3dd4169b5f
clarify some URL validation-related error messages
4 years ago
4785f21316
update_rss_feed: log effective URL after fetching
...
validate_url: treat scheme as case-insensitive
4 years ago
486f1d84ed
resolve_redirects: fix previous
4 years ago
d2867d887a
resolve_redirects: only use three argument version of get_headers() on php 7.1+
4 years ago
03a337a660
add basic safe mode which doesn't load any user plugins
4 years ago
4efc3d7b3f
validate_url: relax requirements for URLs, limit additional port/loopback filtering to fetch_file_contents()
4 years ago
a4525d31b2
replace FALSE with false so that static analyzer shuts up about it
4 years ago
57fac84516
rename gettext.inc to gettext.inc.php (cosmetic)
4 years ago
c25edd0024
fetch_file_contents: validate effective URL (after redirects) without CURL
4 years ago
27e695436f
fetch_file_contents: validate effective URL (after redirects) if using CURL
4 years ago
5a7e7e1367
don't try to call hash_equals() on unset user token
4 years ago
f72e6947d5
use hash_equals() correctly
4 years ago
e3adacc588
fix several cases of Db class being invoked as wrong name (as DB)
4 years ago
16c86e2fc3
replace some plain http links with https
4 years ago
a817d3794d
* use get_random_bytes() for CSRF token
...
* get_random_bytes: use PHP7 random_bytes() if it is available
* validate CSRF token using hash_equals
4 years ago
1f79d614c4
fix OTP QR code not displayed because of CSRF token passed as a query
...
parameter
use type-strict comparison when validating CSRF token on the backend
4 years ago
6a4b6cf603
amend previous to 127/8 subnet
4 years ago
213d6330b1
fetch_file_contents: resolve requested hosts and check for possible
...
loopback address
4 years ago
88c4dc405e
build_url: also put query parameters and fragment in resulting URL
...
rewrite_relative_url: simplify handling of relative URLs
4 years ago
da5af2fae0
cached_url: block SVG images because of potential javascript inside
4 years ago
aeaafefa07
don't pass csrf token as a GET parameter to Article
4 years ago
1621abcffc
rewrite_relative_url: validate resulting absolutized URLs
4 years ago
aa89ea7769
validate_url: only allow safe ports (80, 443), disallow access to loopback
4 years ago
6c02fea641
validate_url: add clean()
4 years ago
4abc7d7898
rename base64_img() to image_to_base64()
4 years ago
1ee458b5c1
cached_url: perform mimetype validation before possible HOOK_SEND_LOCAL_FILE hooks
4 years ago
b4cb67e77f
remove csrf token from rpc method sanityCheck
4 years ago
c3d14e1fa5
- fix multiple vulnerabilities in af_proxy_http
...
- fix vulnerability in rewrite_relative_url() which prevented some URLs from being properly absolutized
- fetch_file_contents: validate all URLs before requesting them
- validate URLs: explicitly whitelist http and https scheme, forbid everything else
- DiskCache/cached_url: only serve whitelisted content types (images, video)
- simplify filename/URL handling code, remove and consolidate some less-used functions
4 years ago
376dce02bb
Update wiki and forums links in error message.
4 years ago
6eb94f1e13
better support for image srcset attributes as discussed in https://community.tt-rss.org/t/problem-with-img-srcset/3519
5 years ago
19893d33e3
only bind up/down in 3 panel mode
5 years ago
ebb373987a
Revert "unbind up/down by default (use native scrolling for consistency with pgup/pgdn)"
...
This reverts commit 6fc18e450b
5 years ago
6fc18e450b
unbind up/down by default (use native scrolling for consistency with pgup/pgdn)
5 years ago
9ae9302b6b
implement keyboard-related changes discussed in https://community.tt-rss.org/t/changing-the-amount-of-scroll-by-arrow-key/3452/7
5 years ago
7a0ea9d90e
Make iframes size responsively.
