e905ce7ea9
fix login
2018-12-03 09:26:26 +03:00
d9c5c93cef
move some more stuff out of common.js
...
rework client-side cookie functions a bit
limit dojo cachebust based on server scripts modification time
remove param_escape()
2018-12-02 20:07:57 +03:00
f89924f7a1
set use strict on JS modules; remove some mostly useless stuff like get_minified_js()
2018-12-02 18:38:27 +03:00
874560db54
remove obsolete row selection functions
...
move getUrlParam() to Utils
2018-12-02 10:33:58 +03:00
2f85b50e36
remove toggleSelectListRow2()
2018-12-02 10:16:25 +03:00
5aa9c60494
bring back (debloated) version of unexpanded combined mode
2018-12-01 01:03:01 +03:00
bf1b89d0f1
enable c-up/down hotkeys even out of cdm
2018-12-01 00:20:09 +03:00
07fd4f8d9d
minor css fixes (mostly for zoom mode)
2018-11-30 17:22:30 +03:00
50052fb78a
strip_harmful_tags: remove data- attributes
2018-11-30 15:02:01 +03:00
9563e3bcd6
remove expandable CDM headlines
2018-11-30 13:51:54 +03:00
fc0a3050eb
use xhrPost is even more places!
2018-11-30 09:23:51 +03:00
c10a43069e
debug logging system rework:
...
* support various logging levels per-message
* remove hacks like debug_suppress, DAEMON_EXTENDED_DEBUG, etc
* _debug() is kept as a compatibility shim for plugins
2018-11-30 08:34:29 +03:00
b2f0858060
sanity config: fix typo
2018-11-22 22:15:27 +03:00
d5256c8228
update sanity_config.php
2018-11-22 21:47:58 +03:00
5f66f872b6
fix session write handler always assuming that database entry exists and failing silently if it doesn't; remove session cookie-related hacks
2018-10-16 14:07:42 +03:00
d246fb9fe1
remove session REMOTE_ADDR checks
2018-10-16 12:12:07 +03:00
f8fc1ac543
login: check for stale session in login handler, instead of authenticate_user()
2018-10-16 11:39:12 +03:00
f730d7bb0a
another attempt to enforce session ID regeneration on login
2018-10-16 09:11:32 +03:00
9dadbdbb21
properly save auth_module after logging in
2018-10-16 07:34:22 +03:00
77aebd7e4a
it was probably not the best idea to use session_regenerate_id() right after session_start(), duh
2018-10-15 21:47:12 +03:00
5feed36a3c
do not use separate _ssl cookie for secure sessions
2018-10-15 15:48:37 +03:00
65e98f4086
force regenerate session id on successful login, remove previous blank SID check
2018-10-15 15:47:50 +03:00
74736fce0f
if empty session is autostarted because of a cookie, immediately destroy it
2018-10-15 14:53:35 +03:00
7d53c2b501
validate_session: bring back IP session binding (enabled by default) and UA checking
2018-10-15 08:26:07 +03:00
ec5687a62b
logout user: commit destroyed session
2018-10-14 22:50:45 +03:00
d2e1e60ecc
1. per-feed option STRIP_IMAGES should now also affect other media tags
...
2. video/audio elements were not replaced with text links properly in
low bandwidth mode
2018-09-07 09:55:43 +03:00
f3068c6397
send_local_file: touch() sent files to reset their expiration cooldown
2018-08-23 13:43:31 +03:00
02bb26a93f
rewrite_cached_urls: support video posters
2018-08-20 14:13:14 +03:00
a1b8651949
Revert "add (hidden) _NGINX_XACCEL_PREFIX which uses nginx X-Accel-Redirect to serve static files faster"
...
