Merge branch '0.9.x' into twitstream

7 files changed, 616 insertions, 82 deletions

diff --git a/actions/apioauthaccesstoken.php b/actions/apioauthaccesstoken.php
index 887df4c20..663a7a2bb 100644
--- a/actions/apioauthaccesstoken.php
+++ b/actions/apioauthaccesstoken.php
@@ -2,7 +2,8 @@
 /**
  * StatusNet, the distributed open-source microblogging tool
  *
- * Exchange an authorized OAuth request token for an access token
+ * Action for getting OAuth token credentials (exchange an authorized
+ * request token for an access token)
  *
  * PHP version 5
  *
@@ -34,7 +35,8 @@ if (!defined('STATUSNET')) {
 require_once INSTALLDIR . '/lib/apioauth.php';
 
 /**
- * Exchange an authorized OAuth request token for an access token
+ * Action for getting OAuth token credentials (exchange an authorized
+ * request token for an access token)
  *
  * @category API
  * @package  StatusNet
@@ -45,6 +47,8 @@ require_once INSTALLDIR . '/lib/apioauth.php';
 
 class ApiOauthAccessTokenAction extends ApiOauthAction
 {
+    protected $reqToken = null;
+    protected $verifier = null;
 
     /**
      * Class handler.
@@ -65,30 +69,58 @@ class ApiOauthAccessTokenAction extends ApiOauthAction
 
         $atok = null;
 
+        // XXX: Insist that oauth_token and oauth_verifier be populated?
+        // Spec doesn't say they MUST be.
+
         try {
+
             $req  = OAuthRequest::from_request();
+
+            $this->reqToken = $req->get_parameter('oauth_token');
+            $this->verifier = $req->get_parameter('oauth_verifier');
+
             $atok = $server->fetch_access_token($req);
 
         } catch (OAuthException $e) {
             common_log(LOG_WARNING, 'API OAuthException - ' . $e->getMessage());
             common_debug(var_export($req, true));
-            $this->outputError($e->getMessage());
-            return;
+            $code = $e->getCode();
+            $this->clientError($e->getMessage(), empty($code) ? 401 : $code, 'text');
         }
 
         if (empty($atok)) {
-            common_debug('couldn\'t get access token.');
-            print "Token exchange failed. Has the request token been authorized?\n";
+
+            // Token exchange failed -- log it
+
+            list($proxy, $ip) = common_client_ip();
+
+            $msg = sprintf(
+                'API OAuth - Failure exchanging request token for access token, '
+                    . 'request token = %s, verifier = %s, IP = %s, proxy = %s',
+                $this->reqToken,
+                $this->verifier,
+                $ip,
+                $proxy
+            );
+
+            common_log(LOG_WARNING, $msg);
+
+            $this->clientError(_("Invalid request token or verifier.", 400, 'text'));
+
         } else {
-            print $atok;
+            $this->showAccessToken($atok);
         }
     }
 
-    function outputError($msg)
+    /*
+     * Display OAuth token credentials
+     *
+     * @param OAuthToken token the access token
+     */
+
+    function showAccessToken($token)
     {
-        header('HTTP/1.1 401 Unauthorized');
-        header('Content-Type: text/html; charset=utf-8');
-        print $msg . "\n";
+        header('Content-Type: application/x-www-form-urlencoded');
+        print $token;
     }
 }
-
diff --git a/actions/apioauthauthorize.php b/actions/apioauthauthorize.php
index c2fbbcdd8..ea5c30c2a 100644
--- a/actions/apioauthauthorize.php
+++ b/actions/apioauthauthorize.php
@@ -32,6 +32,7 @@ if (!defined('STATUSNET')) {
 }
 
 require_once INSTALLDIR . '/lib/apioauth.php';
+require_once INSTALLDIR . '/lib/info.php';
 
 /**
  * Authorize an OAuth request token
@@ -43,9 +44,10 @@ require_once INSTALLDIR . '/lib/apioauth.php';
  * @link     http://status.net/
  */
 
-class ApiOauthAuthorizeAction extends ApiOauthAction
+class ApiOauthAuthorizeAction extends Action
 {
-    var $oauth_token;
+    var $oauthTokenParam;
+    var $reqToken;
     var $callback;
     var $app;
     var $nickname;
@@ -67,12 +69,17 @@ class ApiOauthAuthorizeAction extends ApiOauthAction
     {
         parent::prepare($args);
 
