afa0023c51
don't try to update manually disabled feeds even if they haven't been updated before or are marked for a manual update
4 years ago
37f41a5246
forgotpass: use type strict comparison for reset token
4 years ago
e3adacc588
fix several cases of Db class being invoked as wrong name (as DB)
4 years ago
89d53a7f49
fix typo in previous
4 years ago
1f79d614c4
fix OTP QR code not displayed because of CSRF token passed as a query
...
parameter
use type-strict comparison when validating CSRF token on the backend
4 years ago
9d3c794983
subscribe: allow pre-filling feed URL if passed via query string
4 years ago
33fdde249e
pass CSRF token to opml import and feed icon replace dialogs
4 years ago
42b5564d1e
editarticletags: load dialog via XHR
4 years ago
0706a328a4
handler: default base csrf_ignore() to false
4 years ago
0a142912d3
backend handler: require CSRF, remove obsolete code
4 years ago
154417d80b
public/logout: require valid CSRF token
4 years ago
cbcb10a272
Feeds: load quickaddfeed and search dialogs via XHR w/ CSRF protection
4 years ago
8080c525fd
- backend: require CSRF token to be passed via POST
...
- do not leak CSRF token via GET request in feed debugger
- rework Article/redirect to use POST
4 years ago
e670ac2ee5
require CSRF token for Article/redirect
4 years ago
7e50c6c4b5
- enable CSRF support earlier
...
- remove rpc/sanityCheck from CSRF-excluded calls
4 years ago
79f102c25d
af_proxy_http: never print received data directly, always redirect to cached_url
...
cache/getUrl: basename() passed filename just in case
4 years ago
4a074111b5
user preferences: forbid < and > characters when changing passwords (were silently stripped on save because of clean())
4 years ago
da98ba662e
public/subscribe: require valid CSRF token when validating the form
4 years ago
c3d14e1fa5
- fix multiple vulnerabilities in af_proxy_http
...
- fix vulnerability in rewrite_relative_url() which prevented some URLs from being properly absolutized
- fetch_file_contents: validate all URLs before requesting them
- validate URLs: explicitly whitelist http and https scheme, forbid everything else
- DiskCache/cached_url: only serve whitelisted content types (images, video)
- simplify filename/URL handling code, remove and consolidate some less-used functions
4 years ago
a922b3cc6d
order_to_override_query: allow HOOK_HEADLINES_CUSTOM_SORT_OVERRIDE plugins to override built-in sorting
4 years ago
67f02e2aa7
properly return counters for labels with zero assigned articles
...
refs https://community.tt-rss.org/t/label-counter-doesnt-update-when-count-goes-down-to-zero/3766
4 years ago
88ced02622
Silence php 7.2 error message generated in `session_set_cookie_params`.
4 years ago
ddf9227dc4
pluginhost: allow overriding default sort modes via HOOK_HEADLINES_CUSTOM_SORT_MAP etc
4 years ago
dfa65e9374
move order_by to SQL override logic into a separate function
4 years ago
48be005774
instead of taking batch timestamp and score (?) into account, make oldest first sorting work consistently with newest first - i.e. rely on feed-provided timestamp
4 years ago
05a47e5cf4
OPML: export/import per-feed purge interval
4 years ago
c4ee0e25a1
more int/string type mismatches on getCategories
4 years ago
3da618e0ea
make sure all ints are casted (to int) on getCategories
4 years ago
68b78ecd3d
Merge branch 'bugfix/invalid-opml' of wn/tt-rss into master
4 years ago
b6372a846d
when exporting OPML via web UI, add user login to the filename
4 years ago
fa653f5a43
prefs: show disabled filters properly on mysql
4 years ago
2996a3942f
prefs: show root of filter tree as enabled so it's not grayed out
4 years ago
614d3ac1bf
Properly check if OPML file was loaded during import.
4 years ago
c352e872e9
core: pass found enclosures to HOOK_ARTICLE_FILTER
...
af_redditimgur: remove enclosures if we found something to embed because it's going to be a low-res thumbnail
4 years ago
6eb94f1e13
better support for image srcset attributes as discussed in https://community.tt-rss.org/t/problem-with-img-srcset/3519
4 years ago
d01ad09800
eslint-related fixes; move a few things from global context to App
4 years ago
c8cc845d5b
when removing favicon, reset its auto-refresh timer
4 years ago
06d2c65193
calculate_article_hash: don't die() on previous, woops
4 years ago
3a142cbf58
calculate_article_hash: ignore some useless or read-only fields (i.e. GUID) when calculating hash
4 years ago
cd1f3cb8cc
* store UID in article hashed GUID separately so it could be migrated cleanly to a different instance
...
* store resulting GUID as a JSON object so it could be extended easier if needed
4 years ago
7a2e9bef77
add --opml-export to update.php
4 years ago
c275a0cd33
DiskCache: append fake file extension when sending cached files based on mime type to make saving files easier
4 years ago
3a4b9249a9
DiskCache: properly deal with srcset attributes
4 years ago
4a00f96733
remove unneeded var_dump()
4 years ago
6573541873
* add HOOK_ENCLOSURE_IMPORTED
...
* pass feed id to HOOK_FEED_PARSED
4 years ago
44b1f0fcc0
search: add support for label:XXX search keyword
...
Labels: enforce case-insensitive lookups when creating/looking for labels
4 years ago
1f2a721905
allow overriding built-in templates via templates.local
4 years ago
ec1b0befc7
add support for video[@src] in media cache
...
it's a valid alternative to a source[@src] child element:
https://developer.mozilla.org/en-US/docs/Web/HTML/Element/video
4 years ago
cdde23b4dc
actually download <video> posters to media cache
...
video[@poster] is already supported in the rewriting logic but never
actually downloaded
4 years ago
b4287a2e98
fix url rewriting for videos with poster and src
...
if a poster attribute was present only that would have been rewritten
and the (arguably more important) src attribute would be left as-is
4 years ago
Andrew Dolgov