servers
/
ttrss
mirror of https://tt-rss.org/git/tt-rss.git
1
0
Fork 0
Code Issues Releases Wiki Activity
11,750 Commits 34 Branches 0 Tags 148 MiB
Commit Graph

1626 Commits

Author SHA1 Message Date
Andrew Dolgov 9d7ba773ec move session-related functions to their own namespace 2021-02-16 17:13:16 +03:00
Andrew Dolgov 7fad6ce651 move rgb/hsl functions to their own namespace 2021-02-16 17:07:23 +03:00
Andrew Dolgov bdbbdbb0ed rework controls to accept parameters as array 2021-02-16 16:59:21 +03:00
Andrew Dolgov 627af2c236 amend previous to fix actual underlying problem (double escaping) 2021-02-16 15:36:40 +03:00
Andrew Dolgov 4f4e57bb26 hidden_tag: temporarily prevent htmlspecialchars() to stop embedded JSON from breaking 2021-02-16 15:27:22 +03:00
Andrew Dolgov af4b3e7df0 login form: use control helpers 2021-02-16 15:05:32 +03:00
Andrew Dolgov d7127cead3 feed debugger: use hidden helpers; add button helpers 2021-02-16 14:42:27 +03:00
Andrew Dolgov 26d6b84a57 add namespaced controls with unified naming; deprecated old-style control shortcuts 2021-02-16 14:23:00 +03:00
Andrew Dolgov 5d42ce553f drop legacy DB interface and related sanity checks 2021-02-15 16:55:55 +03:00
Andrew Dolgov 9f55454f63 remove the rest of db.php; rename some leftover methods in feeds 2021-02-15 16:51:35 +03:00
Andrew Dolgov cfad740c99 drop legacy db_ functions wrapper 2021-02-15 16:38:18 +03:00
Andrew Dolgov 020f062a76 feeds: unify naming 2021-02-15 15:43:07 +03:00
Andrew Dolgov 82adb01307 render enclosures on the client 2021-02-15 14:10:46 +03:00
Andrew Dolgov 15fd23c374 use shortcut echo syntax for php templates 2021-02-14 09:15:51 +03:00
Andrew Dolgov 103d30ad3f batch subscribe: use client dialog 2021-02-13 22:16:17 +03:00
Andrew Dolgov 6af83e3881 drop ENABLE_GZIP_OUTPUT; system prefs: load php info only if needed 2021-02-12 21:43:38 +03:00
Andrew Dolgov 119a4226d8 validate_csrf: remove warning 2021-02-12 21:21:23 +03:00
Andrew Dolgov f2d3cba231 add HTTP_ACCEPT_LANGUAGE handling for php8 2021-02-12 21:20:04 +03:00
Andrew Dolgov 1f2ba932b8 RIP easy-installer 2021-02-12 15:59:19 +03:00
Andrew Dolgov d23a261b92 RIP self-registration 2021-02-12 15:57:43 +03:00
Andrew Dolgov 8f8675a26a * filters: remove duplicate code, overall cleanup 
* check if some tres exist before trying to reload them
 2021-02-12 14:31:36 +03:00
Andrew Dolgov 848bc57f29 disable themes in safe mode; rework safe mode warning/login prompt 2021-02-11 21:19:57 +03:00
Andrew Dolgov cc646790fd format_backtrace: don't try to use resources as strings 2021-02-11 10:29:42 +03:00
Andrew Dolgov 7833760fa0 make feed/cat nested dropdowns a bit more readable 2021-02-10 08:58:31 +03:00
Andrew Dolgov 7874f6ac58 remove PHPMD.UnusedFormalParameter 2021-02-08 19:42:10 +03:00
Andrew Dolgov 942afb43a1 sanity checks: use better CLI detection, shorten most of the text 2021-02-08 08:49:21 +03:00
Andrew Dolgov 10392ecc28 event log: add pagination 2021-02-06 10:10:54 +03:00
Andrew Dolgov 8b39e6bca7 _color_pack: define variable before using 2021-02-06 09:29:31 +03:00
Andrew Dolgov a544123b59 fix clean() for arrays and user plugin list 2021-02-06 00:17:41 +03:00
Andrew Dolgov 6e774a58fe more php8 fixes mostly related to login 2021-02-06 00:12:15 +03:00
Andrew Dolgov 403dca154c initial WIP for php8; bump php version requirement to 7.0 2021-02-05 23:41:32 +03:00
Andrew Dolgov 33a5ecd2ce feed editor: show purge interval correctly if FORCE_ARTICLE_PURGE is set 2021-01-07 18:16:42 +03:00
Andrew Dolgov f59c567831 update_rss_feed: fix BLACKLISTED_TAGS not working properly, simplify tag-related code 2020-12-20 23:12:45 +03:00
wn c68f2aabc9 Make 'ttrss_error_handler' compatible w/ 8. 
