servers/ttrss
1
0
Fork 0
mirror of https://tt-rss.org/git/tt-rss.git synced 2024-06-25 11:57:42 +02:00
Code Issues Releases Wiki Activity
10,005 Commits 34 Branches 0 Tags 149 MiB
5c1f70348e
Commit Graph

1475 Commits

Author SHA1 Message Date
Andrew Dolgov
4efc3d7b3f validate_url: relax requirements for URLs, limit additional port/loopback filtering to fetch_file_contents() 2020-09-17 20:20:23 +03:00
Andrew Dolgov
a4525d31b2 replace FALSE with false so that static analyzer shuts up about it 2020-09-17 19:02:27 +03:00
Andrew Dolgov
57fac84516 rename gettext.inc to gettext.inc.php (cosmetic) 2020-09-17 18:56:29 +03:00
Andrew Dolgov
c25edd0024 fetch_file_contents: validate effective URL (after redirects) without CURL 2020-09-17 16:17:33 +03:00
Andrew Dolgov
27e695436f fetch_file_contents: validate effective URL (after redirects) if using CURL 2020-09-17 15:53:13 +03:00
Andrew Dolgov
5a7e7e1367 don't try to call hash_equals() on unset user token 2020-09-17 10:20:55 +03:00
Andrew Dolgov
f72e6947d5 use hash_equals() correctly 2020-09-17 10:04:00 +03:00
Andrew Dolgov
e3adacc588 fix several cases of Db class being invoked as wrong name (as DB) 2020-09-17 09:18:03 +03:00
Andrew Dolgov
16c86e2fc3 replace some plain http links with https 2020-09-17 09:02:30 +03:00
Andrew Dolgov
a817d3794d * use get_random_bytes() for CSRF token 
* get_random_bytes: use PHP7 random_bytes() if it is available
* validate CSRF token using hash_equals
 2020-09-17 08:59:18 +03:00
Andrew Dolgov
1f79d614c4 fix OTP QR code not displayed because of CSRF token passed as a query 
parameter
use type-strict comparison when validating CSRF token on the backend
 2020-09-17 08:43:39 +03:00
Andrew Dolgov
6a4b6cf603 amend previous to 127/8 subnet 2020-09-17 07:37:48 +03:00
Andrew Dolgov
213d6330b1 fetch_file_contents: resolve requested hosts and check for possible 
loopback address
 2020-09-17 07:36:47 +03:00
Andrew Dolgov
88c4dc405e build_url: also put query parameters and fragment in resulting URL 
rewrite_relative_url: simplify handling of relative URLs
 2020-09-16 21:41:05 +03:00
Andrew Dolgov
da5af2fae0 cached_url: block SVG images because of potential javascript inside 2020-09-16 16:25:20 +03:00
Andrew Dolgov
aeaafefa07 don't pass csrf token as a GET parameter to Article 2020-09-15 16:03:09 +03:00
Andrew Dolgov
1621abcffc rewrite_relative_url: validate resulting absolutized URLs 2020-09-15 10:41:57 +03:00
Andrew Dolgov
aa89ea7769 validate_url: only allow safe ports (80, 443), disallow access to loopback 2020-09-15 10:39:09 +03:00
Andrew Dolgov
6c02fea641 validate_url: add clean() 2020-09-15 08:45:15 +03:00
Andrew Dolgov
4abc7d7898 rename base64_img() to image_to_base64() 2020-09-15 08:05:01 +03:00
Andrew Dolgov
1ee458b5c1 cached_url: perform mimetype validation before possible HOOK_SEND_LOCAL_FILE hooks 2020-09-15 07:54:46 +03:00
Andrew Dolgov
b4cb67e77f remove csrf token from rpc method sanityCheck 2020-09-14 20:00:01 +03:00
Andrew Dolgov
c3d14e1fa5 - fix multiple vulnerabilities in af_proxy_http 
- fix vulnerability in rewrite_relative_url() which prevented some URLs from being properly absolutized
- fetch_file_contents: validate all URLs before requesting them
- validate URLs: explicitly whitelist http and https scheme, forbid everything else
- DiskCache/cached_url: only serve whitelisted content types (images, video)
- simplify filename/URL handling code, remove and consolidate some less-used functions
 2020-09-14 19:46:52 +03:00
Rodney Stromlund
376dce02bb Update wiki and forums links in error message. 2020-07-13 09:06:59 -05:00
Andrew Dolgov
6eb94f1e13 better support for image srcset attributes as discussed in https://community.tt-rss.org/t/problem-with-img-srcset/3519 2020-06-15 11:58:59 +03:00
Andrew Dolgov
19893d33e3 only bind up/down in 3 panel mode 2020-05-23 08:53:18 +03:00
Andrew Dolgov
ebb373987a Revert "unbind up/down by default (use native scrolling for consistency with pgup/pgdn)" 
This reverts commit 6fc18e450b.
