Merge remote-tracking branch 'upstream/nightly' into nightly

2016-06-24 16:47:57 +02:00 · 2016-06-24 16:47:57 +02:00 · 8470a55a41
commit 8470a55a41
parent b83ff3f924 d7a4098b56
21 changed files with 274 additions and 143 deletions
--- a/classes/File.php
+++ b/classes/File.php
@ -263,6 +263,11 @@ class File extends Managed_DataObject
        return self::tryFilename($this->filename);
    }

+    public function getSize()
+    {
+        return intval($this->size);
+    }
+
    // where should the file go?

    static function filename(Profile $profile, $origname, $mimetype)
--- a/extlib/ParagonIE/ConstantTime/Base32.php
+++ b/extlib/ParagonIE/ConstantTime/Base32.php
@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;

 /**
@ -39,9 +38,9 @@ abstract class Base32 implements EncoderInterface
     * @param string $src
     * @return string
     */
-    public static function decode(string $src, bool $strictPadding = false): string
+    public static function decode($src)
    {
-        return static::doDecode($src, false, $strictPadding);
+        return static::doDecode($src, false);
    }

    /**
@ -50,9 +49,9 @@ abstract class Base32 implements EncoderInterface
     * @param string $src
     * @return string
     */
-    public static function decodeUpper(string $src, bool $strictPadding = false): string
+    public static function decodeUpper($src)
    {
-        return static::doDecode($src, true, $strictPadding);
+        return static::doDecode($src, true);
    }

    /**
@ -61,7 +60,7 @@ abstract class Base32 implements EncoderInterface
     * @param string $src
     * @return string
     */
-    public static function encode(string $src): string
+    public static function encode($src)
    {
        return static::doEncode($src, false);
    }
@ -72,7 +71,7 @@ abstract class Base32 implements EncoderInterface
     * @param string $src
     * @return string
     */
-    public static function encodeUpper(string $src): string
+    public static function encodeUpper($src)
    {
        return static::doEncode($src, true);
    }
@ -84,7 +83,7 @@ abstract class Base32 implements EncoderInterface
     * @param int $src
     * @return int
     */
-    protected static function decode5Bits(int $src): int
+    protected static function decode5Bits($src)
    {
        $ret = -1;

@ -106,7 +105,7 @@ abstract class Base32 implements EncoderInterface
     * @param int $src
     * @return int
     */
-    protected static function decode5BitsUpper(int $src): int
+    protected static function decode5BitsUpper($src)
    {
        $ret = -1;

@ -126,7 +125,7 @@ abstract class Base32 implements EncoderInterface
     * @param $src
     * @return string
     */
-    protected static function encode5Bits(int $src): string
+    protected static function encode5Bits($src)
    {
        $diff = 0x61;

@ -145,7 +144,7 @@ abstract class Base32 implements EncoderInterface
     * @param $src
     * @return string
     */
-    protected static function encode5BitsUpper(int $src): string
+    protected static function encode5BitsUpper($src)
    {
        $diff = 0x41;

@ -159,12 +158,11 @@ abstract class Base32 implements EncoderInterface
    /**
     * Base32 decoding
     *
-     * @param string $src
+     * @param $src
     * @param bool $upper
-     * @param bool $strictPadding
     * @return string
     */
-    protected static function doDecode(string $src, bool $upper = false, bool $strictPadding = false): string
+    protected static function doDecode($src, $upper = false)
    {
        // We do this to reduce code duplication:
        $method = $upper
@ -176,24 +174,19 @@ abstract class Base32 implements EncoderInterface
        if ($srcLen === 0) {
            return '';
        }
-        if ($strictPadding) {
-            if (($srcLen & 7) === 0) {
-                for ($j = 0; $j < 7; ++$j) {
-                    if ($src[$srcLen - 1] === '=') {
-                        $srcLen--;
-                    } else {
-                        break;
-                    }
+        if (($srcLen & 7) === 0) {
+            for ($j = 0; $j < 7; ++$j) {
+                if ($src[$srcLen - 1] === '=') {
+                    $srcLen--;
+                } else {
+                    break;
                }
            }
-            if (($srcLen & 7) === 1) {
-                throw new \RangeException(
-                    'Incorrect padding'
-                );
-            }
-        } else {
-            $src = \rtrim($src, '=');
-            $srcLen = Binary::safeStrlen($src);
+        }
+        if (($srcLen & 7) === 1) {
+            throw new \RangeException(
+                'Incorrect padding'
+            );
        }

