         $this->element('maker', array('rdf:resource' => $person_uri));
234         $this->element('primaryTopic', array('rdf:resource' => $person_uri));
235         $this->elementEnd('PersonalProfileDocument');
236     }
237
238     /**
239      * Output FOAF <account> bit for the given profile.
240      *
241      * @param Profile $profile
242      * @param mixed $service Root URL of this StatusNet instance for a local
243      *                       user, otherwise null.
244      * @param mixed $useruri URI string for the referenced profile..
245      * @param boolean $fetchSubscriptions Should we load and list all their subscriptions?
246      * @param boolean $isSubscriber if not fetching subs, we can still mark the user as following the current page.
247      *
248      * @return array if $fetchSubscribers is set, return a list of info on those
249      *               subscriptions.
250      */
251     function showMicrobloggingAccount($profile, $service=null, $useruri=null, $fetchSubscriptions=false, $isSubscriber=false)
252     {
253         $attr = array();
254         if ($useruri) {
255             $attr['rdf:about'] = $useruri . '#acct';
256         }
257
258         // Their account
259         $this->elementStart('account');
260         $this->elementStart('OnlineAccount', $attr);
261         if ($service) {
262             $this->element('accountServiceHomepage', array('rdf:resource' =>
263                                                            $service));
264         }
265         $this->element('accountName', null, $profile->nickname);
266         $this->element('accountProfilePage', array('rdf:resource' => $profile->profileurl));
267         if ($useruri) {
268             $this->element('sioc:account_of', array('rdf:resource'=>$useruri));
269         }
270
271         $person = array();
272
273         if ($fetchSubscriptions) {
274             // Get people user is subscribed to
275             $sub = new Subscription();
276             $sub->subscriber = $profile->id;
277             $sub->whereAdd('subscriber != subscribed');
278
279             if ($sub->find()) {
280                 while ($sub->fetch()) {
281                     $profile = Profile::getKV('id', $sub->subscribed);
282                     if (empty($profile)) {
283                         common_debug('Got a bad subscription: '.print_r($sub,true));
284                         continue;
285                     }
286                     $other_uri = $profile->getUri();
287                     $this->element('sioc:follows', array('rdf:resource' => $other_uri.'#acct'));
288                     $person[$other_uri] = array(LISTENEE,
289                                                 $profile->id,
290                                                 $profile->nickname,
291                                                 $profile->isLocal() ? 'local' : 'remote');
292                     unset($profile);
293                 }
294             }
295
296             unset($sub);
297         } else if ($isSubscriber) {
298             // Just declare that they follow the user whose FOAF we're showing.
299             $this->element('sioc:follows', array('rdf:resource' => $this->user->getUri() . '#acct'));
300         }
301
302         $this->elementEnd('OnlineAccount');
303         $this->elementEnd('account');
304
305         return $person;
306     }
307 }