This reverts commit c5c3a0a2a8
2018-08-20 12:48:23 +03:00
2aef804f4b
split transparent rewriting of locally cached media URLs to execute after both sanitize() and HOOK_RENDER_ARTICLE to allow plugins work on original source URLs consistently
2018-08-20 12:12:32 +03:00
c5c3a0a2a8
add (hidden) _NGINX_XACCEL_PREFIX which uses nginx X-Accel-Redirect to serve static files faster
2018-08-20 09:14:10 +03:00
88adf3da1b
send_local_file: add application/octet-stream hack
...
cached_url: return original requested filename to save as
2018-08-16 12:16:51 +03:00
c4869cd573
if PHP_VERSION check fails, show current version
2018-08-13 20:13:08 +03:00
75e765aa00
bump version_static
2018-08-13 16:12:03 +03:00
848c6ac655
bump required php version to 5.6
2018-08-13 16:04:09 +03:00
069aea5989
remove FEED_CRYPT_KEY and everything related to it
...
always assume auth_pass_encrypted is false
2018-08-13 15:59:24 +03:00
a2d1fa5b14
autoloader: check if class name is namespaced before trying to split it
2018-07-18 13:25:18 +03:00
df47100ad1
remove SWF enclosure audio player
2018-06-20 18:17:44 +03:00
a9105e2a61
move JShrink Minifier to vendor/
2018-06-20 15:04:59 +03:00
2aaefbfa54
update autoloader to consider namespaces for third party libraries: placed and loaded from vendor/namespace/classpath.php
...
update readability to a newer implementation based on Readability.js (https://github.com/andreskrey/readability.php )
add vendor/Psr/Log interface required for the above
2018-06-20 14:58:09 +03:00
d00d515320
feedbrowser: fix incorrect usage of LIMIT in prepared statement
2018-06-18 23:50:32 +03:00
af3663edec
Don't bail out if git gc removed refs
2018-06-08 22:07:30 +02:00
68d9c412ea
fetch_file_contents: allow setting http Accept header
2018-05-25 14:25:08 +03:00
f0dbfedc81
increase buffersize to 16384 bytes
...
(also some trailing whitespace got clipped)
2018-05-23 10:40:28 +03:00
74a98a6ff2
increased CURLOPT_BUFFERSIZE from 128 to 256
2018-05-23 10:02:03 +05:00
b14f6d58b4
implement hard limits on downloaded data size for general fetching and cache plugins: MAX_DOWNLOAD_FILE_SIZE & MAX_CACHE_FILE_SIZE
2018-05-20 11:08:33 +03:00
2008ec4ed7
change filter rule regexp type to text
2018-04-14 14:11:29 +02:00
905ff10dc9
Allow abbr tag when sanitizing.
2018-02-27 16:06:10 +00:00
e7c9bc60ec
fix previous wrt if-modified-since being added to context options headers
2018-02-25 14:22:46 +03:00
dd597297cb
Обновить 'include/functions.php'
...
The "Connection: close" header is added to the context_options
2018-02-25 10:03:09 +00:00
3d7db21602
Merge branch 'master' of git.fakecake.org:tt-rss
2018-02-12 09:37:31 +03:00
8babb8e75a
sanitize: disallow width and height attributes for images
2018-02-11 16:47:19 +03:00
1aeb282be1
Merge branch 'save-effective-url' of JustAMacUser/tt-rss into master
2018-02-11 08:57:12 +00:00
7ae05ed790
Have fetch_file_contents() save the effective URL.
2018-02-11 07:56:28 +00:00
2eaf2a1f36
tag_is_valid: simplify code
2018-02-11 10:26:33 +03:00
7f4a404566
include: convert some spaces to tabs
2018-01-30 10:44:31 +03:00
32dc9ec854
undocumenting the proxy settings [see #36 ]
...
in response to https://git.tt-rss.org/git/tt-rss/pulls/36#issuecomment-119
2018-01-18 08:48:53 +01:00
213c01d459
some proxies require `request_fulluri` set to true [see #36 ]
...
at least polipo won't work for plain HTTP URLs (HTTPS strangely also works without `request_fulluri`..?)
see https://git.tt-rss.org/git/tt-rss/pulls/36
2018-01-17 12:28:47 +01:00
ea55f2e11c
Add proper support for proxies
...