        $err = 0;
@ -321,7 +314,7 @@ abstract class Base32 implements EncoderInterface
     * @param bool $upper
     * @return string
     */
-    protected static function doEncode(string $src, bool $upper = false): string
+    protected static function doEncode($src, $upper = false)
    {
        // We do this to reduce code duplication:
        $method = $upper
@ -393,4 +386,4 @@ abstract class Base32 implements EncoderInterface
        }
        return $dest;
    }
-}
+}
--- a/extlib/ParagonIE/ConstantTime/Base32Hex.php
+++ b/extlib/ParagonIE/ConstantTime/Base32Hex.php
@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;

 /**
@ -40,7 +39,7 @@ abstract class Base32Hex extends Base32
     * @param int $src
     * @return int
     */
-    protected static function decode5Bits(int $src): int
+    protected static function decode5Bits($src)
    {
        $ret = -1;

@ -60,7 +59,7 @@ abstract class Base32Hex extends Base32
     * @param int $src
     * @return int
     */
-    protected static function decode5BitsUpper(int $src): int
+    protected static function decode5BitsUpper($src)
    {
        $ret = -1;

@ -80,7 +79,7 @@ abstract class Base32Hex extends Base32
     * @param int $src
     * @return string
     */
-    protected static function encode5Bits(int $src): string
+    protected static function encode5Bits($src)
    {
        $src += 0x30;

@ -99,7 +98,7 @@ abstract class Base32Hex extends Base32
     * @param int $src
     * @return string
     */
-    protected static function encode5BitsUpper(int $src): string
+    protected static function encode5BitsUpper($src)
    {
        $src += 0x30;

--- a/extlib/ParagonIE/ConstantTime/Base64.php
+++ b/extlib/ParagonIE/ConstantTime/Base64.php
@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;

 /**
@ -41,7 +40,7 @@ abstract class Base64 implements EncoderInterface
     * @param string $src
     * @return string
     */
-    public static function encode(string $src): string
+    public static function encode($src)
    {
        $dest = '';
        $srcLen = Binary::safeStrlen($src);
@ -83,18 +82,16 @@ abstract class Base64 implements EncoderInterface
     * Base64 character set "./[A-Z][a-z][0-9]"
     *
     * @param string $src
-     * @param bool $strictPadding
     * @return string|bool
     * @throws \RangeException
     */
-    public static function decode(string $src, bool $strictPadding = false): string
+    public static function decode($src, $strictPadding = false)
    {
        // Remove padding
        $srcLen = Binary::safeStrlen($src);
        if ($srcLen === 0) {
            return '';
        }
-
        if ($strictPadding) {
            if (($srcLen & 3) === 0) {
                if ($src[$srcLen - 1] === '=') {
@ -109,11 +106,6 @@ abstract class Base64 implements EncoderInterface
                    'Incorrect padding'
                );
            }
-            if ($src[$srcLen - 1] === '=') {
-                throw new \RangeException(
-                    'Incorrect padding'
-                );
-            }
        } else {
            $src = \rtrim($src, '=');
            $srcLen = Binary::safeStrlen($src);
@ -141,7 +133,6 @@ abstract class Base64 implements EncoderInterface
        if ($i < $srcLen) {
            $chunk = \unpack('C*', Binary::safeSubstr($src, $i, $srcLen - $i));
            $c0 = static::decode6Bits($chunk[1]);
-
            if ($i + 2 < $srcLen) {
                $c1 = static::decode6Bits($chunk[2]);
                $c2 = static::decode6Bits($chunk[3]);
@ -151,7 +142,7 @@ abstract class Base64 implements EncoderInterface
                    ((($c1 << 4) | ($c2 >> 2)) & 0xff)
                );
                $err |= ($c0 | $c1 | $c2) >> 8;
-            } elseif ($i + 1 < $srcLen) {
+            } elseif($i + 1 < $srcLen) {
                $c1 = static::decode6Bits($chunk[2]);
                $dest .= \pack(
                    'C',
@ -179,7 +170,7 @@ abstract class Base64 implements EncoderInterface
     * @param int $src
     * @return int
     */
-    protected static function decode6Bits(int $src): int
+    protected static function decode6Bits($src)
    {
        $ret = -1;

@ -208,7 +199,7 @@ abstract class Base64 implements EncoderInterface
     * @param int $src
     * @return string
     */
-    protected static function encode6Bits(int $src): string
+    protected static function encode6Bits($src)
    {
        $diff = 0x41;

--- a/extlib/ParagonIE/ConstantTime/Base64DotSlash.php
+++ b/extlib/ParagonIE/ConstantTime/Base64DotSlash.php
@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;