-        $this->nickname    = $this->trimmed('nickname');
-        $this->password    = $this->arg('password');
-        $this->oauth_token = $this->arg('oauth_token');
-        $this->callback    = $this->arg('oauth_callback');
-        $this->store       = new ApiStatusNetOAuthDataStore();
-        $this->app         = $this->store->getAppByRequestToken($this->oauth_token);
+        $this->nickname         = $this->trimmed('nickname');
+        $this->password         = $this->arg('password');
+        $this->oauthTokenParam  = $this->arg('oauth_token');
+        $this->callback         = $this->arg('oauth_callback');
+        $this->store            = new ApiStatusNetOAuthDataStore();
+
+        try {
+            $this->app = $this->store->getAppByRequestToken($this->oauthTokenParam);
+        } catch (Exception $e) {
+            $this->clientError($e->getMessage());
+        }
 
         return true;
     }
@@ -97,14 +104,30 @@ class ApiOauthAuthorizeAction extends ApiOauthAction
 
         } else {
 
-            if (empty($this->oauth_token)) {
+            // Make sure a oauth_token parameter was provided
+            if (empty($this->oauthTokenParam)) {
                 $this->clientError(_('No oauth_token parameter provided.'));
-                return;
+            } else {
+
+                // Check to make sure the token exists
+                $this->reqToken = $this->store->getTokenByKey($this->oauthTokenParam);
+
+                if (empty($this->reqToken)) {
+                    $this->serverError(
+                        _('Invalid request token.')
+                    );
+                } else {
+
+                    // Check to make sure we haven't already authorized the token
+                    if ($this->reqToken->state != 0) {
+                        $this->clientError("Invalid request token.");
+                    }
+                }
             }
 
+            // make sure there's an app associated with this token
             if (empty($this->app)) {
-                $this->clientError(_('Invalid token.'));
-                return;
+                $this->clientError(_('Invalid request token.'));
             }
 
             $name = $this->app->name;
@@ -120,8 +143,8 @@ class ApiOauthAuthorizeAction extends ApiOauthAction
         $token = $this->trimmed('token');
 
         if (!$token || $token != common_session_token()) {
-            $this->showForm(_('There was a problem with your session token. '.
-                              'Try again, please.'));
+            $this->showForm(
+                _('There was a problem with your session token. Try again, please.'));
             return;
         }
 
@@ -130,6 +153,11 @@ class ApiOauthAuthorizeAction extends ApiOauthAction
         $user = null;
 
         if (!common_logged_in()) {
+
+            // XXX Force credentials check?
+
+            // XXX OpenID
+
             $user = common_check_user($this->nickname, $this->password);
             if (empty($user)) {
                 $this->showForm(_("Invalid nickname / password!"));
@@ -141,9 +169,15 @@ class ApiOauthAuthorizeAction extends ApiOauthAction
 
         if ($this->arg('allow')) {
 
-            // mark the req token as authorized
+            // fetch the token
+            $this->reqToken = $this->store->getTokenByKey($this->oauthTokenParam);
 
-            $this->store->authorize_token($this->oauth_token);
+            // mark the req token as authorized
+            try {
+                $this->store->authorize_token($this->oauthTokenParam);
+            } catch (Exception $e) {
+                $this->serverError($e->getMessage());
+            }
 
             // Check to see if there was a previous token associated
             // with this user/app and kill it. If the user is doing this she
@@ -156,8 +190,7 @@ class ApiOauthAuthorizeAction extends ApiOauthAction
 
                 if (!$result) {
                     common_log_db_error($appUser, 'DELETE', __FILE__);
-                    throw new ServerException(_('Database error deleting OAuth application user.'));
-                    return;
+                    $this->serverError(_('Database error deleting OAuth application user.'));
                 }
             }
 
@@ -175,20 +208,19 @@ class ApiOauthAuthorizeAction extends ApiOauthAction
             // granted.  The OAuth app user record then gets updated
             // with the new access token and access type.
 
