Commit a12cd84b authored by Zot's avatar Zot Committed by Mario

santise discovery inputs


(cherry picked from commit 776b8586)
parent dec18d28
...@@ -584,18 +584,18 @@ function diaspora_discover(&$b) { ...@@ -584,18 +584,18 @@ function diaspora_discover(&$b) {
if(array_key_exists('rel',$link)) { if(array_key_exists('rel',$link)) {
if($link['rel'] === NAMESPACE_DFRN) if($link['rel'] === NAMESPACE_DFRN)
$dfrn = $link['href']; $dfrn = escape_tags($link['href']);
if($link['rel'] === 'http://joindiaspora.com/seed_location') { if($link['rel'] === 'http://joindiaspora.com/seed_location') {
$diaspora_base = $link['href']; $diaspora_base = escape_tags($link['href']);
$diaspora = true; $diaspora = true;
} }
if($link['rel'] === 'http://joindiaspora.com/guid') { if($link['rel'] === 'http://joindiaspora.com/guid') {
$diaspora_guid = $link['href']; $diaspora_guid = escape_tags($link['href']);
$diaspora = true; $diaspora = true;
} }
if($link['rel'] === 'diaspora-public-key') { if($link['rel'] === 'diaspora-public-key') {
$diaspora_key = base64_decode($link['href']); $diaspora_key = escape_tags(base64_decode($link['href']));
if(strstr($diaspora_key,'RSA ')) if(strstr($diaspora_key,'RSA '))
$pubkey = rsatopem($diaspora_key); $pubkey = rsatopem($diaspora_key);
else else
...@@ -603,9 +603,9 @@ function diaspora_discover(&$b) { ...@@ -603,9 +603,9 @@ function diaspora_discover(&$b) {
$diaspora = true; $diaspora = true;
} }
if($link['rel'] === 'http://microformats.org/profile/hcard') if($link['rel'] === 'http://microformats.org/profile/hcard')
$hcard = $link['href']; $hcard = escape_tags($link['href']);
if($link['rel'] === 'http://webfinger.net/rel/profile-page') if($link['rel'] === 'http://webfinger.net/rel/profile-page')
$profile = $link['href']; $profile = escape_tags($link['href']);
} }
} }
} }
...@@ -623,22 +623,22 @@ function diaspora_discover(&$b) { ...@@ -623,22 +623,22 @@ function diaspora_discover(&$b) {
foreach($x as $link) { foreach($x as $link) {
if(is_array($link)) { if(is_array($link)) {
if($link['@attributes']['rel'] === NAMESPACE_DFRN) if($link['@attributes']['rel'] === NAMESPACE_DFRN)
$dfrn = unamp($link['@attributes']['href']); $dfrn = escape_tags(unamp($link['@attributes']['href']));
if($link['@attributes']['rel'] === 'http://microformats.org/profile/hcard') if($link['@attributes']['rel'] === 'http://microformats.org/profile/hcard')
$hcard = unamp($link['@attributes']['href']); $hcard = escape_tags(unamp($link['@attributes']['href']));
if($link['@attributes']['rel'] === 'http://webfinger.net/rel/profile-page') if($link['@attributes']['rel'] === 'http://webfinger.net/rel/profile-page')
$profile = unamp($link['@attributes']['href']); $profile = escape_tags(unamp($link['@attributes']['href']));
if($link['@attributes']['rel'] === 'http://joindiaspora.com/seed_location') { if($link['@attributes']['rel'] === 'http://joindiaspora.com/seed_location') {
$diaspora_base = unamp($link['@attributes']['href']); $diaspora_base = escape_tags(unamp($link['@attributes']['href']));
$diaspora = true; $diaspora = true;
} }
if($link['@attributes']['rel'] === 'http://joindiaspora.com/guid') { if($link['@attributes']['rel'] === 'http://joindiaspora.com/guid') {
$diaspora_guid = unamp($link['@attributes']['href']); $diaspora_guid = escape_tags(unamp($link['@attributes']['href']));
$diaspora = true; $diaspora = true;
} }
if($link['@attributes']['rel'] === 'diaspora-public-key') { if($link['@attributes']['rel'] === 'diaspora-public-key') {
$diaspora_key = base64_decode(unamp($link['@attributes']['href'])); $diaspora_key = escape_tags(base64_decode(unamp($link['@attributes']['href'])));
if(strstr($diaspora_key,'RSA ')) if(strstr($diaspora_key,'RSA '))
$pubkey = rsatopem($diaspora_key); $pubkey = rsatopem($diaspora_key);
else else
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment