socialfy-your-domain updated for webfinger (not tested)

socialfy-your-domain/README.txt

@@ -4,65 +4,46 @@ Initial simple way to Webfinger enable your domain -- needs PHP.
 Step 1
 ======
 
-First, put the folders 'xrd' and 'dot-well-known' on your website, so
+Put the 'dot-well-known' on your website, so it loads at:
-they load at:
 
-     http://yourname.com/xrd/
+     https://example.com/.well-known/
 
-     and
+(Remember the . at the beginning of this one, which is common practice
-
+for "hidden" files and why we have renamed it "dot-")
-     http://yourname.com/.well-known/
-
-     (Remember the . at the beginning of this one)
-
-NOTE: If you're using https, make sure each instance of http:// for
-      your own domain ("example.com") is replaced with https://
 
 Step 2
 ======
 
-Next, edit xrd/index.php and enter a secret in this line:
+Edit the .well-known/host-meta file and replace "example.com" with the
-
+domain name you're hosting the .well-known directory on.
-$s = "";
-
-This can be anything you like...
-
-$s = "johnny5";
-
-or 
-
-$s = "12345";
-
-It really doesn't matter too much.
 
+Using vim you can do this as a quick method:
+    $ vim .well-known/host-meta [ENTER]
+    :%s/example.com/domain.com/    [ENTER]
+    :wq [ENTER]
 
 Step 3
 ======
 
-Edit the .well-known/host-meta file and replace all occurrences of
-"example.com" with your domain name.
-
-Step 4
-======
-
 For each user on your site, and this might only be you...
 
-In the xrd directory, make a copy of the example@example.com.xml file
+In the webfinger directory, make a copy of the example@example.com.xml file
-so that it's called...
+so that it's called (replace username and example.com with appropriate
+values, the domain name should be the same as you're "socialifying"):
 
-     yoursecretusername@domain.com.xml
+     username@example.com.xml
 
-So, if your secret from step 2 is 'johnny5' and your name is 'ben' and
+Then edit the file contents, replacing "social.example.com" with your
-your domain is 'titanictoycorp.biz', your file should be called
+GNU social instance's base path, and change the user ID number (and
-johnny5ben@titanictoycorp.biz.xml
-
-Then edit the file, replacing "social.example.com" with your GNU
-social instance's base path, and change the user ID number (and
 nickname for the FOAF link) to that of your account on your social
 site. If you don't know your user ID number, you can see this on your
 GNU social profile page by looking at the destination URLs in the
 Feeds links.
 
+PROTIP: You can get the bulk of the contents (note the <Subject> element though)
+        from curling down your real webfinger data:
+$ curl https://social.example.com/.well-known/webfinger?resource=acct:username@social.example.com
+
 Finally
 =======
 

socialfy-your-domain/dot-well-known/host-meta

@@ -1,8 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<XRD xmlns="http://docs.oasis-open.org/ns/xri/xrd-1.0"
+<XRD xmlns="http://docs.oasis-open.org/ns/xri/xrd-1.0" xmlns:hm="http://host-meta.net/xrd/1.0">  
-     xmlns:hm="http://host-meta.net/xrd/1.0">  
+ <Link rel="lrdd" type="application/xrd+xml"
-  <hm:Host>example.com</hm:Host>
+        template="https://example.com/.well-known/webfinger?resource={uri}"/>
-  <Link rel="lrdd" template="http://example.com/.well-known/xrd?uri={uri}">
-    <Title>WebFinger resource descriptor</Title>
-  </Link>
 </XRD>

socialfy-your-domain/dot-well-known/webfinger/example@example.com.xml

@@ -1,35 +1,35 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <XRD xmlns="http://docs.oasis-open.org/ns/xri/xrd-1.0">
-  <Subject>acct:example@example.com</Subject>
+  <Subject>acct:username@example.com</Subject>
-  <Alias>acct:example@social.example.com</Alias>
+  <Alias>acct:username@social.example.com</Alias>
-  <Alias>http://social.example.com/user/1</Alias>
+  <Alias>https://social.example.com/user/1</Alias>
   <Link rel="http://webfinger.net/rel/profile-page"
         type="text/html"
-	href="http://social.example.com/user/1"/>
+	href="https://social.example.com/user/1"/>
     
   <Link rel="http://schemas.google.com/g/2010#updates-from"
 	type="application/atom+xml"
-	href="http://social.example.com/api/statuses/user_timeline/1.atom"/>
+	href="https://social.example.com/api/statuses/user_timeline/1.atom"/>
     
   <!-- Is this/was this ever supported?
        <Link rel="http://microformats.org/profile/hcard"
        type="text/html"
-       href="http://social.example.com/hcard"/> -->
+       href="https://social.example.com/hcard"/> -->
   
   <Link rel="http://gmpg.org/xfn/11"
 	type="text/html"
-	href="http://social.example.com/user/1"/>
+	href="https://social.example.com/user/1"/>
     
   <Link rel="describedby"
 	type="application/rdf+xml"
-	href="http://social.example.com/username/foaf"/>
+	href="https://social.example.com/username/foaf"/>
 
   <Link rel="http://salmon-protocol.org/ns/salmon-replies"
-	href="http://social.example.com/main/salmon/user/1"/>
+	href="https://social.example.com/main/salmon/user/1"/>
     
   <Link rel="http://salmon-protocol.org/ns/salmon-mention"
-	href="http://social.example.com/main/salmon/user/1"/>
+	href="https://social.example.com/main/salmon/user/1"/>
     
   <Link rel="http://ostatus.org/schema/1.0/subscribe"
-	template="http://social.example.com/main/ostatussub?profile={uri}"/>
+	template="https://social.example.com/main/ostatussub?profile={uri}"/>
 </XRD>

socialfy-your-domain/dot-well-known/webfinger/index.php

@@ -19,23 +19,22 @@
  */
 
 
-$s = "";
+// basename should make sure we can't escape this directory
+$u = basename($_GET['resource']);
 
-/* this should be a secret */
+if (!strpos($u, '@')) {
-
+    throw new Exception('Bad resource');
-$u = $_GET['uri'];
+    exit(1);
-
-$u = substr($u, 5);
-
-$f = $s . $u . ".xml";
-
-if (file_exists($f)) {
-  $fh = fopen($f, 'r');
-  $c = fread($fh, filesize($f));
-  fclose($fh);
-  header('Content-type: text/xml');
-  echo $c;
 }
 
+if (mb_strpos($u, 'acct:')===0) {
+    $u = substr($u, 5);
+}
 
-?>
+$f = $u . ".xml";
+
+if (file_exists($f)) {
+  header('Content-Disposition: attachment; filename="'.urlencode($f).'"');
+  header('Content-type: application/xrd+xml');
+  echo file_get_contents($f);
+}