]> git.mxchange.org Git - quix0rs-gnu-social.git/blob - lib/profileaction.php
XSS vulnerability when remote-subscribing
[quix0rs-gnu-social.git] / lib / profileaction.php
1 <?php
2 /**
3  * StatusNet, the distributed open-source microblogging tool
4  *
5  * Common parent of Personal and Profile actions
6  *
7  * PHP version 5
8  *
9  * LICENCE: This program is free software: you can redistribute it and/or modify
10  * it under the terms of the GNU Affero General Public License as published by
11  * the Free Software Foundation, either version 3 of the License, or
12  * (at your option) any later version.
13  *
14  * This program is distributed in the hope that it will be useful,
15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17  * GNU Affero General Public License for more details.
18  *
19  * You should have received a copy of the GNU Affero General Public License
20  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
21  *
22  * @category  Personal
23  * @package   StatusNet
24  * @author    Evan Prodromou <evan@status.net>
25  * @author    Sarven Capadisli <csarven@status.net>
26  * @copyright 2008-2011 StatusNet, Inc.
27  * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
28  * @link      http://status.net/
29  */
30
31 if (!defined('GNUSOCIAL')) { exit(1); }
32
33 /**
34  * Profile action common superclass
35  *
36  * Abstracts out common code from profile and personal tabs
37  *
38  * @category Personal
39  * @package  StatusNet
40  * @author   Evan Prodromou <evan@status.net>
41  * @license  http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
42  * @link     http://status.net/
43  */
44 abstract class ProfileAction extends ManagedAction
45 {
46     var $page    = null;
47     var $tag     = null;
48
49     protected $target  = null;    // Profile that we're showing
50
51     protected function doPreparation()
52     {
53         // showstream requires a nickname
54         $nickname_arg = $this->trimmed('nickname');
55         $nickname     = common_canonical_nickname($nickname_arg);
56
57         // Permanent redirect on non-canonical nickname
58         if ($nickname_arg != $nickname) {
59             $args = array('nickname' => $nickname);
60             if ($this->arg('page') && $this->arg('page') != 1) {
61                 $args['page'] = $this->arg['page'];
62             }
63             common_redirect(common_local_url($this->getActionName(), $args), 301);
64         }
65
66         try {
67             $user = User::getByNickname($nickname);
68         } catch (NoSuchUserException $e) {
69             $group = Local_group::getKV('nickname', $nickname);
70             if ($group instanceof Local_group) {
71                 common_redirect($group->getProfile()->getUrl());
72             }
73
74             // No user nor group found, throw the NoSuchUserException again
75             throw $e;
76         }
77
78         $this->target = $user->getProfile();
79     }
80
81     protected function prepare(array $args=array())
82     {
83         // this will call ->doPreparation() which child classes use to set $this->target
84         parent::prepare($args);
85
86         if ($this->target->hasRole(Profile_role::SILENCED)
87                 && (!$this->scoped instanceof Profile || !$this->scoped->hasRight(Right::SILENCEUSER))) {
88             throw new ClientException(_('This profile has been silenced by site moderators'), 403);
89         }
90
91         $this->tag = $this->trimmed('tag');
92         $this->page = ($this->arg('page')) ? ($this->arg('page')+0) : 1;
93         common_set_returnto($this->selfUrl());
94
95         return true;
96     }
97
98     public function getTarget()
99     {
100         if (!$this->target instanceof Profile) {
101             throw new ServerException('No target profile in ProfileAction class');
102         }
103         return $this->target;
104     }
105
106     function isReadOnly($args)
107     {
108         return true;
109     }
110
111     function showSections()
112     {
113         $this->showSubscriptions();
114         $this->showSubscribers();
115         $this->showGroups();
116         $this->showLists();
117         $this->showStatistics();
118     }
119
120     /**
121      * Convenience function for common pattern of links to subscription/groups sections.
122      *
123      * @param string $actionClass
124      * @param string $title
125      * @param string $cssClass
126      */
127     private function statsSectionLink($actionClass, $title, $cssClass='')
128     {
129         $this->element('a', array('href' => common_local_url($actionClass,
130                                                              array('nickname' => $this->target->getNickname())),
131                                   'class' => $cssClass),
132                        $title);
133     }
134
135     function showSubscriptions()
136     {
137         $this->elementStart('div', array('id' => 'entity_subscriptions',
138                                          'class' => 'section'));
139         if (Event::handle('StartShowSubscriptionsMiniList', array($this))) {
140             $this->elementStart('h2');
141             // TRANS: H2 text for user subscription statistics.
142             $this->statsSectionLink('subscriptions', _('Following'));
143             $this->text(' ');
144             $this->text($this->target->subscriptionCount());
145             $this->elementEnd('h2');
146         
147             try {
148                 $profile = $this->target->getSubscribed(0, PROFILES_PER_MINILIST + 1);
149                 $pml = new ProfileMiniList($profile, $this);
150                 $pml->show();
151             } catch (NoResultException $e) {
152                 // TRANS: Text for user subscription statistics if the user has no subscription
153                 $this->element('p', null, _('(None)'));
154             }
155
156             Event::handle('EndShowSubscriptionsMiniList', array($this));
157         }
158         $this->elementEnd('div');
159     }
160
161     function showSubscribers()
162     {
163         $this->elementStart('div', array('id' => 'entity_subscribers',
164                                          'class' => 'section'));
165
166         if (Event::handle('StartShowSubscribersMiniList', array($this))) {
167
168             $this->elementStart('h2');
169             // TRANS: H2 text for user subscriber statistics.