 /**
@ -44,7 +43,7 @@ abstract class Base64DotSlash extends Base64
     * @param int $src
     * @return int
     */
-    protected static function decode6Bits(int $src): int
+    protected static function decode6Bits($src)
    {
        $ret = -1;

@ -70,7 +69,7 @@ abstract class Base64DotSlash extends Base64
     * @param int $src
     * @return string
     */
-    protected static function encode6Bits(int $src): string
+    protected static function encode6Bits($src)
    {
        $src += 0x2e;

--- a/extlib/ParagonIE/ConstantTime/Base64DotSlashOrdered.php
+++ b/extlib/ParagonIE/ConstantTime/Base64DotSlashOrdered.php
@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;

 /**
@ -44,7 +43,7 @@ abstract class Base64DotSlashOrdered extends Base64
     * @param int $src
     * @return int
     */
-    protected static function decode6Bits(int $src): int
+    protected static function decode6Bits($src)
    {
        $ret = -1;

@ -67,7 +66,7 @@ abstract class Base64DotSlashOrdered extends Base64
     * @param int $src
     * @return string
     */
-    protected static function encode6Bits(int $src): string
+    protected static function encode6Bits($src)
    {
        $src += 0x2e;

--- a/extlib/ParagonIE/ConstantTime/Base64UrlSafe.php
+++ b/extlib/ParagonIE/ConstantTime/Base64UrlSafe.php
@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;

 /**
@ -45,7 +44,7 @@ abstract class Base64UrlSafe extends Base64
     * @param int $src
     * @return int
     */
-    protected static function decode6Bits(int $src): int
+    protected static function decode6Bits($src)
    {
        $ret = -1;

@ -74,7 +73,7 @@ abstract class Base64UrlSafe extends Base64
     * @param int $src
     * @return string
     */
-    protected static function encode6Bits(int $src): string
+    protected static function encode6Bits($src)
    {
        $diff = 0x41;

--- a/extlib/ParagonIE/ConstantTime/Binary.php
+++ b/extlib/ParagonIE/ConstantTime/Binary.php
@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;

 /**
@ -43,7 +42,7 @@ abstract class Binary
     * @param string $str
     * @return int
     */
-    public static function safeStrlen(string $str): int
+    public static function safeStrlen($str)
    {
        if (\function_exists('mb_strlen')) {
            return \mb_strlen($str, '8bit');
@ -65,10 +64,10 @@ abstract class Binary
     * @throws \TypeError
     */
    public static function safeSubstr(
-        string $str,
-        int $start = 0,
+        $str,
+        $start = 0,
        $length = null
-    ): string {
+    ) {
        if (\function_exists('mb_substr')) {
            // mb_substr($str, 0, NULL, '8bit') returns an empty string on PHP
            // 5.3, so we have to find the length ourselves.
--- a/extlib/ParagonIE/ConstantTime/EncoderInterface.php
+++ b/extlib/ParagonIE/ConstantTime/EncoderInterface.php
@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;

 /**
@ -35,18 +34,17 @@ interface EncoderInterface
     * Convert a binary string into a hexadecimal string without cache-timing
     * leaks
     *
-     * @param string $binString (raw binary)
+     * @param string $bin_string (raw binary)
     * @return string
     */
-    public static function encode(string $binString): string;
+    public static function encode($bin_string);

    /**
     * Convert a binary string into a hexadecimal string without cache-timing
     * leaks
     *
-     * @param string $encodedString
-     * @param bool $strictPadding Error on invalid padding
+     * @param string $encoded_string
     * @return string (raw binary)
     */
-    public static function decode(string $encodedString, bool $strictPadding = false): string;
+    public static function decode($encoded_string);
 }
--- a/extlib/ParagonIE/ConstantTime/Encoding.php
+++ b/extlib/ParagonIE/ConstantTime/Encoding.php
@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;

