From 469118baba078e067c710e1f7ab83152ecedb23f Mon Sep 17 00:00:00 2001
From: Alex Grintsvayg <grin@lbry.io>
Date: Thu, 8 Sep 2016 11:08:12 -0400
Subject: [PATCH] fix xss, remove broken post

---
 content/news/04-meet-the-lbry-founders.md |  9 ------
 controller/Controller.class.php           |  1 +
 controller/Request.class.php              |  5 ++++
 controller/Session.class.php              |  8 +-----
 controller/action/MailActions.class.php   | 20 +++++--------
 controller/action/OpsActions.class.php    | 16 +++++------
 lib/exception/StopException.class.php     |  5 ----
 lib/i18n.class.php                        |  5 ----
 model/CreditApi.class.php                 | 34 -----------------------
 view/Response.class.php                   |  5 ----
 10 files changed, 22 insertions(+), 86 deletions(-)
 delete mode 100644 content/news/04-meet-the-lbry-founders.md
 delete mode 100644 model/CreditApi.class.php

diff --git a/content/news/04-meet-the-lbry-founders.md b/content/news/04-meet-the-lbry-founders.md
deleted file mode 100644
index d7d3ac19..00000000
--- a/content/news/04-meet-the-lbry-founders.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-author: jeremy
-title: Meet the LBRY Founders
-date: '2015-07-28 15:00:00'
----
-
-Here about LBRY straight from the horse's mouth. If there were two horses, that is. And the horses had created a revolutionary system for distributing information.
-
-<iframe width="770" height="433" src="https://www.youtube.com/embed/0fDrBROywZ0" frameborder="0" allowfullscreen style="margin-left: auto; margin-right: auto"></iframe>
\ No newline at end of file
diff --git a/controller/Controller.class.php b/controller/Controller.class.php
index a4d8fb47..768a266c 100644
--- a/controller/Controller.class.php
+++ b/controller/Controller.class.php
@@ -100,6 +100,7 @@ class Controller
       '/why'                       => '/learn',
       '/feedback'                  => '/learn',
       '/faq/when-referral-payouts' => '/faq/referrals',
+      '/news/meet-the-lbry-founders' => '/team',
     ];
 
     $tempRedirects = [
diff --git a/controller/Request.class.php b/controller/Request.class.php
index 3337a4e0..ab4b1091 100644
--- a/controller/Request.class.php
+++ b/controller/Request.class.php
@@ -14,6 +14,11 @@ class Request
     return $_POST[$key] ?? $_GET[$key] ?? $default;
   }
 
+  public static function getPostParam(string $key, $default = null)
+  {
+    return $_POST[$key] ?? $default;
+  }
+
   public static function getMethod(): string
   {
     if (!static::$method)
diff --git a/controller/Session.class.php b/controller/Session.class.php
index 6b923ca3..65f77548 100644
--- a/controller/Session.class.php
+++ b/controller/Session.class.php
@@ -1,14 +1,8 @@
 <?php
 
-/**
- * Very basic wrapper since replacing $_SESSION might happen at scale + convenience methods
- *
- * @author jeremy
- */
 class Session
 {
-  const KEY_MAILCHIMP_LIST_IDS = 'mailchimp_list_ids',
-        KEY_DOWNLOAD_ACCESS_ERROR = 'download_error2',
+  const KEY_DOWNLOAD_ACCESS_ERROR = 'download_error2',
         KEY_DOWNLOAD_ALLOWED = 'beta_download_allowed2',
         KEY_PREFINERY_USER_ID = 'prefinery_user_id',
         KEY_PREFINER_USED_CUSTOM_CODE = 'prefinery_used_custom_code',
diff --git a/controller/action/MailActions.class.php b/controller/action/MailActions.class.php
index 9f0edd42..45d03832 100644
--- a/controller/action/MailActions.class.php
+++ b/controller/action/MailActions.class.php
@@ -1,42 +1,36 @@
 <?php
 
-/**
- * Description of MailActions
- *
- * @author jeremy
- */
 class MailActions extends Actions
 {
   public static function executeListSubscribe()
   {
-    $nextUrl = isset($_POST['returnUrl']) && $_POST['returnUrl'] ? $_POST['returnUrl'] : '/join-list';
+    $nextUrl = Request::getPostParam('returnUrl', '/join-list');
 
     if (!Request::isPost())
     {
       return Controller::redirect($nextUrl);
     }
 
-    Session::set(Session::KEY_LIST_SUB_SIGNATURE, $_POST['listSig'] ?? true);
+    Session::set(Session::KEY_LIST_SUB_SIGNATURE, Request::getPostParam('listSig', true));
 
