1 files changed, 57 insertions, 9 deletions

diff --git a/classes/pluginhost.php b/classes/pluginhost.php
index d09ecca17..6158880f2 100755
--- a/classes/pluginhost.php
+++ b/classes/pluginhost.php
@@ -60,6 +60,8 @@ class PluginHost {
 	const HOOK_FILTER_TRIGGERED = 40;
 	const HOOK_GET_FULL_TEXT = 41;
 	const HOOK_ARTICLE_IMAGE = 42;
+	const HOOK_FEED_TREE = 43;
+	const HOOK_IFRAME_WHITELISTED = 44;
 
 	const KIND_ALL = 1;
 	const KIND_SYSTEM = 2;
@@ -128,28 +130,44 @@ class PluginHost {
 		}
 	}
 
-	function add_hook($type, $sender) {
+	function add_hook($type, $sender, $priority = 50) {
+		$priority = (int) $priority;
+
 		if (!is_array($this->hooks[$type])) {
-			$this->hooks[$type] = array();
+			$this->hooks[$type] = [];
+		}
+
+		if (!is_array($this->hooks[$type][$priority])) {
+			$this->hooks[$type][$priority] = [];
 		}
 
-		array_push($this->hooks[$type], $sender);
+		array_push($this->hooks[$type][$priority], $sender);
+		ksort($this->hooks[$type]);
 	}
 
 	function del_hook($type, $sender) {
 		if (is_array($this->hooks[$type])) {
-			$key = array_Search($sender, $this->hooks[$type]);
-			if ($key !== FALSE) {
-				unset($this->hooks[$type][$key]);
+			foreach (array_keys($this->hooks[$type]) as $prio) {
+				$key = array_search($sender, $this->hooks[$type][$prio]);
+
+				if ($key !== FALSE) {
+					unset($this->hooks[$type][$prio][$key]);
+				}
 			}
 		}
 	}
 
 	function get_hooks($type) {
 		if (isset($this->hooks[$type])) {
-			return $this->hooks[$type];
+			$tmp = [];
+
+			foreach (array_keys($this->hooks[$type]) as $prio) {
+				$tmp = array_merge($tmp, $this->hooks[$type][$prio]);
+			}
+
+			return $tmp;
 		} else {
-			return array();
+			return [];
 		}
 	}
 	function load_all($kind, $owner_uid = false, $skip_init = false) {
@@ -170,7 +188,7 @@ class PluginHost {
 
 		foreach ($plugins as $class) {
 			$class = trim($class);
-			$class_file = strtolower(basename($class));
+			$class_file = strtolower(clean_filename($class));
 
 			if (!is_dir(__DIR__."/../plugins/$class_file") &&
 					!is_dir(__DIR__."/../plugins.local/$class_file")) continue;
@@ -475,4 +493,34 @@ class PluginHost {
 	function get_owner_uid() {
 		return $this->owner_uid;
 	}
+
+	// handled by classes/pluginhandler.php, requires valid session
+	function get_method_url($sender, $method, $params)  {
+		return get_self_url_prefix() . "/backend.php?" .
+			http_build_query(
+				array_merge(
+					[
+						"op" => "pluginhandler",
+						"plugin" => strtolower(get_class($sender)),
+						"method" => $method
+					],
+					$params));
+	}
+
+	// WARNING: endpoint in public.php, exposed to unauthenticated users
+	function get_public_method_url($sender, $method, $params)  {
+		if ($sender->is_public_method($method)) {
+			return get_self_url_prefix() . "/public.php?" .
+				http_build_query(
+					array_merge(
+						[
+							"op" => "pluginhandler",
+							"plugin" => strtolower(get_class($sender)),
+							"pmethod" => $method
+						],
+						$params));
+		} else {
+			user_error("get_public_method_url: requested method '$method' of '" . get_class($sender) . "' is private.");
+		}
+	}
 }