 /**
@ -37,7 +36,7 @@ abstract class Encoding
     * @param $str
     * @return string
     */
-    public static function base32Encode(string $str): string
+    public static function base32Encode($str)
    {
        return Base32::encode($str);
    }
@ -48,7 +47,7 @@ abstract class Encoding
     * @param $str
     * @return string
     */
-    public static function base32EncodeUpper(string $str): string
+    public static function base32EncodeUpper($str)
    {
        return Base32::encodeUpper($str);
    }
@ -59,7 +58,7 @@ abstract class Encoding
     * @param $str
     * @return string
     */
-    public static function base32Decode(string $str): string
+    public static function base32Decode($str)
    {
        return Base32::decode($str);
    }
@ -70,7 +69,7 @@ abstract class Encoding
     * @param $str
     * @return string
     */
-    public static function base32DecodeUpper(string $str): string
+    public static function base32DecodeUpper($str)
    {
        return Base32::decodeUpper($str);
    }
@ -81,7 +80,7 @@ abstract class Encoding
     * @param $str
     * @return string
     */
-    public static function base32HexEncode(string $str): string
+    public static function base32HexEncode($str)
    {
        return Base32Hex::encode($str);
    }
@ -93,7 +92,7 @@ abstract class Encoding
     * @param $str
     * @return string
     */
-    public static function base32HexEncodeUpper(string $str): string
+    public static function base32HexEncodeUpper($str)
    {
        return Base32Hex::encodeUpper($str);
    }
@ -104,7 +103,7 @@ abstract class Encoding
     * @param $str
     * @return string
     */
-    public static function base32HexDecode(string $str): string
+    public static function base32HexDecode($str)
    {
        return Base32Hex::decode($str);
    }
@ -115,7 +114,7 @@ abstract class Encoding
     * @param $str
     * @return string
     */
-    public static function base32HexDecodeUpper(string $str): string
+    public static function base32HexDecodeUpper($str)
    {
        return Base32Hex::decodeUpper($str);
    }
@ -126,7 +125,7 @@ abstract class Encoding
     * @param $str
     * @return string
     */
-    public static function base64Encode(string $str): string
+    public static function base64Encode($str)
    {
        return Base64::encode($str);
    }
@ -137,7 +136,7 @@ abstract class Encoding
     * @param $str
     * @return string
     */
-    public static function base64Decode(string $str): string
+    public static function base64Decode($str)
    {
        return Base64::decode($str);
    }
@ -149,9 +148,9 @@ abstract class Encoding
     * @param $src
     * @return string
     */
-    public static function base64EncodeDotSlash(string $str): string
+    public static function base64EncodeDotSlash($src)
    {
-        return Base64DotSlash::encode($str);
+        return Base64DotSlash::encode($src);
    }

    /**
@ -163,9 +162,9 @@ abstract class Encoding
     * @return bool|string
     * @throws \RangeException
     */
-    public static function base64DecodeDotSlash(string $str): string
+    public static function base64DecodeDotSlash($src)
    {
-        return Base64DotSlash::decode($str);
+        return Base64DotSlash::decode($src);
    }

    /**
@ -175,9 +174,9 @@ abstract class Encoding
     * @param $src
     * @return string
     */
-    public static function base64EncodeDotSlashOrdered(string $str): string
+    public static function base64EncodeDotSlashOrdered($src)
    {
-        return Base64DotSlashOrdered::encode($str);
+        return Base64DotSlashOrdered::encode($src);
    }

    /**
@ -189,9 +188,9 @@ abstract class Encoding
     * @return bool|string
     * @throws \RangeException
     */
-    public static function base64DecodeDotSlashOrdered(string $str): string
+    public static function base64DecodeDotSlashOrdered($src)
    {
-        return Base64DotSlashOrdered::decode($str);
+        return Base64DotSlashOrdered::decode($src);
    }

    /**
@ -201,7 +200,7 @@ abstract class Encoding
     * @param string $bin_string (raw binary)
     * @return string
     */
-    public static function hexEncode(string $bin_string): string
+    public static function hexEncode($bin_string)
    {
        return Hex::encode($bin_string);
    }
@ -214,7 +213,7 @@ abstract class Encoding
     * @return string (raw binary)
     * @throws \RangeException
     */
-    public static function hexDecode(string $hex_string): string
+    public static function hexDecode($hex_string)
    {
        return Hex::decode($hex_string);
    }
@ -226,7 +225,7 @@ abstract class Encoding
     * @param string $bin_string (raw binary)
     * @return string
     */
-    public static function hexEncodeUpper(string $bin_string): string
+    public static function hexEncodeUpper($bin_string)
    {
        return Hex::encodeUpper($bin_string);
    }
@ -238,7 +237,7 @@ abstract class Encoding
     * @param string $bin_string (raw binary)
     * @return string
     */
-    public static function hexDecodeUpper(string $bin_string): string
+    public static function hexDecodeUpper($bin_string)
    {
        return Hex::decode($bin_string);
    }
--- a/extlib/ParagonIE/ConstantTime/Hex.php
+++ b/extlib/ParagonIE/ConstantTime/Hex.php
@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;

