From 6dcb293ba0e4fd4f38e2e3f4eb5b75df5f8d771f Mon Sep 17 00:00:00 2001
From: Mikael Nordfeldth <mmn@hethane.se>
Date: Thu, 23 Jun 2016 23:03:58 +0200
Subject: [PATCH 01/10] Unnecessarily verbose code

---
 plugins/LRDD/lib/discovery.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugins/LRDD/lib/discovery.php b/plugins/LRDD/lib/discovery.php
index 4049113408..6818e12557 100644
--- a/plugins/LRDD/lib/discovery.php
+++ b/plugins/LRDD/lib/discovery.php
@@ -99,7 +99,7 @@ class Discovery
 
                 common_debug("LRDD discovery method for '$uri': {$class}");
                 $lrdd = new $class;
-                $links = call_user_func(array($lrdd, 'discover'), $uri);
+                $links = $lrdd->discover($uri);
                 $link = Discovery::getService($links, Discovery::LRDD_REL);
 
                 // Load the LRDD XRD

From a4051945fd71a812132febe0e6041775b75cd2ea Mon Sep 17 00:00:00 2001
From: Mikael Nordfeldth <mmn@hethane.se>
Date: Thu, 23 Jun 2016 23:27:18 +0200
Subject: [PATCH 02/10] Handle exception from Magic Envelope toXML function

---
 plugins/Diaspora/DiasporaPlugin.php | 7 ++++++-
 plugins/OStatus/OStatusPlugin.php   | 7 ++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/plugins/Diaspora/DiasporaPlugin.php b/plugins/Diaspora/DiasporaPlugin.php
index 451d6b904e..c054d3b767 100644
--- a/plugins/Diaspora/DiasporaPlugin.php
+++ b/plugins/Diaspora/DiasporaPlugin.php
@@ -225,7 +225,12 @@ class DiasporaPlugin extends Plugin
 
     public function onSalmonSlap($endpoint_uri, MagicEnvelope $magic_env, Profile $target=null)
     {
-        $envxml = $magic_env->toXML($target, 'diaspora');
+        try {
+            $envxml = $magic_env->toXML($target, 'diaspora');
+        } catch (Exception $e) {
+            common_log(LOG_ERR, sprintf('Could not generate Magic Envelope XML (diaspora flavour) for profile id=='.$target->getID().': '.$e->getMessage()));
+            return false;
+        }
 
         // Diaspora wants another POST format (base64url-encoded POST variable 'xml')
         $headers = array('Content-Type: application/x-www-form-urlencoded');
diff --git a/plugins/OStatus/OStatusPlugin.php b/plugins/OStatus/OStatusPlugin.php
index 9751772fdc..d455f1f478 100644
--- a/plugins/OStatus/OStatusPlugin.php
+++ b/plugins/OStatus/OStatusPlugin.php
@@ -1407,7 +1407,12 @@ class OStatusPlugin extends Plugin
 
     public function onSalmonSlap($endpoint_uri, MagicEnvelope $magic_env, Profile $target=null)
     {
-        $envxml = $magic_env->toXML($target);
+        try {
+            $envxml = $magic_env->toXML($target);
+        } catch (Exception $e) {
+            common_log(LOG_ERR, sprintf('Could not generate Magic Envelope XML for profile id=='.$target->getID().': '.$e->getMessage()));
+            return false;
+        }
 
         $headers = array('Content-Type: application/magic-envelope+xml');
 

From 39e8c13afbc460f28a309a71dcb5f548f477c775 Mon Sep 17 00:00:00 2001
From: Mikael Nordfeldth <mmn@hethane.se>
Date: Fri, 24 Jun 2016 13:51:40 +0200
Subject: [PATCH 03/10] Properly parse incoming bookmarks

---
 lib/activityobject.php                | 20 +++++++++++++++++---
 plugins/Bookmark/classes/Bookmark.php | 10 +++++-----
 2 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/lib/activityobject.php b/lib/activityobject.php
index ca6390b725..d211136d3c 100644
--- a/lib/activityobject.php
+++ b/lib/activityobject.php
@@ -28,9 +28,7 @@
  * @link      http://status.net/
  */
 
-if (!defined('STATUSNET')) {
-    exit(1);
-}
+if (!defined('GNUSOCIAL')) { exit(1); }
 
 require_once(INSTALLDIR.'/lib/activitystreamjsondocument.php');
 
@@ -269,6 +267,22 @@ class ActivityObject
         if (empty($this->id) && !empty($this->link)) { // fallback if there's no ID
             $this->id = $this->link;
         }
+
+        $els = $element->childNodes;
+        $out = array();
+
+        for ($i = 0; $i < $els->length; $i++) {
+            $link = $els->item($i);
+            if ($link->localName == ActivityUtils::LINK && $link->namespaceURI == ActivityUtils::ATOM) {
+                $attrs = array();
+                foreach ($link->attributes as $attrName=>$attrNode) {
+                    $attrs[$attrName] = $attrNode->nodeValue;
+                }
+                $this->extra[] = [$link->localName,
+                                    $attrs,
+                                    $link->nodeValue];
+            }
+        }
     }
 
     // @todo FIXME: rationalize with Activity::_fromRssItem()
diff --git a/plugins/Bookmark/classes/Bookmark.php b/plugins/Bookmark/classes/Bookmark.php
index b593bc1909..02b4d3d2e3 100644
--- a/plugins/Bookmark/classes/Bookmark.php
+++ b/plugins/Bookmark/classes/Bookmark.php
@@ -162,19 +162,19 @@ class Bookmark extends Managed_DataObject
         $url = null;
         // each extra element is array('tagname', array('attr'=>'val', ...), 'content')
         foreach ($actobj->extra as $extra) {
-            if ($extra[1]['rel'] !== 'related') {
+            if ($extra[0] !== ActivityUtils::LINK || $extra[1][ActivityUtils::REL] !== 'related') {
                 continue;
             }
-            if ($url===null && strlen($extra[1]['href'])>0) {
-                $url = $extra[1]['href'];
+            if ($url===null && strlen($extra[1][ActivityUtils::HREF])>0) {
+                $url = $extra[1][ActivityUtils::HREF];
             } elseif ($url !== null) {
                 // TRANS: Client exception thrown when a bookmark is formatted incorrectly.
-                throw new ClientException(sprintf(_m('Expected exactly 1 link rel=related in a Bookmark, got %1$d.'), count($relLinkEls)));
+                throw new ClientException(sprintf(_m('Expected exactly 1 link rel=related in a Bookmark, got more than that.')));
             }
         }
         if (is_null($url)) {
             // TRANS: Client exception thrown when a bookmark is formatted incorrectly.
-            throw new ClientException(sprintf(_m('Expected exactly 1 link rel=related in a Bookmark, got %1$d.'), count($relLinkEls)));
+            throw new ClientException(sprintf(_m('Expected exactly 1 link rel=related in a Bookmark, got 0.')));
         }
 