2d467abc46/UPGRADING (L43)
2d467abc46/UPGRADING (L63)
 2020-12-12 10:28:52 -06:00
wn 936b91a7e6 Don't do deprecated 'libxml_disable_entity_loader(true)' under PHP 8. 
2d467abc46/UPGRADING (L886)
 2020-12-12 10:28:49 -06:00
wn 6bdf4a1a25 Switch to 'get_error_types()' to ensure availability in 'include/functions.php'. 
The global in 'sanity_check()' was null... possibly due to circular requires?
 2020-12-12 10:28:48 -06:00
wn 08a6f6bde2 Only do sanity checks for self URL if we can create a valid URL. 
'sanity_check.php' gets included in 'update.php' and 'update_daemon2.php', where a Host request header is likely not provided.
 2020-12-12 10:28:47 -06:00
Andrew Dolgov 65254f5db4 - move sphinx plugin to a separate repo 
- regenerate config checks without sphinx-related variables
 2020-12-11 09:48:34 +03:00
Andrew Dolgov 81c52b4b1e add support for an override stylesheet which applies to all users 2020-11-30 15:53:32 +03:00
Andrew Dolgov 24cdacd59e enable Farsi locale in the UI 2020-10-01 10:19:04 +03:00
Andrew Dolgov 8a02a728c8 add DAEMON_UNSUCCESSFUL_DAYS_LIMIT tunable (defaults to 30 days) 2020-09-30 17:03:16 +03:00
Andrew Dolgov da5deaaca1 set session.cookie_lifetime to 0 initially instead of a rather useless min() 2020-09-30 14:43:53 +03:00
Andrew Dolgov de22464ea8 schema: add ttrss_feeds.last_successful_update 2020-09-28 14:14:06 +03:00
Andrew Dolgov 215f388992 move timestamp-related stuff to a separate class 2020-09-23 13:04:26 +03:00
Andrew Dolgov 74568df4ff remove a lot of stuff from global context (functions.php), add a few helper classes instead 2020-09-22 09:04:33 +03:00
Andrew Dolgov d04ac399ff clarify some URL validation-related error messages 2020-09-21 20:37:29 +03:00
Andrew Dolgov 3dd4169b5f clarify some URL validation-related error messages 2020-09-21 20:35:24 +03:00
Andrew Dolgov 4785f21316 update_rss_feed: log effective URL after fetching 
validate_url: treat scheme as case-insensitive
 2020-09-21 20:26:57 +03:00
Andrew Dolgov 486f1d84ed resolve_redirects: fix previous 2020-09-20 18:14:34 +03:00
Andrew Dolgov d2867d887a resolve_redirects: only use three argument version of get_headers() on php 7.1+ 2020-09-20 17:27:04 +03:00
Andrew Dolgov 03a337a660 add basic safe mode which doesn't load any user plugins 2020-09-18 15:48:22 +03:00
Andrew Dolgov 4efc3d7b3f validate_url: relax requirements for URLs, limit additional port/loopback filtering to fetch_file_contents() 2020-09-17 20:20:23 +03:00
Andrew Dolgov a4525d31b2 replace FALSE with false so that static analyzer shuts up about it 2020-09-17 19:02:27 +03:00
Andrew Dolgov 57fac84516 rename gettext.inc to gettext.inc.php (cosmetic) 2020-09-17 18:56:29 +03:00
Andrew Dolgov c25edd0024 fetch_file_contents: validate effective URL (after redirects) without CURL 2020-09-17 16:17:33 +03:00
Andrew Dolgov 27e695436f fetch_file_contents: validate effective URL (after redirects) if using CURL 2020-09-17 15:53:13 +03:00
Andrew Dolgov 5a7e7e1367 don't try to call hash_equals() on unset user token 2020-09-17 10:20:55 +03:00