5 years ago
2b55afbeec
sanitize: forbid "allow" attribute
...
CSS: remove auto hyphens stuff, remove iframe width clipping to 98% because they get squished
5 years ago
2558fcbe21
add hotkey "\" to cancel current search
5 years ago
e934e9f05e
sanitize: simplify initial attribute processing
5 years ago
7d9dd51cf4
sanitize: remove srcset plain-http hack, globally disallow width and height attributes for all elements
5 years ago
83c8834421
sanitize: handle picture[@srcset] elements properly, i.e. rewrite relative URLs
5 years ago
1ad43dd202
Fix documentation for _noexpand commands
5 years ago
569228a5df
In get_version() disable DIRECTORY_SEPARATOR check, permit using git on Windows to get version details;
5 years ago
4e74da590e
af_readability: allow get full text button to work as a toggle; in cdm, scroll to article after embedding
5 years ago
07b27b375f
update toggle_embed_original hotkey to invoke readability embed instead of removed embed_original plugin
5 years ago
4ab3854aed
don't generate default.css, replace with themes/light.css as a default root CSS file
5 years ago
06b9d39662
add support for image loading=lazy attribute
5 years ago
076c5382fa
login form: add workarounds for chrome password manager
5 years ago
6080cca9ca
scrap counter cache system; rework counters to sum() booleans instead
5 years ago
a6d314b753
support dark mode for login form
5 years ago
01513aa41b
disable MAX_FETCH_REQUESTS_PER_HOST warnings for the time being
5 years ago
5fc499e19e
get_version: don't rely on exec() exit code to determine whether output is valid
5 years ago
fdb1fc7608
get_version: fix commit/timestamp lost on subsequent invocations because of misbehaving caching
5 years ago
6439f7817d
force-disable php display_errors/display_startup_errors on startup
5 years ago
c309856a97
get_version: filter out Darwin
5 years ago
74feef0f9d
get_version: always return unsupported on windows
5 years ago
c46c5e59fc
SELF_USER_AGENT: switch to get_version()
5 years ago
72d8a34f74
get_version: don't pass useless root dir to git, instead log it in case of failure
5 years ago
72d0fac80c
remove version.php and VERSION global constant, do version-related things in a slightly less ridiculous way
5 years ago
0237dee980
implement automatic night mode detection using MQL
...
add separate light.css to force light theme
remove manual night mode toggle and related code
5 years ago
0a10832491
- update descriptions of changed hotkeys
...
- bind noscroll variants of move article hotkeys to n/p by default
- update N/P (i.e. scroll article content) hotkeys to scroll by fraction of viewport height instead of hardcoded pixel distance
- minor fixes w/ checking for undefined
5 years ago
008afb97a9
exp: unbind from pgup/pgdn buttons by default
5 years ago
6191c48596
trim() contents of version_static.txt
5 years ago
f4945b1ba1
Merge branch 'page-hotkeys' of suraia/tt-rss into master
5 years ago
5907409a84
add support for custom version_static.txt for package maintainers
5 years ago
f133b78a3e
Fix Shift+PageUp/Down hotkeys
5 years ago
ac95ab4a65
user css dialog: allow saving and applying CSS without closing the dialog
5 years ago
565547f5a1
php 7.4 deprecation-related fixes
5 years ago
1902a7dcb0
pgup/pgdown hotkey normalization:
...
- pgup/pgdown without modifier scroll headline buffer
- shift+pgup/pgdown work similarly to shift+up/down but operating on pages
5 years ago
f30287be65
versioning changes
...