There are situations where you want tt-rss to use a proxy (e.g.
because of network restrictions, or privacy concerns).
tt-rss already comes with an undocumented `_CURL_HTTP_PROXY`
variable (see eg https://binfalse.de/2015/05/06/ttrss-with-proxy/ ),
however that won't have an effect when, for example, php-curl is
not installed, see
c30f5e1811/include/functions.php (L377)c30f5e1811/include/functions.php (L487)
2018-01-14 00:30:22 +01:00
9274109c19
search_to_sql: quote fallback search language
2017-12-30 16:27:05 +03:00
56c2216295
Add missing quotes to array_map.
2017-12-30 01:00:56 -05:00
bed2d6e054
force-cast some variables used in queries to integer
...
do not display SQL query in headlines debug mode
2017-12-17 16:24:13 +03:00
7651b6e2cd
sanitize: disable referrer via referrerpolicy for img elements
2017-12-13 20:07:10 +03:00
4d10b4abca
merge login form css into default.css
...
update more hardcoded colors to use @color-accent
update @color-accent
2017-12-10 22:51:39 +03:00
f8db5bb4db
installer: use PDO, improve wording for some notices
...
PDO wrapper: allow working with blank DB_HOST
2017-12-10 09:20:52 +03:00
76fc7a2d9c
bool_to_sql_bool: for some reason PDO really likes integers for boolean columns
...
incidentally this fixes OPML filter import
2017-12-06 00:12:28 +03:00
c4a08e4ff0
remove mentions of deprecated.js
2017-12-05 07:09:01 +03:00
e6532439d6
force strip_tags() on all user input unless explicitly allowed
2017-12-03 23:35:38 +03:00
fa3bcfa379
queryfeedheadlines: there's no need to quote order_by/override_order
...
else: feedicon cache busting etc
2017-12-03 22:49:57 +03:00
7c0eb1b621
add defaultPasswordWarning nag dialog
2017-12-03 20:46:27 +03:00
bfebf57c5f
get_theme_path: fallback to css/default.css if default theme is selected
2017-12-03 14:17:25 +03:00
2cf93c046c
pref-users: fix sorting the table
2017-12-03 13:54:31 +03:00
3eecebc34f
sanity_check: do not invoke PDO without checking that it exists
2017-12-03 13:41:09 +03:00
97a5e13370
add sanity check for PDO
2017-12-03 13:40:09 +03:00
83303f20e0
update version static for css & db changes
2017-12-03 13:38:25 +03:00
09bc54c690
further stylesheet simplification related fixes
2017-12-03 13:25:34 +03:00
8ff3cbb32e
filters: remove sql_bool_to_bool()
...
checkbox_to_sql_bool: return ints (???)
2017-12-03 09:26:11 +03:00
ed5cd6eae5
get_feed_access_key: param type bullshit
2017-12-03 00:25:12 +03:00
6cf3a57282
login: fix profile dropdown popping out in a weird place
2017-12-03 00:23:11 +03:00
7d960ce7e9
auth_internal: use PDO + other fixes
2017-12-03 00:18:08 +03:00
4ee398a41e
Merge branch 'master' of git.fakecake.org:tt-rss into pdo-experimental
2017-12-02 23:13:49 +03:00
1e78803c44
search_to_sql: leftover tsquery query fix for pgsql
2017-12-02 23:11:28 +03:00
a2d77092fe
search_to_sql: quoting fix
2017-12-02 22:58:59 +03:00
0002e598f8
sql_bool_to_bool: backwards compat fix
2017-12-02 22:39:34 +03:00
e4befe6bf4
fix label cache being double escaped on save
...
remove some old-style escaping
2017-12-02 15:47:53 +03:00
ef83c69404
more boolean fixes
2017-12-02 14:13:16 +03:00
da9ea57d1c
checkbox to sql bool related changes, some more boolean fixes
2017-12-02 14:07:48 +03:00
7ccb4e91ff
boolean handling changes which probably won't break everything
2017-12-02 14:02:01 +03:00
c949a9282e
OPML: use PDO; minor fixes
2017-12-02 01:08:30 +03:00
fbe7cb0a48
rpc: switch to PDO
2017-12-01 23:49:14 +03:00
ecf6baaa1c
fix add_feed_category
2017-12-01 22:17:04 +03:00
cc9450c309
ccache, misc: fixes
...
