From b31fc3bfa939c2b384e86182e57d12188624e909 Mon Sep 17 00:00:00 2001
From: Hypolite Petovan <hypolite@mrpetovan.com>
Date: Sat, 30 Jan 2021 17:52:01 -0500
Subject: [PATCH] Move GET starred/{id} to POST item/{id}/star

---
 src/Module/{Starred.php => Item/Star.php} | 46 +++++++++++++++--------
 static/routes.config.php                  |  2 +-
 view/js/main.js                           |  2 +-
 3 files changed, 33 insertions(+), 17 deletions(-)
 rename src/Module/{Starred.php => Item/Star.php} (60%)

diff --git a/src/Module/Starred.php b/src/Module/Item/Star.php
similarity index 60%
rename from src/Module/Starred.php
rename to src/Module/Item/Star.php
index 8bc0fa3e4e..fb1a5d2044 100644
--- a/src/Module/Starred.php
+++ b/src/Module/Item/Star.php
@@ -19,33 +19,38 @@
  *
  */
 
-namespace Friendica\Module;
+namespace Friendica\Module\Item;
 
 use Friendica\BaseModule;
+use Friendica\Core\Session;
+use Friendica\Core\System;
 use Friendica\DI;
 use Friendica\Model\Item;
 use Friendica\Model\Post;
+use Friendica\Network\HTTPException;
 
 /**
  * Toggle starred items
  */
-class Starred extends BaseModule
+class Star extends BaseModule
 {
 	public static function rawContent(array $parameters = [])
 	{
-		if (!local_user()) {
-			throw new \Friendica\Network\HTTPException\ForbiddenException();
+		$l10n = DI::l10n();
+
+		if (!Session::isAuthenticated()) {
+			throw new HttpException\ForbiddenException($l10n->t('Access denied.'));
 		}
 
-		if (empty($parameters['item'])) {
-			throw new \Friendica\Network\HTTPException\BadRequestException();
+		if (empty($parameters['id'])) {
+			throw new HTTPException\BadRequestException();
 		}
 
-		$itemId = intval($parameters['item']);
+		$itemId = intval($parameters['id']);
 
 		$item = Post::selectFirstForUser(local_user(), ['starred'], ['uid' => local_user(), 'id' => $itemId]);
 		if (empty($item)) {
-			throw new \Friendica\Network\HTTPException\NotFoundException();
+			throw new HTTPException\NotFoundException();
 		}
 
 		$starred = !(bool)$item['starred'];
@@ -53,14 +58,25 @@ class Starred extends BaseModule
 		Item::update(['starred' => $starred], ['id' => $itemId]);
 
 		// See if we've been passed a return path to redirect to
-		$returnPath = $_REQUEST['return'] ?? '';
-		if (!empty($returnPath)) {
-			$rand = '_=' . time() . (strpos($returnPath, '?') ? '&' : '?') . 'rand';
-			DI::baseUrl()->redirect($returnPath . $rand);
+		$return_path = $_REQUEST['return'] ?? '';
+		if (!empty($return_path)) {
+			$rand = '_=' . time();
+			if (strpos($return_path, '?')) {
+				$rand = "&$rand";
+			} else {
+				$rand = "?$rand";
+			}
+
+			DI::baseUrl()->redirect($return_path . $rand);
 		}
 
-		// the json doesn't really matter, it will either be 0 or 1
-		echo json_encode((int)$starred);
-		exit();
+		$return = [
+			'status'  => 'ok',
+			'item_id' => $itemId,
+			'verb'    => 'star',
+			'state'   => (int)$starred,
+		];
+
+		System::jsonExit($return);
 	}
 }
diff --git a/static/routes.config.php b/static/routes.config.php
index 6acad3827e..7d1d9a1bfc 100644
--- a/static/routes.config.php
+++ b/static/routes.config.php
@@ -294,6 +294,7 @@ return [
 		'/{id:\d+}/activity/{verb}' => [Module\Item\Activity::class,    [        R::POST]],
 		'/{id:\d+}/ignore'          => [Module\Item\Ignore::class,      [        R::POST]],
 		'/{id:\d+}/pin'             => [Module\Item\Pin::class,         [        R::POST]],
+		'/{id:\d+}/star'            => [Module\Item\Star::class,        [        R::POST]],
 	],
 
 	'/localtime'          => [Module\Debug\Localtime::class, [R::GET, R::POST]],
@@ -412,7 +413,6 @@ return [
 	'/rsd.xml'                       => [Module\ReallySimpleDiscovery::class, [R::GET]],
 	'/smilies[/json]'                => [Module\Smilies::class,               [R::GET]],
 	'/statistics.json'               => [Module\Statistics::class,            [R::GET]],
-	'/starred/{item:\d+}'            => [Module\Starred::class,               [R::GET]],
 	'/toggle_mobile'                 => [Module\ToggleMobile::class,          [R::GET]],
 	'/tos'                           => [Module\Tos::class,                   [R::GET]],
 
diff --git a/view/js/main.js b/view/js/main.js
index d1976fdaa9..0b9c1da283 100644
--- a/view/js/main.js
+++ b/view/js/main.js
@@ -685,7 +685,7 @@ function dosubthread(ident) {
 function doStar(ident) {
 	ident = ident.toString();
 	$('#like-rotator-' + ident).show();
-	$.get('starred/' + ident)
+	$.post('item/' + ident + '/star')
 	.then(function(data) {
 		if (data.state === 1) {
 			$('#starred-' + ident)