Commit Graph

1558 Commits

Author SHA1 Message Date
Andrew Dolgov 1f2ba932b8 RIP easy-installer 2021-02-12 15:59:19 +03:00
Andrew Dolgov d23a261b92 RIP self-registration 2021-02-12 15:57:43 +03:00
Andrew Dolgov 8f8675a26a * filters: remove duplicate code, overall cleanup
* check if some tres exist before trying to reload them
2021-02-12 14:31:36 +03:00
Andrew Dolgov 848bc57f29 disable themes in safe mode; rework safe mode warning/login prompt 2021-02-11 21:19:57 +03:00
Andrew Dolgov cc646790fd format_backtrace: don't try to use resources as strings 2021-02-11 10:29:42 +03:00
Andrew Dolgov 7833760fa0 make feed/cat nested dropdowns a bit more readable 2021-02-10 08:58:31 +03:00
Andrew Dolgov 7874f6ac58 remove PHPMD.UnusedFormalParameter 2021-02-08 19:42:10 +03:00
Andrew Dolgov 942afb43a1 sanity checks: use better CLI detection, shorten most of the text 2021-02-08 08:49:21 +03:00
Andrew Dolgov 10392ecc28 event log: add pagination 2021-02-06 10:10:54 +03:00
Andrew Dolgov 8b39e6bca7 _color_pack: define variable before using 2021-02-06 09:29:31 +03:00
Andrew Dolgov a544123b59 fix clean() for arrays and user plugin list 2021-02-06 00:17:41 +03:00
Andrew Dolgov 6e774a58fe more php8 fixes mostly related to login 2021-02-06 00:12:15 +03:00
Andrew Dolgov 403dca154c initial WIP for php8; bump php version requirement to 7.0 2021-02-05 23:41:32 +03:00
Andrew Dolgov 33a5ecd2ce feed editor: show purge interval correctly if FORCE_ARTICLE_PURGE is set 2021-01-07 18:16:42 +03:00
Andrew Dolgov f59c567831 update_rss_feed: fix BLACKLISTED_TAGS not working properly, simplify tag-related code 2020-12-20 23:12:45 +03:00
wn c68f2aabc9 Make 'ttrss_error_handler' compatible w/ 8.
2d467abc46/UPGRADING (L43)
2d467abc46/UPGRADING (L63)
2020-12-12 10:28:52 -06:00
wn 936b91a7e6 Don't do deprecated 'libxml_disable_entity_loader(true)' under PHP 8.
2d467abc46/UPGRADING (L886)
2020-12-12 10:28:49 -06:00
wn 6bdf4a1a25 Switch to 'get_error_types()' to ensure availability in 'include/functions.php'.
The global in 'sanity_check()' was null... possibly due to circular requires?
2020-12-12 10:28:48 -06:00
wn 08a6f6bde2 Only do sanity checks for self URL if we can create a valid URL.
'sanity_check.php' gets included in 'update.php' and 'update_daemon2.php', where a Host request header is likely not provided.