 /**
@ -38,7 +37,7 @@ abstract class Hex implements EncoderInterface
     * @param string $bin_string (raw binary)
     * @return string
     */
-    public static function encode(string $bin_string): string
+    public static function encode($bin_string)
    {
        $hex = '';
        $len = Binary::safeStrlen($bin_string);
@ -62,7 +61,7 @@ abstract class Hex implements EncoderInterface
     * @param string $bin_string (raw binary)
     * @return string
     */
-    public static function encodeUpper(string $bin_string): string
+    public static function encodeUpper($bin_string)
    {
        $hex = '';
        $len = Binary::safeStrlen($bin_string);
@ -84,29 +83,23 @@ abstract class Hex implements EncoderInterface
     * leaks
     *
     * @param string $hex_string
-     * @param bool $strictPadding
     * @return string (raw binary)
     * @throws \RangeException
     */
-    public static function decode(string $hexString, bool $strictPadding = false): string
+    public static function decode($hex_string)
    {
        $hex_pos = 0;
        $bin = '';
        $c_acc = 0;
-        $hex_len = Binary::safeStrlen($hexString);
+        $hex_len = Binary::safeStrlen($hex_string);
        $state = 0;
        if (($hex_len & 1) !== 0) {
-            if ($strictPadding) {
-                throw new \RangeException(
-                    'Expected an even number of hexadecimal characters'
-                );
-            } else {
-                $hexString = '0' . $hexString;
-                ++$hex_len;
-            }
+            throw new \RangeException(
+                'Expected an even number of hexadecimal characters'
+            );
        }

-        $chunk = \unpack('C*', $hexString);
+        $chunk = \unpack('C*', $hex_string);
        while ($hex_pos < $hex_len) {
            ++$hex_pos;
            $c = $chunk[$hex_pos];
--- a/extlib/ParagonIE/ConstantTime/RFC4648.php
+++ b/extlib/ParagonIE/ConstantTime/RFC4648.php
@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;

 /**
@ -42,7 +41,7 @@ abstract class RFC4648
     * @param string $str
     * @return string
     */
-    public function base64Encode(string $str): string
+    public function base64Encode($str)
    {
        return Base64::encode($str);
    }
@ -55,9 +54,9 @@ abstract class RFC4648
     * @param string $str
     * @return string
     */
-    public function base64Decode(string $str): string
+    public function base64Decode($str)
    {
-        return Base64::decode($str, true);
+        return Base64::decode($str);
    }

    /**
@ -68,7 +67,7 @@ abstract class RFC4648
     * @param string $str
     * @return string
     */
-    public function base64UrlSafeEncode(string $str): string
+    public function base64UrlSafeEncode($str)
    {
        return Base64UrlSafe::encode($str);
    }
@ -81,9 +80,9 @@ abstract class RFC4648
     * @param string $str
     * @return string
     */
-    public function base64UrlSafeDecode(string $str): string
+    public function base64UrlSafeDecode($str)
    {
-        return Base64UrlSafe::decode($str, true);
+        return Base64UrlSafe::decode($str);
    }

    /**
@ -94,7 +93,7 @@ abstract class RFC4648
     * @param string $str
     * @return string
     */
-    public function base32Encode(string $str): string
+    public function base32Encode($str)
    {
        return Base32::encodeUpper($str);
    }
@ -107,9 +106,9 @@ abstract class RFC4648
     * @param string $str
     * @return string
     */
-    public function base32Decode(string $str): string
+    public function base32Decode($str)
    {
-        return Base32::decodeUpper($str, true);
+        return Base32::decodeUpper($str);
    }

    /**
@ -120,7 +119,7 @@ abstract class RFC4648
     * @param string $str
     * @return string
     */
-    public function base32HexEncode(string $str): string
+    public function base32HexEncode($str)
    {
        return Base32::encodeUpper($str);
    }
@ -133,9 +132,9 @@ abstract class RFC4648
     * @param string $str
     * @return string
     */
-    public function base32HexDecode(string $str): string
+    public function base32HexDecode($str)
    {
-        return Base32::decodeUpper($str, true);
+        return Base32::decodeUpper($str);
    }

