Andrew Dolgov
1621abcffc
rewrite_relative_url: validate resulting absolutized URLs
4 years ago
Andrew Dolgov
aa89ea7769
validate_url: only allow safe ports (80, 443), disallow access to loopback
4 years ago
Andrew Dolgov
6c02fea641
validate_url: add clean()
4 years ago
Andrew Dolgov
4abc7d7898
rename base64_img() to image_to_base64()
4 years ago
Andrew Dolgov
1ee458b5c1
cached_url: perform mimetype validation before possible HOOK_SEND_LOCAL_FILE hooks
4 years ago
Andrew Dolgov
b4cb67e77f
remove csrf token from rpc method sanityCheck
4 years ago
Andrew Dolgov
c3d14e1fa5
- fix multiple vulnerabilities in af_proxy_http
...
- fix vulnerability in rewrite_relative_url() which prevented some URLs from being properly absolutized
- fetch_file_contents: validate all URLs before requesting them
- validate URLs: explicitly whitelist http and https scheme, forbid everything else
- DiskCache/cached_url: only serve whitelisted content types (images, video)
- simplify filename/URL handling code, remove and consolidate some less-used functions
4 years ago
Andrew Dolgov
6eb94f1e13
better support for image srcset attributes as discussed in https://community.tt-rss.org/t/problem-with-img-srcset/3519
4 years ago
Andrew Dolgov
19893d33e3
only bind up/down in 3 panel mode
5 years ago
Andrew Dolgov
ebb373987a
Revert "unbind up/down by default (use native scrolling for consistency with pgup/pgdn)"
...
This reverts commit 6fc18e450b
.
5 years ago
Andrew Dolgov
6fc18e450b
unbind up/down by default (use native scrolling for consistency with pgup/pgdn)
5 years ago
Andrew Dolgov
9ae9302b6b
implement keyboard-related changes discussed in https://community.tt-rss.org/t/changing-the-amount-of-scroll-by-arrow-key/3452/7
5 years ago
JustAMacUser
7a0ea9d90e
Make iframes size responsively.
5 years ago
Andrew Dolgov
2b55afbeec
sanitize: forbid "allow" attribute
...
CSS: remove auto hyphens stuff, remove iframe width clipping to 98% because they get squished
5 years ago
Andrew Dolgov
2558fcbe21
add hotkey "\" to cancel current search
5 years ago
Andrew Dolgov
e934e9f05e
sanitize: simplify initial attribute processing
5 years ago
Andrew Dolgov
7d9dd51cf4
sanitize: remove srcset plain-http hack, globally disallow width and height attributes for all elements
5 years ago
Andrew Dolgov
83c8834421
sanitize: handle picture[@srcset] elements properly, i.e. rewrite relative URLs
5 years ago
Martin Stone
1ad43dd202
Fix documentation for _noexpand commands
5 years ago
Toby Simmons
569228a5df
In get_version() disable DIRECTORY_SEPARATOR check, permit using git on Windows to get version details;
5 years ago
Andrew Dolgov
4e74da590e
af_readability: allow get full text button to work as a toggle; in cdm, scroll to article after embedding
5 years ago
Andrew Dolgov
07b27b375f
update toggle_embed_original hotkey to invoke readability embed instead of removed embed_original plugin
5 years ago
Andrew Dolgov
4ab3854aed
don't generate default.css, replace with themes/light.css as a default root CSS file
5 years ago
Andrew Dolgov
06b9d39662
add support for image loading=lazy attribute
5 years ago
Andrew Dolgov
6080cca9ca
scrap counter cache system; rework counters to sum() booleans instead
5 years ago
Andrew Dolgov
01513aa41b
disable MAX_FETCH_REQUESTS_PER_HOST warnings for the time being
5 years ago
Andrew Dolgov
5fc499e19e
get_version: don't rely on exec() exit code to determine whether output is valid
5 years ago
Andrew Dolgov
fdb1fc7608
get_version: fix commit/timestamp lost on subsequent invocations because of misbehaving caching
5 years ago
Andrew Dolgov
6439f7817d
force-disable php display_errors/display_startup_errors on startup
5 years ago
Andrew Dolgov
c309856a97
get_version: filter out Darwin
5 years ago
Andrew Dolgov
74feef0f9d
get_version: always return unsupported on windows
5 years ago
Andrew Dolgov
c46c5e59fc
SELF_USER_AGENT: switch to get_version()
5 years ago
Andrew Dolgov
72d8a34f74
get_version: don't pass useless root dir to git, instead log it in case of failure
5 years ago
Andrew Dolgov
72d0fac80c
remove version.php and VERSION global constant, do version-related things in a slightly less ridiculous way
5 years ago
Andrew Dolgov
0237dee980
implement automatic night mode detection using MQL
...
add separate light.css to force light theme
remove manual night mode toggle and related code
5 years ago
Andrew Dolgov
0a10832491
- update descriptions of changed hotkeys
...