-            $appUser->token          = $this->oauth_token;
+            $appUser->token          = $this->oauthTokenParam;
             $appUser->created        = common_sql_now();
 
             $result = $appUser->insert();
 
             if (!$result) {
                 common_log_db_error($appUser, 'INSERT', __FILE__);
-                throw new ServerException(_('Database error inserting OAuth application user.'));
-                return;
+                $this->serverError(_('Database error inserting OAuth application user.'));
             }
 
-            // if we have a callback redirect and provide the token
+            // If we have a callback redirect and provide the token
 
-            // A callback specified in the app setup overrides whatever
+            // Note: A callback specified in the app setup overrides whatever
             // is passed in with the request.
 
             if (!empty($this->app->callback_url)) {
@@ -197,40 +229,40 @@ class ApiOauthAuthorizeAction extends ApiOauthAction
 
             if (!empty($this->callback)) {
 
-                $target_url = $this->getCallback($this->callback,
-                                                 array('oauth_token' => $this->oauth_token));
+                $targetUrl = $this->getCallback(
+                    $this->callback,
+                    array(
+                        'oauth_token'    => $this->oauthTokenParam,
+                        'oauth_verifier' => $this->reqToken->verifier // 1.0a
+                    )
+                );
+
+                // Redirect the user to the provided OAuth callback
+                common_redirect($targetUrl, 303);
 
-                common_redirect($target_url, 303);
             } else {
-                common_debug("callback was empty!");
+                common_log(
+                    LOG_INFO,
+                    "No oauth_callback parameter provided for application ID "
+                    . $this->app->id
+                    . " when authorizing request token."
+                );
             }
 
-            // otherwise inform the user that the rt was authorized
-
-            $this->elementStart('p');
-
-            // XXX: Do OAuth 1.0a verifier code
-
-            $this->raw(sprintf(_("The request token %s has been authorized. " .
-                                 'Please exchange it for an access token.'),
-                               $this->oauth_token));
-
-            $this->elementEnd('p');
-
-        } else if ($this->arg('deny')) {
-
-            $datastore = new ApiStatusNetOAuthDataStore();
-            $datastore->revoke_token($this->oauth_token, 0);
+            // Otherwise, inform the user that the rt was authorized
+            $this->showAuthorized();
 
-            $this->elementStart('p');
+        } else if ($this->arg('cancel')) {
 
-            $this->raw(sprintf(_("The request token %s has been denied and revoked."),
-                               $this->oauth_token));
+            try {
+                $this->store->revoke_token($this->oauthTokenParam, 0);
+                $this->showCanceled();
+            } catch (Exception $e) {
+                $this->ServerError($e->getMessage());
+            }
 
-            $this->elementEnd('p');
         } else {
             $this->clientError(_('Unexpected form submission.'));
-            return;
         }
     }
 
@@ -276,7 +308,7 @@ class ApiOauthAuthorizeAction extends ApiOauthAction
                                  _('Allow or deny access'));
 
         $this->hidden('token', common_session_token());
-        $this->hidden('oauth_token', $this->oauth_token);
+        $this->hidden('oauth_token', $this->oauthTokenParam);
         $this->hidden('oauth_callback', $this->callback);
 
         $this->elementStart('ul', 'form_data');
@@ -321,11 +353,11 @@ class ApiOauthAuthorizeAction extends ApiOauthAction
 
         }
 
-        $this->element('input', array('id' => 'deny_submit',
+        $this->element('input', array('id' => 'cancel_submit',
                                       'class' => 'submit submit form_action-primary',
-                                      'name' => 'deny',
+                                      'name' => 'cancel',
                                       'type' => 'submit',
-                                      'value' => _('Deny')));
+                                      'value' => _('Cancel')));
 
         $this->element('input', array('id' => 'allow_submit',
                                       'class' => 'submit submit form_action-secondary',
@@ -348,7 +380,7 @@ class ApiOauthAuthorizeAction extends ApiOauthAction
 
     function getInstructions()
     {
-        return _('Allow or deny access to your account information.');
+        return _('Authorize access to your account information.');
     }
 
     /**
@@ -388,4 +420,107 @@ class ApiOauthAuthorizeAction extends ApiOauthAction
         // NOP
     }
 