         if (!strlen($actobj->title)) {

From da365be5a2011bcb7939130fa60320f7d7198ed0 Mon Sep 17 00:00:00 2001
From: Mikael Nordfeldth <mmn@hethane.se>
Date: Fri, 24 Jun 2016 14:49:52 +0200
Subject: [PATCH 04/10] ParagonIE\ConstantTime required PHP7, going to v1.x
 branch

---
 extlib/ParagonIE/ConstantTime/Base32.php      | 57 +++++++-------
 extlib/ParagonIE/ConstantTime/Base32Hex.php   |  9 +--
 extlib/ParagonIE/ConstantTime/Base64.php      | 19 ++---
 .../ParagonIE/ConstantTime/Base64DotSlash.php |  5 +-
 .../ConstantTime/Base64DotSlashOrdered.php    |  5 +-
 .../ParagonIE/ConstantTime/Base64UrlSafe.php  |  5 +-
 extlib/ParagonIE/ConstantTime/Binary.php      |  9 +--
 .../ConstantTime/EncoderInterface.php         | 10 +--
 extlib/ParagonIE/ConstantTime/Encoding.php    | 45 ++++++-----
 extlib/ParagonIE/ConstantTime/Hex.php         | 23 ++----
 extlib/ParagonIE/ConstantTime/RFC4648.php     | 31 ++++----
 extlib/ParagonIE/README.md                    | 74 +++++++++++++++++++
 12 files changed, 167 insertions(+), 125 deletions(-)
 create mode 100644 extlib/ParagonIE/README.md

diff --git a/extlib/ParagonIE/ConstantTime/Base32.php b/extlib/ParagonIE/ConstantTime/Base32.php
index a65c1c7343..28b8ca200e 100644
--- a/extlib/ParagonIE/ConstantTime/Base32.php
+++ b/extlib/ParagonIE/ConstantTime/Base32.php
@@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;
 
 /**
@@ -39,9 +38,9 @@ abstract class Base32 implements EncoderInterface
      * @param string $src
      * @return string
      */
-    public static function decode(string $src, bool $strictPadding = false): string
+    public static function decode($src)
     {
-        return static::doDecode($src, false, $strictPadding);
+        return static::doDecode($src, false);
     }
 
     /**
@@ -50,9 +49,9 @@ abstract class Base32 implements EncoderInterface
      * @param string $src
      * @return string
      */
-    public static function decodeUpper(string $src, bool $strictPadding = false): string
+    public static function decodeUpper($src)
     {
-        return static::doDecode($src, true, $strictPadding);
+        return static::doDecode($src, true);
     }
 
     /**
@@ -61,7 +60,7 @@ abstract class Base32 implements EncoderInterface
      * @param string $src
      * @return string
      */
-    public static function encode(string $src): string
+    public static function encode($src)
     {
         return static::doEncode($src, false);
     }
@@ -72,7 +71,7 @@ abstract class Base32 implements EncoderInterface
      * @param string $src
      * @return string
      */
-    public static function encodeUpper(string $src): string
+    public static function encodeUpper($src)
     {
         return static::doEncode($src, true);
     }
@@ -84,7 +83,7 @@ abstract class Base32 implements EncoderInterface
      * @param int $src
      * @return int
      */
-    protected static function decode5Bits(int $src): int
+    protected static function decode5Bits($src)
     {
         $ret = -1;
 
@@ -106,7 +105,7 @@ abstract class Base32 implements EncoderInterface
      * @param int $src
      * @return int
      */
-    protected static function decode5BitsUpper(int $src): int
+    protected static function decode5BitsUpper($src)
     {
         $ret = -1;
 
@@ -126,7 +125,7 @@ abstract class Base32 implements EncoderInterface
      * @param $src
      * @return string
      */
-    protected static function encode5Bits(int $src): string
+    protected static function encode5Bits($src)
     {
         $diff = 0x61;
 
@@ -145,7 +144,7 @@ abstract class Base32 implements EncoderInterface
      * @param $src
      * @return string
      */
-    protected static function encode5BitsUpper(int $src): string
+    protected static function encode5BitsUpper($src)
     {
         $diff = 0x41;
 
@@ -159,12 +158,11 @@ abstract class Base32 implements EncoderInterface
     /**
      * Base32 decoding
      *
-     * @param string $src
+     * @param $src
      * @param bool $upper
-     * @param bool $strictPadding
      * @return string
      */
-    protected static function doDecode(string $src, bool $upper = false, bool $strictPadding = false): string
+    protected static function doDecode($src, $upper = false)
     {
         // We do this to reduce code duplication:
         $method = $upper
@@ -176,24 +174,19 @@ abstract class Base32 implements EncoderInterface
         if ($srcLen === 0) {
             return '';
         }
-        if ($strictPadding) {
-            if (($srcLen & 7) === 0) {
-                for ($j = 0; $j < 7; ++$j) {
-                    if ($src[$srcLen - 1] === '=') {
-                        $srcLen--;
-                    } else {
-                        break;
-                    }
+        if (($srcLen & 7) === 0) {
+            for ($j = 0; $j < 7; ++$j) {
+                if ($src[$srcLen - 1] === '=') {
+                    $srcLen--;
+                } else {
+                    break;
                 }
             }
-            if (($srcLen & 7) === 1) {
-                throw new \RangeException(
-                    'Incorrect padding'
-                );
-            }
-        } else {
-            $src = \rtrim($src, '=');
-            $srcLen = Binary::safeStrlen($src);
+        }
+        if (($srcLen & 7) === 1) {
+            throw new \RangeException(
+                'Incorrect padding'
+            );
         }
 
