servers
/
ttrss
mirror of https://tt-rss.org/git/tt-rss.git
1
0
Fork 0
Code Issues Releases Wiki Activity
11,315 Commits 34 Branches 0 Tags 148 MiB
Commit Graph

1603 Commits

Author SHA1 Message Date
Andrew Dolgov 2621fe7955 fix get_pref always using default profile; remove unneeded code from db_prefs 2021-02-25 12:53:20 +03:00
Andrew Dolgov bd2314170d implement prefs UI based on new prefs class and a few more things 2021-02-25 12:46:13 +03:00
Andrew Dolgov 1112922029 bump schema for upcoming prefs overhaul 2021-02-25 10:11:09 +03:00
Andrew Dolgov 8d2e3c2528 drop errors.php and simplify error handling 2021-02-23 22:26:07 +03:00
Andrew Dolgov 85095f8a53 rename TTRSS_SESSION_NAME to SESSION_NAME 2021-02-23 17:01:25 +03:00
Andrew Dolgov 2ae0b7059f cleanup some defined-stuff 2021-02-23 09:01:27 +03:00
Andrew Dolgov 29ada58b4a move db-prefs shortcut functions to functions.php 2021-02-22 23:25:14 +03:00
Andrew Dolgov 445ac1213c finalize config:: migration; make config.php optional 2021-02-22 22:51:12 +03:00
Andrew Dolgov 12bcf826e4 don't include config.php everywhere 2021-02-22 22:39:20 +03:00
Andrew Dolgov 211f699aa0 migrate the rest into Config:: 2021-02-22 22:35:27 +03:00
Andrew Dolgov e4107ac952 wip: initial for config object 2021-02-22 21:47:48 +03:00
Andrew Dolgov 42173386b3 dirname(__FILE__) -> __DIR__ 2021-02-22 17:38:46 +03:00
Andrew Dolgov add6242e51 do not use define_default() because it screws with static analyzers 2021-02-22 17:35:52 +03:00
fox 3f00502305 Merge pull request 'Let 'RSSUtils::check_feed_favicon' update existing favicons.' (#6) from wn/tt-rss:check-feed-favicon into master 
Reviewed-on: https://git.tt-rss.org/fox/tt-rss/pulls/6
 2021-02-22 17:25:02 +03:00
Andrew Dolgov be4e7b1340 fix several issues reported by phpstan 2021-02-22 14:41:09 +03:00
wn_ 02a9485966 Try to limit max favicon size, don't store current/old in a var. 2021-02-21 23:30:31 +00:00
Andrew Dolgov f6bfb89b29 pref-prefs: switch to new control shorthand in a few places 2021-02-21 23:18:32 +03:00
Andrew Dolgov 94560132dd for the most part, deal with filter rules UI 2021-02-21 09:35:07 +03:00
Andrew Dolgov fc0ebf0891 move bookmarklet-related methods out of public.php into the plugin 2021-02-19 20:21:36 +03:00
Andrew Dolgov 6b43b788d9 migrate xhrJson invocations to the new helper 2021-02-19 10:22:00 +03:00
Andrew Dolgov c088e9d9d8 get rid of a few more prototype-isms 2021-02-18 22:23:06 +03:00
Andrew Dolgov a2c75257f1 bookmarklets: cleanup 2021-02-18 13:16:55 +03:00
Andrew Dolgov e4609c18ef * add (disabled) shortcut syntax for plugin methods 
* add controls shortcut for pluginhandler tags
 * add similar shortcut for frontend
 * allow plugins to selectively exclude their methods from CSRF checking
 2021-02-17 21:44:21 +03:00
Andrew Dolgov 0fc783e2b3 cleanup markup in some plugins, make nsfw generate dijit widgets 2021-02-16 22:07:37 +03:00
Andrew Dolgov 91e7969383 replace a few more controls to new style 2021-02-16 18:57:06 +03:00
Andrew Dolgov 24c79d91c2 controls_compat: comment out most of them 2021-02-16 18:53:56 +03:00
Andrew Dolgov bf88c64d1e fix floicon not imported from global namespace 2021-02-16 18:14:57 +03:00
Andrew Dolgov 9d7ba773ec move session-related functions to their own namespace 2021-02-16 17:13:16 +03:00
Andrew Dolgov 7fad6ce651 move rgb/hsl functions to their own namespace 2021-02-16 17:07:23 +03:00
Andrew Dolgov bdbbdbb0ed rework controls to accept parameters as array 2021-02-16 16:59:21 +03:00
Andrew Dolgov 627af2c236 amend previous to fix actual underlying problem (double escaping) 2021-02-16 15:36:40 +03:00