- bind noscroll variants of move article hotkeys to n/p by default
- update N/P (i.e. scroll article content) hotkeys to scroll by fraction of viewport height instead of hardcoded pixel distance
- minor fixes w/ checking for undefined
5 years ago
Andrew Dolgov
008afb97a9
exp: unbind from pgup/pgdn buttons by default
5 years ago
Michael Kuhn
f133b78a3e
Fix Shift+PageUp/Down hotkeys
5 years ago
Andrew Dolgov
ac95ab4a65
user css dialog: allow saving and applying CSS without closing the dialog
5 years ago
Andrew Dolgov
1902a7dcb0
pgup/pgdown hotkey normalization:
...
- pgup/pgdown without modifier scroll headline buffer
- shift+pgup/pgdown work similarly to shift+up/down but operating on pages
5 years ago
Andrew Dolgov
f30287be65
versioning changes
...
- remove VERSION_STATIC - https://community.tt-rss.org/t/versioning-changes-for-trunk/2974
- report git commit/timestamp properly by invoking git instead of trying to parse .git/HEAD etc
- remove git-related global constants used when checking for updates
5 years ago
Andrew Dolgov
6913158b82
add hotkeys to scroll headlines/articles (whichever is active) by one page
5 years ago
Andrew Dolgov
d15f0349bf
remove hardcoded iframe domain whitelist, make iframe script whitelisting configurable by plugins (HOOK_IFRAME_WHITELISTED)
5 years ago
Andrew Dolgov
e5b7b145e5
cache media: set referrer to source URL when fetching images
5 years ago
Andrew Dolgov
8c3efd51ec
reset domain hit quota on feed update start
5 years ago
Andrew Dolgov
cd4b7f1988
implement MAX_FETCH_REQUESTS_PER_HOST: only generating a warning on exceeded quota for the time being
5 years ago
Andrew Dolgov
68b0380118
add placeholder authentication via app passwords if service is passed
...
forbid logins via regular passwords for services
remove AUTH_DISABLE_OTP
5 years ago
Andrew Dolgov
84e9f1d5cc
update schema for app-specific passwords
5 years ago
JustAMacUser
4cc6a773ff
Removed redundant text for next/prev article without scroll.
5 years ago
JustAMacUser
2e61551c28
Try to clarify next/prev article keyboard shortcut help.
5 years ago
Andrew Dolgov
3e4701116d
af_readability: add missing file
5 years ago
Andrew Dolgov
6914ad1f74
retire MIN_CACHE_FILE_SIZE
5 years ago
Andrew Dolgov
3c075bfd21
DiskCache: more strict checking for input filenames, getUrl() is no longer static
5 years ago
Andrew Dolgov
133c2b482b
move rewrite_cached_urls to DiskCache::rewriteUrls()
5 years ago
Andrew Dolgov
b1dd38f880
add DiskCache.getUrl() and use it in a bunch of places
5 years ago
Andrew Dolgov
088fcf8131
move more globals to more appropriate places
...
set libxml to always use internal errors
5 years ago
Andrew Dolgov
4fa9aee4e7
move several more global functions to more appropriate classes
5 years ago
Andrew Dolgov
6d746453c7
get_feeds_from_html: remove XML preamble hack
...
move several related helper functions to Feeds class
5 years ago
Andrew Dolgov
ccc0315ef0
better tsquery support:
...
1. report query syntax errors properly
2. fall back to implicit &-joining only if no joiners are detected in user query, otherwise permit full tsquery syntax
6 years ago
ltGuillaume
3d8c6967da
Add keyboard shortcut 'g r': Go to Recently read
6 years ago
Andrew Dolgov
6768b3a4a3
schema: add DEFAULT_SEARCH_LANGUAGE
6 years ago
Greg-T
2c2f74a104
PDO error in cleanup_tags repaired
...
Changes :
- add PDO::PARAM_INT to a value in a PDO query
- switch limit to limit_part to respect semantic here (cleanup by packages)
6 years ago
Andrew Dolgov
671f4cee65
domdocument: remove old meta charset unicode hacks, replace with shorter xml preamble utf8 hack (on loadhtml where it makes sense)
...
af_readability: better (?) charset hack for non-unicode pages
6 years ago
Andrew Dolgov
01b2f0a24f
support "picture" tags in articles
6 years ago
Michael Kuhn
e74f7bde22
Refactor hotkeys to use keypress instead of keydown
...
keydown returns the "raw" key in event.which. Depending on the keyboard
layout, this may not be what is wanted. For example, on a German
keyboard, Shift+7 has to be pressed to get a slash. However, event.which
will be 55, which corresponds to "7". In the keypress event, however,
event.which will be 47, which corresponds to "/".
