]> git.mxchange.org Git - quix0rs-gnu-social.git/blob - plugins/Directory/lib/sortablegrouplist.php
XSS vulnerability when remote-subscribing
[quix0rs-gnu-social.git] / plugins / Directory / lib / sortablegrouplist.php
1 <?php
2 /**
3  * StatusNet, the distributed open-source microblogging tool
4  *
5  * Widget to show a sortable list of profiles
6  *
7  * PHP version 5
8  *
9  * LICENCE: This program is free software: you can redistribute it and/or modify
10  * it under the terms of the GNU Affero General Public License as published by
11  * the Free Software Foundation, either version 3 of the License, or
12  * (at your option) any later version.
13  *
14  * This program is distributed in the hope that it will be useful,
15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17  * GNU Affero General Public License for more details.
18  *
19  * You should have received a copy of the GNU Affero General Public License
20  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
21  *
22  * @category  Public
23  * @package   StatusNet
24  * @author    Zach Copley <zach@status.net>
25  * @copyright 2011 StatusNet, Inc.
26  * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
27  * @link      http://status.net/
28  */
29
30 if (!defined('GNUSOCIAL')) { exit(1); }
31
32 /**
33  * Widget to show a sortable list of subscriptions
34  *
35  * @category Public
36  * @package  StatusNet
37  * @author   Zach Copley <zach@status.net>
38  * @license  http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
39  * @link     http://status.net/
40  */
41 class SortableGroupList extends SortableSubscriptionList
42 {
43     function startList()
44     {
45         $this->out->elementStart('table', array('class' => 'profile_list xoxo'));
46         $this->out->elementStart('thead');
47         $this->out->elementStart('tr');
48
49         $tableHeaders = array(
50             // TRANS: Column header in table for user nickname.
51             'nickname'    => _m('Nickname'),
52             // TRANS: Column header in table for timestamp when user was created.
53             'created'     => _m('Created')
54         );
55
56         foreach ($tableHeaders as $id => $label) {
57             $attrs   = array('id' => $id);
58             $current = (!empty($this->action->sort) && $this->action->sort == $id);
59
60             if ($current || empty($this->action->sort) && $id == 'nickname') {
61                 $attrs['class'] = 'current';
62             }
63
64             if ($current && $this->action->reverse) {
65                 $attrs['class'] .= ' reverse';
66                 $attrs['class'] = trim($attrs['class']);
67             }
68
69             $this->out->elementStart('th', $attrs);
70
71             $linkAttrs = array();
72             $params    = array('sort' => $id);
73
74             if (!empty($this->action->q)) {
75                 $params['q'] = $this->action->q;
76             }
77
78             if ($current && !$this->action->reverse) {
79                 $params['reverse'] = 'true';
80             }
81
82             $args = array();
83
84             $filter = $this->action->arg('filter');
85
86             if (!empty($filter)) {
87                 $args['filter'] = $filter;
88             }
89
90             $linkAttrs['href'] = common_local_url(
91                 $this->action->arg('action'), $args, $params
92             );
93
94             $this->out->element('a', $linkAttrs, $label);
95             $this->out->elementEnd('th');
96         }
97
98         // TRANS: Column header in table for members of a group.
99         $this->out->element('th', array('id' => 'Members'), _m('Members'));
100         $this->out->element('th', array('id' => 'controls'), null);
101
102         $this->out->elementEnd('tr');
103         $this->out->elementEnd('thead');
104
105         $this->out->elementStart('tbody');
106     }
107
108     function newListItem($profile)
109     {
110         return new SortableGroupListItem($profile, $this->owner, $this->action);
111     }
112 }
113
114 class SortableGroupListItem extends SortableSubscriptionListItem
115 {
116     function showHomepage()
117     {
118         if (!empty($this->profile->homepage)) {
119             $this->out->text(' ');
120             $aAttrs = $this->homepageAttributes();
121             $this->out->elementStart('a', $aAttrs);
122             $this->out->raw($this->highlight($this->profile->homepage));
123             $this->out->elementEnd('a');
124         }
125     }
126
127     function showDescription()
128     {
129         if (!empty($this->profile->description)) {
130             $cutoff      = 140; // XXX Should this be configurable?
