1 files changed, 33 insertions, 19 deletions

diff --git a/lib/activity.php b/lib/activity.php
index 2cb80f9e1..d84eabf7c 100644
--- a/lib/activity.php
+++ b/lib/activity.php
@@ -78,7 +78,7 @@ class PoCoAddress
         if (!empty($this->formatted)) {
             $xs = new XMLStringer(true);
             $xs->elementStart('poco:address');
-            $xs->element('poco:formatted', null, $this->formatted);
+            $xs->element('poco:formatted', null, common_xml_safe_str($this->formatted));
             $xs->elementEnd('poco:address');
             return $xs->getString();
         }
@@ -279,7 +279,7 @@ class PoCo
         );
 
         if (!empty($this->note)) {
-            $xs->element('poco:note', null, $this->note);
+            $xs->element('poco:note', null, common_xml_safe_str($this->note));
         }
 
         if (!empty($this->address)) {
@@ -457,13 +457,13 @@ class ActivityUtils
 
             // slavishly following http://atompub.org/rfc4287.html#rfc.section.4.1.3.3
 
-            if ($type == 'text') {
+            if (empty($type) || $type == 'text') {
                 return $contentEl->textContent;
             } else if ($type == 'html') {
                 $text = $contentEl->textContent;
                 return htmlspecialchars_decode($text, ENT_QUOTES);
             } else if ($type == 'xhtml') {
-                $divEl = ActivityUtils::child($contentEl, 'div');
+                $divEl = ActivityUtils::child($contentEl, 'div', 'http://www.w3.org/1999/xhtml');
                 if (empty($divEl)) {
                     return null;
                 }
@@ -476,7 +476,7 @@ class ActivityUtils
                     $text .= $doc->saveXML($child);
                 }
                 return trim($text);
-            } else if (in_array(array('text/xml', 'application/xml'), $type) ||
+            } else if (in_array($type, array('text/xml', 'application/xml')) ||
                        preg_match('#(+|/)xml$#', $type)) {
                 throw new ClientException(_("Can't handle embedded XML content yet."));
             } else if (strncasecmp($type, 'text/', 5)) {
@@ -681,9 +681,16 @@ class ActivityObject
         if ($this->type == self::PERSON || $this->type == self::GROUP) {
             $this->displayName = $this->title;
 
-            $avatars = ActivityUtils::getLinks($element, 'avatar');
-            foreach ($avatars as $link) {
-                $this->avatarLinks[] = new AvatarLink($link);
+            $photos = ActivityUtils::getLinks($element, 'photo');
+            if (count($photos)) {
+                foreach ($photos as $link) {
+                    $this->avatarLinks[] = new AvatarLink($link);
+                }
+            } else {
+                $avatars = ActivityUtils::getLinks($element, 'avatar');
+                foreach ($avatars as $link) {
+                    $this->avatarLinks[] = new AvatarLink($link);
+                }
             }
 
             $this->poco = new PoCo($element);
@@ -805,7 +812,6 @@ class ActivityObject
         return $object;
     }
 
-
     function asString($tag='activity:object')
     {
         $xs = new XMLStringer(true);
@@ -817,16 +823,28 @@ class ActivityObject
         $xs->element(self::ID, null, $this->id);
 
         if (!empty($this->title)) {
-            $xs->element(self::TITLE, null, $this->title);
+            $xs->element(
+                self::TITLE,
+                null,
+                common_xml_safe_str($this->title)
+            );
         }
 
         if (!empty($this->summary)) {
-            $xs->element(self::SUMMARY, null, $this->summary);
+            $xs->element(
+                self::SUMMARY,
+                null,
+                common_xml_safe_str($this->summary)
+            );
         }
 
         if (!empty($this->content)) {
             // XXX: assuming HTML content here
-            $xs->element(ActivityUtils::CONTENT, array('type' => 'html'), $this->content);
+            $xs->element(
+                ActivityUtils::CONTENT,
+                array('type' => 'html'),
+                common_xml_safe_str($this->content)
+            );
         }
 
         if (!empty($this->link)) {
@@ -1065,15 +1083,11 @@ class Activity
 
         $this->entry = $entry;
 
-        // @fixme Don't send in a DOMDocument
+        // Insist on a feed's root DOMElement; don't allow a DOMDocument
         if ($feed instanceof DOMDocument) {
-            common_log(
-                LOG_WARNING,
-                'Activity::__construct() - '
-                . 'DOMDocument passed in for feed by mistake. '
-                . "Expecting a 'feed' DOMElement."
+            throw new ClientException(
+                _("Expecting a root feed element but got a whole XML document.")
             );
-            $feed = $feed->getElementsByTagName('feed')->item(0);
         }
 
         $this->feed  = $feed;