+    /*
+     * Show a nice message confirming the authorization
+     * operation was canceled.
+     *
+     * @return nothing
+     */
+
+    function showCanceled()
+    {
+        $info = new InfoAction(
+            _('Authorization canceled.'),
+            sprintf(
+                _('The request token %s has been revoked.'),
+                $this->oauthTokenParm
+            )
+        );
+
+        $info->showPage();
+    }
+
+    /*
+     * Show a nice message that the authorization was successful.
+     * If the operation is out-of-band, show a pin.
+     *
+     * @return nothing
+     */
+
+    function showAuthorized()
+    {
+        $title = sprintf(
+            _("You have successfully authorized %s."),
+            $this->app->name
+        );
+
+        $msg = sprintf(
+            _('Please return to %s and enter the following security code to complete the process.'),
+            $this->app->name
+        );
+
+        if ($this->reqToken->verified_callback == 'oob') {
+            $pin = new ApiOauthPinAction($title, $msg, $this->reqToken->verifier);
+            $pin->showPage();
+        } else {
+
+            // NOTE: This would only happen if an application registered as
+            // a web application but sent in 'oob' for the oauth_callback
+            // parameter. Usually web apps will send in a callback and
+            // not use the pin-based workflow.
+
+            $info = new InfoAction(
+                $title,
+                $msg,
+                $this->oauthTokenParam,
+                $this->reqToken->verifier
+            );
+
+            $info->showPage();
+        }
+    }
+
+    /*
+     * Properly format the callback URL and parameters so it's
+     * suitable for a redirect in the OAuth dance
+     *
+     * @param string $url       the URL
+     * @param array  $params    an array of parameters
+     *
+     * @return string $url  a URL to use for redirecting to
+     */
+
+    function getCallback($url, $params)
+    {
+        foreach ($params as $k => $v) {
+            $url = $this->appendQueryVar(
+                $url,
+                OAuthUtil::urlencode_rfc3986($k),
+                OAuthUtil::urlencode_rfc3986($v)
+            );
+        }
+
+        return $url;
+    }
+
+    /*
+     * Append a new query parameter after any existing query
+     * parameters.
+     *
+     * @param string $url   the URL
+     * @prarm string $k     the parameter name
+     * @param string $v     value of the paramter
+     *
+     * @return string $url  the new URL with added parameter
+     */
+
+    function appendQueryVar($url, $k, $v) {
+        $url = preg_replace('/(.*)(\?|&)' . $k . '=[^&]+?(&)(.*)/i', '$1$2$4', $url . '&');
+        $url = substr($url, 0, -1);
+        if (strpos($url, '?') === false) {
+            return ($url . '?' . $k . '=' . $v);
+        } else {
+            return ($url . '&' . $k . '=' . $v);
+        }
+    }
 }
diff --git a/actions/apioauthpin.php b/actions/apioauthpin.php
new file mode 100644
index 000000000..5e6713a54
--- /dev/null
+++ b/actions/apioauthpin.php
@@ -0,0 +1,67 @@
+<?php
+/**
+ * StatusNet, the distributed open-source microblogging tool
+ *
+ * Action for displaying an OAuth verifier pin
+ *
+ * PHP version 5
+ *
+ * LICENCE: This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * @category  Action
+ * @package   StatusNet
+ * @author    Zach Copley <zach@status.net>
+ * @copyright 2010 StatusNet, Inc.
+ * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
+ * @link      http://status.net/
+ */
+
+if (!defined('STATUSNET') && !defined('LACONICA')) {
+    exit(1);
+}
+
+require_once INSTALLDIR . '/lib/info.php';
+
+/**
+ * Class for displaying an OAuth verifier pin
+ *
+ * XXX: I'm pretty sure we don't need to check the logged in state here. -- Zach
+ *
+ * @category Action
+ * @package  StatusNet
+ * @author   Zach Copley <zach@status.net>
+ * @license  http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
+ * @link     http://status.net/
+ */
+
+class ApiOauthPinAction extends InfoAction
+{
+    function __construct($title, $message, $verifier)
+    {
+        $this->verifier = $verifier;
+        $this->title    = $title;
+        parent::__construct($title, $message);
+    }
+
+    /**
+     * Display content.
+     *
+     * @return nothing
+     */
+    function showContent()
+    {
+        $this->element('div', array('class' => 'info'), $this->message);
+        $this->element('div', array('id' => 'oauth_pin'), $this->verifier);
+    }
+}
diff --git a/actions/apioauthrequesttoken.php b/actions/apioauthrequesttoken.php
index 4fa626d86..478d2dbfc 100644
--- a/actions/apioauthrequesttoken.php
+++ b/actions/apioauthrequesttoken.php
@@ -2,7 +2,7 @@
 /**
  * StatusNet, the distributed open-source microblogging tool
  *
- * Get an OAuth request token
+ * Issue temporary OAuth credentials (a request token)
  *
  * PHP version 5
  *
@@ -34,7 +34,7 @@ if (!defined('STATUSNET')) {
 require_once INSTALLDIR . '/lib/apioauth.php';
 
