Split up source and source_link. Never trust HTML!

https://community.highlandarrow.com/notice/269667
or alternatively: https://social.umeahackerspace.se/conversation/495655

actions/apisearchatom.php

@@ -337,21 +337,21 @@ class ApiSearchAtomAction extends ApiPrivateAuthAction
         // @todo: Here is where we'd put in a link to an atom feed for threads
 
         $source = null;
+        $source_link = null;
 
         $ns = $notice->getSource();
         if ($ns instanceof Notice_source) {
-            if (!empty($ns->name) && !empty($ns->url)) {
+            $source = $ns->code;
-                $source = '<a href="'
+            if (!empty($ns->url)) {
-                   . htmlspecialchars($ns->url)
+                $source_link = $ns->url;
-                   . '" rel="nofollow">'
+                if (!empty($ns->name)) {
-                   . htmlspecialchars($ns->name)
+                    $source = $ns->name;
-                   . '</a>';
+                }
-            } else {
-                $source = $ns->code;
             }
         }
 
         $this->element("twitter:source", null, $source);
+        $this->element("twitter:source_link", null, $source_link);
 
         $this->elementStart('author');
 

classes/Notice.php

@@ -2123,11 +2123,7 @@ class Notice extends Managed_DataObject
             if (!empty($ns->url)) {
                 $noticeInfoAttr['source_link'] = $ns->url;
                 if (!empty($ns->name)) {
-                    $noticeInfoAttr['source'] =  '<a href="'
+                    $noticeInfoAttr['source'] = $ns->name;
-                        . htmlspecialchars($ns->url)
-                        . '" rel="nofollow">'
-                        . htmlspecialchars($ns->name)
-                        . '</a>';
                 }
             }
         }

lib/apiaction.php

@@ -337,22 +337,22 @@ class ApiAction extends Action
         $twitter_status['in_reply_to_status_id'] = $in_reply_to;
 
         $source = null;
+        $source_link = null;
 
         $ns = $notice->getSource();
         if ($ns instanceof Notice_source) {
-            if (!empty($ns->name) && !empty($ns->url)) {
+            $source = $ns->code;
-                $source = '<a href="'
+            if (!empty($ns->url)) {
-		    . htmlspecialchars($ns->url)
+                $source_link = $ns->url;
-		    . '" rel="nofollow">'
+                if (!empty($ns->name)) {
-		    . htmlspecialchars($ns->name)
+                    $source = $ns->name;
-		    . '</a>';
+                }
-            } else {
-                $source = $ns->code;
             }
         }
 
         $twitter_status['uri'] = $notice->getUri();
         $twitter_status['source'] = $source;
+        $twitter_status['source_link'] = $source_link;
         $twitter_status['id'] = intval($notice->id);
 
         $replier_profile = null;

lib/jsonsearchresultslist.php

@@ -184,7 +184,8 @@ class ResultItem
     var $id;
     var $from_user_id;
     var $iso_language_code;
-    var $source;
+    var $source = null;
+    var $source_link = null;
     var $profile_image_url;
     var $created_at;
 
@@ -234,7 +235,8 @@ class ResultItem
 
         $this->iso_language_code = Profile_prefs::getConfigData($this->profile, 'site', 'language');
         
-        $this->source = $this->getSourceLink($this->notice->source);
+        // set source and source_link
+        $this->setSourceData();
 
         $this->profile_image_url = $this->profile->avatarUrl(AVATAR_STREAM_SIZE);
 
@@ -242,34 +244,43 @@ class ResultItem
     }
 
     /**
-     * Show the source of the notice
+     * Set the notice's source data (api/app name and URL)
      *
      * Either the name (and link) of the API client that posted the notice,
-     * or one of other other channels.
+     * or one of other other channels. Uses the local notice object.
      *
-     * @param string $source the source of the Notice
+     * @return void
-     *
-     * @return string a fully rendered source of the Notice
      */
-    function getSourceLink($source)
+    function setSourceData()
     {
-        // Gettext translations for the below source types are available.
+        $source = null;
-        $source_name = _($source);
+        $source_link = null;
+
         switch ($source) {
         case 'web':
         case 'xmpp':
         case 'mail':
         case 'omb':
         case 'api':
+            // Gettext translations for the below source types are available.
+            $source = _($this->notice->source);
             break;
+
         default:
-            $ns = Notice_source::getKV($source);
+            $ns = Notice_source::getKV($this->notice->source);
             if ($ns instanceof Notice_source) {
-                $source_name = '<a href="' . $ns->url . '">' . $ns->name . '</a>';
+                $source = $ns->code;
+                if (!empty($ns->url)) {
+                    $source_link = $ns->url;
+                    if (!empty($ns->name)) {
+                        $source = $ns->name;
+                    }
+                }
             }
             break;
         }
 
-        return $source_name;
+        $this->source = $source;
+        $this->source_link = $source_link;
     }
 }