-    $email = $_POST['email'];
+    $email = Request::getPostParam('email');
     if (!$email|| !filter_var($email, FILTER_VALIDATE_EMAIL))
     {
       Session::set(Session::KEY_LIST_SUB_ERROR, $email ? __('Please provide a valid email address.') : __('Please provide an email address.'));
     }
-    elseif (!$_POST['listId'])
+    elseif (!Request::getPostParam('listId'))
     {
       Session::set(Session::KEY_LIST_SUB_ERROR, __('List not provided.'));
     }
     else
     {
-      $mcListId = $_POST['listId'];
-      $mergeFields = isset($_POST['mergeFields']) ? (unserialize($_POST['mergeFields']) ?: []) : [];
+      $mcListId = htmlspecialchars(Request::getPostParam('listId'));
+      $mergeFields = Request::getPostParam('mergeFields') ? (unserialize(Request::getPostParam('mergeFields')) ?: []) : [];
       try
       {
         static::subscribeToMailchimp($email, $mcListId, $mergeFields);
-        Session::set(Session::KEY_MAILCHIMP_LIST_IDS, array_merge(Session::get(Session::KEY_MAILCHIMP_LIST_IDS, []), [$mcListId]));
         Session::set(Session::KEY_LIST_SUB_SUCCESS, true);
-        Session::set(Session::KEY_LIST_SUB_FB_EVENT, $_POST['fbEvent'] ?? null);
+        Session::set(Session::KEY_LIST_SUB_FB_EVENT, Request::getPostParam('fbEvent') ?? null);
       }
       catch (MailchimpSubscribeException $e)
       {
diff --git a/controller/action/OpsActions.class.php b/controller/action/OpsActions.class.php
index 05252a13..b3508bbf 100644
--- a/controller/action/OpsActions.class.php
+++ b/controller/action/OpsActions.class.php
@@ -40,17 +40,17 @@ class OpsActions extends Actions
 
   public static function executeLogUpload(): array
   {
-    $log = isset($_POST['log']) ? urldecode($_POST['log']) : null;
-    if (isset($_POST['name']))
+    $log = Request::getPostParam('log') ? urldecode(Request::getPostParam('log')) : null;
+    if (Request::getPostParam('name'))
     {
-      $name = substr(trim(urldecode($_POST['name'])), 0, 50);
+      $name = substr(trim(urldecode(Request::getPostParam('name'))), 0, 50);
     }
-    elseif (isset($_POST['date']))
+    elseif (Request::getPostParam('date'))
     {
-      $name = substr(trim(urldecode($_POST['date'])), 0, 20) . '_' .
-              substr(trim(urldecode($_POST['hash'])), 0, 20) . '_' .
-              substr(trim(urldecode($_POST['sys'])), 0, 50) . '_' .
-              substr(trim(urldecode($_POST['type'])), 0, 20);
+      $name = substr(trim(urldecode(Request::getPostParam('date'))), 0, 20) . '_' .
+              substr(trim(urldecode(Request::getPostParam('hash'))), 0, 20) . '_' .
+              substr(trim(urldecode(Request::getPostParam('sys'))), 0, 50) . '_' .
+              substr(trim(urldecode(Request::getPostParam('type'))), 0, 20);
     }
     else
     {
diff --git a/lib/exception/StopException.class.php b/lib/exception/StopException.class.php
index 81e2d9d1..ad3dc43d 100644
--- a/lib/exception/StopException.class.php
+++ b/lib/exception/StopException.class.php
@@ -1,10 +1,5 @@
 <?php
 
-/**
- * Used to immediately end execution
- *
- * @author jeremy
- */
 class StopException extends Exception
 {
   
diff --git a/lib/i18n.class.php b/lib/i18n.class.php
index 3b70fc5d..25498bd8 100644
--- a/lib/i18n.class.php
+++ b/lib/i18n.class.php
@@ -8,11 +8,6 @@ function __($msg, $args = [])
   return strtr(i18n::translate($msg), $args);
 }
 
-/**
- * Description of i18n
- *
- * @author jeremy
- */
 class i18n
 {
   protected static
diff --git a/model/CreditApi.class.php b/model/CreditApi.class.php
deleted file mode 100644
index b9f43994..00000000
--- a/model/CreditApi.class.php
+++ /dev/null
@@ -1,34 +0,0 @@
-<?php
-
-/**
- * Description of CreditApi
- *
- * @author jeremy
- */
-class CreditApi
-{
-  public static function getCurrentTestCreditReward()
-  {
-    return 1000;
-  }
-  
-  public static function getTotalDollarSales()
-  {
-    return 22585;
-  }
-
-  public static function getTotalPeople()
-  {
-    $rawJSON = @file_get_contents('https://spreadsheets.google.com/feeds/cells/1iOC1o5jq_4ySwRzsy2tZPPltw6Tbky2e3lDFdsWV8dU/okf1n52/public/full/R1C1?alt=json');
-    $json = $rawJSON ? json_decode($rawJSON, true) : [];
-    return isset($json['entry']) && isset($json['entry']['content']) && is_numeric($json['entry']['content']['$t'] ) ?
-              $json['entry']['content']['$t'] :
-              6687; //fallback #
-  }
-
-  public static function getCreditsPerDollar($days)
-  {
-    //naive algo = decrease 0.5% per day
-    return 200 * max(0, 100 - $days / 2) / 100;
-  }
-}
diff --git a/view/Response.class.php b/view/Response.class.php
index f134b780..10689a7c 100644
--- a/view/Response.class.php
+++ b/view/Response.class.php
@@ -1,10 +1,5 @@
 <?php
 
-/**
- * Description of Response
- *
- * @author jeremy
- */
 class Response
 {
   const HEADER_STATUS   = 'Status';