         $err = 0;
@@ -321,7 +314,7 @@ abstract class Base32 implements EncoderInterface
      * @param bool $upper
      * @return string
      */
-    protected static function doEncode(string $src, bool $upper = false): string
+    protected static function doEncode($src, $upper = false)
     {
         // We do this to reduce code duplication:
         $method = $upper
@@ -393,4 +386,4 @@ abstract class Base32 implements EncoderInterface
         }
         return $dest;
     }
-}
+}
\ No newline at end of file
diff --git a/extlib/ParagonIE/ConstantTime/Base32Hex.php b/extlib/ParagonIE/ConstantTime/Base32Hex.php
index 5aff0a6b3a..f37cf1d4ec 100644
--- a/extlib/ParagonIE/ConstantTime/Base32Hex.php
+++ b/extlib/ParagonIE/ConstantTime/Base32Hex.php
@@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;
 
 /**
@@ -40,7 +39,7 @@ abstract class Base32Hex extends Base32
      * @param int $src
      * @return int
      */
-    protected static function decode5Bits(int $src): int
+    protected static function decode5Bits($src)
     {
         $ret = -1;
 
@@ -60,7 +59,7 @@ abstract class Base32Hex extends Base32
      * @param int $src
      * @return int
      */
-    protected static function decode5BitsUpper(int $src): int
+    protected static function decode5BitsUpper($src)
     {
         $ret = -1;
 
@@ -80,7 +79,7 @@ abstract class Base32Hex extends Base32
      * @param int $src
      * @return string
      */
-    protected static function encode5Bits(int $src): string
+    protected static function encode5Bits($src)
     {
         $src += 0x30;
 
@@ -99,7 +98,7 @@ abstract class Base32Hex extends Base32
      * @param int $src
      * @return string
      */
-    protected static function encode5BitsUpper(int $src): string
+    protected static function encode5BitsUpper($src)
     {
         $src += 0x30;
 
diff --git a/extlib/ParagonIE/ConstantTime/Base64.php b/extlib/ParagonIE/ConstantTime/Base64.php
index df801cc8ec..7e6e24b937 100644
--- a/extlib/ParagonIE/ConstantTime/Base64.php
+++ b/extlib/ParagonIE/ConstantTime/Base64.php
@@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;
 
 /**
@@ -41,7 +40,7 @@ abstract class Base64 implements EncoderInterface
      * @param string $src
      * @return string
      */
-    public static function encode(string $src): string
+    public static function encode($src)
     {
         $dest = '';
         $srcLen = Binary::safeStrlen($src);
@@ -83,18 +82,16 @@ abstract class Base64 implements EncoderInterface
      * Base64 character set "./[A-Z][a-z][0-9]"
      *
      * @param string $src
-     * @param bool $strictPadding
      * @return string|bool
      * @throws \RangeException
      */
-    public static function decode(string $src, bool $strictPadding = false): string
+    public static function decode($src, $strictPadding = false)
     {
         // Remove padding
         $srcLen = Binary::safeStrlen($src);
         if ($srcLen === 0) {
             return '';
         }
-
         if ($strictPadding) {
             if (($srcLen & 3) === 0) {
                 if ($src[$srcLen - 1] === '=') {
@@ -109,11 +106,6 @@ abstract class Base64 implements EncoderInterface
                     'Incorrect padding'
                 );
             }
-            if ($src[$srcLen - 1] === '=') {
-                throw new \RangeException(
-                    'Incorrect padding'
-                );
-            }
         } else {
             $src = \rtrim($src, '=');
             $srcLen = Binary::safeStrlen($src);
@@ -141,7 +133,6 @@ abstract class Base64 implements EncoderInterface
         if ($i < $srcLen) {
             $chunk = \unpack('C*', Binary::safeSubstr($src, $i, $srcLen - $i));
             $c0 = static::decode6Bits($chunk[1]);
-
             if ($i + 2 < $srcLen) {
                 $c1 = static::decode6Bits($chunk[2]);
                 $c2 = static::decode6Bits($chunk[3]);
@@ -151,7 +142,7 @@ abstract class Base64 implements EncoderInterface
                     ((($c1 << 4) | ($c2 >> 2)) & 0xff)
                 );
                 $err |= ($c0 | $c1 | $c2) >> 8;
-            } elseif ($i + 1 < $srcLen) {
+            } elseif($i + 1 < $srcLen) {
                 $c1 = static::decode6Bits($chunk[2]);
                 $dest .= \pack(
                     'C',
@@ -179,7 +170,7 @@ abstract class Base64 implements EncoderInterface
      * @param int $src
      * @return int
      */
-    protected static function decode6Bits(int $src): int
+    protected static function decode6Bits($src)
     {
         $ret = -1;
 
@@ -208,7 +199,7 @@ abstract class Base64 implements EncoderInterface
      * @param int $src
      * @return string
      */
-    protected static function encode6Bits(int $src): string
+    protected static function encode6Bits($src)
     {
         $diff = 0x41;
 
diff --git a/extlib/ParagonIE/ConstantTime/Base64DotSlash.php b/extlib/ParagonIE/ConstantTime/Base64DotSlash.php
index 7f975139b1..160459782e 100644
--- a/extlib/ParagonIE/ConstantTime/Base64DotSlash.php
+++ b/extlib/ParagonIE/ConstantTime/Base64DotSlash.php
@@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;
 
 /**
@@ -44,7 +43,7 @@ abstract class Base64DotSlash extends Base64
      * @param int $src
      * @return int
      */
-    protected static function decode6Bits(int $src): int
+    protected static function decode6Bits($src)
     {
         $ret = -1;
 
@@ -70,7 +69,7 @@ abstract class Base64DotSlash extends Base64
      * @param int $src
      * @return string
      */
-    protected static function encode6Bits(int $src): string
+    protected static function encode6Bits($src)
     {
         $src += 0x2e;
 
diff --git a/extlib/ParagonIE/ConstantTime/Base64DotSlashOrdered.php b/extlib/ParagonIE/ConstantTime/Base64DotSlashOrdered.php
index 3fb4209e68..3f5e6b40b6 100644
--- a/extlib/ParagonIE/ConstantTime/Base64DotSlashOrdered.php
+++ b/extlib/ParagonIE/ConstantTime/Base64DotSlashOrdered.php
@@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;
 