Andrew Dolgov f72e6947d5 use hash_equals() correctly 2020-09-17 10:04:00 +03:00
Andrew Dolgov e3adacc588 fix several cases of Db class being invoked as wrong name (as DB) 2020-09-17 09:18:03 +03:00
Andrew Dolgov 16c86e2fc3 replace some plain http links with https 2020-09-17 09:02:30 +03:00
Andrew Dolgov a817d3794d * use get_random_bytes() for CSRF token 
* get_random_bytes: use PHP7 random_bytes() if it is available
* validate CSRF token using hash_equals
 2020-09-17 08:59:18 +03:00
Andrew Dolgov 1f79d614c4 fix OTP QR code not displayed because of CSRF token passed as a query 
parameter
use type-strict comparison when validating CSRF token on the backend
 2020-09-17 08:43:39 +03:00
Andrew Dolgov 6a4b6cf603 amend previous to 127/8 subnet 2020-09-17 07:37:48 +03:00
Andrew Dolgov 213d6330b1 fetch_file_contents: resolve requested hosts and check for possible 
loopback address
 2020-09-17 07:36:47 +03:00
Andrew Dolgov 88c4dc405e build_url: also put query parameters and fragment in resulting URL 
rewrite_relative_url: simplify handling of relative URLs
 2020-09-16 21:41:05 +03:00
Andrew Dolgov da5af2fae0 cached_url: block SVG images because of potential javascript inside 2020-09-16 16:25:20 +03:00
Andrew Dolgov aeaafefa07 don't pass csrf token as a GET parameter to Article 2020-09-15 16:03:09 +03:00
Andrew Dolgov 1621abcffc rewrite_relative_url: validate resulting absolutized URLs 2020-09-15 10:41:57 +03:00
Andrew Dolgov aa89ea7769 validate_url: only allow safe ports (80, 443), disallow access to loopback 2020-09-15 10:39:09 +03:00
Andrew Dolgov 6c02fea641 validate_url: add clean() 2020-09-15 08:45:15 +03:00
Andrew Dolgov 4abc7d7898 rename base64_img() to image_to_base64() 2020-09-15 08:05:01 +03:00
Andrew Dolgov 1ee458b5c1 cached_url: perform mimetype validation before possible HOOK_SEND_LOCAL_FILE hooks 2020-09-15 07:54:46 +03:00
Andrew Dolgov b4cb67e77f remove csrf token from rpc method sanityCheck 2020-09-14 20:00:01 +03:00
Andrew Dolgov c3d14e1fa5 - fix multiple vulnerabilities in af_proxy_http 
- fix vulnerability in rewrite_relative_url() which prevented some URLs from being properly absolutized
- fetch_file_contents: validate all URLs before requesting them
- validate URLs: explicitly whitelist http and https scheme, forbid everything else
- DiskCache/cached_url: only serve whitelisted content types (images, video)
- simplify filename/URL handling code, remove and consolidate some less-used functions
 2020-09-14 19:46:52 +03:00
Rodney Stromlund 376dce02bb Update wiki and forums links in error message. 2020-07-13 09:06:59 -05:00
Andrew Dolgov 6eb94f1e13 better support for image srcset attributes as discussed in https://community.tt-rss.org/t/problem-with-img-srcset/3519 2020-06-15 11:58:59 +03:00
Andrew Dolgov 19893d33e3 only bind up/down in 3 panel mode 2020-05-23 08:53:18 +03:00
Andrew Dolgov ebb373987a Revert "unbind up/down by default (use native scrolling for consistency with pgup/pgdn)" 
This reverts commit 6fc18e450b.