    /**
@ -146,7 +145,7 @@ abstract class RFC4648
     * @param string $str
     * @return string
     */
-    public function base16Encode(string $str): string
+    public function base16Encode($str)
    {
        return Hex::encodeUpper($str);
    }
@ -159,8 +158,8 @@ abstract class RFC4648
     * @param string $str
     * @return string
     */
-    public function base16Decode(string $str): string
+    public function base16Decode($str)
    {
-        return Hex::decode($str, true);
+        return Hex::decode($str);
    }
 }
--- a/extlib/ParagonIE/README.md
+++ b/extlib/ParagonIE/README.md
@ -0,0 +1,74 @@
+# Constant-Time Encoding
+
+[![Build Status](https://travis-ci.org/paragonie/constant_time_encoding.svg?branch=v1.x)](https://travis-ci.org/paragonie/constant_time_encoding)
+
+Based on the [constant-time base64 implementation made by Steve "Sc00bz" Thomas](https://github.com/Sc00bz/ConstTimeEncoding),
+this library aims to offer character encoding functions that do not leak
+information about what you are encoding/decoding via processor cache 
+misses. Further reading on [cache-timing attacks](http://blog.ircmaxell.com/2014/11/its-all-about-time.html).
+
+Our fork offers the following enchancements:
+
+* `mbstring.func_overload` resistance
+* Unit tests
+* Composer- and Packagist-ready
+* Base16 encoding
+* Base32 encoding
+* Uses `pack()` and `unpack()` instead of `chr()` and `ord()`
+
+## PHP Version Requirements
+
+This library should work on any [supported version of PHP](https://secure.php.net/supported-versions.php).
+It *may* work on earlier versions, but we **do not** guarantee it. If it
+doesn't, we **will not** fix it to work on earlier versions of PHP.
+
+## How to Install
+
+```sh
+composer require paragonie/constant_time_encoding
+```
+
+## How to Use
+
+```php
+use \ParagonIE\ConstantTime\Encoding;
+
+// possibly (if applicable): 
+// require 'vendor/autoload.php';
+
+$data = random_bytes(32);
+echo Encoding::base64Encode($data), "\n";
+echo Encoding::base32EncodeUpper($data), "\n";
+echo Encoding::base32Encode($data), "\n";
+echo Encoding::hexEncode($data), "\n";
+echo Encoding::hexEncodeUpper($data), "\n";
+```
+
+Example output:
+ 
+```
+1VilPkeVqirlPifk5scbzcTTbMT2clp+Zkyv9VFFasE=
+2VMKKPSHSWVCVZJ6E7SONRY3ZXCNG3GE6ZZFU7TGJSX7KUKFNLAQ====
+2vmkkpshswvcvzj6e7sonry3zxcng3ge6zzfu7tgjsx7kukfnlaq====
+d558a53e4795aa2ae53e27e4e6c71bcdc4d36cc4f6725a7e664caff551456ac1
+D558A53E4795AA2AE53E27E4E6C71BDCC4D36CC4F6725A7E664CAFF551456AC1
+```
+
+If you only need a particular variant, you can just reference the 
+required class like so:
+
+```php
+use \ParagonIE\ConstantTime\Base64;
+use \ParagonIE\ConstantTime\Base32;
+
+$data = random_bytes(32);
+echo Base64::encode($data), "\n";
+echo Base32::encode($data), "\n";
+```
+
+Example output:
+
+```
+1VilPkeVqirlPifk5scbzcTTbMT2clp+Zkyv9VFFasE=
+2vmkkpshswvcvzj6e7sonry3zxcng3ge6zzfu7tgjsx7kukfnlaq====
+```
--- a/lib/activityobject.php
+++ b/lib/activityobject.php
@ -28,9 +28,7 @@
 * @link      http://status.net/
 */

-if (!defined('STATUSNET')) {
-    exit(1);
-}
+if (!defined('GNUSOCIAL')) { exit(1); }

 require_once(INSTALLDIR.'/lib/activitystreamjsondocument.php');

@ -269,6 +267,22 @@ class ActivityObject
        if (empty($this->id) && !empty($this->link)) { // fallback if there's no ID
            $this->id = $this->link;
        }
+
+        $els = $element->childNodes;
+        $out = array();
+
+        for ($i = 0; $i < $els->length; $i++) {
+            $link = $els->item($i);
+            if ($link->localName == ActivityUtils::LINK && $link->namespaceURI == ActivityUtils::ATOM) {
+                $attrs = array();
+                foreach ($link->attributes as $attrName=>$attrNode) {
+                    $attrs[$attrName] = $attrNode->nodeValue;
+                }
+                $this->extra[] = [$link->localName,
+                                    $attrs,
+                                    $link->nodeValue];
+            }
+        }
    }

    // @todo FIXME: rationalize with Activity::_fromRssItem()
--- a/lib/httpclient.php
+++ b/lib/httpclient.php
@ -206,6 +206,29 @@ class HTTPClient extends HTTP_Request2
        return $data;
    }