131             $description = htmlspecialchars($this->profile->description);
132
133             if (mb_strlen($description) > $cutoff) {
134                 $description = mb_substr($description, 0, $cutoff - 1)
135                     .'<a href="' . $this->profile->homeUrl() .'">…</a>';
136             }
137
138             $this->out->elementStart('p', 'note');
139             $this->out->raw($description);
140             $this->out->elementEnd('p');
141         }
142
143     }
144
145     // TODO: Make sure we can do ->getAvatar() for group profiles too!
146     function showAvatar(Profile $profile, $size=null)
147     {
148         $logo = $profile->getGroup()->stream_logo ?: User_group::defaultLogo($size ?: $this->avatarSize());
149
150         $this->out->element('img', array('src'    => $logo,
151                                          'class'  => 'avatar u-photo',
152                                          'width'  => AVATAR_STREAM_SIZE,
153                                          'height' => AVATAR_STREAM_SIZE,
154                                          'alt'    => $profile->getBestName()));
155     }
156
157     function show()
158     {
159         if (Event::handle('StartProfileListItem', array($this))) {
160             $this->startItem();
161             if (Event::handle('StartProfileListItemProfile', array($this))) {
162                 $this->showProfile();
163                 Event::handle('EndProfileListItemProfile', array($this));
164             }
165
166             // XXX Add events?
167             $this->showCreatedDate();
168             $this->showMemberCount();
169
170             if (Event::handle('StartProfileListItemActions', array($this))) {
171                 $this->showActions();
172                 Event::handle('EndProfileListItemActions', array($this));
173             }
174             $this->endItem();
175
176             Event::handle('EndProfileListItem', array($this));
177         }
178     }
179
180     function showProfile()
181     {
182         $this->startProfile();
183
184         $this->showAvatar($this->profile->getProfile());
185         $this->out->element('a', array('href'  => $this->profile->homeUrl(),
186                                             'class' => 'p-org p-nickname',
187                                             'rel'   => 'contact group'),
188                                  $this->profile->getNickname());
189
190         $this->showFullName();
191         $this->showLocation();
192         $this->showHomepage();
193         $this->showDescription(); // groups have this instead of bios
194         // Relevant portion!
195         $this->showTags();
196         $this->endProfile();
197     }
198
199     function endActions()
200     {
201         // delete button
202         $cur = common_current_user();
203         list($action, $r2args) = $this->out->returnToArgs();
204         $r2args['action'] = $action;
205         if ($cur instanceof User && $cur->hasRight(Right::DELETEGROUP)) {
206             $this->out->elementStart('li', 'entity_delete');
207             $df = new DeleteGroupForm($this->out, $this->profile, $r2args);
208             $df->show();
209             $this->out->elementEnd('li');
210         }
211
212         $this->out->elementEnd('ul');
213         $this->out->elementEnd('td');
214     }
215
216     function showActions()
217     {
218         $this->startActions();
219         if (Event::handle('StartProfileListItemActionElements', array($this))) {
220             $this->showJoinButton();
221             Event::handle('EndProfileListItemActionElements', array($this));
222         }
223         $this->endActions();
224     }
225
226     function showJoinButton()
227     {
228         $user = $this->owner;
229         if ($user) {
230
231             $this->out->elementStart('li', 'entity_subscribe');
232             // XXX: special-case for user looking at own
233             // subscriptions page
234             if ($user->isMember($this->profile)) {
235                 $lf = new LeaveForm($this->out, $this->profile);
236                 $lf->show();
237             } else if (!Group_block::isBlocked($this->profile, $user->getProfile())) {
238                 $jf = new JoinForm($this->out, $this->profile);
239                 $jf->show();
240             }
241
242             $this->out->elementEnd('li');
243         }
244     }
245
246     function showMemberCount()
247     {
248         $this->out->elementStart('td', 'entry_member_count');
249         $this->out->raw($this->profile->getMemberCount());
250         $this->out->elementEnd('td');
251     }
252
253     function showCreatedDate()
254     {
255         $this->out->elementStart('td', 'entry_created');
256         // @todo FIXME: Should we provide i18n for timestamps in core?
257         $this->out->raw(date('j M Y', strtotime($this->profile->created)));
258         $this->out->elementEnd('td');
259     }
260
261     function showAdmins()
262     {
263         $this->out->elementStart('td', 'entry_admins');
264         // @todo
265         $this->out->raw('gargargar');
266         $this->out->elementEnd('td');
267     }
268
269     /**
270      * Only show the tags if we're logged in
271      */
272     function showTags()
273     {
274          if (common_logged_in()) {
275             parent::showTags();
276         }
277
278     }
279 }