59c14e9c00
api: remove base64 encoded passwords (wtf), log all authentication failures in userhelper
4 years ago
efd196839a
stop caching schema version entirely, fix some session_start() related warnings
4 years ago
c96172fa04
use constants in get_pref()/set_pref()
4 years ago
988eb3ac91
initial (wip) for new prefs
4 years ago
8d2e3c2528
drop errors.php and simplify error handling
4 years ago
e4107ac952
wip: initial for config object
4 years ago
be4e7b1340
fix several issues reported by phpstan
4 years ago
d1328321be
move published OPML endpoint to public.php
4 years ago
053b262aa7
rename public.php/cached_url to cached
4 years ago
fc0ebf0891
move bookmarklet-related methods out of public.php into the plugin
4 years ago
c088e9d9d8
get rid of a few more prototype-isms
4 years ago
70fa423026
initial for RIP prototype/scriptaculous
4 years ago
273ada7353
* implement shortcut syntax for exposed plugin methods
...
* move shared article rendering code to share plugin
4 years ago
26d6b84a57
add namespaced controls with unified naming; deprecated old-style control shortcuts
4 years ago
39604bedef
move reset_password to UserHelper
4 years ago
6426ae559a
dbupdater: unify naming
4 years ago
166f2d4666
diskcache: unify naming
4 years ago
8e79f1717d
prefs: unify naming
4 years ago
257efb43c6
article: unify naming
4 years ago
020f062a76
feeds: unify naming
4 years ago
82adb01307
render enclosures on the client
4 years ago
0b7377238a
add Handler_Administrative
4 years ago
a8cc43a0ff
move logout_user() to UserHelper
4 years ago
15fd23c374
use shortcut echo syntax for php templates
4 years ago
d3940b6259
fix a bunch of warnings related to generated feeds
4 years ago
e6624cf631
fix a few more session-related warnings
4 years ago
71dfc83466
force _ENABLED_PLUGINS to string when passed to pluginhost
4 years ago
74986d1ac6
shorten pref tab names; make log-alert clickable
4 years ago
09e9f34bb4
add UserHelper::find_user_by_login() and rewrite some user checks to invoke it instead of going through PDO
4 years ago
7af8744c85
authentication: make logins case-insensitive (force lowercase)
4 years ago
9f3de2d24c
login: fix profile warning
4 years ago
7eb860af61
even more hooks
4 years ago
1eb1629d9e
pluginhost: rework run_hooks() to be shorter, add callback variant; implement exception handling for both
4 years ago
3f972f8fed
public/subscribe: fix warnings
4 years ago
6e774a58fe
more php8 fixes mostly related to login
4 years ago
403dca154c
initial WIP for php8; bump php version requirement to 7.0
4 years ago
da0ad82c24
Archive cleanup:
...
- remove code to manually archive/unarchive articles
- remove ttrss_archived_feeds/orig_feed_id handling - the whole thing was implemented for
this data to be kept indefinitely; it doesn't make a lot of sense to deal with this stuff
now that it is expired after one month anyway (same reasons as feed browser being removed - privacy)
- remove "originally from"-related stuff because of the above
- also remove unused remaining frontend/backend code related to feed browser (rip)
4 years ago
40f38fc87f
pluginhost: load plugin data automatically (also marks load_data method as private)
4 years ago
f67f0f864b
HOOK_ARTICLE_EXPORT_FEED: also pass owner_uid
4 years ago
fadf4dec96
Include tags for HOOK_ARTICLE_EXPORT_FEED.
4 years ago
a8302fb253
use X-Real-IP headers if possible while authenticating
4 years ago
215f388992
move timestamp-related stuff to a separate class
4 years ago
74568df4ff
remove a lot of stuff from global context (functions.php), add a few helper classes instead
4 years ago
03a337a660
add basic safe mode which doesn't load any user plugins
4 years ago
37f41a5246
forgotpass: use type strict comparison for reset token
4 years ago
1f79d614c4
fix OTP QR code not displayed because of CSRF token passed as a query
...
parameter
use type-strict comparison when validating CSRF token on the backend
4 years ago
9d3c794983
subscribe: allow pre-filling feed URL if passed via query string
4 years ago
154417d80b
public/logout: require valid CSRF token
4 years ago
8080c525fd
- backend: require CSRF token to be passed via POST
...
- do not leak CSRF token via GET request in feed debugger
- rework Article/redirect to use POST
4 years ago
da98ba662e
public/subscribe: require valid CSRF token when validating the form
4 years ago
Andrew Dolgov