Merge pull request #13308 from MrPetovan/bug/13216-toggle-mobile-local

Rework Module\ToggleMobile to check for local links

src/App/BaseURL.php

@@ -127,4 +127,14 @@ class BaseURL extends Uri implements UriInterface
 		$redirectTo = $this->__toString() . '/' . ltrim($toUrl, '/');
 		System::externalRedirect($redirectTo);
 	}
+
+	public function isLocalUrl(string $url): bool
+	{
+		return strpos(Strings::normaliseLink($url), Strings::normaliseLink((string)$this)) === 0;
+	}
+
+	public function isLocalUri(UriInterface $uri): bool
+	{
+		return $this->isLocalUrl((string)$uri);
+	}
 }

src/Module/ToggleMobile.php

@@ -21,32 +21,43 @@
 
 namespace Friendica\Module;
 
+use Friendica\App;
 use Friendica\BaseModule;
-use Friendica\DI;
+use Friendica\Core\L10n;
+use Friendica\Core\Session\Capability\IHandleSessions;
+use Friendica\Core\System;
+use Friendica\Network\HTTPException\BadRequestException;
+use Friendica\Util;
+use GuzzleHttp\Psr7\Uri;
+use Psr\Log\LoggerInterface;
 
 /**
  * Toggles the mobile view (on/off)
  */
 class ToggleMobile extends BaseModule
 {
-	protected function content(array $request = []): string
+	/** @var IHandleSessions */
+	private $session;
+
+	public function __construct(IHandleSessions $session, L10n $l10n, App\BaseURL $baseUrl, App\Arguments $args, LoggerInterface $logger, Util\Profiler $profiler, Response $response, array $server, array $parameters = [])
 	{
-		$a = DI::app();
+		parent::__construct($l10n, $baseUrl, $args, $logger, $profiler, $response, $server, $parameters);
 
-		if (isset($_GET['off'])) {
+		$this->session = $session;
-			$_SESSION['show-mobile'] = false;
-		} else {
-			$_SESSION['show-mobile'] = true;
 	}
 
-		if (isset($_GET['address'])) {
+	protected function rawContent(array $request = [])
-			$address = $_GET['address'];
+	{
-		} else {
+		$address = $request['address'] ?? '' ?: $this->baseUrl;
-			$address = '';
+
+		$uri = new Uri($address);
+
+		if (!$this->baseUrl->isLocalUri($uri)) {
+			throw new BadRequestException();
 		}
 
-		$a->redirect($address);
+		$this->session->set('show-mobile', !isset($request['off']));
 
-		return '';
+		System::externalRedirect((string)$uri);
 	}
 }

src/Util/Network.php

@@ -640,10 +640,11 @@ class Network
 	 * @param string $url
 	 *
 	 * @return bool
+	 * @deprecated since 2023.09, please use BaseUrl->isLocalUrl or BaseUrl->isLocalUri instead.
 	 */
 	public static function isLocalLink(string $url): bool
 	{
-		return (strpos(Strings::normaliseLink($url), Strings::normaliseLink(DI::baseUrl())) !== false);
+		return DI::baseUrl()->isLocalUrl($url);
 	}
 
 	/**