 /**
- * Get an OAuth request token
+ * Issue temporary OAuth credentials (a request token)
  *
  * @category API
  * @package  StatusNet
@@ -58,22 +58,23 @@ class ApiOauthRequestTokenAction extends ApiOauthAction
     {
         parent::prepare($args);
 
-        $this->callback  = $this->arg('oauth_callback');
-
-        if (!empty($this->callback)) {
-            common_debug("callback: $this->callback");
-        }
+        // XXX: support "force_login" parameter like Twitter? (Forces the user to enter
+        // their credentials to ensure the correct users account is authorized.)
 
         return true;
     }
 
     /**
-     * Class handler.
+     * Handle a request for temporary OAuth credentials
+     *
+     * Make sure the request is kosher, then emit a set of temporary
+     * credentials -- AKA an unauthorized request token.
      *
      * @param array $args array of arguments
      *
      * @return void
      */
+
     function handle($args)
     {
         parent::handle($args);
@@ -85,14 +86,78 @@ class ApiOauthRequestTokenAction extends ApiOauthAction
         $server->add_signature_method($hmac_method);
 
         try {
-            $req   = OAuthRequest::from_request();
+
+            $req = OAuthRequest::from_request();
+
+            // verify callback
+            if (!$this->verifyCallback($req->get_parameter('oauth_callback'))) {
+                throw new OAuthException(
+                    "You must provide a valid URL or 'oob' in oauth_callback.",
+                    400
+                );
+            }
+
+            // check signature and issue a new request token
             $token = $server->fetch_request_token($req);
-            print $token;
+
+            common_log(
+                LOG_INFO,
+                sprintf(
+                    "API OAuth - Issued request token %s for consumer %s with oauth_callback %s",
+                    $token->key,
+                    $req->get_parameter('oauth_consumer_key'),
+                    "'" . $req->get_parameter('oauth_callback') ."'"
+                )
+            );
+
+            // return token to the client
+            $this->showRequestToken($token);
+
         } catch (OAuthException $e) {
             common_log(LOG_WARNING, 'API OAuthException - ' . $e->getMessage());
-            header('HTTP/1.1 401 Unauthorized');
-            header('Content-Type: text/html; charset=utf-8');
-            print $e->getMessage() . "\n";
+
+            // Return 401 for for bad credentials or signature problems,
+            // and 400 for missing or unsupported parameters
+
+            $code = $e->getCode();
+            $this->clientError($e->getMessage(), empty($code) ? 401 : $code, 'text');
+        }
+    }
+
+    /*
+     * Display temporary OAuth credentials
+     */
+
+    function showRequestToken($token)
+    {
+        header('Content-Type: application/x-www-form-urlencoded');
+        print $token;
+        print '&oauth_callback_confirmed=true';
+    }
+
+    /* Make sure the callback parameter contains either a real URL
+     * or the string 'oob'.
+     *
+     * @todo Check for evil/banned URLs here
+     *
+     * @return boolean true or false
+     */
+
+    function verifyCallback($callback)
+    {
+        if ($callback == "oob") {
+            common_debug("OAuth request token requested for out of bounds client.");
+
+            // XXX: Should we throw an error if a client is registered as a
+            // web application but requests the pin based workflow? For now I'm
+            // allowing the workflow to proceed and issuing a pin. --Zach
+
+            return true;
+        } else {
+            return Validate::uri(
+                $callback,
+                array('allowed_schemes' => array('http', 'https'))
+            );
         }
     }
 