 2020-05-23 08:39:44 +03:00
Andrew Dolgov 6fc18e450b unbind up/down by default (use native scrolling for consistency with pgup/pgdn) 2020-05-23 08:38:03 +03:00
Andrew Dolgov 9ae9302b6b implement keyboard-related changes discussed in https://community.tt-rss.org/t/changing-the-amount-of-scroll-by-arrow-key/3452/7 2020-05-17 08:25:51 +03:00
JustAMacUser 7a0ea9d90e Make iframes size responsively. 2020-05-15 22:25:56 -04:00
Andrew Dolgov 2b55afbeec sanitize: forbid "allow" attribute 
CSS: remove auto hyphens stuff, remove iframe width clipping to 98% because they get squished
 2020-05-09 12:49:19 +03:00
Andrew Dolgov 2558fcbe21 add hotkey "\" to cancel current search 2020-05-09 07:56:06 +03:00
Andrew Dolgov e934e9f05e sanitize: simplify initial attribute processing 2020-04-29 19:12:29 +03:00
Andrew Dolgov 7d9dd51cf4 sanitize: remove srcset plain-http hack, globally disallow width and height attributes for all elements 2020-04-29 19:04:34 +03:00
Andrew Dolgov 83c8834421 sanitize: handle picture[@srcset] elements properly, i.e. rewrite relative URLs 2020-04-29 19:02:44 +03:00
Martin Stone 1ad43dd202
Fix documentation for _noexpand commands 2020-03-25 20:30:34 +00:00
Toby Simmons 569228a5df In get_version() disable DIRECTORY_SEPARATOR check, permit using git on Windows to get version details; 2020-03-02 11:28:21 -06:00
Andrew Dolgov 4e74da590e af_readability: allow get full text button to work as a toggle; in cdm, scroll to article after embedding 2020-02-28 08:03:25 +03:00
Andrew Dolgov 07b27b375f update toggle_embed_original hotkey to invoke readability embed instead of removed embed_original plugin 2020-02-27 09:47:20 +03:00
Andrew Dolgov 4ab3854aed don't generate default.css, replace with themes/light.css as a default root CSS file 2020-02-22 16:22:44 +03:00
Andrew Dolgov 06b9d39662 add support for image loading=lazy attribute 2020-02-13 20:20:55 +03:00
Andrew Dolgov 076c5382fa login form: add workarounds for chrome password manager 2020-01-25 17:00:51 +03:00
Andrew Dolgov 6080cca9ca scrap counter cache system; rework counters to sum() booleans instead 2020-01-24 14:25:31 +03:00
Andrew Dolgov a6d314b753 support dark mode for login form 2020-01-23 13:14:47 +03:00
Andrew Dolgov 01513aa41b disable MAX_FETCH_REQUESTS_PER_HOST warnings for the time being 2020-01-17 07:26:55 +03:00
Andrew Dolgov 5fc499e19e get_version: don't rely on exec() exit code to determine whether output is valid 2020-01-14 20:50:40 +03:00
Andrew Dolgov fdb1fc7608 get_version: fix commit/timestamp lost on subsequent invocations because of misbehaving caching 2019-12-20 18:17:05 +03:00
Andrew Dolgov 6439f7817d force-disable php display_errors/display_startup_errors on startup 2019-12-19 08:37:19 +03:00
Andrew Dolgov c309856a97 get_version: filter out Darwin 2019-12-19 07:04:01 +03:00
Andrew Dolgov 74feef0f9d get_version: always return unsupported on windows 2019-12-18 19:28:00 +03:00
Andrew Dolgov c46c5e59fc SELF_USER_AGENT: switch to get_version() 2019-12-18 15:56:27 +03:00
Andrew Dolgov 72d8a34f74 get_version: don't pass useless root dir to git, instead log it in case of failure 2019-12-18 15:29:12 +03:00
Andrew Dolgov 72d0fac80c remove version.php and VERSION global constant, do version-related things in a slightly less ridiculous way 2019-12-18 14:27:40 +03:00
Andrew Dolgov 0237dee980 implement automatic night mode detection using MQL 
add separate light.css to force light theme
