Commit Graph

226 Commits (2547ece0cacb7080060ad3bc32b879fee6b52230)

Author SHA1 Message Date
Andrew Dolgov 15fd23c374 use shortcut echo syntax for php templates 4 years ago
Andrew Dolgov d3940b6259 fix a bunch of warnings related to generated feeds 4 years ago
Andrew Dolgov e6624cf631 fix a few more session-related warnings 4 years ago
Andrew Dolgov 71dfc83466 force _ENABLED_PLUGINS to string when passed to pluginhost 4 years ago
Andrew Dolgov 74986d1ac6 shorten pref tab names; make log-alert clickable 4 years ago
Andrew Dolgov 09e9f34bb4 add UserHelper::find_user_by_login() and rewrite some user checks to invoke it instead of going through PDO 4 years ago
Andrew Dolgov 7af8744c85 authentication: make logins case-insensitive (force lowercase) 4 years ago
Andrew Dolgov 9f3de2d24c login: fix profile warning 4 years ago
Andrew Dolgov 7eb860af61 even more hooks 4 years ago
Andrew Dolgov 1eb1629d9e pluginhost: rework run_hooks() to be shorter, add callback variant; implement exception handling for both 4 years ago
Andrew Dolgov 3f972f8fed public/subscribe: fix warnings 4 years ago
Andrew Dolgov 6e774a58fe more php8 fixes mostly related to login 4 years ago
Andrew Dolgov 403dca154c initial WIP for php8; bump php version requirement to 7.0 4 years ago
Andrew Dolgov da0ad82c24 Archive cleanup:
- remove code to manually archive/unarchive articles
- remove ttrss_archived_feeds/orig_feed_id handling - the whole thing was implemented for
this data to be kept indefinitely; it doesn't make a lot of sense to deal with this stuff
now that it is expired after one month anyway (same reasons as feed browser being removed - privacy)
- remove "originally from"-related stuff because of the above
- also remove unused remaining frontend/backend code related to feed browser (rip)
4 years ago
Andrew Dolgov 40f38fc87f pluginhost: load plugin data automatically (also marks load_data method as private) 4 years ago
Andrew Dolgov f67f0f864b HOOK_ARTICLE_EXPORT_FEED: also pass owner_uid 4 years ago
JustAMacUser fadf4dec96 Include tags for HOOK_ARTICLE_EXPORT_FEED. 4 years ago
Andrew Dolgov a8302fb253 use X-Real-IP headers if possible while authenticating 4 years ago
Andrew Dolgov 215f388992 move timestamp-related stuff to a separate class 4 years ago
Andrew Dolgov 74568df4ff remove a lot of stuff from global context (functions.php), add a few helper classes instead 4 years ago
Andrew Dolgov 03a337a660 add basic safe mode which doesn't load any user plugins 4 years ago
Andrew Dolgov 37f41a5246 forgotpass: use type strict comparison for reset token 4 years ago
Andrew Dolgov 1f79d614c4 fix OTP QR code not displayed because of CSRF token passed as a query
parameter
use type-strict comparison when validating CSRF token on the backend
4 years ago
Andrew Dolgov 9d3c794983 subscribe: allow pre-filling feed URL if passed via query string 4 years ago
Andrew Dolgov 154417d80b public/logout: require valid CSRF token 4 years ago
Andrew Dolgov 8080c525fd - backend: require CSRF token to be passed via POST
- do not leak CSRF token via GET request in feed debugger
- rework Article/redirect to use POST
4 years ago
Andrew Dolgov da98ba662e public/subscribe: require valid CSRF token when validating the form 4 years ago
Andrew Dolgov c3d14e1fa5 - fix multiple vulnerabilities in af_proxy_http
- fix vulnerability in rewrite_relative_url() which prevented some URLs from being properly absolutized
- fetch_file_contents: validate all URLs before requesting them
- validate URLs: explicitly whitelist http and https scheme, forbid everything else
- DiskCache/cached_url: only serve whitelisted content types (images, video)
- simplify filename/URL handling code, remove and consolidate some less-used functions
4 years ago
Rodney Stromlund 88ced02622 Silence php 7.2 error message generated in `session_set_cookie_params`. 4 years ago
Andrew Dolgov dfa65e9374 move order_by to SQL override logic into a separate function 4 years ago
Andrew Dolgov 48be005774 instead of taking batch timestamp and score (?) into account, make oldest first sorting work consistently with newest first - i.e. rely on feed-provided timestamp 4 years ago
Andrew Dolgov 1f2a721905 allow overriding built-in templates via templates.local 5 years ago
Andrew Dolgov bdb1e475e7 external subscribe dialog: support dark theme 5 years ago
Andrew Dolgov b2876f6c72 share anything dialog: support dark theme 5 years ago
Andrew Dolgov 4ab3854aed don't generate default.css, replace with themes/light.css as a default root CSS file 5 years ago
Andrew Dolgov aa56bcaf44 support night mode when using share by URL 5 years ago
Andrew Dolgov f47998f569 generate_syndicated_feed: use local media in generated feeds if it is available 5 years ago
Andrew Dolgov 72d0fac80c remove version.php and VERSION global constant, do version-related things in a slightly less ridiculous way 5 years ago
Andrew Dolgov ef514bc4bd add notifications for mail and password changes
update and shorten some other message templates
5 years ago
Rodney Stromlund 958c4dc124 Removed extra php end tag that was showing in the page title 5 years ago
Andrew Dolgov 3e4701116d af_readability: add missing file 5 years ago
Andrew Dolgov 0e3b71c535 public/pluginhandler: log invalid requests 5 years ago
Andrew Dolgov d4df57e1a4 Article::get_article_image() - also return stream URI if possible 5 years ago
Andrew Dolgov 68e2b05f65 * move get_article_image to Article; implement better og:image detection (similar to android app)
* pass article image to API clients in headlines row object
5 years ago
Andrew Dolgov 39f459eb04 public/cached_url: forbid sending files with extensions 5 years ago
Andrew Dolgov 3c075bfd21 DiskCache: more strict checking for input filenames, getUrl() is no longer static 5 years ago
Andrew Dolgov fdb6066bf6 * HOOK_ENCLOSURE_ENTRY: pass article_id to handler
* DiskCache: multiple fixes; support isWritable() for cache entries, set content-disposition for send()
* public/cached_url: allow selecting files from sub-caches other than images
* plugins/Cache_Starred_Images: rework to use DiskCache, can be enabled per-user, properly handles article enclosures, etc
5 years ago
Andrew Dolgov 133c2b482b move rewrite_cached_urls to DiskCache::rewriteUrls() 5 years ago
Andrew Dolgov b1dd38f880 add DiskCache.getUrl() and use it in a bunch of places 5 years ago
Andrew Dolgov ea30061cce public: fix share() returning random unshared articles if uuid is not given 5 years ago