Commit Graph

10200 Commits (403dca154c6b539de221f9e16174a0fdd0a1e896)
 

Author SHA1 Message Date
Andrew Dolgov c25edd0024 fetch_file_contents: validate effective URL (after redirects) without CURL 4 years ago
Andrew Dolgov 27e695436f fetch_file_contents: validate effective URL (after redirects) if using CURL 4 years ago
Andrew Dolgov afa0023c51 don't try to update manually disabled feeds even if they haven't been updated before or are marked for a manual update 4 years ago
Andrew Dolgov f41fdef389 add gulp task for less compilation 4 years ago
Andrew Dolgov 5415a0e033 add makefile for less to css compilation 4 years ago
Andrew Dolgov 37f41a5246 forgotpass: use type strict comparison for reset token 4 years ago
Andrew Dolgov 5a7e7e1367 don't try to call hash_equals() on unset user token 4 years ago
Andrew Dolgov f72e6947d5 use hash_equals() correctly 4 years ago
Andrew Dolgov e3adacc588 fix several cases of Db class being invoked as wrong name (as DB) 4 years ago
Andrew Dolgov 16c86e2fc3 replace some plain http links with https 4 years ago
Andrew Dolgov a817d3794d * use get_random_bytes() for CSRF token
* get_random_bytes: use PHP7 random_bytes() if it is available
* validate CSRF token using hash_equals
4 years ago
Andrew Dolgov 0757ad0406 auth_internal: use type-strict comparison when checking OTP code 4 years ago
Andrew Dolgov 89d53a7f49 fix typo in previous 4 years ago
Andrew Dolgov 1f79d614c4 fix OTP QR code not displayed because of CSRF token passed as a query
parameter
use type-strict comparison when validating CSRF token on the backend
4 years ago
Andrew Dolgov 6a4b6cf603 amend previous to 127/8 subnet 4 years ago
Andrew Dolgov 213d6330b1 fetch_file_contents: resolve requested hosts and check for possible
loopback address
4 years ago
Andrew Dolgov 88c4dc405e build_url: also put query parameters and fragment in resulting URL
rewrite_relative_url: simplify handling of relative URLs
4 years ago
Andrew Dolgov 9d3c794983 subscribe: allow pre-filling feed URL if passed via query string 4 years ago
Andrew Dolgov da5af2fae0 cached_url: block SVG images because of potential javascript inside 4 years ago
Andrew Dolgov 33fdde249e pass CSRF token to opml import and feed icon replace dialogs 4 years ago
Andrew Dolgov f693ebab21 fix default password nag dialog, load via xhr 4 years ago
Andrew Dolgov 77faa5d523 editFeed: only try to reload feed tree in preferences if its actually there 4 years ago
Andrew Dolgov 3f9390c45f comments link: load in new tab 4 years ago
Andrew Dolgov 42b5564d1e editarticletags: load dialog via XHR 4 years ago
Andrew Dolgov 0706a328a4 handler: default base csrf_ignore() to false 4 years ago
Andrew Dolgov 0a142912d3 backend handler: require CSRF, remove obsolete code 4 years ago
Andrew Dolgov 154417d80b public/logout: require valid CSRF token 4 years ago
Andrew Dolgov cbcb10a272 Feeds: load quickaddfeed and search dialogs via XHR w/ CSRF protection 4 years ago
Andrew Dolgov 8080c525fd - backend: require CSRF token to be passed via POST
- do not leak CSRF token via GET request in feed debugger
- rework Article/redirect to use POST
4 years ago
Andrew Dolgov aeaafefa07 don't pass csrf token as a GET parameter to Article 4 years ago
Andrew Dolgov e670ac2ee5 require CSRF token for Article/redirect 4 years ago
Andrew Dolgov 7e50c6c4b5 - enable CSRF support earlier
- remove rpc/sanityCheck from CSRF-excluded calls
4 years ago
Andrew Dolgov 91e1542a82 af_proxy_http: require separate token to access imgproxy 4 years ago
Andrew Dolgov 1621abcffc rewrite_relative_url: validate resulting absolutized URLs 4 years ago
Andrew Dolgov aa89ea7769 validate_url: only allow safe ports (80, 443), disallow access to loopback 4 years ago
Andrew Dolgov 6c02fea641 validate_url: add clean() 4 years ago
Andrew Dolgov 4abc7d7898 rename base64_img() to image_to_base64() 4 years ago
Andrew Dolgov 79f102c25d af_proxy_http: never print received data directly, always redirect to cached_url
cache/getUrl: basename() passed filename just in case
4 years ago
Andrew Dolgov 1ee458b5c1 cached_url: perform mimetype validation before possible HOOK_SEND_LOCAL_FILE hooks 4 years ago
Andrew Dolgov 0758397dd8 af_redditimgur: don't add embedded blank gif image for rewritten videos 4 years ago
Andrew Dolgov 4a074111b5 user preferences: forbid < and > characters when changing passwords (were silently stripped on save because of clean()) 4 years ago
Andrew Dolgov da98ba662e public/subscribe: require valid CSRF token when validating the form 4 years ago
Andrew Dolgov b4cb67e77f remove csrf token from rpc method sanityCheck 4 years ago
Andrew Dolgov c3d14e1fa5 - fix multiple vulnerabilities in af_proxy_http
- fix vulnerability in rewrite_relative_url() which prevented some URLs from being properly absolutized
- fetch_file_contents: validate all URLs before requesting them
- validate URLs: explicitly whitelist http and https scheme, forbid everything else
- DiskCache/cached_url: only serve whitelisted content types (images, video)
- simplify filename/URL handling code, remove and consolidate some less-used functions
4 years ago
Andrew Dolgov 5b17fdc362 Merge branch 'weblate-integration' 4 years ago
Andrew Dolgov a922b3cc6d order_to_override_query: allow HOOK_HEADLINES_CUSTOM_SORT_OVERRIDE plugins to override built-in sorting 4 years ago
Andrew Dolgov 67f02e2aa7 properly return counters for labels with zero assigned articles
refs https://community.tt-rss.org/t/label-counter-doesnt-update-when-count-goes-down-to-zero/3766
4 years ago
fox 5497a137de Merge branch 'master' of rodneys_mission/tt-rss into master 4 years ago
Rodney Stromlund 88ced02622 Silence php 7.2 error message generated in `session_set_cookie_params`. 4 years ago
Andrew Dolgov ddf9227dc4 pluginhost: allow overriding default sort modes via HOOK_HEADLINES_CUSTOM_SORT_MAP etc 4 years ago