remove manual night mode toggle and related code
 2019-12-12 20:09:43 +03:00
Andrew Dolgov 0a10832491 - update descriptions of changed hotkeys 
- bind noscroll variants of move article hotkeys to n/p by default
- update N/P (i.e. scroll article content) hotkeys to scroll by fraction of viewport height instead of hardcoded pixel distance
- minor fixes w/ checking for undefined
 2019-12-11 06:53:32 +03:00
Andrew Dolgov 008afb97a9 exp: unbind from pgup/pgdn buttons by default 2019-12-09 12:38:04 +03:00
Andrew Dolgov 6191c48596 trim() contents of version_static.txt 2019-12-09 07:11:34 +03:00
fox f4945b1ba1 Merge branch 'page-hotkeys' of suraia/tt-rss into master 2019-12-08 06:02:10 +00:00
Andrew Dolgov 5907409a84 add support for custom version_static.txt for package maintainers 2019-12-08 08:58:23 +03:00
Michael Kuhn f133b78a3e Fix Shift+PageUp/Down hotkeys 2019-12-06 20:39:22 +01:00
Andrew Dolgov ac95ab4a65 user css dialog: allow saving and applying CSS without closing the dialog 2019-12-06 14:02:30 +03:00
Andrew Dolgov 565547f5a1 php 7.4 deprecation-related fixes 2019-12-06 07:27:22 +03:00
Andrew Dolgov 1902a7dcb0 pgup/pgdown hotkey normalization: 
- pgup/pgdown without modifier scroll headline buffer
- shift+pgup/pgdown work similarly to shift+up/down but operating on pages
 2019-12-05 17:00:17 +03:00
Andrew Dolgov f30287be65 versioning changes 
- remove VERSION_STATIC - https://community.tt-rss.org/t/versioning-changes-for-trunk/2974
- report git commit/timestamp properly by invoking git instead of trying to parse .git/HEAD etc
- remove git-related global constants used when checking for updates
 2019-12-05 13:23:54 +03:00
Andrew Dolgov 6913158b82 add hotkeys to scroll headlines/articles (whichever is active) by one page 2019-12-04 15:50:49 +03:00
Andrew Dolgov d15f0349bf remove hardcoded iframe domain whitelist, make iframe script whitelisting configurable by plugins (HOOK_IFRAME_WHITELISTED) 2019-11-27 11:52:51 +03:00
Andrew Dolgov e5b7b145e5 cache media: set referrer to source URL when fetching images 2019-11-25 09:48:24 +03:00
Andrew Dolgov 8c3efd51ec reset domain hit quota on feed update start 2019-11-17 13:17:21 +03:00
Andrew Dolgov cd4b7f1988 implement MAX_FETCH_REQUESTS_PER_HOST: only generating a warning on exceeded quota for the time being 2019-11-14 07:38:49 +03:00
cac2s 6b47f5a6d1 fix position for "forgotpass" link 2019-11-13 10:52:25 +02:00
Andrew Dolgov 68b0380118 add placeholder authentication via app passwords if service is passed 
forbid logins via regular passwords for services
remove AUTH_DISABLE_OTP
 2019-11-01 13:03:06 +03:00
Andrew Dolgov 84e9f1d5cc update schema for app-specific passwords 2019-11-01 11:57:45 +03:00
JustAMacUser 4cc6a773ff Removed redundant text for next/prev article without scroll. 2019-09-23 01:09:11 -04:00
JustAMacUser 2e61551c28 Try to clarify next/prev article keyboard shortcut help. 2019-09-22 15:13:28 -04:00
Andrew Dolgov 3e4701116d af_readability: add missing file 2019-08-16 15:29:24 +03:00
Andrew Dolgov 9806a2b5ff bump version_static 2019-08-14 13:38:20 +03:00
Andrew Dolgov 6914ad1f74 retire MIN_CACHE_FILE_SIZE 2019-08-14 12:44:50 +03:00
Andrew Dolgov 3c075bfd21 DiskCache: more strict checking for input filenames, getUrl() is no longer static 2019-08-14 09:49:18 +03:00
Andrew Dolgov 133c2b482b move rewrite_cached_urls to DiskCache::rewriteUrls() 2019-08-13 12:46:57 +03:00
