From 06d918d575cfb112b8719b0441548d55e679fe51 Mon Sep 17 00:00:00 2001
From: Zach Copley <zach@status.net>
Date: Tue, 5 Oct 2010 01:21:50 +0000
Subject: [PATCH] Strip out the special 'p' paramter added by index.php from
 $_SERVER['QUERY_STRING'] before doing OAuth requests. Required by the latest
 version of the OAuth lib.

---
 lib/apioauth.php | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/lib/apioauth.php b/lib/apioauth.php
index 1c87e42324..3f71de0c35 100644
--- a/lib/apioauth.php
+++ b/lib/apioauth.php
@@ -86,11 +86,18 @@ class ApiOauthAction extends Action
         }
 
         // strip out the p param added in index.php
-
-        // XXX: should we strip anything else?  Or alternatively
-        // only allow a known list of params?
         unset($_GET['p']);
         unset($_POST['p']);
+        unset($_REQUEST['p']);
+
+        $queryArray = explode('&', $_SERVER['QUERY_STRING']);
+        for ($i = 0; $i < sizeof($queryArray); $i++) {
+            if (substr($queryArray[$i], 0, 1) == 'p=') {
+                unset($queryArray[$i]);
+            }
+        }
+
+        $_SERVER['QUERY_STRING'] = implode('&', $queryString);
     }
 
     function getCallback($url, $params)