]> git.mxchange.org Git - quix0rs-gnu-social.git/blob - lib/grouplist.php
XSS vulnerability when remote-subscribing
[quix0rs-gnu-social.git] / lib / grouplist.php
1 <?php
2
3 /**
4  * StatusNet, the distributed open-source microblogging tool
5  *
6  * Widget to show a list of groups
7  *
8  * PHP version 5
9  *
10  * LICENCE: This program is free software: you can redistribute it and/or modify
11  * it under the terms of the GNU Affero General Public License as published by
12  * the Free Software Foundation, either version 3 of the License, or
13  * (at your option) any later version.
14  *
15  * This program is distributed in the hope that it will be useful,
16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18  * GNU Affero General Public License for more details.
19  *
20  * You should have received a copy of the GNU Affero General Public License
21  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
22  *
23  * @category  Public
24  * @package   StatusNet
25  * @author    Evan Prodromou <evan@status.net>
26  * @copyright 2008-2009 StatusNet, Inc.
27  * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
28  * @link      http://status.net/
29  */
30
31 if (!defined('STATUSNET') && !defined('LACONICA')) {
32     exit(1);
33 }
34
35 require_once INSTALLDIR.'/lib/widget.php';
36
37 /**
38  * Widget to show a list of groups
39  *
40  * @category Public
41  * @package  StatusNet
42  * @author   Evan Prodromou <evan@status.net>
43  * @license  http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
44  * @link     http://status.net/
45  */
46
47 class GroupList extends Widget
48 {
49     /** Current group, group query. */
50     var $group = null;
51     /** Owner of this list */
52     var $owner = null;
53     /** Action object using us. */
54     var $action = null;
55
56     function __construct($group, $owner=null, $action=null)
57     {
58         parent::__construct($action);
59
60         $this->group = $group;
61         $this->owner = $owner;
62         $this->action = $action;
63     }
64
65     function show()
66     {
67         $this->out->elementStart('ul', 'profiles groups xoxo');
68
69         $cnt = 0;
70
71         while ($this->group->fetch()) {
72             $cnt++;
73             if($cnt > GROUPS_PER_PAGE) {
74                 break;
75             }
76             $this->showgroup();
77         }
78
79         $this->out->elementEnd('ul');
80
81         return $cnt;
82     }
83
84     function showGroup()
85     {
86         $this->out->elementStart('li', array('class' => 'profile h-card',
87                                              'id' => 'group-' . $this->group->id));
88
89         $user = common_current_user();
90
91         $this->out->elementStart('div', 'entity_profile');
92
93         $logo = $this->group->stream_logo ?: User_group::defaultLogo(AVATAR_STREAM_SIZE);
94
95         $this->out->elementStart('a', array('href' => $this->group->homeUrl(),
96                                             'class' => 'u-url p-nickname',
97                                             'rel' => 'contact group'));
98         $this->out->element('img', array('src' => $logo,
99                                          'class' => 'avatar u-photo',
100                                          'width' => AVATAR_STREAM_SIZE,
101                                          'height' => AVATAR_STREAM_SIZE,
102                                          'alt' => $this->group->getBestName()));
103         $this->out->text($this->group->getNickname());
104         $this->out->elementEnd('a');
105
106         if ($this->group->fullname) {
107             $this->out->text(' ');
108             $this->out->elementStart('span', 'p-name');
109             $this->out->raw($this->highlight($this->group->fullname));
110             $this->out->elementEnd('span');
111         }
112         if ($this->group->location) {
113             $this->out->text(' ');
114             $this->out->elementStart('span', 'label');
115             $this->out->raw($this->highlight($this->group->location));
116             $this->out->elementEnd('span');
117         }
118         if ($this->group->homepage) {
119             $this->out->text(' ');
120             $this->out->elementStart('a', array('href' => $this->group->homepage,
121                                                 'class' => 'u-url'));
122             $this->out->raw($this->highlight($this->group->homepage));
123             $this->out->elementEnd('a');
124         }
125         if ($this->group->description) {
126             $this->out->elementStart('p', 'note');
127             $this->out->raw($this->highlight($this->group->description));
128             $this->out->elementEnd('p');
129         }
130
131         // If we're on a list with an owner (subscriptions or subscribers)...
132
133         if (!empty($user) && !empty($this->owner) && $user->id == $this->owner->id) {
134             $this->showOwnerControls();
135         }
136
137         $this->out->elementEnd('div');
138
139         if ($user) {
140             $this->out->elementStart('div', 'entity_actions');
141             $this->out->elementStart('ul');
142             $this->out->elementStart('li', 'entity_subscribe');
143             // XXX: special-case for user looking at own
144             // subscriptions page
145             if ($user->isMember($this->group)) {
146                 $lf = new LeaveForm($this->out, $this->group);
147                 $lf->show();
148             } else if (!Group_block::isBlocked($this->group, $user->getProfile())) {
149                 $jf = new JoinForm($this->out, $this->group);
150                 $jf->show();
151             }
152             $this->out->elementEnd('li');
153             $this->out->elementEnd('ul');
154             $this->out->elementEnd('div');
155         }
156
157         $this->out->elementEnd('li');
158     }
159
160     /* Override this in subclasses. */
161
162     function showOwnerControls()
163     {
164         return;
165     }
166
167     function highlight($text)
168     {
169         return htmlspecialchars($text);
170     }
171 }