feeds: start PDO transition
2017-12-01 19:42:02 +03:00
1271407eea
public: partial conversion to PDO, misc fixes
2017-12-01 18:57:34 +03:00
cab58c44ae
some minor PDO-related fixes
2017-12-01 18:26:53 +03:00
c9d5c26041
auth/base: PDO
...
functions: fix small pdo-related bug
2017-12-01 17:40:53 +03:00
d068111a37
controls: PDO
2017-12-01 15:10:05 +03:00
bbd9e5045e
controls: start pdo stuff
2017-12-01 15:03:14 +03:00
4ff8bdcb00
feedbrowser: PDO
2017-12-01 14:56:27 +03:00
fdda3e4efb
pdo pdo pdo
2017-12-01 14:50:10 +03:00
4d13514dd4
sessions: PDO
2017-12-01 14:48:23 +03:00
a21f7495ae
more pdo stuff
2017-12-01 14:39:24 +03:00
90dafaa9f6
add qmarks function
2017-12-01 12:44:54 +03:00
b78a6f08b6
more pdo stuff i guess
2017-12-01 12:42:18 +03:00
7c4d7bce3f
increase default of MAX_CONDITIONAL_INTERVAL to 12 hours
2017-12-01 11:51:46 +03:00
8aa568b3a2
some more pdo stuff
2017-12-01 10:35:22 +03:00
bfc54b0369
Merge branch 'pdo-experimental' of git.fakecake.org:tt-rss into pdo-experimental
2017-12-01 10:17:36 +03:00
e50c8eaa4e
enforce unconditional requests every 6 hours even if server claims data is not modified
2017-11-30 13:12:28 +03:00
ecd2e414bd
add ttrss_feeds.last_unconditional (schema bump)
2017-11-30 12:55:50 +03:00
8adb3ec472
add some WIP pdo stuff
2017-11-30 12:28:07 +03:00
9dd336a2c3
generate base css files using lessc
2017-11-29 18:55:12 +03:00
820873de9f
update myisam fail warning
2017-11-27 20:20:33 +03:00
0b68b1629e
add a sanity check for tt-rss myisam tables
2017-11-27 20:09:02 +03:00
6eeeec4838
Allow <hr> tag in the RSS item' description
2017-11-03 10:23:29 +03:00
9d930af9e1
fetch_file_contents: improve error handling
...
1. if request fails get error string from http response status line
2. do not override http error with possible CURL/php specific last error
3. fix silent php error generated while processing response headers to get last modified value
2017-10-30 13:13:10 +03:00
8716ec20d6
add sanity check for mime_content_type()
2017-10-29 10:17:43 +03:00
8b73bd28d8
remove apache-specific x-sendfile stuff
...
implement a hook (HOOK_SEND_LOCAL_FILE) which plugins may use to send files
via httpd-specific implementation to increase performance typically on larger files
2017-10-08 17:14:56 +03:00
701c5a7ee4
get_favicon_url: only check base elements with href attribute
2017-10-01 15:47:31 -05:00
241f69e4db
Handle potentially-relative base element when getting favicon.
...
The base element's "href" attribute is not required to be absolute,
so rewrite relative to the site URL if it is relative.