 2020-05-23 08:39:44 +03:00
Andrew Dolgov
6fc18e450b unbind up/down by default (use native scrolling for consistency with pgup/pgdn) 2020-05-23 08:38:03 +03:00
Andrew Dolgov
9ae9302b6b implement keyboard-related changes discussed in https://community.tt-rss.org/t/changing-the-amount-of-scroll-by-arrow-key/3452/7 2020-05-17 08:25:51 +03:00
JustAMacUser
7a0ea9d90e Make iframes size responsively. 2020-05-15 22:25:56 -04:00
Andrew Dolgov
2b55afbeec sanitize: forbid "allow" attribute 
CSS: remove auto hyphens stuff, remove iframe width clipping to 98% because they get squished
 2020-05-09 12:49:19 +03:00
Andrew Dolgov
2558fcbe21 add hotkey "\" to cancel current search 2020-05-09 07:56:06 +03:00
Andrew Dolgov
e934e9f05e sanitize: simplify initial attribute processing 2020-04-29 19:12:29 +03:00
Andrew Dolgov
7d9dd51cf4 sanitize: remove srcset plain-http hack, globally disallow width and height attributes for all elements 2020-04-29 19:04:34 +03:00
Andrew Dolgov
83c8834421 sanitize: handle picture[@srcset] elements properly, i.e. rewrite relative URLs 2020-04-29 19:02:44 +03:00
Martin Stone
1ad43dd202
Fix documentation for _noexpand commands 2020-03-25 20:30:34 +00:00
Toby Simmons
569228a5df In get_version() disable DIRECTORY_SEPARATOR check, permit using git on Windows to get version details; 2020-03-02 11:28:21 -06:00
Andrew Dolgov
4e74da590e af_readability: allow get full text button to work as a toggle; in cdm, scroll to article after embedding 2020-02-28 08:03:25 +03:00
Andrew Dolgov
07b27b375f update toggle_embed_original hotkey to invoke readability embed instead of removed embed_original plugin 2020-02-27 09:47:20 +03:00
Andrew Dolgov
4ab3854aed don't generate default.css, replace with themes/light.css as a default root CSS file 2020-02-22 16:22:44 +03:00
Andrew Dolgov
06b9d39662 add support for image loading=lazy attribute 2020-02-13 20:20:55 +03:00
Andrew Dolgov
076c5382fa login form: add workarounds for chrome password manager 2020-01-25 17:00:51 +03:00
Andrew Dolgov
6080cca9ca scrap counter cache system; rework counters to sum() booleans instead 2020-01-24 14:25:31 +03:00
Andrew Dolgov
a6d314b753 support dark mode for login form 2020-01-23 13:14:47 +03:00
Andrew Dolgov
01513aa41b disable MAX_FETCH_REQUESTS_PER_HOST warnings for the time being 2020-01-17 07:26:55 +03:00
Andrew Dolgov
5fc499e19e get_version: don't rely on exec() exit code to determine whether output is valid 2020-01-14 20:50:40 +03:00
Andrew Dolgov
fdb1fc7608 get_version: fix commit/timestamp lost on subsequent invocations because of misbehaving caching 2019-12-20 18:17:05 +03:00
Andrew Dolgov
6439f7817d force-disable php display_errors/display_startup_errors on startup 2019-12-19 08:37:19 +03:00
Andrew Dolgov
c309856a97 get_version: filter out Darwin 2019-12-19 07:04:01 +03:00
Andrew Dolgov
74feef0f9d get_version: always return unsupported on windows 2019-12-18 19:28:00 +03:00