 /**
@@ -44,7 +43,7 @@ abstract class Base64DotSlashOrdered extends Base64
      * @param int $src
      * @return int
      */
-    protected static function decode6Bits(int $src): int
+    protected static function decode6Bits($src)
     {
         $ret = -1;
 
@@ -67,7 +66,7 @@ abstract class Base64DotSlashOrdered extends Base64
      * @param int $src
      * @return string
      */
-    protected static function encode6Bits(int $src): string
+    protected static function encode6Bits($src)
     {
         $src += 0x2e;
 
diff --git a/extlib/ParagonIE/ConstantTime/Base64UrlSafe.php b/extlib/ParagonIE/ConstantTime/Base64UrlSafe.php
index f250095d18..3e4edf8dfe 100644
--- a/extlib/ParagonIE/ConstantTime/Base64UrlSafe.php
+++ b/extlib/ParagonIE/ConstantTime/Base64UrlSafe.php
@@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;
 
 /**
@@ -45,7 +44,7 @@ abstract class Base64UrlSafe extends Base64
      * @param int $src
      * @return int
      */
-    protected static function decode6Bits(int $src): int
+    protected static function decode6Bits($src)
     {
         $ret = -1;
 
@@ -74,7 +73,7 @@ abstract class Base64UrlSafe extends Base64
      * @param int $src
      * @return string
      */
-    protected static function encode6Bits(int $src): string
+    protected static function encode6Bits($src)
     {
         $diff = 0x41;
 
diff --git a/extlib/ParagonIE/ConstantTime/Binary.php b/extlib/ParagonIE/ConstantTime/Binary.php
index 1028e66eda..4447b192e0 100644
--- a/extlib/ParagonIE/ConstantTime/Binary.php
+++ b/extlib/ParagonIE/ConstantTime/Binary.php
@@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;
 
 /**
@@ -43,7 +42,7 @@ abstract class Binary
      * @param string $str
      * @return int
      */
-    public static function safeStrlen(string $str): int
+    public static function safeStrlen($str)
     {
         if (\function_exists('mb_strlen')) {
             return \mb_strlen($str, '8bit');
@@ -65,10 +64,10 @@ abstract class Binary
      * @throws \TypeError
      */
     public static function safeSubstr(
-        string $str,
-        int $start = 0,
+        $str,
+        $start = 0,
         $length = null
-    ): string {
+    ) {
         if (\function_exists('mb_substr')) {
             // mb_substr($str, 0, NULL, '8bit') returns an empty string on PHP
             // 5.3, so we have to find the length ourselves.
diff --git a/extlib/ParagonIE/ConstantTime/EncoderInterface.php b/extlib/ParagonIE/ConstantTime/EncoderInterface.php
index ca699168d2..8ecb45eae5 100644
--- a/extlib/ParagonIE/ConstantTime/EncoderInterface.php
+++ b/extlib/ParagonIE/ConstantTime/EncoderInterface.php
@@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;
 
 /**
@@ -35,18 +34,17 @@ interface EncoderInterface
      * Convert a binary string into a hexadecimal string without cache-timing
      * leaks
      *
-     * @param string $binString (raw binary)
+     * @param string $bin_string (raw binary)
      * @return string
      */
-    public static function encode(string $binString): string;
+    public static function encode($bin_string);
 
     /**
      * Convert a binary string into a hexadecimal string without cache-timing
      * leaks
      *
-     * @param string $encodedString
-     * @param bool $strictPadding Error on invalid padding
+     * @param string $encoded_string
      * @return string (raw binary)
      */
-    public static function decode(string $encodedString, bool $strictPadding = false): string;
+    public static function decode($encoded_string);
 }
diff --git a/extlib/ParagonIE/ConstantTime/Encoding.php b/extlib/ParagonIE/ConstantTime/Encoding.php
index 8ea8aec498..55a3c7821f 100644
--- a/extlib/ParagonIE/ConstantTime/Encoding.php
+++ b/extlib/ParagonIE/ConstantTime/Encoding.php
@@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;
 
 /**
@@ -37,7 +36,7 @@ abstract class Encoding
      * @param $str
      * @return string
      */
-    public static function base32Encode(string $str): string
+    public static function base32Encode($str)
     {
         return Base32::encode($str);
     }
@@ -48,7 +47,7 @@ abstract class Encoding
      * @param $str
      * @return string
      */
-    public static function base32EncodeUpper(string $str): string
+    public static function base32EncodeUpper($str)
     {
         return Base32::encodeUpper($str);
     }
@@ -59,7 +58,7 @@ abstract class Encoding
      * @param $str
      * @return string
      */
-    public static function base32Decode(string $str): string
+    public static function base32Decode($str)
     {
         return Base32::decode($str);
     }
@@ -70,7 +69,7 @@ abstract class Encoding
      * @param $str
      * @return string
      */
-    public static function base32DecodeUpper(string $str): string
+    public static function base32DecodeUpper($str)
     {
         return Base32::decodeUpper($str);
     }
@@ -81,7 +80,7 @@ abstract class Encoding
      * @param $str
      * @return string
      */
-    public static function base32HexEncode(string $str): string
+    public static function base32HexEncode($str)
     {
         return Base32Hex::encode($str);
     }
@@ -93,7 +92,7 @@ abstract class Encoding
      * @param $str
      * @return string
      */
-    public static function base32HexEncodeUpper(string $str): string
+    public static function base32HexEncodeUpper($str)
     {
         return Base32Hex::encodeUpper($str);
     }
@@ -104,7 +103,7 @@ abstract class Encoding
      * @param $str
      * @return string
      */
-    public static function base32HexDecode(string $str): string
+    public static function base32HexDecode($str)
     {
         return Base32Hex::decode($str);
     }
@@ -115,7 +114,7 @@ abstract class Encoding
      * @param $str
      * @return string
      */
-    public static function base32HexDecodeUpper(string $str): string
+    public static function base32HexDecodeUpper($str)
     {
         return Base32Hex::decodeUpper($str);
     }
@@ -126,7 +125,7 @@ abstract class Encoding
      * @param $str
      * @return string
      */
-    public static function base64Encode(string $str): string
+    public static function base64Encode($str)
     {
         return Base64::encode($str);
     }
@@ -137,7 +136,7 @@ abstract class Encoding
      * @param $str
      * @return string
      */
-    public static function base64Decode(string $str): string
+    public static function base64Decode($str)
     {
         return Base64::decode($str);
     }
@@ -149,9 +148,9 @@ abstract class Encoding
      * @param $src
      * @return string
      */
-    public static function base64EncodeDotSlash(string $str): string
+    public static function base64EncodeDotSlash($src)
     {
-        return Base64DotSlash::encode($str);
+        return Base64DotSlash::encode($src);
     }
 
