]> git.mxchange.org Git - quix0rs-gnu-social.git/blob - actions/foafgroup.php
XSS vulnerability when remote-subscribing
[quix0rs-gnu-social.git] / actions / foafgroup.php
1 <?php
2 /*
3  * StatusNet the distributed open-source microblogging tool
4  * Copyright (C) 2008, 2009, StatusNet, Inc.
5  *
6  * This program is free software: you can redistribute it and/or modify
7  * it under the terms of the GNU Affero General Public License as published by
8  * the Free Software Foundation, either version 3 of the License, or
9  * (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  * GNU Affero General Public License for more details.
15  *
16  * You should have received a copy of the GNU Affero General Public License
17  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
18  *
19  * @category  Mail
20  * @package   StatusNet
21  * @author    Evan Prodromou <evan@status.net>
22  * @author    Toby Inkster <mail@tobyinkster.co.uk>
23  * @copyright 2009 StatusNet, Inc.
24  * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
25  * @link      http://status.net/
26  */
27
28 if (!defined('STATUSNET') && !defined('LACONICA')) { exit(1); }
29
30 // @todo XXX: Documentation missing.
31 class FoafGroupAction extends Action
32 {
33     function isReadOnly($args)
34     {
35         return true;
36     }
37
38     function prepare($args)
39     {
40         parent::prepare($args);
41
42         $nickname_arg = $this->arg('nickname');
43
44         if (empty($nickname_arg)) {
45             // TRANS: Client error displayed when requesting Friends of a Friend feed without providing a group nickname.
46             $this->clientError(_('No such group.'), 404);
47         }
48
49         $this->nickname = common_canonical_nickname($nickname_arg);
50
51         // Permanent redirect on non-canonical nickname
52
53         if ($nickname_arg != $this->nickname) {
54             common_redirect(common_local_url('foafgroup',
55                                              array('nickname' => $this->nickname)),
56                             301);
57             return false;
58         }
59
60         $local = Local_group::getKV('nickname', $this->nickname);
61
62         if (!$local) {
63             // TRANS: Client error displayed when requesting Friends of a Friend feed for a non-local group.
64             $this->clientError(_('No such group.'), 404);
65         }
66
67         $this->group = User_group::getKV('id', $local->group_id);
68
69         if (!$this->group) {
70             // TRANS: Client error displayed when requesting Friends of a Friend feed for a nickname that is not a group.
71             $this->clientError(_('No such group.'), 404);
72         }
73
74         common_set_returnto($this->selfUrl());
75
76         return true;
77     }
78
79     function handle($args)
80     {
81         parent::handle($args);
82
83         header('Content-Type: application/rdf+xml');
84
85         $this->startXML();
86         $this->elementStart('rdf:RDF', array('xmlns:rdf' =>
87                                               'http://www.w3.org/1999/02/22-rdf-syntax-ns#',
88                                               'xmlns:dcterms' =>
89                                               'http://purl.org/dc/terms/',
90                                               'xmlns:sioc' =>
91                                               'http://rdfs.org/sioc/ns#',
92                                               'xmlns:foaf' =>
93                                               'http://xmlns.com/foaf/0.1/',
94                                               'xmlns:statusnet' =>
95                                               'http://status.net/ont/',
96                                               'xmlns' => 'http://xmlns.com/foaf/0.1/'));
97
98         $this->showPpd(common_local_url('foafgroup', array('nickname' => $this->nickname)), $this->group->permalink());
99
100         $this->elementStart('Group', array('rdf:about' =>
101                                              $this->group->permalink()));
102         if ($this->group->fullname) {
103             $this->element('name', null, $this->group->fullname);
104         }
105         if ($this->group->description) {
106             $this->element('dcterms:description', null, $this->group->description);
107         }
108         if ($this->group->nickname) {
109             $this->element('dcterms:identifier', null, $this->group->nickname);
110             $this->element('nick', null, $this->group->nickname);
111         }
112         foreach ($this->group->getAliases() as $alias) {
113             $this->element('nick', null, $alias);
114         }
115         if ($this->group->homeUrl()) {
116             $this->element('weblog', array('rdf:resource' => $this->group->homeUrl()));
117         }
118         if ($this->group->homepage) {
119             $this->element('page', array('rdf:resource' => $this->group->homepage));
120         }
121         if ($this->group->homepage_logo) {
122             $this->element('depiction', array('rdf:resource' => $this->group->homepage_logo));
123         }
124
125         $members = $this->group->getMembers();
126         $member_details = array();
127         while ($members->fetch()) {
128             $member_uri = common_local_url('userbyid', array('id'=>$members->id));
129             $member_details[$member_uri] = array(
130                                         'nickname' => $members->nickname,
131                                         'is_admin' => false,
132                                         );
133             $this->element('member', array('rdf:resource' => $member_uri));
134         }
135
136         $admins = $this->group->getAdmins();
137         while ($admins->fetch()) {
138             $admin_uri = common_local_url('userbyid', array('id'=>$admins->id));
139             $member_details[$admin_uri]['is_admin'] = true;
140             $this->element('statusnet:groupAdmin', array('rdf:resource' => $admin_uri));
141         }
142
143         $this->elementEnd('Group');
144
145         ksort($member_details);
146         foreach ($member_details as $uri => $details) {
147             if ($details['is_admin'])
148             {
149                 $this->elementStart('Agent', array('rdf:about' => $uri));
150                 $this->element('nick', null, $details['nickname']);
151                 $this->elementStart('account');
152                 $this->elementStart('sioc:User', array('rdf:about'=>$uri.'#acct'));
153                 $this->elementStart('sioc:has_function');
154                 $this->elementStart('statusnet:GroupAdminRole');
155                 $this->element('sioc:scope', array('rdf:resource' => $this->group->permalink()));
156                 $this->elementEnd('statusnet:GroupAdminRole');
157                 $this->elementEnd('sioc:has_function');
158                 $this->elementEnd('sioc:User');
159                 $this->elementEnd('account');
160                 $this->elementEnd('Agent');
161             }
162             else
163             {
164                 $this->element('Agent', array(
165                                         'foaf:nick' => $details['nickname'],
166                                         'rdf:about' => $uri,
167                                         ));
168             }
169         }
170
171         $this->elementEnd('rdf:RDF');
172         $this->endXML();
173     }
174
175     function showPpd($foaf_url, $person_uri)
176     {
177         $this->elementStart('Document', array('rdf:about' => $foaf_url));
178         $this->element('primaryTopic', array('rdf:resource' => $person_uri));
179         $this->elementEnd('Document');
180     }
181
182 }