2020-12-12 10:28:47 -06:00
Andrew Dolgov 65254f5db4 - move sphinx plugin to a separate repo
- regenerate config checks without sphinx-related variables
2020-12-11 09:48:34 +03:00
Andrew Dolgov 81c52b4b1e add support for an override stylesheet which applies to all users 2020-11-30 15:53:32 +03:00
Andrew Dolgov 24cdacd59e enable Farsi locale in the UI 2020-10-01 10:19:04 +03:00
Andrew Dolgov 8a02a728c8 add DAEMON_UNSUCCESSFUL_DAYS_LIMIT tunable (defaults to 30 days) 2020-09-30 17:03:16 +03:00
Andrew Dolgov da5deaaca1 set session.cookie_lifetime to 0 initially instead of a rather useless min() 2020-09-30 14:43:53 +03:00
Andrew Dolgov de22464ea8 schema: add ttrss_feeds.last_successful_update 2020-09-28 14:14:06 +03:00
Andrew Dolgov 215f388992 move timestamp-related stuff to a separate class 2020-09-23 13:04:26 +03:00
Andrew Dolgov 74568df4ff remove a lot of stuff from global context (functions.php), add a few helper classes instead 2020-09-22 09:04:33 +03:00
Andrew Dolgov d04ac399ff clarify some URL validation-related error messages 2020-09-21 20:37:29 +03:00
Andrew Dolgov 3dd4169b5f clarify some URL validation-related error messages 2020-09-21 20:35:24 +03:00
Andrew Dolgov 4785f21316 update_rss_feed: log effective URL after fetching
validate_url: treat scheme as case-insensitive
2020-09-21 20:26:57 +03:00
Andrew Dolgov 486f1d84ed resolve_redirects: fix previous 2020-09-20 18:14:34 +03:00
Andrew Dolgov d2867d887a resolve_redirects: only use three argument version of get_headers() on php 7.1+ 2020-09-20 17:27:04 +03:00
Andrew Dolgov 03a337a660 add basic safe mode which doesn't load any user plugins 2020-09-18 15:48:22 +03:00
Andrew Dolgov 4efc3d7b3f validate_url: relax requirements for URLs, limit additional port/loopback filtering to fetch_file_contents() 2020-09-17 20:20:23 +03:00
Andrew Dolgov a4525d31b2 replace FALSE with false so that static analyzer shuts up about it 2020-09-17 19:02:27 +03:00
Andrew Dolgov 57fac84516 rename gettext.inc to gettext.inc.php (cosmetic) 2020-09-17 18:56:29 +03:00
Andrew Dolgov c25edd0024 fetch_file_contents: validate effective URL (after redirects) without CURL 2020-09-17 16:17:33 +03:00
Andrew Dolgov 27e695436f fetch_file_contents: validate effective URL (after redirects) if using CURL 2020-09-17 15:53:13 +03:00
Andrew Dolgov 5a7e7e1367 don't try to call hash_equals() on unset user token 2020-09-17 10:20:55 +03:00
Andrew Dolgov f72e6947d5 use hash_equals() correctly 2020-09-17 10:04:00 +03:00
Andrew Dolgov e3adacc588 fix several cases of Db class being invoked as wrong name (as DB) 2020-09-17 09:18:03 +03:00
Andrew Dolgov 16c86e2fc3 replace some plain http links with https 2020-09-17 09:02:30 +03:00
Andrew Dolgov a817d3794d * use get_random_bytes() for CSRF token
* get_random_bytes: use PHP7 random_bytes() if it is available
* validate CSRF token using hash_equals
2020-09-17 08:59:18 +03:00
Andrew Dolgov 1f79d614c4 fix OTP QR code not displayed because of CSRF token passed as a query
parameter
use type-strict comparison when validating CSRF token on the backend
2020-09-17 08:43:39 +03:00
Andrew Dolgov 6a4b6cf603 amend previous to 127/8 subnet 2020-09-17 07:37:48 +03:00
Andrew Dolgov 213d6330b1 fetch_file_contents: resolve requested hosts and check for possible
loopback address
2020-09-17 07:36:47 +03:00
Andrew Dolgov 88c4dc405e build_url: also put query parameters and fragment in resulting URL
rewrite_relative_url: simplify handling of relative URLs
2020-09-16 21:41:05 +03:00
Andrew Dolgov da5af2fae0 cached_url: block SVG images because of potential javascript inside 2020-09-16 16:25:20 +03:00