     /**
@@ -163,9 +162,9 @@ abstract class Encoding
      * @return bool|string
      * @throws \RangeException
      */
-    public static function base64DecodeDotSlash(string $str): string
+    public static function base64DecodeDotSlash($src)
     {
-        return Base64DotSlash::decode($str);
+        return Base64DotSlash::decode($src);
     }
 
     /**
@@ -175,9 +174,9 @@ abstract class Encoding
      * @param $src
      * @return string
      */
-    public static function base64EncodeDotSlashOrdered(string $str): string
+    public static function base64EncodeDotSlashOrdered($src)
     {
-        return Base64DotSlashOrdered::encode($str);
+        return Base64DotSlashOrdered::encode($src);
     }
 
     /**
@@ -189,9 +188,9 @@ abstract class Encoding
      * @return bool|string
      * @throws \RangeException
      */
-    public static function base64DecodeDotSlashOrdered(string $str): string
+    public static function base64DecodeDotSlashOrdered($src)
     {
-        return Base64DotSlashOrdered::decode($str);
+        return Base64DotSlashOrdered::decode($src);
     }
 
     /**
@@ -201,7 +200,7 @@ abstract class Encoding
      * @param string $bin_string (raw binary)
      * @return string
      */
-    public static function hexEncode(string $bin_string): string
+    public static function hexEncode($bin_string)
     {
         return Hex::encode($bin_string);
     }
@@ -214,7 +213,7 @@ abstract class Encoding
      * @return string (raw binary)
      * @throws \RangeException
      */
-    public static function hexDecode(string $hex_string): string
+    public static function hexDecode($hex_string)
     {
         return Hex::decode($hex_string);
     }
@@ -226,7 +225,7 @@ abstract class Encoding
      * @param string $bin_string (raw binary)
      * @return string
      */
-    public static function hexEncodeUpper(string $bin_string): string
+    public static function hexEncodeUpper($bin_string)
     {
         return Hex::encodeUpper($bin_string);
     }
@@ -238,7 +237,7 @@ abstract class Encoding
      * @param string $bin_string (raw binary)
      * @return string
      */
-    public static function hexDecodeUpper(string $bin_string): string
+    public static function hexDecodeUpper($bin_string)
     {
         return Hex::decode($bin_string);
     }
diff --git a/extlib/ParagonIE/ConstantTime/Hex.php b/extlib/ParagonIE/ConstantTime/Hex.php
index 1d10937fe3..32962c0ba9 100644
--- a/extlib/ParagonIE/ConstantTime/Hex.php
+++ b/extlib/ParagonIE/ConstantTime/Hex.php
@@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;
 
 /**
@@ -38,7 +37,7 @@ abstract class Hex implements EncoderInterface
      * @param string $bin_string (raw binary)
      * @return string
      */
-    public static function encode(string $bin_string): string
+    public static function encode($bin_string)
     {
         $hex = '';
         $len = Binary::safeStrlen($bin_string);
@@ -62,7 +61,7 @@ abstract class Hex implements EncoderInterface
      * @param string $bin_string (raw binary)
      * @return string
      */
-    public static function encodeUpper(string $bin_string): string
+    public static function encodeUpper($bin_string)
     {
         $hex = '';
         $len = Binary::safeStrlen($bin_string);
@@ -84,29 +83,23 @@ abstract class Hex implements EncoderInterface
      * leaks
      *
      * @param string $hex_string
-     * @param bool $strictPadding
      * @return string (raw binary)
      * @throws \RangeException
      */
-    public static function decode(string $hexString, bool $strictPadding = false): string
+    public static function decode($hex_string)
     {
         $hex_pos = 0;
         $bin = '';
         $c_acc = 0;
-        $hex_len = Binary::safeStrlen($hexString);
+        $hex_len = Binary::safeStrlen($hex_string);
         $state = 0;
         if (($hex_len & 1) !== 0) {
-            if ($strictPadding) {
-                throw new \RangeException(
-                    'Expected an even number of hexadecimal characters'
-                );
-            } else {
-                $hexString = '0' . $hexString;
-                ++$hex_len;
-            }
+            throw new \RangeException(
+                'Expected an even number of hexadecimal characters'
+            );
         }
 
-        $chunk = \unpack('C*', $hexString);
+        $chunk = \unpack('C*', $hex_string);
         while ($hex_pos < $hex_len) {
             ++$hex_pos;
             $c = $chunk[$hex_pos];
diff --git a/extlib/ParagonIE/ConstantTime/RFC4648.php b/extlib/ParagonIE/ConstantTime/RFC4648.php
index 63b2ee69f5..58efdcc8bb 100644
--- a/extlib/ParagonIE/ConstantTime/RFC4648.php
+++ b/extlib/ParagonIE/ConstantTime/RFC4648.php
@@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;
 
 /**
@@ -42,7 +41,7 @@ abstract class RFC4648
      * @param string $str
      * @return string
      */
-    public function base64Encode(string $str): string
+    public function base64Encode($str)
     {
         return Base64::encode($str);
     }
@@ -55,9 +54,9 @@ abstract class RFC4648
      * @param string $str
      * @return string
      */
-    public function base64Decode(string $str): string
+    public function base64Decode($str)
     {
-        return Base64::decode($str, true);
+        return Base64::decode($str);
     }
 
