aeaafefa07
don't pass csrf token as a GET parameter to Article
4 years ago
1621abcffc
rewrite_relative_url: validate resulting absolutized URLs
4 years ago
aa89ea7769
validate_url: only allow safe ports (80, 443), disallow access to loopback
4 years ago
6c02fea641
validate_url: add clean()
4 years ago
4abc7d7898
rename base64_img() to image_to_base64()
4 years ago
1ee458b5c1
cached_url: perform mimetype validation before possible HOOK_SEND_LOCAL_FILE hooks
4 years ago
b4cb67e77f
remove csrf token from rpc method sanityCheck
4 years ago
c3d14e1fa5
- fix multiple vulnerabilities in af_proxy_http
...
- fix vulnerability in rewrite_relative_url() which prevented some URLs from being properly absolutized
- fetch_file_contents: validate all URLs before requesting them
- validate URLs: explicitly whitelist http and https scheme, forbid everything else
- DiskCache/cached_url: only serve whitelisted content types (images, video)
- simplify filename/URL handling code, remove and consolidate some less-used functions
4 years ago
6eb94f1e13
better support for image srcset attributes as discussed in https://community.tt-rss.org/t/problem-with-img-srcset/3519
5 years ago
19893d33e3
only bind up/down in 3 panel mode
5 years ago
ebb373987a
Revert "unbind up/down by default (use native scrolling for consistency with pgup/pgdn)"
...
This reverts commit 6fc18e450b
5 years ago
6fc18e450b
unbind up/down by default (use native scrolling for consistency with pgup/pgdn)
5 years ago
9ae9302b6b
implement keyboard-related changes discussed in https://community.tt-rss.org/t/changing-the-amount-of-scroll-by-arrow-key/3452/7
5 years ago
7a0ea9d90e
Make iframes size responsively.
5 years ago
2b55afbeec
sanitize: forbid "allow" attribute
...
CSS: remove auto hyphens stuff, remove iframe width clipping to 98% because they get squished
5 years ago
2558fcbe21
add hotkey "\" to cancel current search
5 years ago
e934e9f05e
sanitize: simplify initial attribute processing
5 years ago
7d9dd51cf4
sanitize: remove srcset plain-http hack, globally disallow width and height attributes for all elements
5 years ago
83c8834421
sanitize: handle picture[@srcset] elements properly, i.e. rewrite relative URLs
5 years ago
1ad43dd202
Fix documentation for _noexpand commands
5 years ago
569228a5df
In get_version() disable DIRECTORY_SEPARATOR check, permit using git on Windows to get version details;
5 years ago
4e74da590e
af_readability: allow get full text button to work as a toggle; in cdm, scroll to article after embedding
5 years ago
07b27b375f
update toggle_embed_original hotkey to invoke readability embed instead of removed embed_original plugin
5 years ago
4ab3854aed
don't generate default.css, replace with themes/light.css as a default root CSS file
5 years ago
06b9d39662
add support for image loading=lazy attribute
5 years ago
6080cca9ca
scrap counter cache system; rework counters to sum() booleans instead
5 years ago
01513aa41b
disable MAX_FETCH_REQUESTS_PER_HOST warnings for the time being
5 years ago
5fc499e19e
get_version: don't rely on exec() exit code to determine whether output is valid
5 years ago
fdb1fc7608
get_version: fix commit/timestamp lost on subsequent invocations because of misbehaving caching
5 years ago
6439f7817d
force-disable php display_errors/display_startup_errors on startup
5 years ago
c309856a97
get_version: filter out Darwin
5 years ago
74feef0f9d
get_version: always return unsupported on windows
5 years ago
c46c5e59fc
SELF_USER_AGENT: switch to get_version()
5 years ago
72d8a34f74
get_version: don't pass useless root dir to git, instead log it in case of failure
5 years ago
72d0fac80c
remove version.php and VERSION global constant, do version-related things in a slightly less ridiculous way
5 years ago
0237dee980
implement automatic night mode detection using MQL
...
add separate light.css to force light theme
remove manual night mode toggle and related code
5 years ago
0a10832491
- update descriptions of changed hotkeys
...
- bind noscroll variants of move article hotkeys to n/p by default
- update N/P (i.e. scroll article content) hotkeys to scroll by fraction of viewport height instead of hardcoded pixel distance
- minor fixes w/ checking for undefined
5 years ago
008afb97a9
exp: unbind from pgup/pgdn buttons by default
5 years ago
f133b78a3e
Fix Shift+PageUp/Down hotkeys
5 years ago
ac95ab4a65
user css dialog: allow saving and applying CSS without closing the dialog
5 years ago
1902a7dcb0
pgup/pgdown hotkey normalization:
...
- pgup/pgdown without modifier scroll headline buffer
- shift+pgup/pgdown work similarly to shift+up/down but operating on pages
5 years ago
f30287be65
versioning changes
...
- remove VERSION_STATIC - https://community.tt-rss.org/t/versioning-changes-for-trunk/2974
- report git commit/timestamp properly by invoking git instead of trying to parse .git/HEAD etc
- remove git-related global constants used when checking for updates
5 years ago
6913158b82
add hotkeys to scroll headlines/articles (whichever is active) by one page
5 years ago
d15f0349bf
remove hardcoded iframe domain whitelist, make iframe script whitelisting configurable by plugins (HOOK_IFRAME_WHITELISTED)
5 years ago
e5b7b145e5
cache media: set referrer to source URL when fetching images
5 years ago
8c3efd51ec
reset domain hit quota on feed update start
5 years ago
cd4b7f1988
implement MAX_FETCH_REQUESTS_PER_HOST: only generating a warning on exceeded quota for the time being
5 years ago
68b0380118
add placeholder authentication via app passwords if service is passed
...
forbid logins via regular passwords for services
remove AUTH_DISABLE_OTP
5 years ago
84e9f1d5cc
update schema for app-specific passwords
5 years ago
4cc6a773ff
Removed redundant text for next/prev article without scroll.
5 years ago
Andrew Dolgov