Andrew Dolgov
|
d04ac399ff
|
clarify some URL validation-related error messages
|
4 years ago |
|
Andrew Dolgov
|
3dd4169b5f
|
clarify some URL validation-related error messages
|
4 years ago |
|
Andrew Dolgov
|
4785f21316
|
update_rss_feed: log effective URL after fetching
validate_url: treat scheme as case-insensitive
|
4 years ago |
|
Andrew Dolgov
|
486f1d84ed
|
resolve_redirects: fix previous
|
4 years ago |
|
Andrew Dolgov
|
d2867d887a
|
resolve_redirects: only use three argument version of get_headers() on php 7.1+
|
4 years ago |
|
Andrew Dolgov
|
05ef9aac2f
|
update URL pointing to version.json
|
4 years ago |
|
fox
|
7584ecc8a2
|
Merge branch 'gettext-const-scope' of JustAMacUser/tt-rss into master
|
4 years ago |
|
JustAMacUser
|
c8ac9dc7ea
|
Remove `private` scope for class constants.
This change branches from the merged patch by Sunil Mohan Adapa's for
Debian's package.
|
4 years ago |
|
Andrew Dolgov
|
03a337a660
|
add basic safe mode which doesn't load any user plugins
|
4 years ago |
|
Andrew Dolgov
|
3588d5186e
|
- gettext: merge patch from Sunil Mohan Adapa which rewrites plural parser to not use eval()
- fix typo in aforementioned patch which caused plurals to never load
- update code again to newer PHP constructor syntax
|
4 years ago |
|
Andrew Dolgov
|
4f5ae94b62
|
prevent source errors from crashing gulp watch
|
4 years ago |
|
Andrew Dolgov
|
f3803c9e60
|
add eslint to package.json
|
4 years ago |
|
Andrew Dolgov
|
5c1f70348e
|
add less to package.json
|
4 years ago |
|
Andrew Dolgov
|
4efc3d7b3f
|
validate_url: relax requirements for URLs, limit additional port/loopback filtering to fetch_file_contents()
|
4 years ago |
|
Andrew Dolgov
|
a4525d31b2
|
replace FALSE with false so that static analyzer shuts up about it
|
4 years ago |
|
Andrew Dolgov
|
57fac84516
|
rename gettext.inc to gettext.inc.php (cosmetic)
|
4 years ago |
|
Andrew Dolgov
|
d8619b9a84
|
auth_internal: cast OTP code to integer before trying to check it
|
4 years ago |
|
Andrew Dolgov
|
c25edd0024
|
fetch_file_contents: validate effective URL (after redirects) without CURL
|
4 years ago |
|
Andrew Dolgov
|
27e695436f
|
fetch_file_contents: validate effective URL (after redirects) if using CURL
|
4 years ago |
|
Andrew Dolgov
|
afa0023c51
|
don't try to update manually disabled feeds even if they haven't been updated before or are marked for a manual update
|
4 years ago |
|
Andrew Dolgov
|
f41fdef389
|
add gulp task for less compilation
|
4 years ago |
|
Andrew Dolgov
|
5415a0e033
|
add makefile for less to css compilation
|
4 years ago |
|
Andrew Dolgov
|
37f41a5246
|
forgotpass: use type strict comparison for reset token
|
4 years ago |
|
Andrew Dolgov
|
5a7e7e1367
|
don't try to call hash_equals() on unset user token
|
4 years ago |
|
Andrew Dolgov
|
f72e6947d5
|
use hash_equals() correctly
|
4 years ago |
|
Andrew Dolgov
|
e3adacc588
|
fix several cases of Db class being invoked as wrong name (as DB)
|
4 years ago |
|
Andrew Dolgov
|
16c86e2fc3
|
replace some plain http links with https
|
4 years ago |
|
Andrew Dolgov
|
a817d3794d
|
* use get_random_bytes() for CSRF token
* get_random_bytes: use PHP7 random_bytes() if it is available
* validate CSRF token using hash_equals
|
4 years ago |
|
Andrew Dolgov
|
0757ad0406
|
auth_internal: use type-strict comparison when checking OTP code
|
4 years ago |
|
Andrew Dolgov
|
89d53a7f49
|
fix typo in previous
|
4 years ago |
|
Andrew Dolgov
|
1f79d614c4
|
fix OTP QR code not displayed because of CSRF token passed as a query
parameter
use type-strict comparison when validating CSRF token on the backend
|
4 years ago |
|
Andrew Dolgov
|
6a4b6cf603
|
amend previous to 127/8 subnet
|
4 years ago |
|
Andrew Dolgov
|
213d6330b1
|
fetch_file_contents: resolve requested hosts and check for possible
loopback address
|
4 years ago |
|
Andrew Dolgov
|
88c4dc405e
|
build_url: also put query parameters and fragment in resulting URL
rewrite_relative_url: simplify handling of relative URLs
|
4 years ago |
|
Andrew Dolgov
|
9d3c794983
|
subscribe: allow pre-filling feed URL if passed via query string
|
4 years ago |
|
Andrew Dolgov
|
da5af2fae0
|
cached_url: block SVG images because of potential javascript inside
|
4 years ago |
|
Andrew Dolgov
|
33fdde249e
|
pass CSRF token to opml import and feed icon replace dialogs
|
4 years ago |
|
Andrew Dolgov
|
f693ebab21
|
fix default password nag dialog, load via xhr
|
4 years ago |
|
Andrew Dolgov
|
77faa5d523
|
editFeed: only try to reload feed tree in preferences if its actually there
|
4 years ago |
|
Andrew Dolgov
|
3f9390c45f
|
comments link: load in new tab
|
4 years ago |
|
Andrew Dolgov
|
42b5564d1e
|
editarticletags: load dialog via XHR
|
4 years ago |
|
Andrew Dolgov
|
0706a328a4
|
handler: default base csrf_ignore() to false
|
4 years ago |
|
Andrew Dolgov
|
0a142912d3
|
backend handler: require CSRF, remove obsolete code
|
4 years ago |
|
Andrew Dolgov
|
154417d80b
|
public/logout: require valid CSRF token
|
4 years ago |
|
Andrew Dolgov
|
cbcb10a272
|
Feeds: load quickaddfeed and search dialogs via XHR w/ CSRF protection
|
4 years ago |
|
Andrew Dolgov
|
8080c525fd
|
- backend: require CSRF token to be passed via POST
- do not leak CSRF token via GET request in feed debugger
- rework Article/redirect to use POST
|
4 years ago |
|
Andrew Dolgov
|
aeaafefa07
|
don't pass csrf token as a GET parameter to Article
|
4 years ago |
|
Andrew Dolgov
|
e670ac2ee5
|
require CSRF token for Article/redirect
|
4 years ago |
|
Andrew Dolgov
|
7e50c6c4b5
|
- enable CSRF support earlier
- remove rpc/sanityCheck from CSRF-excluded calls
|
4 years ago |
|
Andrew Dolgov
|
91e1542a82
|
af_proxy_http: require separate token to access imgproxy
|
4 years ago |