     /**
@@ -68,7 +67,7 @@ abstract class RFC4648
      * @param string $str
      * @return string
      */
-    public function base64UrlSafeEncode(string $str): string
+    public function base64UrlSafeEncode($str)
     {
         return Base64UrlSafe::encode($str);
     }
@@ -81,9 +80,9 @@ abstract class RFC4648
      * @param string $str
      * @return string
      */
-    public function base64UrlSafeDecode(string $str): string
+    public function base64UrlSafeDecode($str)
     {
-        return Base64UrlSafe::decode($str, true);
+        return Base64UrlSafe::decode($str);
     }
 
     /**
@@ -94,7 +93,7 @@ abstract class RFC4648
      * @param string $str
      * @return string
      */
-    public function base32Encode(string $str): string
+    public function base32Encode($str)
     {
         return Base32::encodeUpper($str);
     }
@@ -107,9 +106,9 @@ abstract class RFC4648
      * @param string $str
      * @return string
      */
-    public function base32Decode(string $str): string
+    public function base32Decode($str)
     {
-        return Base32::decodeUpper($str, true);
+        return Base32::decodeUpper($str);
     }
 
     /**
@@ -120,7 +119,7 @@ abstract class RFC4648
      * @param string $str
      * @return string
      */
-    public function base32HexEncode(string $str): string
+    public function base32HexEncode($str)
     {
         return Base32::encodeUpper($str);
     }
@@ -133,9 +132,9 @@ abstract class RFC4648
      * @param string $str
      * @return string
      */
-    public function base32HexDecode(string $str): string
+    public function base32HexDecode($str)
     {
-        return Base32::decodeUpper($str, true);
+        return Base32::decodeUpper($str);
     }
 
     /**
@@ -146,7 +145,7 @@ abstract class RFC4648
      * @param string $str
      * @return string
      */
-    public function base16Encode(string $str): string
+    public function base16Encode($str)
     {
         return Hex::encodeUpper($str);
     }
@@ -159,8 +158,8 @@ abstract class RFC4648
      * @param string $str
      * @return string
      */
-    public function base16Decode(string $str): string
+    public function base16Decode($str)
     {
-        return Hex::decode($str, true);
+        return Hex::decode($str);
     }
 }
\ No newline at end of file
diff --git a/extlib/ParagonIE/README.md b/extlib/ParagonIE/README.md
new file mode 100644
index 0000000000..5e9afc2779
--- /dev/null
+++ b/extlib/ParagonIE/README.md
@@ -0,0 +1,74 @@
+# Constant-Time Encoding
+
+[![Build Status](https://travis-ci.org/paragonie/constant_time_encoding.svg?branch=v1.x)](https://travis-ci.org/paragonie/constant_time_encoding)
+
+Based on the [constant-time base64 implementation made by Steve "Sc00bz" Thomas](https://github.com/Sc00bz/ConstTimeEncoding),
+this library aims to offer character encoding functions that do not leak
+information about what you are encoding/decoding via processor cache 
+misses. Further reading on [cache-timing attacks](http://blog.ircmaxell.com/2014/11/its-all-about-time.html).
+
+Our fork offers the following enchancements:
+
+* `mbstring.func_overload` resistance
+* Unit tests
+* Composer- and Packagist-ready
+* Base16 encoding
+* Base32 encoding
+* Uses `pack()` and `unpack()` instead of `chr()` and `ord()`
+
+## PHP Version Requirements
+
+This library should work on any [supported version of PHP](https://secure.php.net/supported-versions.php).
+It *may* work on earlier versions, but we **do not** guarantee it. If it
+doesn't, we **will not** fix it to work on earlier versions of PHP.
+
+## How to Install
+
+```sh
+composer require paragonie/constant_time_encoding
+```
+
+## How to Use
+
+```php
+use \ParagonIE\ConstantTime\Encoding;
+
+// possibly (if applicable): 
+// require 'vendor/autoload.php';
+
+$data = random_bytes(32);
+echo Encoding::base64Encode($data), "\n";
+echo Encoding::base32EncodeUpper($data), "\n";
+echo Encoding::base32Encode($data), "\n";
+echo Encoding::hexEncode($data), "\n";
+echo Encoding::hexEncodeUpper($data), "\n";
+```
+
+Example output:
+ 
+```
+1VilPkeVqirlPifk5scbzcTTbMT2clp+Zkyv9VFFasE=
+2VMKKPSHSWVCVZJ6E7SONRY3ZXCNG3GE6ZZFU7TGJSX7KUKFNLAQ====
+2vmkkpshswvcvzj6e7sonry3zxcng3ge6zzfu7tgjsx7kukfnlaq====
+d558a53e4795aa2ae53e27e4e6c71bcdc4d36cc4f6725a7e664caff551456ac1
+D558A53E4795AA2AE53E27E4E6C71BDCC4D36CC4F6725A7E664CAFF551456AC1
+```
+
+If you only need a particular variant, you can just reference the 
+required class like so:
+
+```php
+use \ParagonIE\ConstantTime\Base64;
+use \ParagonIE\ConstantTime\Base32;
+
+$data = random_bytes(32);
+echo Base64::encode($data), "\n";
+echo Base32::encode($data), "\n";
+```
+
+Example output:
+
+```
+1VilPkeVqirlPifk5scbzcTTbMT2clp+Zkyv9VFFasE=
+2vmkkpshswvcvzj6e7sonry3zxcng3ge6zzfu7tgjsx7kukfnlaq====
+```
\ No newline at end of file

From c19f87f867d6281890034044f66da8e3d08ed612 Mon Sep 17 00:00:00 2001
From: Mikael Nordfeldth <mmn@hethane.se>
Date: Fri, 24 Jun 2016 15:19:24 +0200
Subject: [PATCH 05/10] fixes issue #189 with a script lacking exception
 handling

---
 plugins/OStatus/scripts/renew-feeds.php | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/plugins/OStatus/scripts/renew-feeds.php b/plugins/OStatus/scripts/renew-feeds.php
index 8f8ac3ee1d..d63f448827 100755
--- a/plugins/OStatus/scripts/renew-feeds.php
+++ b/plugins/OStatus/scripts/renew-feeds.php
@@ -37,7 +37,11 @@ try {
 
 while ($sub->fetch()) {
     echo "Renewing feed subscription\n\tExp.: {$sub->sub_end}\n\tFeed: {$sub->uri}\n\tHub:  {$sub->huburi}\n";
-    $sub->renew();
+    try {
+        $sub->renew();
+    } catch (Exception $e) {
+        echo "FAILED: {$e->getMessage()}\n";
+    }
 }
 
 echo "Done!";

