26d6b84a57
add namespaced controls with unified naming; deprecated old-style control shortcuts
4 years ago
020f062a76
feeds: unify naming
4 years ago
119a4226d8
validate_csrf: remove warning
4 years ago
f2d3cba231
add HTTP_ACCEPT_LANGUAGE handling for php8
4 years ago
a544123b59
fix clean() for arrays and user plugin list
4 years ago
6e774a58fe
more php8 fixes mostly related to login
4 years ago
403dca154c
initial WIP for php8; bump php version requirement to 7.0
4 years ago
33a5ecd2ce
feed editor: show purge interval correctly if FORCE_ARTICLE_PURGE is set
4 years ago
f59c567831
update_rss_feed: fix BLACKLISTED_TAGS not working properly, simplify tag-related code
4 years ago
936b91a7e6
Don't do deprecated 'libxml_disable_entity_loader(true)' under PHP 8.
...
2d467abc46/UPGRADING (L886)
4 years ago
6bdf4a1a25
Switch to 'get_error_types()' to ensure availability in 'include/functions.php'.
...
The global in 'sanity_check()' was null... possibly due to circular requires?
4 years ago
81c52b4b1e
add support for an override stylesheet which applies to all users
4 years ago
24cdacd59e
enable Farsi locale in the UI
4 years ago
8a02a728c8
add DAEMON_UNSUCCESSFUL_DAYS_LIMIT tunable (defaults to 30 days)
4 years ago
de22464ea8
schema: add ttrss_feeds.last_successful_update
4 years ago
215f388992
move timestamp-related stuff to a separate class
4 years ago
74568df4ff
remove a lot of stuff from global context (functions.php), add a few helper classes instead
4 years ago
d04ac399ff
clarify some URL validation-related error messages
4 years ago
3dd4169b5f
clarify some URL validation-related error messages
4 years ago
4785f21316
update_rss_feed: log effective URL after fetching
...
validate_url: treat scheme as case-insensitive
4 years ago
486f1d84ed
resolve_redirects: fix previous
4 years ago
d2867d887a
resolve_redirects: only use three argument version of get_headers() on php 7.1+
4 years ago
03a337a660
add basic safe mode which doesn't load any user plugins
4 years ago
4efc3d7b3f
validate_url: relax requirements for URLs, limit additional port/loopback filtering to fetch_file_contents()
4 years ago
a4525d31b2
replace FALSE with false so that static analyzer shuts up about it
4 years ago
57fac84516
rename gettext.inc to gettext.inc.php (cosmetic)
4 years ago
c25edd0024
fetch_file_contents: validate effective URL (after redirects) without CURL
4 years ago
27e695436f
fetch_file_contents: validate effective URL (after redirects) if using CURL
4 years ago
5a7e7e1367
don't try to call hash_equals() on unset user token
4 years ago
f72e6947d5
use hash_equals() correctly
4 years ago
e3adacc588
fix several cases of Db class being invoked as wrong name (as DB)
4 years ago
16c86e2fc3
replace some plain http links with https
4 years ago
a817d3794d
* use get_random_bytes() for CSRF token
...
* get_random_bytes: use PHP7 random_bytes() if it is available
* validate CSRF token using hash_equals
4 years ago
1f79d614c4
fix OTP QR code not displayed because of CSRF token passed as a query
...
parameter
use type-strict comparison when validating CSRF token on the backend
4 years ago
6a4b6cf603
amend previous to 127/8 subnet
4 years ago
213d6330b1
fetch_file_contents: resolve requested hosts and check for possible
...
loopback address
4 years ago
88c4dc405e
build_url: also put query parameters and fragment in resulting URL
...
rewrite_relative_url: simplify handling of relative URLs
4 years ago
da5af2fae0
cached_url: block SVG images because of potential javascript inside
4 years ago
aeaafefa07
don't pass csrf token as a GET parameter to Article
4 years ago
1621abcffc
rewrite_relative_url: validate resulting absolutized URLs
4 years ago
aa89ea7769
validate_url: only allow safe ports (80, 443), disallow access to loopback
4 years ago
6c02fea641
validate_url: add clean()
4 years ago
4abc7d7898
rename base64_img() to image_to_base64()
4 years ago
1ee458b5c1
cached_url: perform mimetype validation before possible HOOK_SEND_LOCAL_FILE hooks
4 years ago
b4cb67e77f
remove csrf token from rpc method sanityCheck
4 years ago
c3d14e1fa5
- fix multiple vulnerabilities in af_proxy_http
...
- fix vulnerability in rewrite_relative_url() which prevented some URLs from being properly absolutized
- fetch_file_contents: validate all URLs before requesting them
- validate URLs: explicitly whitelist http and https scheme, forbid everything else
- DiskCache/cached_url: only serve whitelisted content types (images, video)
- simplify filename/URL handling code, remove and consolidate some less-used functions
4 years ago
6eb94f1e13
better support for image srcset attributes as discussed in https://community.tt-rss.org/t/problem-with-img-srcset/3519
4 years ago
19893d33e3
only bind up/down in 3 panel mode
5 years ago
ebb373987a
Revert "unbind up/down by default (use native scrolling for consistency with pgup/pgdn)"
...
This reverts commit 6fc18e450b
5 years ago
6fc18e450b
unbind up/down by default (use native scrolling for consistency with pgup/pgdn)
5 years ago
Andrew Dolgov