Andrew Dolgov 4f4e57bb26 hidden_tag: temporarily prevent htmlspecialchars() to stop embedded JSON from breaking 2021-02-16 15:27:22 +03:00
Andrew Dolgov af4b3e7df0 login form: use control helpers 2021-02-16 15:05:32 +03:00
Andrew Dolgov d7127cead3 feed debugger: use hidden helpers; add button helpers 2021-02-16 14:42:27 +03:00
Andrew Dolgov 26d6b84a57 add namespaced controls with unified naming; deprecated old-style control shortcuts 2021-02-16 14:23:00 +03:00
Andrew Dolgov 5d42ce553f drop legacy DB interface and related sanity checks 2021-02-15 16:55:55 +03:00
Andrew Dolgov 9f55454f63 remove the rest of db.php; rename some leftover methods in feeds 2021-02-15 16:51:35 +03:00
Andrew Dolgov cfad740c99 drop legacy db_ functions wrapper 2021-02-15 16:38:18 +03:00
Andrew Dolgov 020f062a76 feeds: unify naming 2021-02-15 15:43:07 +03:00
Andrew Dolgov 82adb01307 render enclosures on the client 2021-02-15 14:10:46 +03:00
Andrew Dolgov 15fd23c374 use shortcut echo syntax for php templates 2021-02-14 09:15:51 +03:00
Andrew Dolgov 103d30ad3f batch subscribe: use client dialog 2021-02-13 22:16:17 +03:00
Andrew Dolgov 6af83e3881 drop ENABLE_GZIP_OUTPUT; system prefs: load php info only if needed 2021-02-12 21:43:38 +03:00
Andrew Dolgov 119a4226d8 validate_csrf: remove warning 2021-02-12 21:21:23 +03:00
Andrew Dolgov f2d3cba231 add HTTP_ACCEPT_LANGUAGE handling for php8 2021-02-12 21:20:04 +03:00
Andrew Dolgov 1f2ba932b8 RIP easy-installer 2021-02-12 15:59:19 +03:00
Andrew Dolgov d23a261b92 RIP self-registration 2021-02-12 15:57:43 +03:00
Andrew Dolgov 8f8675a26a * filters: remove duplicate code, overall cleanup 
* check if some tres exist before trying to reload them
 2021-02-12 14:31:36 +03:00
Andrew Dolgov 848bc57f29 disable themes in safe mode; rework safe mode warning/login prompt 2021-02-11 21:19:57 +03:00
Andrew Dolgov cc646790fd format_backtrace: don't try to use resources as strings 2021-02-11 10:29:42 +03:00
Andrew Dolgov 7833760fa0 make feed/cat nested dropdowns a bit more readable 2021-02-10 08:58:31 +03:00
Andrew Dolgov 7874f6ac58 remove PHPMD.UnusedFormalParameter 2021-02-08 19:42:10 +03:00
Andrew Dolgov 942afb43a1 sanity checks: use better CLI detection, shorten most of the text 2021-02-08 08:49:21 +03:00
Andrew Dolgov 10392ecc28 event log: add pagination 2021-02-06 10:10:54 +03:00
Andrew Dolgov 8b39e6bca7 _color_pack: define variable before using 2021-02-06 09:29:31 +03:00
Andrew Dolgov a544123b59 fix clean() for arrays and user plugin list 2021-02-06 00:17:41 +03:00
Andrew Dolgov 6e774a58fe more php8 fixes mostly related to login 2021-02-06 00:12:15 +03:00
Andrew Dolgov 403dca154c initial WIP for php8; bump php version requirement to 7.0 2021-02-05 23:41:32 +03:00
Andrew Dolgov 33a5ecd2ce feed editor: show purge interval correctly if FORCE_ARTICLE_PURGE is set 2021-01-07 18:16:42 +03:00
Andrew Dolgov f59c567831 update_rss_feed: fix BLACKLISTED_TAGS not working properly, simplify tag-related code 2020-12-20 23:12:45 +03:00
wn c68f2aabc9 Make 'ttrss_error_handler' compatible w/ 8. 
2d467abc46/UPGRADING (L43)
2d467abc46/UPGRADING (L63)
 2020-12-12 10:28:52 -06:00
wn 936b91a7e6 Don't do deprecated 'libxml_disable_entity_loader(true)' under PHP 8. 
2d467abc46/UPGRADING (L886)
 2020-12-12 10:28:49 -06:00
wn 6bdf4a1a25 Switch to 'get_error_types()' to ensure availability in 'include/functions.php'. 
The global in 'sanity_check()' was null... possibly due to circular requires?
 2020-12-12 10:28:48 -06:00
wn 08a6f6bde2 Only do sanity checks for self URL if we can create a valid URL. 
'sanity_check.php' gets included in 'update.php' and 'update_daemon2.php', where a Host request header is likely not provided.