From 0adb7af9a03a16fd45d900c5e15e8d386c454778 Mon Sep 17 00:00:00 2001
From: Mikael Nordfeldth <mmn@hethane.se>
Date: Fri, 24 Jun 2016 15:43:20 +0200
Subject: [PATCH 06/10] Allow a quickHead request, will only return headers

---
 lib/httpclient.php | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/lib/httpclient.php b/lib/httpclient.php
index 1e399bd83e..04a365274d 100644
--- a/lib/httpclient.php
+++ b/lib/httpclient.php
@@ -206,6 +206,29 @@ class HTTPClient extends HTTP_Request2
         return $data;
     }
 
+    /**
+     * If you want an Accept header, put it in $headers
+     */
+    public static function quickHead($url, array $params=array(), array $headers=array())
+    {
+        if (!empty($params)) {
+            $params = http_build_query($params, null, '&');
+            if (strpos($url, '?') === false) {
+                $url .= '?' . $params;
+            } else {
+                $url .= '&' . $params;
+            }
+        }
+
+        $client = new HTTPClient();
+        $response = $client->head($url, $headers);
+        if (!$response->isOk()) {
+            // TRANS: Exception. %s is the URL we tried to GET.
+            throw new Exception(sprintf(_m('Could not GET URL %s.'), $url), $response->getStatus());
+        }
+        return $response->getHeader();
+    }
+
     /**
      * Convenience function to run a GET request.
      *

From f1e3314bb790de9f372b47f3bc5af0f2e85b3710 Mon Sep 17 00:00:00 2001
From: Mikael Nordfeldth <mmn@hethane.se>
Date: Fri, 24 Jun 2016 15:47:02 +0200
Subject: [PATCH 07/10] StoreRemoteMedia avoids too large files

---
 .../StoreRemoteMediaPlugin.php                | 34 +++++++++++++++----
 1 file changed, 28 insertions(+), 6 deletions(-)

diff --git a/plugins/StoreRemoteMedia/StoreRemoteMediaPlugin.php b/plugins/StoreRemoteMedia/StoreRemoteMediaPlugin.php
index f38ca4713e..c9964869a4 100644
--- a/plugins/StoreRemoteMedia/StoreRemoteMediaPlugin.php
+++ b/plugins/StoreRemoteMedia/StoreRemoteMediaPlugin.php
@@ -77,22 +77,44 @@ class StoreRemoteMediaPlugin extends Plugin
             return true;
         }
 
-        if (!$this->checkWhiteList($file->getUrl()) ||
-            !$this->checkBlackList($file->getUrl())) {
+        $remoteUrl = $file->getUrl();
+
+        if (!$this->checkWhiteList($remoteUrl) ||
+            !$this->checkBlackList($remoteUrl)) {
 		    return true;
         }
 
-        // First we download the file to memory and test whether it's actually an image file
-        common_debug(sprintf('Downloading remote file id==%u with URL: %s', $file->getID(), _ve($file->getUrl())));
         try {
-            $imgData = HTTPClient::quickGet($file->getUrl());
+            $http = new HTTPClient();
+            common_debug(sprintf('Performing HEAD request for remote file id==%u to avoid unnecessarily downloading too large files. URL: %s', $file->getID(), $remoteUrl));
+            $head = $http->head($remoteUrl);
+            $headers = $head->getHeader();
+            if (!isset($headers['content-length'])) {
+                // file size not specified on remote server
+                common_debug(sprintf('%s: Ignoring remote media because we did not get a content length for file id==%u', __CLASS__, $file->getID()));
+                return true;
+            } elseif (intval($headers['content-length']) > common_config('attachments', 'file_quota')) {
+                // file too big
+                common_debug(sprintf('%s: Skipping remote media because content length (%u) is larger than file_quota (%u) for file id==%u', __CLASS__, intval($headers['content-length']), common_config('attachments', 'file_quota'), $file->getID()));
+                return true;
+            }
+
+            $remoteUrl = $head->effectiveUrl;   // to avoid going through redirects again
+            if (!$this->checkBlackList($remoteUrl)) {
+                common_log(LOG_WARN, sprintf('%s: Non-blacklisted URL %s redirected to blacklisted URL %s', __CLASS__, $file->getUrl(), $remoteUrl));
+                return true;
+            }
+
+            // Then we download the file to memory and test whether it's actually an image file
+            common_debug(sprintf('Downloading remote file id==%u with effective URL: %s', $file->getID(), _ve($remoteUrl)));
+            $imgData = $http->get($remoteUrl);
         } catch (HTTP_Request2_ConnectionException $e) {
             common_log(LOG_ERR, __CLASS__.': quickGet on URL: '._ve($file->getUrl()).' threw exception: '.$e->getMessage());
             return true;
         }
         $info = @getimagesizefromstring($imgData);
         if ($info === false) {
-            throw new UnsupportedMediaException(_('Remote file format was not identified as an image.'), $file->getUrl());
+            throw new UnsupportedMediaException(_('Remote file format was not identified as an image.'), $remoteUrl);
         } elseif (!$info[0] || !$info[1]) {
             throw new UnsupportedMediaException(_('Image file had impossible geometry (0 width or height)'));
         }

From 1dfac3ad63017071cca551a3e7f557da3f6d24aa Mon Sep 17 00:00:00 2001
From: Mikael Nordfeldth <mmn@hethane.se>
Date: Fri, 24 Jun 2016 15:53:23 +0200
Subject: [PATCH 08/10] Allow getting filesize by function

---
 classes/File.php | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/classes/File.php b/classes/File.php
index c85d919fd7..1a38aefa72 100644
--- a/classes/File.php
+++ b/classes/File.php
@@ -263,6 +263,11 @@ class File extends Managed_DataObject
         return self::tryFilename($this->filename);
     }
 
+    public function getSize()
+    {
+        return intval($this->size);
+    }
+
     // where should the file go?
 
     static function filename(Profile $profile, $origname, $mimetype)

From af23c9f7cd4530c70fcbcceffba278648ec95ab0 Mon Sep 17 00:00:00 2001
From: Mikael Nordfeldth <mmn@hethane.se>
Date: Fri, 24 Jun 2016 15:56:14 +0200
Subject: [PATCH 09/10] StoreRemoteMedia now checks remote filesize before
 downloading

