15fd23c374
use shortcut echo syntax for php templates
4 years ago
17413078a7
pref feeds: index cleanup, split into several methods, use tabs to maximize space for feed tree, persist feed tree state
4 years ago
3d11c61f32
* OPML import: don't reload everything, just feed tree
...
* dialogs: use auto-destroying dialog for almost all dialogs instead of destroying them manually
* some general dialog-related cleanup
4 years ago
d466284fab
* customizeCSS: client dialog
...
* remove hardcoded width from most dialogs (move to css)
* add helper to easily get dialog from its widget
* rework some dialog buttons to use current object instead of calling dialog by name
4 years ago
7af8744c85
authentication: make logins case-insensitive (force lowercase)
4 years ago
72edab5f1c
close_button: fix warning
4 years ago
7874f6ac58
remove PHPMD.UnusedFormalParameter
4 years ago
51d2deeea9
fix hierarchy of authentication modules, make everything extend Auth_Base and implement hook_auth_user() for pluginhost
4 years ago
363b3629a4
rewrite a few more hooks
4 years ago
9de26d44da
af_psql_trgm: fix warning
4 years ago
d293cbd5a9
fix several warnings related to feed editor
4 years ago
c1ad7acfb9
bookmarklet: encode URL properly so special characters won't get lost
4 years ago
5849a39820
af_redditimgur: don't try to load empty html; fix a warning in update debugger
4 years ago
ce489a724b
fix a few more warnings
4 years ago
9fdeb58fd3
check a few more php8 warnings
4 years ago
6e774a58fe
more php8 fixes mostly related to login
4 years ago
403dca154c
initial WIP for php8; bump php version requirement to 7.0
4 years ago
6c546f37ba
af_redditimgur: handle youtube /embed/ URLs
4 years ago
b30b354b53
af_redditimgur: add some last minute handling for generic preview media URLs provided in JSON
4 years ago
0d1336bd29
af_redditimgur:
...
* draw a basic form for testurl() if no url is given
* only process specific JSON media files/child elements until something is found
* handle generic preview images for self posts (not link posts because
link is handled afterwards)
4 years ago
1ded706f8f
af_redditimgur: cleanup, rework to embed stuff from reddit-provided JSON first
4 years ago
41bde84a92
af_redditimgur: add basic support for reddit galleries
4 years ago
4e95591087
af_redditimgur: shorten href stuff
4 years ago
7a2ad08a7d
scored_oldest_first: update sort caption
4 years ago
c82457e534
add plugins/scored_oldest_first
4 years ago
6d4005f984
af_psql_trgm:
...
1. better debugging output
2. fix incorrect default values being used sometimes
3. remove special workaround for equal titles because trgm extension
seems to be working properly for those now (tested on postgres 11)
4. code cleanup
4 years ago
0868ff9d64
auth_remote: use empty() instead of isset() while checking headers
4 years ago
dc40f69511
fix auth_remote broken by previous commit
4 years ago
8a34084df1
auth_remote: rewrite header checking to be more readable
4 years ago
8764662138
af_redditimgur: also blacklist in-content links
4 years ago
564a24fd78
Add support for HTTP_REMOTE_USER variable for user authentication
4 years ago
9e62513095
af_redditimgur: also rewrite in the API handler
4 years ago
f25ea5355c
af_redditimgur: add option to rewrite reddit URLs to teddit.net
4 years ago
50d089ae59
redditimgur: blacklist github because it usually resolves to a huge profile photo of someone
4 years ago
6f31372b37
Address param order deprecation warning for 'af_redditimgur'.
4 years ago
65254f5db4
- move sphinx plugin to a separate repo
...
- regenerate config checks without sphinx-related variables
4 years ago
43bd3394c3
shorten_expanded: remove loading=lazy from images if enabled
4 years ago
8479421da4
af_readability: allow appending to original summary instead of always
...
replacing it, some minor code cleanup
4 years ago
65b3926ae5
Ensure proxy_all setting is saved in database.
4 years ago
38a7a1da88
hide uninteresting errors in several DOMDocument->loadHTML() invocations
4 years ago
215f388992
move timestamp-related stuff to a separate class
4 years ago
74568df4ff
remove a lot of stuff from global context (functions.php), add a few helper classes instead
4 years ago
a4525d31b2
replace FALSE with false so that static analyzer shuts up about it
4 years ago
d8619b9a84
auth_internal: cast OTP code to integer before trying to check it
4 years ago
a817d3794d
* use get_random_bytes() for CSRF token
...
* get_random_bytes: use PHP7 random_bytes() if it is available
* validate CSRF token using hash_equals
4 years ago
0757ad0406
auth_internal: use type-strict comparison when checking OTP code
4 years ago
91e1542a82
af_proxy_http: require separate token to access imgproxy
4 years ago
79f102c25d
af_proxy_http: never print received data directly, always redirect to cached_url
...
cache/getUrl: basename() passed filename just in case
4 years ago
0758397dd8
af_redditimgur: don't add embedded blank gif image for rewritten videos
4 years ago
c3d14e1fa5
- fix multiple vulnerabilities in af_proxy_http
...
- fix vulnerability in rewrite_relative_url() which prevented some URLs from being properly absolutized
- fetch_file_contents: validate all URLs before requesting them
- validate URLs: explicitly whitelist http and https scheme, forbid everything else
- DiskCache/cached_url: only serve whitelisted content types (images, video)
- simplify filename/URL handling code, remove and consolidate some less-used functions
4 years ago
Andrew Dolgov