 2020-12-12 10:28:47 -06:00
Andrew Dolgov 65254f5db4 - move sphinx plugin to a separate repo 
- regenerate config checks without sphinx-related variables
 2020-12-11 09:48:34 +03:00
Andrew Dolgov 81c52b4b1e add support for an override stylesheet which applies to all users 2020-11-30 15:53:32 +03:00
Andrew Dolgov 24cdacd59e enable Farsi locale in the UI 2020-10-01 10:19:04 +03:00
Andrew Dolgov 8a02a728c8 add DAEMON_UNSUCCESSFUL_DAYS_LIMIT tunable (defaults to 30 days) 2020-09-30 17:03:16 +03:00
Andrew Dolgov da5deaaca1 set session.cookie_lifetime to 0 initially instead of a rather useless min() 2020-09-30 14:43:53 +03:00
Andrew Dolgov de22464ea8 schema: add ttrss_feeds.last_successful_update 2020-09-28 14:14:06 +03:00
Andrew Dolgov 215f388992 move timestamp-related stuff to a separate class 2020-09-23 13:04:26 +03:00
Andrew Dolgov 74568df4ff remove a lot of stuff from global context (functions.php), add a few helper classes instead 2020-09-22 09:04:33 +03:00
Andrew Dolgov d04ac399ff clarify some URL validation-related error messages 2020-09-21 20:37:29 +03:00
Andrew Dolgov 3dd4169b5f clarify some URL validation-related error messages 2020-09-21 20:35:24 +03:00
Andrew Dolgov 4785f21316 update_rss_feed: log effective URL after fetching 
validate_url: treat scheme as case-insensitive
 2020-09-21 20:26:57 +03:00
Andrew Dolgov 486f1d84ed resolve_redirects: fix previous 2020-09-20 18:14:34 +03:00
Andrew Dolgov d2867d887a resolve_redirects: only use three argument version of get_headers() on php 7.1+ 2020-09-20 17:27:04 +03:00
Andrew Dolgov 03a337a660 add basic safe mode which doesn't load any user plugins 2020-09-18 15:48:22 +03:00
Andrew Dolgov 4efc3d7b3f validate_url: relax requirements for URLs, limit additional port/loopback filtering to fetch_file_contents() 2020-09-17 20:20:23 +03:00
Andrew Dolgov a4525d31b2 replace FALSE with false so that static analyzer shuts up about it 2020-09-17 19:02:27 +03:00
Andrew Dolgov 57fac84516 rename gettext.inc to gettext.inc.php (cosmetic) 2020-09-17 18:56:29 +03:00
Andrew Dolgov c25edd0024 fetch_file_contents: validate effective URL (after redirects) without CURL 2020-09-17 16:17:33 +03:00
Andrew Dolgov 27e695436f fetch_file_contents: validate effective URL (after redirects) if using CURL 2020-09-17 15:53:13 +03:00
Andrew Dolgov 5a7e7e1367 don't try to call hash_equals() on unset user token 2020-09-17 10:20:55 +03:00
Andrew Dolgov f72e6947d5 use hash_equals() correctly 2020-09-17 10:04:00 +03:00
Andrew Dolgov e3adacc588 fix several cases of Db class being invoked as wrong name (as DB) 2020-09-17 09:18:03 +03:00
Andrew Dolgov 16c86e2fc3 replace some plain http links with https 2020-09-17 09:02:30 +03:00
Andrew Dolgov a817d3794d * use get_random_bytes() for CSRF token 
* get_random_bytes: use PHP7 random_bytes() if it is available
* validate CSRF token using hash_equals
 2020-09-17 08:59:18 +03:00
Andrew Dolgov 1f79d614c4 fix OTP QR code not displayed because of CSRF token passed as a query 
parameter
use type-strict comparison when validating CSRF token on the backend
 2020-09-17 08:43:39 +03:00
Andrew Dolgov 6a4b6cf603 amend previous to 127/8 subnet 2020-09-17 07:37:48 +03:00
Andrew Dolgov 213d6330b1 fetch_file_contents: resolve requested hosts and check for possible 
loopback address
 2020-09-17 07:36:47 +03:00
Andrew Dolgov 88c4dc405e build_url: also put query parameters and fragment in resulting URL 
rewrite_relative_url: simplify handling of relative URLs
 2020-09-16 21:41:05 +03:00
Andrew Dolgov da5af2fae0 cached_url: block SVG images because of potential javascript inside 2020-09-16 16:25:20 +03:00
Andrew Dolgov aeaafefa07 don't pass csrf token as a GET parameter to Article 2020-09-15 16:03:09 +03:00
Andrew Dolgov 1621abcffc rewrite_relative_url: validate resulting absolutized URLs 2020-09-15 10:41:57 +03:00
Andrew Dolgov aa89ea7769 validate_url: only allow safe ports (80, 443), disallow access to loopback 2020-09-15 10:39:09 +03:00
Andrew Dolgov 6c02fea641 validate_url: add clean() 2020-09-15 08:45:15 +03:00
Andrew Dolgov 4abc7d7898 rename base64_img() to image_to_base64() 2020-09-15 08:05:01 +03:00
Andrew Dolgov 1ee458b5c1 cached_url: perform mimetype validation before possible HOOK_SEND_LOCAL_FILE hooks 2020-09-15 07:54:46 +03:00
Andrew Dolgov b4cb67e77f remove csrf token from rpc method sanityCheck 2020-09-14 20:00:01 +03:00