---
 .../StoreRemoteMediaPlugin.php                | 29 +++++++++++--------
 1 file changed, 17 insertions(+), 12 deletions(-)

diff --git a/plugins/StoreRemoteMedia/StoreRemoteMediaPlugin.php b/plugins/StoreRemoteMedia/StoreRemoteMediaPlugin.php
index c9964869a4..36e3544efa 100644
--- a/plugins/StoreRemoteMedia/StoreRemoteMediaPlugin.php
+++ b/plugins/StoreRemoteMedia/StoreRemoteMediaPlugin.php
@@ -85,28 +85,33 @@ class StoreRemoteMediaPlugin extends Plugin
         }
 
         try {
+            /*
             $http = new HTTPClient();
             common_debug(sprintf('Performing HEAD request for remote file id==%u to avoid unnecessarily downloading too large files. URL: %s', $file->getID(), $remoteUrl));
             $head = $http->head($remoteUrl);
-            $headers = $head->getHeader();
-            if (!isset($headers['content-length'])) {
-                // file size not specified on remote server
-                common_debug(sprintf('%s: Ignoring remote media because we did not get a content length for file id==%u', __CLASS__, $file->getID()));
-                return true;
-            } elseif (intval($headers['content-length']) > common_config('attachments', 'file_quota')) {
-                // file too big
-                common_debug(sprintf('%s: Skipping remote media because content length (%u) is larger than file_quota (%u) for file id==%u', __CLASS__, intval($headers['content-length']), common_config('attachments', 'file_quota'), $file->getID()));
-                return true;
-            }
-
             $remoteUrl = $head->effectiveUrl;   // to avoid going through redirects again
             if (!$this->checkBlackList($remoteUrl)) {
                 common_log(LOG_WARN, sprintf('%s: Non-blacklisted URL %s redirected to blacklisted URL %s', __CLASS__, $file->getUrl(), $remoteUrl));
                 return true;
             }
 
+            $headers = $head->getHeader();
+            $filesize = isset($headers['content-length']) ? $headers['content-length'] : null;
+            */
+            $filesize = $file->getSize();
+            if (empty($filesize)) {
+                // file size not specified on remote server
+                common_debug(sprintf('%s: Ignoring remote media because we did not get a content length for file id==%u', __CLASS__, $file->getID()));
+                return true;
+            } elseif ($filesize > common_config('attachments', 'file_quota')) {
+                // file too big
+                common_debug(sprintf('%s: Skipping remote media because content length (%u) is larger than file_quota (%u) for file id==%u', __CLASS__, intval($filesize), common_config('attachments', 'file_quota'), $file->getID()));
+                return true;
+            }
+
+            $http = new HTTPClient();
             // Then we download the file to memory and test whether it's actually an image file
-            common_debug(sprintf('Downloading remote file id==%u with effective URL: %s', $file->getID(), _ve($remoteUrl)));
+            common_debug(sprintf('Downloading remote file id==%u (should be size %u) with effective URL: %s', $file->getID(), $filesize, _ve($remoteUrl)));
             $imgData = $http->get($remoteUrl);
         } catch (HTTP_Request2_ConnectionException $e) {
             common_log(LOG_ERR, __CLASS__.': quickGet on URL: '._ve($file->getUrl()).' threw exception: '.$e->getMessage());

From d7a4098b5606a885f8a8ec2f28cd701c3ac7c689 Mon Sep 17 00:00:00 2001
From: Mikael Nordfeldth <mmn@hethane.se>
Date: Fri, 24 Jun 2016 16:07:57 +0200
Subject: [PATCH 10/10] Use a separate max download limit for remote files than
 file_quota too

---
 plugins/StoreRemoteMedia/StoreRemoteMediaPlugin.php | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/plugins/StoreRemoteMedia/StoreRemoteMediaPlugin.php b/plugins/StoreRemoteMedia/StoreRemoteMediaPlugin.php
index 36e3544efa..64c6355b2b 100644
--- a/plugins/StoreRemoteMedia/StoreRemoteMediaPlugin.php
+++ b/plugins/StoreRemoteMedia/StoreRemoteMediaPlugin.php
@@ -18,6 +18,8 @@ class StoreRemoteMediaPlugin extends Plugin
     public $domain_blacklist = array();
     public $check_blacklist = false;
 
+    public $max_image_bytes = 5242880;  // 5MiB max image size by default
+
     protected $imgData = array();
 
     // these should be declared protected everywhere
@@ -103,16 +105,20 @@ class StoreRemoteMediaPlugin extends Plugin
                 // file size not specified on remote server
                 common_debug(sprintf('%s: Ignoring remote media because we did not get a content length for file id==%u', __CLASS__, $file->getID()));
                 return true;
+            } elseif ($filesize > $this->max_image_bytes) {
+                //FIXME: When we perhaps start fetching videos etc. we'll need to differentiate max_image_bytes from that...
+                // file too big according to plugin configuration
+                common_debug(sprintf('%s: Skipping remote media because content length (%u) is larger than plugin configured max_image_bytes (%u) for file id==%u', __CLASS__, intval($filesize), $this->max_image_bytes, $file->getID()));
+                return true;
             } elseif ($filesize > common_config('attachments', 'file_quota')) {
-                // file too big
+                // file too big according to site configuration
                 common_debug(sprintf('%s: Skipping remote media because content length (%u) is larger than file_quota (%u) for file id==%u', __CLASS__, intval($filesize), common_config('attachments', 'file_quota'), $file->getID()));
                 return true;
             }
 
-            $http = new HTTPClient();
             // Then we download the file to memory and test whether it's actually an image file
             common_debug(sprintf('Downloading remote file id==%u (should be size %u) with effective URL: %s', $file->getID(), $filesize, _ve($remoteUrl)));
-            $imgData = $http->get($remoteUrl);
+            $imgData = HTTPClient::quickGet($remoteUrl);
         } catch (HTTP_Request2_ConnectionException $e) {
             common_log(LOG_ERR, __CLASS__.': quickGet on URL: '._ve($file->getUrl()).' threw exception: '.$e->getMessage());
             return true;