154417d80b
public/logout: require valid CSRF token
4 years ago
8080c525fd
- backend: require CSRF token to be passed via POST
...
- do not leak CSRF token via GET request in feed debugger
- rework Article/redirect to use POST
4 years ago
da98ba662e
public/subscribe: require valid CSRF token when validating the form
4 years ago
c3d14e1fa5
- fix multiple vulnerabilities in af_proxy_http
...
- fix vulnerability in rewrite_relative_url() which prevented some URLs from being properly absolutized
- fetch_file_contents: validate all URLs before requesting them
- validate URLs: explicitly whitelist http and https scheme, forbid everything else
- DiskCache/cached_url: only serve whitelisted content types (images, video)
- simplify filename/URL handling code, remove and consolidate some less-used functions
4 years ago
88ced02622
Silence php 7.2 error message generated in `session_set_cookie_params`.
4 years ago
dfa65e9374
move order_by to SQL override logic into a separate function
4 years ago
48be005774
instead of taking batch timestamp and score (?) into account, make oldest first sorting work consistently with newest first - i.e. rely on feed-provided timestamp
4 years ago
1f2a721905
allow overriding built-in templates via templates.local
5 years ago
bdb1e475e7
external subscribe dialog: support dark theme
5 years ago
b2876f6c72
share anything dialog: support dark theme
5 years ago
4ab3854aed
don't generate default.css, replace with themes/light.css as a default root CSS file
5 years ago
aa56bcaf44
support night mode when using share by URL
5 years ago
f47998f569
generate_syndicated_feed: use local media in generated feeds if it is available
5 years ago
72d0fac80c
remove version.php and VERSION global constant, do version-related things in a slightly less ridiculous way
5 years ago
ef514bc4bd
add notifications for mail and password changes
...
update and shorten some other message templates
5 years ago
958c4dc124
Removed extra php end tag that was showing in the page title
5 years ago
3e4701116d
af_readability: add missing file
5 years ago
0e3b71c535
public/pluginhandler: log invalid requests
5 years ago
d4df57e1a4
Article::get_article_image() - also return stream URI if possible
5 years ago
68e2b05f65
* move get_article_image to Article; implement better og:image detection (similar to android app)
...
* pass article image to API clients in headlines row object
5 years ago
39f459eb04
public/cached_url: forbid sending files with extensions
5 years ago
3c075bfd21
DiskCache: more strict checking for input filenames, getUrl() is no longer static
5 years ago
fdb6066bf6
* HOOK_ENCLOSURE_ENTRY: pass article_id to handler
...
* DiskCache: multiple fixes; support isWritable() for cache entries, set content-disposition for send()
* public/cached_url: allow selecting files from sub-caches other than images
* plugins/Cache_Starred_Images: rework to use DiskCache, can be enabled per-user, properly handles article enclosures, etc
5 years ago
133c2b482b
move rewrite_cached_urls to DiskCache::rewriteUrls()
5 years ago
b1dd38f880
add DiskCache.getUrl() and use it in a bunch of places
5 years ago
ea30061cce
public: fix share() returning random unshared articles if uuid is not given
5 years ago
4fa9aee4e7
move several more global functions to more appropriate classes
6 years ago
6d746453c7
get_feeds_from_html: remove XML preamble hack
...
move several related helper functions to Feeds class
6 years ago
671f4cee65
domdocument: remove old meta charset unicode hacks, replace with shorter xml preamble utf8 hack (on loadhtml where it makes sense)
...
af_readability: better (?) charset hack for non-unicode pages
6 years ago
6ae0a3dd3e
share: further improve og:description excerpt logic, minor layout stuff
6 years ago
74e8661351
share: decode entities in metadata fields so that length limits would make more sense
6 years ago
19f162dbe3
css: insensitive -> text-muted
6 years ago
44858ca2dd
Merge branch 'master' of git.fakecake.org:tt-rss
6 years ago
e91223ec7d
update CLI schema updater with newer warnings
6 years ago
609662d48c
oops, fix typo
6 years ago
91cfd9c391
dbupdater: add mysql transaction warning
6 years ago
0881d0a00d
some dbupdater improvements; fix schema 136 syntax for mysql
6 years ago
38e01270d8
archived feeds: expire old entries (schema bump)
6 years ago
ef6d2b8a4e
update notifications to make them more visible
...
cleanup some minor stuff in pref-users
6 years ago
5b3a73e574
login: switch to absolute redirect urls
6 years ago
925065b1fe
Revert "login: only allow relative URLs in return="
...
This reverts commit c68ac04020
6 years ago
c68ac04020
login: only allow relative URLs in return=
6 years ago
cc57ed3775
public/subscribe: add basic dialog to enter feed urls
6 years ago
54c1b5c611
fill in some missing doctypes; use short doctype where it wasn't
6 years ago
d60038d48b
simplify some public.php prompts; prevent from submitting forgotpass form repeatedly if check succeeds
6 years ago
6701497879
public.php: markup cleanup
6 years ago
be322d6fc8
cleanup sharepopup dialog
6 years ago
d9e20f8b16
update external subscribe dialog
6 years ago
5ce55faa3b
installer: reduce margins; misc fixes
6 years ago
420e71280a
dbupdater: dojoify, add some missing translations
6 years ago
Andrew Dolgov