diff --git a/actions/deletegroup.php b/actions/deletegroup.php
new file mode 100644
index 000000000..acb309e1d
--- /dev/null
+++ b/actions/deletegroup.php
@@ -0,0 +1,226 @@
+<?php
+/**
+ * StatusNet, the distributed open-source microblogging tool
+ *
+ * Delete a group
+ *
+ * PHP version 5
+ *
+ * LICENCE: This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * @category  Group
+ * @package   StatusNet
+ * @author    Evan Prodromou <evan@status.net>
+ * @author    Brion Vibber <brion@status.net>
+ * @copyright 2008-2010 StatusNet, Inc.
+ * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
+ * @link      http://status.net/
+ */
+
+if (!defined('STATUSNET') && !defined('LACONICA')) {
+    exit(1);
+}
+
+/**
+ * Delete a group
+ *
+ * This is the action for deleting a group.
+ *
+ * @category Group
+ * @package  StatusNet
+ * @author   Evan Prodromou <evan@status.net>
+ * @author   Brion Vibber <brion@status.net>
+ * @license  http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
+ * @link     http://status.net/
+ * @fixme merge more of this code with related variants
+ */
+
+class DeletegroupAction extends RedirectingAction
+{
+    var $group = null;
+
+    /**
+     * Prepare to run
+     *
+     * @fixme merge common setup code with other group actions
+     * @fixme allow group admins to delete their own groups
+     */
+
+    function prepare($args)
+    {
+        parent::prepare($args);
+
+        if (!common_logged_in()) {
+            $this->clientError(_('You must be logged in to delete a group.'));
+            return false;
+        }
+
+        $nickname_arg = $this->trimmed('nickname');
+        $id = intval($this->arg('id'));
+        if ($id) {
+            $this->group = User_group::staticGet('id', $id);
+        } else if ($nickname_arg) {
+            $nickname = common_canonical_nickname($nickname_arg);
+
+            // Permanent redirect on non-canonical nickname
+
+            if ($nickname_arg != $nickname) {
+                $args = array('nickname' => $nickname);
+                common_redirect(common_local_url('leavegroup', $args), 301);
+                return false;
+            }
+
+            $local = Local_group::staticGet('nickname', $nickname);
+
+            if (!$local) {
+                $this->clientError(_('No such group.'), 404);
+                return false;
+            }
+
+            $this->group = User_group::staticGet('id', $local->group_id);
+        } else {
+            $this->clientError(_('No nickname or ID.'), 404);
+            return false;
+        }
+
+        if (!$this->group) {
+            $this->clientError(_('No such group.'), 404);
+            return false;
+        }
+
+        $cur = common_current_user();
+        if (!$cur->hasRight(Right::DELETEGROUP)) {
+            $this->clientError(_('You are not allowed to delete this group.'), 403);
+            return false;
+        }
+
+        return true;
+    }
+
+    /**
+     * Handle the request
+     *
+     * On POST, delete the group.
+     *
+     * @param array $args unused
+     *
+     * @return void
+     */
+
+    function handle($args)
+    {
+        parent::handle($args);
+        if ($_SERVER['REQUEST_METHOD'] == 'POST') {
+            if ($this->arg('no')) {
+                $this->returnToPrevious();
+                return;
+            } elseif ($this->arg('yes')) {
+                $this->handlePost();
+                return;
+            }
+        }
+        $this->showPage();
+    }
+
+    function handlePost()
+    {
+        $cur = common_current_user();
+
+        try {
+            if (Event::handle('StartDeleteGroup', array($this->group))) {
+                $this->group->delete();
+                Event::handle('EndDeleteGroup', array($this->group));
+            }
+        } catch (Exception $e) {
+            $this->serverError(sprintf(_('Could not delete group %2$s.'),
+                                       $this->group->nickname));
+        }
+
+        if ($this->boolean('ajax')) {
+            $this->startHTML('text/xml;charset=utf-8');
+            $this->elementStart('head');
+            $this->element('title', null, sprintf(_('Deleted group %2$s'),
+                                                  $this->group->nickname));
+            $this->elementEnd('head');
+            $this->elementStart('body');
+            // @fixme add a sensible AJAX response form!
+            $this->elementEnd('body');
+            $this->elementEnd('html');
+        } else {
+            // @fixme if we could direct to the page on which this group
+            // would have shown... that would be awesome
+            common_redirect(common_local_url('groups'),
+                            303);
+        }
+    }
+
+    function title() {
+        return _('Delete group');
+    }
+
+    function showContent() {
+        $this->areYouSureForm();
+    }
+
+    /**
+     * Confirm with user.
+     * Ripped from DeleteuserAction
+     *
+     * Shows a confirmation form.
+     *
+     * @fixme refactor common code for things like this
+     * @return void
+     */
+    function areYouSureForm()
+    {
+        $id = $this->group->id;
+        $this->elementStart('form', array('id' => 'deletegroup-' . $id,
+                                           'method' => 'post',
+                                           'class' => 'form_settings form_entity_block',
+                                           'action' => common_local_url('deletegroup', array('id' => $this->group->id))));
+        $this->elementStart('fieldset');
+        $this->hidden('token', common_session_token());
+        $this->element('legend', _('Delete group'));
+        if (Event::handle('StartDeleteGroupForm', array($this, $this->group))) {
+            $this->element('p', null,
+                           _('Are you sure you want to delete this group? '.
+                             'This will clear all data about the group from the '.
+                             'database, without a backup. ' .
+                             'Public posts to this group will still appear in ' .
+                             'individual timelines.'));
+            foreach ($this->args as $k => $v) {
+                if (substr($k, 0, 9) == 'returnto-') {
+                    $this->hidden($k, $v);
+                }
+            }
+            Event::handle('EndDeleteGroupForm', array($this, $this->group));
+        }
+        $this->submit('form_action-no',
+                      // TRANS: Button label on the delete group form.
+                      _m('BUTTON','No'),
+                      'submit form_action-primary',
+                      'no',
+                      // TRANS: Submit button title for 'No' when deleting a group.
+                      _('Do not delete this group'));
+        $this->submit('form_action-yes',
+                      // TRANS: Button label on the delete group form.
+                      _m('BUTTON','Yes'),
+                      'submit form_action-secondary',
+                      'yes',
+                      // TRANS: Submit button title for 'Yes' when deleting a group.
+                      _('Delete this group'));
+        $this->elementEnd('fieldset');
+        $this->elementEnd('form');
+    }
+}
\ No newline at end of file
diff --git a/actions/deletenotice.php b/actions/deletenotice.php
index 68c43040b..2879faa5d 100644
--- a/actions/deletenotice.php
+++ b/actions/deletenotice.php
@@ -45,6 +45,12 @@ class DeletenoticeAction extends Action
         parent::prepare($args);
 