- remove VERSION_STATIC - https://community.tt-rss.org/t/versioning-changes-for-trunk/2974
- report git commit/timestamp properly by invoking git instead of trying to parse .git/HEAD etc
- remove git-related global constants used when checking for updates
5 years ago
6913158b82
add hotkeys to scroll headlines/articles (whichever is active) by one page
5 years ago
d15f0349bf
remove hardcoded iframe domain whitelist, make iframe script whitelisting configurable by plugins (HOOK_IFRAME_WHITELISTED)
5 years ago
e5b7b145e5
cache media: set referrer to source URL when fetching images
5 years ago
8c3efd51ec
reset domain hit quota on feed update start
5 years ago
cd4b7f1988
implement MAX_FETCH_REQUESTS_PER_HOST: only generating a warning on exceeded quota for the time being
5 years ago
6b47f5a6d1
fix position for "forgotpass" link
5 years ago
68b0380118
add placeholder authentication via app passwords if service is passed
...
forbid logins via regular passwords for services
remove AUTH_DISABLE_OTP
5 years ago
84e9f1d5cc
update schema for app-specific passwords
5 years ago
4cc6a773ff
Removed redundant text for next/prev article without scroll.
5 years ago
2e61551c28
Try to clarify next/prev article keyboard shortcut help.
5 years ago
3e4701116d
af_readability: add missing file
5 years ago
9806a2b5ff
bump version_static
5 years ago
6914ad1f74
retire MIN_CACHE_FILE_SIZE
5 years ago
3c075bfd21
DiskCache: more strict checking for input filenames, getUrl() is no longer static
5 years ago
133c2b482b
move rewrite_cached_urls to DiskCache::rewriteUrls()
5 years ago
b1dd38f880
add DiskCache.getUrl() and use it in a bunch of places
5 years ago
088fcf8131
move more globals to more appropriate places
...
set libxml to always use internal errors
6 years ago
4fa9aee4e7
move several more global functions to more appropriate classes
6 years ago
6d746453c7
get_feeds_from_html: remove XML preamble hack
...
move several related helper functions to Feeds class
6 years ago
66cbe55148
sanity check: require UConverter from php intl
6 years ago
ccc0315ef0
better tsquery support:
...
1. report query syntax errors properly
2. fall back to implicit &-joining only if no joiners are detected in user query, otherwise permit full tsquery syntax
6 years ago
3d8c6967da
Add keyboard shortcut 'g r': Go to Recently read
6 years ago
6fbf349155
add hidden _SKIP_SESSION_UA_CHECKS tunable
6 years ago
6768b3a4a3
schema: add DEFAULT_SEARCH_LANGUAGE
6 years ago
2c2f74a104
PDO error in cleanup_tags repaired
...
Changes :
- add PDO::PARAM_INT to a value in a PDO query
- switch limit to limit_part to respect semantic here (cleanup by packages)
6 years ago
671f4cee65
domdocument: remove old meta charset unicode hacks, replace with shorter xml preamble utf8 hack (on loadhtml where it makes sense)
...
af_readability: better (?) charset hack for non-unicode pages
6 years ago
01b2f0a24f
support "picture" tags in articles
6 years ago
e74f7bde22
Refactor hotkeys to use keypress instead of keydown
...
keydown returns the "raw" key in event.which. Depending on the keyboard
layout, this may not be what is wanted. For example, on a German
keyboard, Shift+7 has to be pressed to get a slash. However, event.which
will be 55, which corresponds to "7". In the keypress event, however,
event.which will be 47, which corresponds to "/".
Sadly, several important keys (such as escape and the arrow keys) do not
trigger a keypress event. Therefore, they have to be handled using a
keydown event.
This change refactors the hotkey support to make use of keypress events
whenever possible. This will make hotkeys work regardless of the user's
keyboard layout. Escape and arrow keys are still handled via keydown
events.
There should be only one change in behavior: I could not make Ctrl+/
work and therefore rebound the help dialog to "?".
6 years ago
32f9fda33d
add composite key on ttrss_feeds (feed_url & owner_uid)
6 years ago
0b74db5ad7
remove feedbrowser (other feeds)
6 years ago
38e01270d8
archived feeds: expire old entries (schema bump)
6 years ago
Andrew Dolgov