020f062a76
feeds: unify naming
3 years ago
82adb01307
render enclosures on the client
3 years ago
a8cc43a0ff
move logout_user() to UserHelper
3 years ago
15fd23c374
use shortcut echo syntax for php templates
3 years ago
d3940b6259
fix a bunch of warnings related to generated feeds
3 years ago
71dfc83466
force _ENABLED_PLUGINS to string when passed to pluginhost
3 years ago
74986d1ac6
shorten pref tab names; make log-alert clickable
3 years ago
09e9f34bb4
add UserHelper::find_user_by_login() and rewrite some user checks to invoke it instead of going through PDO
3 years ago
7af8744c85
authentication: make logins case-insensitive (force lowercase)
3 years ago
9f3de2d24c
login: fix profile warning
3 years ago
7eb860af61
even more hooks
3 years ago
1eb1629d9e
pluginhost: rework run_hooks() to be shorter, add callback variant; implement exception handling for both
3 years ago
3f972f8fed
public/subscribe: fix warnings
3 years ago
6e774a58fe
more php8 fixes mostly related to login
3 years ago
403dca154c
initial WIP for php8; bump php version requirement to 7.0
3 years ago
da0ad82c24
Archive cleanup:
...
- remove code to manually archive/unarchive articles
- remove ttrss_archived_feeds/orig_feed_id handling - the whole thing was implemented for
this data to be kept indefinitely; it doesn't make a lot of sense to deal with this stuff
now that it is expired after one month anyway (same reasons as feed browser being removed - privacy)
- remove "originally from"-related stuff because of the above
- also remove unused remaining frontend/backend code related to feed browser (rip)
3 years ago
40f38fc87f
pluginhost: load plugin data automatically (also marks load_data method as private)
3 years ago
f67f0f864b
HOOK_ARTICLE_EXPORT_FEED: also pass owner_uid
4 years ago
fadf4dec96
Include tags for HOOK_ARTICLE_EXPORT_FEED.
4 years ago
a8302fb253
use X-Real-IP headers if possible while authenticating
4 years ago
215f388992
move timestamp-related stuff to a separate class
4 years ago
74568df4ff
remove a lot of stuff from global context (functions.php), add a few helper classes instead
4 years ago
03a337a660
add basic safe mode which doesn't load any user plugins
4 years ago
37f41a5246
forgotpass: use type strict comparison for reset token
4 years ago
1f79d614c4
fix OTP QR code not displayed because of CSRF token passed as a query
...
parameter
use type-strict comparison when validating CSRF token on the backend
4 years ago
9d3c794983
subscribe: allow pre-filling feed URL if passed via query string
4 years ago
154417d80b
public/logout: require valid CSRF token
4 years ago
8080c525fd
- backend: require CSRF token to be passed via POST
...
- do not leak CSRF token via GET request in feed debugger
- rework Article/redirect to use POST
4 years ago
da98ba662e
public/subscribe: require valid CSRF token when validating the form
4 years ago
c3d14e1fa5
- fix multiple vulnerabilities in af_proxy_http
...
- fix vulnerability in rewrite_relative_url() which prevented some URLs from being properly absolutized
- fetch_file_contents: validate all URLs before requesting them
- validate URLs: explicitly whitelist http and https scheme, forbid everything else
- DiskCache/cached_url: only serve whitelisted content types (images, video)
- simplify filename/URL handling code, remove and consolidate some less-used functions
4 years ago
88ced02622
Silence php 7.2 error message generated in `session_set_cookie_params`.
4 years ago
dfa65e9374
move order_by to SQL override logic into a separate function
4 years ago
48be005774
instead of taking batch timestamp and score (?) into account, make oldest first sorting work consistently with newest first - i.e. rely on feed-provided timestamp
4 years ago
1f2a721905
allow overriding built-in templates via templates.local
4 years ago
bdb1e475e7
external subscribe dialog: support dark theme
4 years ago
b2876f6c72
share anything dialog: support dark theme
4 years ago
4ab3854aed
don't generate default.css, replace with themes/light.css as a default root CSS file
4 years ago
aa56bcaf44
support night mode when using share by URL
5 years ago
f47998f569
generate_syndicated_feed: use local media in generated feeds if it is available
5 years ago
72d0fac80c
remove version.php and VERSION global constant, do version-related things in a slightly less ridiculous way
5 years ago
ef514bc4bd
add notifications for mail and password changes
...
update and shorten some other message templates
5 years ago
958c4dc124
Removed extra php end tag that was showing in the page title
5 years ago
3e4701116d
af_readability: add missing file
5 years ago
0e3b71c535
public/pluginhandler: log invalid requests
5 years ago
d4df57e1a4
Article::get_article_image() - also return stream URI if possible
5 years ago
68e2b05f65
* move get_article_image to Article; implement better og:image detection (similar to android app)
...
* pass article image to API clients in headlines row object
5 years ago
39f459eb04
public/cached_url: forbid sending files with extensions
5 years ago
3c075bfd21
DiskCache: more strict checking for input filenames, getUrl() is no longer static
5 years ago
fdb6066bf6
* HOOK_ENCLOSURE_ENTRY: pass article_id to handler
...
* DiskCache: multiple fixes; support isWritable() for cache entries, set content-disposition for send()
* public/cached_url: allow selecting files from sub-caches other than images
* plugins/Cache_Starred_Images: rework to use DiskCache, can be enabled per-user, properly handles article enclosures, etc
5 years ago
133c2b482b
move rewrite_cached_urls to DiskCache::rewriteUrls()
5 years ago
Andrew Dolgov