8d2e3c2528
drop errors.php and simplify error handling
2021-02-23 22:26:07 +03:00
e4107ac952
wip: initial for config object
2021-02-22 21:47:48 +03:00
be4e7b1340
fix several issues reported by phpstan
2021-02-22 14:41:09 +03:00
d1328321be
move published OPML endpoint to public.php
2021-02-21 15:16:39 +03:00
053b262aa7
rename public.php/cached_url to cached
2021-02-19 20:28:15 +03:00
fc0ebf0891
move bookmarklet-related methods out of public.php into the plugin
2021-02-19 20:21:36 +03:00
c088e9d9d8
get rid of a few more prototype-isms
2021-02-18 22:23:06 +03:00
70fa423026
initial for RIP prototype/scriptaculous
2021-02-18 21:51:18 +03:00
273ada7353
* implement shortcut syntax for exposed plugin methods
...
* move shared article rendering code to share plugin
2021-02-17 09:59:14 +03:00
26d6b84a57
add namespaced controls with unified naming; deprecated old-style control shortcuts
2021-02-16 14:23:00 +03:00
39604bedef
move reset_password to UserHelper
2021-02-15 16:59:54 +03:00
6426ae559a
dbupdater: unify naming
2021-02-15 16:14:00 +03:00
166f2d4666
diskcache: unify naming
2021-02-15 16:11:30 +03:00
8e79f1717d
prefs: unify naming
2021-02-15 16:07:22 +03:00
257efb43c6
article: unify naming
2021-02-15 15:52:28 +03:00
020f062a76
feeds: unify naming
2021-02-15 15:43:07 +03:00
82adb01307
render enclosures on the client
2021-02-15 14:10:46 +03:00
a8cc43a0ff
move logout_user() to UserHelper
2021-02-14 15:31:03 +03:00
15fd23c374
use shortcut echo syntax for php templates
2021-02-14 09:15:51 +03:00
d3940b6259
fix a bunch of warnings related to generated feeds
2021-02-12 22:00:33 +03:00
71dfc83466
force _ENABLED_PLUGINS to string when passed to pluginhost
2021-02-12 17:20:37 +03:00
74986d1ac6
shorten pref tab names; make log-alert clickable
2021-02-11 15:49:32 +03:00
09e9f34bb4
add UserHelper::find_user_by_login() and rewrite some user checks to invoke it instead of going through PDO
2021-02-11 10:22:27 +03:00
7af8744c85
authentication: make logins case-insensitive (force lowercase)
2021-02-11 09:57:57 +03:00
9f3de2d24c
login: fix profile warning
2021-02-08 22:03:27 +03:00
7eb860af61
even more hooks
2021-02-08 21:28:09 +03:00
1eb1629d9e
pluginhost: rework run_hooks() to be shorter, add callback variant; implement exception handling for both
2021-02-08 14:24:45 +03:00
3f972f8fed
public/subscribe: fix warnings
2021-02-08 08:20:30 +03:00
6e774a58fe
more php8 fixes mostly related to login
2021-02-06 00:12:15 +03:00
403dca154c
initial WIP for php8; bump php version requirement to 7.0
2021-02-05 23:41:32 +03:00
da0ad82c24
Archive cleanup:
...
- remove code to manually archive/unarchive articles
- remove ttrss_archived_feeds/orig_feed_id handling - the whole thing was implemented for
this data to be kept indefinitely; it doesn't make a lot of sense to deal with this stuff
now that it is expired after one month anyway (same reasons as feed browser being removed - privacy)
- remove "originally from"-related stuff because of the above
- also remove unused remaining frontend/backend code related to feed browser (rip)
2021-01-17 14:55:11 +03:00
40f38fc87f
pluginhost: load plugin data automatically (also marks load_data method as private)
2021-01-15 08:32:06 +03:00
f67f0f864b
HOOK_ARTICLE_EXPORT_FEED: also pass owner_uid
2021-01-11 22:52:31 +03:00
fadf4dec96
Include tags for HOOK_ARTICLE_EXPORT_FEED.
2021-01-10 03:23:16 -05:00
a8302fb253
use X-Real-IP headers if possible while authenticating
2021-01-05 10:17:24 +03:00
215f388992
move timestamp-related stuff to a separate class
2020-09-23 13:04:26 +03:00
74568df4ff
remove a lot of stuff from global context (functions.php), add a few helper classes instead
2020-09-22 09:04:33 +03:00
03a337a660
add basic safe mode which doesn't load any user plugins
2020-09-18 15:48:22 +03:00
37f41a5246
forgotpass: use type strict comparison for reset token
2020-09-17 11:49:27 +03:00
1f79d614c4
fix OTP QR code not displayed because of CSRF token passed as a query
...
parameter
use type-strict comparison when validating CSRF token on the backend
2020-09-17 08:43:39 +03:00
9d3c794983
subscribe: allow pre-filling feed URL if passed via query string
2020-09-16 17:20:31 +03:00
154417d80b
public/logout: require valid CSRF token
2020-09-15 16:59:11 +03:00
8080c525fd
- backend: require CSRF token to be passed via POST
...
- do not leak CSRF token via GET request in feed debugger
- rework Article/redirect to use POST
2020-09-15 16:12:53 +03:00
da98ba662e
public/subscribe: require valid CSRF token when validating the form
2020-09-14 20:21:22 +03:00
c3d14e1fa5
- fix multiple vulnerabilities in af_proxy_http
...
- fix vulnerability in rewrite_relative_url() which prevented some URLs from being properly absolutized
- fetch_file_contents: validate all URLs before requesting them
- validate URLs: explicitly whitelist http and https scheme, forbid everything else
- DiskCache/cached_url: only serve whitelisted content types (images, video)
- simplify filename/URL handling code, remove and consolidate some less-used functions
2020-09-14 19:46:52 +03:00
88ced02622
Silence php 7.2 error message generated in `session_set_cookie_params`.
2020-08-14 10:47:46 -05:00
dfa65e9374
move order_by to SQL override logic into a separate function
2020-08-13 11:52:32 +03:00
48be005774
instead of taking batch timestamp and score (?) into account, make oldest first sorting work consistently with newest first - i.e. rely on feed-provided timestamp
2020-08-11 13:29:09 +03:00
1f2a721905
allow overriding built-in templates via templates.local
2020-03-13 14:40:35 +03:00
bdb1e475e7
external subscribe dialog: support dark theme
2020-02-27 13:40:32 +03:00
Andrew Dolgov
JustAMacUser
Rodney Stromlund