170             $this->statsSectionLink('subscribers', _('Followers'));
171             $this->text(' ');
172             $this->text($this->target->subscriberCount());
173             $this->elementEnd('h2');
174
175             try {
176                 $profile = $this->target->getSubscribers(0, PROFILES_PER_MINILIST + 1);
177                 $sml = new SubscribersMiniList($profile, $this);
178                 $sml->show();
179             } catch (NoResultException $e) {
180                 // TRANS: Text for user subscriber statistics if user has no subscribers.
181                 $this->element('p', null, _('(None)'));
182             }
183
184             Event::handle('EndShowSubscribersMiniList', array($this));
185         }
186
187         $this->elementEnd('div');
188     }
189
190     function showStatistics()
191     {
192         $notice_count = $this->target->noticeCount();
193         $age_days     = (time() - strtotime($this->target->created)) / 86400;
194         if ($age_days < 1) {
195             // Rather than extrapolating out to a bajillion...
196             $age_days = 1;
197         }
198         $daily_count = round($notice_count / $age_days);
199
200         $this->elementStart('div', array('id' => 'entity_statistics',
201                                          'class' => 'section'));
202
203         // TRANS: H2 text for user statistics.
204         $this->element('h2', null, _('Statistics'));
205
206         $profile = $this->target;
207         $actionParams = array('nickname' => $profile->nickname);
208         $stats = array(
209             array(
210                 'id' => 'user-id',
211                 // TRANS: Label for user statistics.
212                 'label' => _('User ID'),
213                 'value' => $profile->id,
214             ),
215             array(
216                 'id' => 'member-since',
217                 // TRANS: Label for user statistics.
218                 'label' => _('Member since'),
219                 'value' => date('j M Y', strtotime($profile->created))
220             ),
221             array(
222                 'id' => 'notices',
223                 // TRANS: Label for user statistics.
224                 'label' => _('Notices'),
225                 'value' => $notice_count,
226             ),
227             array(
228                 'id' => 'daily_notices',
229                 // TRANS: Label for user statistics.
230                 // TRANS: Average count of posts made per day since account registration.
231                 'label' => _('Daily average'),
232                 'value' => $daily_count
233             )
234         );
235
236         // Give plugins a chance to add stats entries
237         Event::handle('ProfileStats', array($profile, &$stats));
238
239         foreach ($stats as $row) {
240             $this->showStatsRow($row);
241         }
242         $this->elementEnd('div');
243     }
244
245     private function showStatsRow($row)
246     {
247         $this->elementStart('dl', 'entity_' . $row['id']);
248         $this->elementStart('dt');
249         if (!empty($row['link'])) {
250             $this->element('a', array('href' => $row['link']), $row['label']);
251         } else {
252             $this->text($row['label']);
253         }
254         $this->elementEnd('dt');
255         $this->element('dd', null, $row['value']);
256         $this->elementEnd('dl');
257     }
258
259     function showGroups()
260     {
261         $groups = $this->target->getGroups(0, GROUPS_PER_MINILIST + 1);
262
263         $this->elementStart('div', array('id' => 'entity_groups',
264                                          'class' => 'section'));
265         if (Event::handle('StartShowGroupsMiniList', array($this))) {
266             $this->elementStart('h2');
267             // TRANS: H2 text for user group membership statistics.
268             $this->statsSectionLink('usergroups', _('Groups'));
269             $this->text(' ');
270             $this->text($this->target->getGroupCount());
271             $this->elementEnd('h2');
272
273             if ($groups instanceof User_group) {
274                 $gml = new GroupMiniList($groups, $this->target, $this);
275                 $cnt = $gml->show();
276             } else {
277                 // TRANS: Text for user user group membership statistics if user is not a member of any group.
278                 $this->element('p', null, _('(None)'));
279             }
280
281             Event::handle('EndShowGroupsMiniList', array($this));
282         }
283             $this->elementEnd('div');
284     }
285
286     function showLists()
287     {
288         $lists = $this->target->getLists($this->scoped);
289
290         if ($lists->N > 0) {
291             $this->elementStart('div', array('id' => 'entity_lists',
292                                              'class' => 'section'));
293
294             if (Event::handle('StartShowListsMiniList', array($this))) {
295
296                 $url = common_local_url('peopletagsbyuser',
297                                         array('nickname' => $this->target->getNickname()));
298
299                 $this->elementStart('h2');
300                 $this->element('a',
301                                array('href' => $url),
302                                // TRANS: H2 text for user list membership statistics.
303                                _('Lists'));
304                 $this->text(' ');
305                 $this->text($lists->N);
306                 $this->elementEnd('h2');
307
308                 $this->elementStart('ul');
309
310
311                 $first = true;
312
313                 while ($lists->fetch()) {
314                     if (!empty($lists->mainpage)) {
315                         $url = $lists->mainpage;
316                     } else {
317                         $url = common_local_url('showprofiletag',
318                                                 array('nickname' => $this->target->getNickname(),
319                                                       'tag'    => $lists->tag));
320                     }
321                     if (!$first) {
322                         $this->text(', ');
323                     } else {
324                         $first = false;
325                     }
326
327                     $this->element('a', array('href' => $url),
328                                    $lists->tag);
329                 }
330
331                 $this->elementEnd('ul');
332
333                 Event::handle('EndShowListsMiniList', array($this));
334             }
335             $this->elementEnd('div');
336         }
337     }
338 }
339
340 class SubscribersMiniList extends ProfileMiniList
341 {
342     function newListItem($profile)
343     {
344         return new SubscribersMiniListItem($profile, $this->action);
345     }
346 }
347
348 class SubscribersMiniListItem extends ProfileMiniListItem
349 {
350     function linkAttributes()
351     {
352         $aAttrs = parent::linkAttributes();
353         if (common_config('nofollow', 'subscribers')) {
354             $aAttrs['rel'] .= ' nofollow';
355         }
356         return $aAttrs;
357     }
358 }