+    /**
+     * If you want an Accept header, put it in $headers
+     */
+    public static function quickHead($url, array $params=array(), array $headers=array())
+    {
+        if (!empty($params)) {
+            $params = http_build_query($params, null, '&');
+            if (strpos($url, '?') === false) {
+                $url .= '?' . $params;
+            } else {
+                $url .= '&' . $params;
+            }
+        }
+
+        $client = new HTTPClient();
+        $response = $client->head($url, $headers);
+        if (!$response->isOk()) {
+            // TRANS: Exception. %s is the URL we tried to GET.
+            throw new Exception(sprintf(_m('Could not GET URL %s.'), $url), $response->getStatus());
+        }
+        return $response->getHeader();
+    }
+
    /**
     * Convenience function to run a GET request.
     *
--- a/plugins/Bookmark/classes/Bookmark.php
+++ b/plugins/Bookmark/classes/Bookmark.php
@ -162,19 +162,19 @@ class Bookmark extends Managed_DataObject
        $url = null;
        // each extra element is array('tagname', array('attr'=>'val', ...), 'content')
        foreach ($actobj->extra as $extra) {
-            if ($extra[1]['rel'] !== 'related') {
+            if ($extra[0] !== ActivityUtils::LINK || $extra[1][ActivityUtils::REL] !== 'related') {
                continue;
            }
-            if ($url===null && strlen($extra[1]['href'])>0) {
-                $url = $extra[1]['href'];
+            if ($url===null && strlen($extra[1][ActivityUtils::HREF])>0) {
+                $url = $extra[1][ActivityUtils::HREF];
            } elseif ($url !== null) {
                // TRANS: Client exception thrown when a bookmark is formatted incorrectly.
-                throw new ClientException(sprintf(_m('Expected exactly 1 link rel=related in a Bookmark, got %1$d.'), count($relLinkEls)));
+                throw new ClientException(sprintf(_m('Expected exactly 1 link rel=related in a Bookmark, got more than that.')));
            }
        }
        if (is_null($url)) {
            // TRANS: Client exception thrown when a bookmark is formatted incorrectly.
-            throw new ClientException(sprintf(_m('Expected exactly 1 link rel=related in a Bookmark, got %1$d.'), count($relLinkEls)));
+            throw new ClientException(sprintf(_m('Expected exactly 1 link rel=related in a Bookmark, got 0.')));
        }

        if (!strlen($actobj->title)) {
--- a/plugins/Diaspora/DiasporaPlugin.php
+++ b/plugins/Diaspora/DiasporaPlugin.php
@ -225,7 +225,12 @@ class DiasporaPlugin extends Plugin

    public function onSalmonSlap($endpoint_uri, MagicEnvelope $magic_env, Profile $target=null)
    {
-        $envxml = $magic_env->toXML($target, 'diaspora');
+        try {
+            $envxml = $magic_env->toXML($target, 'diaspora');
+        } catch (Exception $e) {
+            common_log(LOG_ERR, sprintf('Could not generate Magic Envelope XML (diaspora flavour) for profile id=='.$target->getID().': '.$e->getMessage()));
+            return false;
+        }

        // Diaspora wants another POST format (base64url-encoded POST variable 'xml')
        $headers = array('Content-Type: application/x-www-form-urlencoded');
--- a/plugins/LRDD/lib/discovery.php
+++ b/plugins/LRDD/lib/discovery.php
@ -99,7 +99,7 @@ class Discovery

                common_debug("LRDD discovery method for '$uri': {$class}");
                $lrdd = new $class;
-                $links = call_user_func(array($lrdd, 'discover'), $uri);
+                $links = $lrdd->discover($uri);
                $link = Discovery::getService($links, Discovery::LRDD_REL);

                // Load the LRDD XRD
--- a/plugins/OStatus/OStatusPlugin.php
+++ b/plugins/OStatus/OStatusPlugin.php
@ -1407,7 +1407,12 @@ class OStatusPlugin extends Plugin

    public function onSalmonSlap($endpoint_uri, MagicEnvelope $magic_env, Profile $target=null)
    {
-        $envxml = $magic_env->toXML($target);
+        try {
+            $envxml = $magic_env->toXML($target);
+        } catch (Exception $e) {
+            common_log(LOG_ERR, sprintf('Could not generate Magic Envelope XML for profile id=='.$target->getID().': '.$e->getMessage()));
+            return false;
+        }

        $headers = array('Content-Type: application/magic-envelope+xml');