         $this->user   = common_current_user();
+
+        if (!$this->user) {
+            common_user_error(_('Not logged in.'));
+            exit;
+        }
+
         $notice_id    = $this->trimmed('notice');
         $this->notice = Notice::staticGet($notice_id);
 
@@ -63,10 +69,7 @@ class DeletenoticeAction extends Action
     {
         parent::handle($args);
 
-        if (!common_logged_in()) {
-            common_user_error(_('Not logged in.'));
-            exit;
-        } else if ($this->notice->profile_id != $this->user_profile->id &&
+        if ($this->notice->profile_id != $this->user_profile->id &&
                    !$this->user->hasRight(Right::DELETEOTHERSNOTICE)) {
             common_user_error(_('Can\'t delete this notice.'));
             exit;
diff --git a/actions/showgroup.php b/actions/showgroup.php
index 17c37e4d7..9a12bafaf 100644
--- a/actions/showgroup.php
+++ b/actions/showgroup.php
@@ -316,6 +316,12 @@ class ShowgroupAction extends GroupDesignAction
             Event::handle('EndGroupSubscribe', array($this, $this->group));
         }
         $this->elementEnd('li');
+        if ($cur->hasRight(Right::DELETEGROUP)) {
+            $this->elementStart('li', 'entity_delete');
+            $df = new DeleteGroupForm($this, $this->group);
+            $df->show();
+            $this->elementEnd('li');
+        }
         $this->elementEnd('ul');
         $this->elementEnd('div');
     }