Andrew Dolgov aeaafefa07 don't pass csrf token as a GET parameter to Article 2020-09-15 16:03:09 +03:00
Andrew Dolgov 1621abcffc rewrite_relative_url: validate resulting absolutized URLs 2020-09-15 10:41:57 +03:00
Andrew Dolgov aa89ea7769 validate_url: only allow safe ports (80, 443), disallow access to loopback 2020-09-15 10:39:09 +03:00
Andrew Dolgov 6c02fea641 validate_url: add clean() 2020-09-15 08:45:15 +03:00
Andrew Dolgov 4abc7d7898 rename base64_img() to image_to_base64() 2020-09-15 08:05:01 +03:00
Andrew Dolgov 1ee458b5c1 cached_url: perform mimetype validation before possible HOOK_SEND_LOCAL_FILE hooks 2020-09-15 07:54:46 +03:00
Andrew Dolgov b4cb67e77f remove csrf token from rpc method sanityCheck 2020-09-14 20:00:01 +03:00
Andrew Dolgov c3d14e1fa5 - fix multiple vulnerabilities in af_proxy_http
- fix vulnerability in rewrite_relative_url() which prevented some URLs from being properly absolutized
- fetch_file_contents: validate all URLs before requesting them
- validate URLs: explicitly whitelist http and https scheme, forbid everything else
- DiskCache/cached_url: only serve whitelisted content types (images, video)
- simplify filename/URL handling code, remove and consolidate some less-used functions
2020-09-14 19:46:52 +03:00
Rodney Stromlund 376dce02bb Update wiki and forums links in error message. 2020-07-13 09:06:59 -05:00
Andrew Dolgov 6eb94f1e13 better support for image srcset attributes as discussed in https://community.tt-rss.org/t/problem-with-img-srcset/3519 2020-06-15 11:58:59 +03:00
Andrew Dolgov 19893d33e3 only bind up/down in 3 panel mode 2020-05-23 08:53:18 +03:00
Andrew Dolgov ebb373987a Revert "unbind up/down by default (use native scrolling for consistency with pgup/pgdn)"
This reverts commit 6fc18e450b.
2020-05-23 08:39:44 +03:00
Andrew Dolgov 6fc18e450b unbind up/down by default (use native scrolling for consistency with pgup/pgdn) 2020-05-23 08:38:03 +03:00
Andrew Dolgov 9ae9302b6b implement keyboard-related changes discussed in https://community.tt-rss.org/t/changing-the-amount-of-scroll-by-arrow-key/3452/7 2020-05-17 08:25:51 +03:00
JustAMacUser 7a0ea9d90e Make iframes size responsively. 2020-05-15 22:25:56 -04:00
Andrew Dolgov 2b55afbeec sanitize: forbid "allow" attribute
CSS: remove auto hyphens stuff, remove iframe width clipping to 98% because they get squished
2020-05-09 12:49:19 +03:00
Andrew Dolgov 2558fcbe21 add hotkey "\" to cancel current search 2020-05-09 07:56:06 +03:00
Andrew Dolgov e934e9f05e sanitize: simplify initial attribute processing 2020-04-29 19:12:29 +03:00
Andrew Dolgov 7d9dd51cf4 sanitize: remove srcset plain-http hack, globally disallow width and height attributes for all elements 2020-04-29 19:04:34 +03:00
Andrew Dolgov 83c8834421 sanitize: handle picture[@srcset] elements properly, i.e. rewrite relative URLs 2020-04-29 19:02:44 +03:00
Martin Stone 1ad43dd202
Fix documentation for _noexpand commands 2020-03-25 20:30:34 +00:00
Toby Simmons 569228a5df In get_version() disable DIRECTORY_SEPARATOR check, permit using git on Windows to get version details; 2020-03-02 11:28:21 -06:00
Andrew Dolgov 4e74da590e af_readability: allow get full text button to work as a toggle; in cdm, scroll to article after embedding 2020-02-28 08:03:25 +03:00
Andrew Dolgov 07b27b375f update toggle_embed_original hotkey to invoke readability embed instead of removed embed_original plugin 2020-02-27 09:47:20 +03:00
Andrew Dolgov 4ab3854aed don't generate default.css, replace with themes/light.css as a default root CSS file 2020-02-22 16:22:44 +03:00
Andrew Dolgov 06b9d39662 add support for image loading=lazy attribute 2020-02-13 20:20:55 +03:00