Sadly, several important keys (such as escape and the arrow keys) do not
trigger a keypress event. Therefore, they have to be handled using a
keydown event.
This change refactors the hotkey support to make use of keypress events
whenever possible. This will make hotkeys work regardless of the user's
keyboard layout. Escape and arrow keys are still handled via keydown
events.
There should be only one change in behavior: I could not make Ctrl+/
work and therefore rebound the help dialog to "?".
6 years ago
Andrew Dolgov
32f9fda33d
add composite key on ttrss_feeds (feed_url & owner_uid)
6 years ago
Andrew Dolgov
38e01270d8
archived feeds: expire old entries (schema bump)
6 years ago
Andrew Dolgov
dfd3a4e581
update previous with make_password() in tt-rss proper
6 years ago
Andrew Dolgov
16a9bdc387
make_password: generate longer passwords by default, use better random function if available
6 years ago
Andrew Dolgov
925065b1fe
Revert "login: only allow relative URLs in return="
...
This reverts commit c68ac04020
.
6 years ago
Andrew Dolgov
c68ac04020
login: only allow relative URLs in return=
6 years ago
Andrew Dolgov
72fcc81919
support per-plugin locale directories
6 years ago
Andrew Dolgov
32db1cb872
OPML: include (and import) ttrss per-feed update interval and sort order
6 years ago
Andrew Dolgov
874a2d2170
Revert "enable fi_FI locale"
...
oops, nevermind
This reverts commit e00041b206
.
6 years ago
Andrew Dolgov
e00041b206
enable fi_FI locale
6 years ago
root
5ac1935db5
Make article date select 12/24 time based on SHORT_DATE_FORMAT
6 years ago
Andrii Zhuk
f1f2b81a90
Add i18n for auto mode:wq
6 years ago
Andrii Zhuk
57c3322088
Changed language name for Ukrainian
6 years ago
Andrew Dolgov
17a8821c0b
enable uk_UA locale; rebase translations
6 years ago
Andrew Dolgov
1351ce370a
truncate_middle: make it utf8 aware
6 years ago
Andrew Dolgov
a5517fe857
fetch_file_contents: decompress gzipped data
...
af_readability: remove utf8 preamble hack
6 years ago
Andrew Dolgov
957c44d177
rework git update checking to be initiated by frontend, outside of runtime info output
6 years ago
Andrew Dolgov
d53cdaf815
requestCounters: remove cooldown
6 years ago
Andrew Dolgov
25ca144bb7
score: get correct classes for rows/score icons on the client
6 years ago
Andrew Dolgov
7e5c999146
show alert if recent_log_events > 0
6 years ago
Andrew Dolgov
51de0ce807
runtime info: return count of recent eventlog entries
6 years ago
Andrew Dolgov
1c8593c1fa
add hotkey (a N) to toggle night.css
6 years ago
Andrew Dolgov
703351c79e
remove theme supports-version etc checking
6 years ago
Andrew Dolgov
3e4326e34d
add ttrss_filters2.last_triggered (bump schema version)
6 years ago
Andrew Dolgov
a01c33d654
add HOOK_FILTER_TRIGGERED (for filter debugging)
6 years ago
Andrew Dolgov
0b8cbc9156
remove some bitmaps and rework stuff using it to use iconfont instead
6 years ago
Andrew Dolgov
15d05e8a26
night.css: do not import default less theme statically
...
remove themes/default.php (not needed)
compact.css: fixes
6 years ago
Andrew Dolgov
d2d2cb7e7d
rework scoring display, JS processing and icons
6 years ago
Andrew Dolgov
197e80add6
fix several issues related to profile being set to a non-numeric value
6 years ago
Andrew Dolgov
d9c5c93cef
move some more stuff out of common.js
...
rework client-side cookie functions a bit
limit dojo cachebust based on server scripts modification time
remove param_escape()
6 years ago
Andrew Dolgov
f89924f7a1
set use strict on JS modules; remove some mostly useless stuff like get_minified_js()
6 years ago
Andrew Dolgov
874560db54
remove obsolete row selection functions
...
move getUrlParam() to Utils
6 years ago
Andrew Dolgov
5aa9c60494
bring back (debloated) version of unexpanded combined mode
6 years ago
Andrew Dolgov
bf1b89d0f1
enable c-up/down hotkeys even out of cdm
6 years ago
Andrew Dolgov
50052fb78a
strip_harmful_tags: remove data- attributes
6 years ago