--- a/plugins/OStatus/scripts/renew-feeds.php
+++ b/plugins/OStatus/scripts/renew-feeds.php
@ -37,7 +37,11 @@ try {

 while ($sub->fetch()) {
    echo "Renewing feed subscription\n\tExp.: {$sub->sub_end}\n\tFeed: {$sub->uri}\n\tHub:  {$sub->huburi}\n";
-    $sub->renew();
+    try {
+        $sub->renew();
+    } catch (Exception $e) {
+        echo "FAILED: {$e->getMessage()}\n";
+    }
 }

 echo "Done!";
--- a/plugins/StoreRemoteMedia/StoreRemoteMediaPlugin.php
+++ b/plugins/StoreRemoteMedia/StoreRemoteMediaPlugin.php
@ -18,6 +18,8 @@ class StoreRemoteMediaPlugin extends Plugin
    public $domain_blacklist = array();
    public $check_blacklist = false;

+    public $max_image_bytes = 5242880;  // 5MiB max image size by default
+
    protected $imgData = array();

    // these should be declared protected everywhere
@ -77,22 +79,53 @@ class StoreRemoteMediaPlugin extends Plugin
            return true;
        }

-        if (!$this->checkWhiteList($file->getUrl()) ||
-            !$this->checkBlackList($file->getUrl())) {
+        $remoteUrl = $file->getUrl();
+
+        if (!$this->checkWhiteList($remoteUrl) ||
+            !$this->checkBlackList($remoteUrl)) {
 		    return true;
        }

-        // First we download the file to memory and test whether it's actually an image file
-        common_debug(sprintf('Downloading remote file id==%u with URL: %s', $file->getID(), _ve($file->getUrl())));
        try {
-            $imgData = HTTPClient::quickGet($file->getUrl());
+            /*
+            $http = new HTTPClient();
+            common_debug(sprintf('Performing HEAD request for remote file id==%u to avoid unnecessarily downloading too large files. URL: %s', $file->getID(), $remoteUrl));
+            $head = $http->head($remoteUrl);
+            $remoteUrl = $head->effectiveUrl;   // to avoid going through redirects again
+            if (!$this->checkBlackList($remoteUrl)) {
+                common_log(LOG_WARN, sprintf('%s: Non-blacklisted URL %s redirected to blacklisted URL %s', __CLASS__, $file->getUrl(), $remoteUrl));
+                return true;
+            }
+
+            $headers = $head->getHeader();
+            $filesize = isset($headers['content-length']) ? $headers['content-length'] : null;
+            */
+            $filesize = $file->getSize();
+            if (empty($filesize)) {
+                // file size not specified on remote server
+                common_debug(sprintf('%s: Ignoring remote media because we did not get a content length for file id==%u', __CLASS__, $file->getID()));
+                return true;
+            } elseif ($filesize > $this->max_image_bytes) {
+                //FIXME: When we perhaps start fetching videos etc. we'll need to differentiate max_image_bytes from that...
+                // file too big according to plugin configuration
+                common_debug(sprintf('%s: Skipping remote media because content length (%u) is larger than plugin configured max_image_bytes (%u) for file id==%u', __CLASS__, intval($filesize), $this->max_image_bytes, $file->getID()));
+                return true;
+            } elseif ($filesize > common_config('attachments', 'file_quota')) {
+                // file too big according to site configuration
+                common_debug(sprintf('%s: Skipping remote media because content length (%u) is larger than file_quota (%u) for file id==%u', __CLASS__, intval($filesize), common_config('attachments', 'file_quota'), $file->getID()));
+                return true;
+            }
+
+            // Then we download the file to memory and test whether it's actually an image file
+            common_debug(sprintf('Downloading remote file id==%u (should be size %u) with effective URL: %s', $file->getID(), $filesize, _ve($remoteUrl)));
+            $imgData = HTTPClient::quickGet($remoteUrl);
        } catch (HTTP_Request2_ConnectionException $e) {
            common_log(LOG_ERR, __CLASS__.': quickGet on URL: '._ve($file->getUrl()).' threw exception: '.$e->getMessage());
            return true;
        }
        $info = @getimagesizefromstring($imgData);
        if ($info === false) {
-            throw new UnsupportedMediaException(_('Remote file format was not identified as an image.'), $file->getUrl());
+            throw new UnsupportedMediaException(_('Remote file format was not identified as an image.'), $remoteUrl);
        } elseif (!$info[0] || !$info[1]) {
            throw new UnsupportedMediaException(_('Image file had impossible geometry (0 width or height)'));
        }