Andrew Dolgov b1dd38f880 add DiskCache.getUrl() and use it in a bunch of places 2019-08-13 12:39:21 +03:00
Andrew Dolgov 088fcf8131 move more globals to more appropriate places 
set libxml to always use internal errors
 2019-06-20 08:40:02 +03:00
Andrew Dolgov 4fa9aee4e7 move several more global functions to more appropriate classes 2019-06-20 08:14:06 +03:00
Andrew Dolgov 6d746453c7 get_feeds_from_html: remove XML preamble hack 
move several related helper functions to Feeds class
 2019-06-20 07:51:48 +03:00
Andrew Dolgov 66cbe55148 sanity check: require UConverter from php intl 2019-05-01 09:32:46 +03:00
Andrew Dolgov ccc0315ef0 better tsquery support: 
1. report query syntax errors properly
2. fall back to implicit &-joining only if no joiners are detected in user query, otherwise permit full tsquery syntax
 2019-04-30 14:39:08 +03:00
ltGuillaume 3d8c6967da Add keyboard shortcut 'g r': Go to Recently read 2019-04-12 07:29:15 +00:00
Andrew Dolgov 6fbf349155 add hidden _SKIP_SESSION_UA_CHECKS tunable 2019-04-11 16:15:55 +03:00
Andrew Dolgov 6768b3a4a3 schema: add DEFAULT_SEARCH_LANGUAGE 2019-04-10 12:47:46 +03:00
Greg-T 2c2f74a104 PDO error in cleanup_tags repaired 
Changes :
- add PDO::PARAM_INT to a value in a PDO query
- switch limit to limit_part to respect semantic here (cleanup by packages)
 2019-03-28 15:50:13 +00:00
Andrew Dolgov 671f4cee65 domdocument: remove old meta charset unicode hacks, replace with shorter xml preamble utf8 hack (on loadhtml where it makes sense) 
af_readability: better (?) charset hack for non-unicode pages
 2019-03-21 21:08:02 +03:00
Andrew Dolgov 01b2f0a24f support "picture" tags in articles 2019-03-19 07:18:48 +03:00
Michael Kuhn e74f7bde22 Refactor hotkeys to use keypress instead of keydown 
keydown returns the "raw" key in event.which. Depending on the keyboard
layout, this may not be what is wanted. For example, on a German
keyboard, Shift+7 has to be pressed to get a slash. However, event.which
will be 55, which corresponds to "7". In the keypress event, however,
event.which will be 47, which corresponds to "/".

Sadly, several important keys (such as escape and the arrow keys) do not
trigger a keypress event. Therefore, they have to be handled using a
keydown event.

This change refactors the hotkey support to make use of keypress events
whenever possible. This will make hotkeys work regardless of the user's
keyboard layout. Escape and arrow keys are still handled via keydown
events.

There should be only one change in behavior: I could not make Ctrl+/
work and therefore rebound the help dialog to "?".
 2019-03-11 12:01:27 +01:00
Andrew Dolgov 32f9fda33d add composite key on ttrss_feeds (feed_url & owner_uid) 2019-03-10 15:45:30 +03:00
Andrew Dolgov 0b74db5ad7 remove feedbrowser (other feeds) 2019-03-06 20:02:06 +03:00
Andrew Dolgov 38e01270d8 archived feeds: expire old entries (schema bump) 2019-03-06 19:06:05 +03:00
Andrew Dolgov dfd3a4e581 update previous with make_password() in tt-rss proper 2019-03-05 20:18:50 +03:00
Andrew Dolgov 16a9bdc387 make_password: generate longer passwords by default, use better random function if available 2019-03-05 20:16:50 +03:00
Andrew Dolgov 5b3a73e574 login: switch to absolute redirect urls 2019-03-04 20:38:39 +03:00
Andrew Dolgov 925065b1fe Revert "login: only allow relative URLs in return=" 
This reverts commit c68ac04020.
 2019-03-04 07:02:58 +03:00