Andrew Dolgov 076c5382fa login form: add workarounds for chrome password manager 2020-01-25 17:00:51 +03:00
Andrew Dolgov 6080cca9ca scrap counter cache system; rework counters to sum() booleans instead 2020-01-24 14:25:31 +03:00
Andrew Dolgov a6d314b753 support dark mode for login form 2020-01-23 13:14:47 +03:00
Andrew Dolgov 01513aa41b disable MAX_FETCH_REQUESTS_PER_HOST warnings for the time being 2020-01-17 07:26:55 +03:00
Andrew Dolgov 5fc499e19e get_version: don't rely on exec() exit code to determine whether output is valid 2020-01-14 20:50:40 +03:00
Andrew Dolgov fdb1fc7608 get_version: fix commit/timestamp lost on subsequent invocations because of misbehaving caching 2019-12-20 18:17:05 +03:00
Andrew Dolgov 6439f7817d force-disable php display_errors/display_startup_errors on startup 2019-12-19 08:37:19 +03:00
Andrew Dolgov c309856a97 get_version: filter out Darwin 2019-12-19 07:04:01 +03:00
Andrew Dolgov 74feef0f9d get_version: always return unsupported on windows 2019-12-18 19:28:00 +03:00
Andrew Dolgov c46c5e59fc SELF_USER_AGENT: switch to get_version() 2019-12-18 15:56:27 +03:00
Andrew Dolgov 72d8a34f74 get_version: don't pass useless root dir to git, instead log it in case of failure 2019-12-18 15:29:12 +03:00
Andrew Dolgov 72d0fac80c remove version.php and VERSION global constant, do version-related things in a slightly less ridiculous way 2019-12-18 14:27:40 +03:00
Andrew Dolgov 0237dee980 implement automatic night mode detection using MQL
add separate light.css to force light theme
remove manual night mode toggle and related code
2019-12-12 20:09:43 +03:00
Andrew Dolgov 0a10832491 - update descriptions of changed hotkeys
- bind noscroll variants of move article hotkeys to n/p by default
- update N/P (i.e. scroll article content) hotkeys to scroll by fraction of viewport height instead of hardcoded pixel distance
- minor fixes w/ checking for undefined
2019-12-11 06:53:32 +03:00
Andrew Dolgov 008afb97a9 exp: unbind from pgup/pgdn buttons by default 2019-12-09 12:38:04 +03:00
Andrew Dolgov 6191c48596 trim() contents of version_static.txt 2019-12-09 07:11:34 +03:00
fox f4945b1ba1 Merge branch 'page-hotkeys' of suraia/tt-rss into master 2019-12-08 06:02:10 +00:00
Andrew Dolgov 5907409a84 add support for custom version_static.txt for package maintainers 2019-12-08 08:58:23 +03:00
Michael Kuhn f133b78a3e Fix Shift+PageUp/Down hotkeys 2019-12-06 20:39:22 +01:00
Andrew Dolgov ac95ab4a65 user css dialog: allow saving and applying CSS without closing the dialog 2019-12-06 14:02:30 +03:00
Andrew Dolgov 565547f5a1 php 7.4 deprecation-related fixes 2019-12-06 07:27:22 +03:00
Andrew Dolgov 1902a7dcb0 pgup/pgdown hotkey normalization:
- pgup/pgdown without modifier scroll headline buffer
- shift+pgup/pgdown work similarly to shift+up/down but operating on pages
2019-12-05 17:00:17 +03:00
Andrew Dolgov f30287be65 versioning changes
- remove VERSION_STATIC - https://community.tt-rss.org/t/versioning-changes-for-trunk/2974
- report git commit/timestamp properly by invoking git instead of trying to parse .git/HEAD etc
- remove git-related global constants used when checking for updates
2019-12-05 13:23:54 +03:00
Andrew Dolgov 6913158b82 add hotkeys to scroll headlines/articles (whichever is active) by one page 2019-12-04 15:50:49 +03:00
Andrew Dolgov d15f0349bf remove hardcoded iframe domain whitelist, make iframe script whitelisting configurable by plugins (HOOK_IFRAME_WHITELISTED) 2019-11-27 11:52:51 +03:00
Andrew Dolgov e5b7b145e5 cache media: set referrer to source URL when fetching images 2019-11-25 09:48:24 +03:00