1 files changed, 43 insertions, 16 deletions

diff --git a/lib/util.php b/lib/util.php
index a43666fa5..b17a44bd8 100644
--- a/lib/util.php
+++ b/lib/util.php
@@ -581,10 +581,8 @@ function common_shorten_link($url, $reverse = false)
 
 function common_xml_safe_str($str)
 {
-    $xmlStr = htmlentities(iconv('UTF-8', 'UTF-8//IGNORE', $str), ENT_NOQUOTES, 'UTF-8');
-
-    // Replace control, formatting, and surrogate characters with '*', ala Twitter
-    return preg_replace('/[\p{Cc}\p{Cf}\p{Cs}]/u', '*', $str);
+    // Neutralize control codes and surrogates
+	return preg_replace('/[\p{Cc}\p{Cs}]/u', '*', $str);
 }
 
 function common_tag_link($tag)
@@ -622,9 +620,13 @@ function common_at_link($sender_id, $nickname)
             $url = $recipient->profileurl;
         }
         $xs = new XMLStringer(false);
+        $attrs = array('href' => $url,
+                       'class' => 'url');
+        if (!empty($recipient->fullname)) {
+            $attrs['title'] = $recipient->fullname . ' (' . $recipient->nickname . ')';
+        }
         $xs->elementStart('span', 'vcard');
-        $xs->elementStart('a', array('href' => $url,
-                                     'class' => 'url'));
+        $xs->elementStart('a', $attrs);
         $xs->element('span', 'fn nickname', $nickname);
         $xs->elementEnd('a');
         $xs->elementEnd('span');
@@ -639,10 +641,14 @@ function common_group_link($sender_id, $nickname)
     $sender = Profile::staticGet($sender_id);
     $group = User_group::staticGet('nickname', common_canonical_nickname($nickname));
     if ($group && $sender->isMember($group)) {
+        $attrs = array('href' => $group->permalink(),
+                       'class' => 'url');
+        if (!empty($group->fullname)) {
+            $attrs['title'] = $group->fullname . ' (' . $group->nickname . ')';
+        }
         $xs = new XMLStringer();
         $xs->elementStart('span', 'vcard');
-        $xs->elementStart('a', array('href' => $group->permalink(),
-                                     'class' => 'url'));
+        $xs->elementStart('a', $attrs);
         $xs->element('span', 'fn nickname', $nickname);
         $xs->elementEnd('a');
         $xs->elementEnd('span');
@@ -713,25 +719,46 @@ function common_relative_profile($sender, $nickname, $dt=null)
 
 function common_local_url($action, $args=null, $params=null, $fragment=null)
 {
+    static $sensitive = array('login', 'register', 'passwordsettings',
+                              'twittersettings', 'finishopenidlogin',
+                              'finishaddopenid', 'api');
+
     $r = Router::get();
     $path = $r->build($action, $args, $params, $fragment);
 
+    $ssl = in_array($action, $sensitive);
+
     if (common_config('site','fancy')) {
-        $url = common_path(mb_substr($path, 1));
+        $url = common_path(mb_substr($path, 1), $ssl);
     } else {
         if (mb_strpos($path, '/index.php') === 0) {
-            $url = common_path(mb_substr($path, 1));
+            $url = common_path(mb_substr($path, 1), $ssl);
         } else {
-            $url = common_path('index.php'.$path);
+            $url = common_path('index.php'.$path, $ssl);
         }
     }
     return $url;
 }
 
-function common_path($relative)
+function common_path($relative, $ssl=false)
 {
     $pathpart = (common_config('site', 'path')) ? common_config('site', 'path')."/" : '';
-    return "http://".common_config('site', 'server').'/'.$pathpart.$relative;
+
+    if (($ssl && (common_config('site', 'ssl') === 'sometimes'))
+        || common_config('site', 'ssl') === 'always') {
+        $proto = 'https';
+        if (is_string(common_config('site', 'sslserver')) &&
+            mb_strlen(common_config('site', 'sslserver')) > 0) {
+            $serverpart = common_config('site', 'sslserver');
+        } else {
+            $serverpart = common_config('site', 'server');
+        }
+    } else {
+        $proto = 'http';
+        $serverpart = common_config('site', 'server');
+    }
+
+    return $proto.'://'.$serverpart.'/'.$pathpart.$relative;
 }
 
 function common_date_string($dt)
@@ -821,7 +848,7 @@ function common_redirect($url, $code=307)
                            303 => "See Other",
                            307 => "Temporary Redirect");
 
-    header("Status: ${code} $status[$code]");
+    header('HTTP/1.1 '.$code.' '.$status[$code]);
     header("Location: $url");
 
     $xo = new XMLOutputter();
@@ -923,9 +950,9 @@ function common_profile_url($nickname)
 
 // Should make up a reasonable root URL
 
-function common_root_url()
+function common_root_url($ssl=false)
 {
-    return common_path('');
+    return common_path('', $ssl);
 }
 
 // returns $bytes bytes of random data as a hexadecimal string