See:
* https://www.w3.org/TR/html51/document-metadata.html#the-base-element
* https://html.spec.whatwg.org/multipage/semantics.html#the-base-element
2017-10-01 14:25:12 -05:00
153cb6d305
add support for http 304 not modified (no timestamp calculation bullshit like last time)
2017-08-17 14:40:21 +03:00
5e78b0c253
do not base headlines label context submenu on feed tree labels category
2017-07-30 11:55:30 +03:00
1b5b1e5fec
sessions: use is_server_https() for secure cookie setting
2017-07-17 07:33:43 +03:00
e234ac8dcb
$_SERVER['HTTPS'] can be exists and 'off' for non-https connectios
2017-07-17 00:44:48 +03:00
09628e1b1a
rework previous 32 bit session stuff
2017-07-13 14:40:30 +03:00
e6d77d2b29
Merge branch 'master' of git.fakecake.org:tt-rss
2017-07-13 08:57:31 +03:00
b465c28ee0
sessions: clip max expiry value to a 32bit integer
2017-07-13 08:57:07 +03:00
9f7bd151c6
hopefully unify handling of server HTTPS variables where needed, use scheme based on SELF_URL_PATH otherwise
2017-07-10 16:20:40 +03:00
643ebe4229
sanity: check X-Forwarded-Proto for self_url
2017-07-10 14:04:50 +02:00
b2d42e960b
replace some usages of SELF_URL_PATH with get_self_url_prefix()
2017-07-06 23:01:44 +03:00
948471a44b
self url path checking: accept value without an ending slash
2017-07-06 22:51:56 +03:00
2953687b72
sanity: it's probably a good idea to check whether we're running under httpd before enforcing SELF_URL_PATH checks
2017-07-05 22:46:05 +03:00
1f91695895
previous: spaces -> tabs
2017-07-05 22:07:41 +03:00
7506b61af2
sanity: check whether SELF_URL_PATH conforms to data returned by httpd
2017-07-05 22:00:31 +03:00
d76d5e86d2
controls: disable print_feed_select (unused)
2017-07-02 22:57:06 +03:00
10a1f28f7c
schema: updates for new filter format (bump version to 131)
2017-07-02 20:59:24 +03:00
02f3992a5a
Revert "Revert "filters: support matching on multiple feeds/categories""
...
This reverts commit f5d174bda9
2017-07-02 20:37:52 +03:00
f5d174bda9
Revert "filters: support matching on multiple feeds/categories"
...
This reverts commit 0bf7e007bb
2017-07-02 20:37:01 +03:00
0bf7e007bb
filters: support matching on multiple feeds/categories
...
opml: update filter export/import for new format
2017-07-02 20:27:21 +03:00
6fd0399694
tunables:
...
* add CACHE_MAX_DAYS as a tunable generic expiry interval for various cached files
* add some comments to tunables in functions.php
* rename _MIN_CACHE_FILE_SIZE to MIN_CACHE_FILE_SIZE
* respect MIN_CACHE_FILE_SIZE setting in a few more places where content is cached
2017-05-29 23:14:42 +03:00
9b8bec700a
Replace '__autoload' (deprecated in PHP 7.2) with 'spl_autoload_register'.
...
http://php.net/manual/en/function.autoload.php
http://php.net/spl_autoload_register
https://wiki.php.net/rfc/deprecations_php_7_2
2017-05-27 10:52:16 -05:00
5b6ea1ef91
remove pubsubhubbub: dead
2017-05-16 10:41:20 +03:00
c114a2596f
move add_feed_url() to pref_feeds
2017-05-11 09:07:49 +03:00
4fd0790804
fix DAEMON_SLEEP_INTERVAL not being defined when used
...
enforce minimum 60 sec spawn/sleep interval in update processes
2017-05-06 10:54:14 +03:00
e6c886bf66
wrap rssfuncs into rssutils class
2017-05-05 18:10:07 +03:00
65af3b2cbb
move counter stuff to a separate class
2017-05-05 11:54:31 +03:00
e35ba0e212
add sanity check for SELF_URL_PATH going to http url if server is accessed over https
2017-05-05 10:16:54 +03:00
7c9b5a3fe4
move label stuff to Labels class
...
fix some unresolved functions
2017-05-04 15:57:40 +03:00
c2f0f24e4c
move digest stuff to Digest class
2017-05-04 15:41:38 +03:00
0086a89740
move some label stuff to labels.php
...
move getfeedcategory() to Feeds
2017-05-04 15:36:36 +03:00
904aff7667
abs_to_rel_path: removed
2017-05-04 15:28:21 +03:00
4a0da0e5bf
move get_article_labels to Article
2017-05-04 15:26:21 +03:00
Andrew Dolgov
Tobias Bell
Alexander Yaburov
foobar
JustAMacUser
Metallizzer
fox
martin scharm
Andrew Dolgov
JustAMacUser
Andrew Dolgov
woxcab
wn_
Natan Frei
Cédric Barboiron