Andrew Dolgov
b4cb67e77f
remove csrf token from rpc method sanityCheck
2020-09-14 20:00:01 +03:00
Andrew Dolgov
c3d14e1fa5
- fix multiple vulnerabilities in af_proxy_http
...
- fix vulnerability in rewrite_relative_url() which prevented some URLs from being properly absolutized
- fetch_file_contents: validate all URLs before requesting them
- validate URLs: explicitly whitelist http and https scheme, forbid everything else
- DiskCache/cached_url: only serve whitelisted content types (images, video)
- simplify filename/URL handling code, remove and consolidate some less-used functions
2020-09-14 19:46:52 +03:00
Rodney Stromlund
376dce02bb
Update wiki and forums links in error message.
2020-07-13 09:06:59 -05:00
Andrew Dolgov
6eb94f1e13
better support for image srcset attributes as discussed in https://community.tt-rss.org/t/problem-with-img-srcset/3519
2020-06-15 11:58:59 +03:00
Andrew Dolgov
19893d33e3
only bind up/down in 3 panel mode
2020-05-23 08:53:18 +03:00
Andrew Dolgov
ebb373987a
Revert "unbind up/down by default (use native scrolling for consistency with pgup/pgdn)"
...
This reverts commit 6fc18e450b
.
2020-05-23 08:39:44 +03:00
Andrew Dolgov
6fc18e450b
unbind up/down by default (use native scrolling for consistency with pgup/pgdn)
2020-05-23 08:38:03 +03:00
Andrew Dolgov
9ae9302b6b
implement keyboard-related changes discussed in https://community.tt-rss.org/t/changing-the-amount-of-scroll-by-arrow-key/3452/7
2020-05-17 08:25:51 +03:00
JustAMacUser
7a0ea9d90e
Make iframes size responsively.
2020-05-15 22:25:56 -04:00
Andrew Dolgov
2b55afbeec
sanitize: forbid "allow" attribute
...
CSS: remove auto hyphens stuff, remove iframe width clipping to 98% because they get squished
2020-05-09 12:49:19 +03:00
Andrew Dolgov
2558fcbe21
add hotkey "\" to cancel current search
2020-05-09 07:56:06 +03:00
Andrew Dolgov
e934e9f05e
sanitize: simplify initial attribute processing
2020-04-29 19:12:29 +03:00
Andrew Dolgov
7d9dd51cf4
sanitize: remove srcset plain-http hack, globally disallow width and height attributes for all elements
2020-04-29 19:04:34 +03:00
Andrew Dolgov
83c8834421
sanitize: handle picture[@srcset] elements properly, i.e. rewrite relative URLs
2020-04-29 19:02:44 +03:00
Martin Stone
1ad43dd202
Fix documentation for _noexpand commands
2020-03-25 20:30:34 +00:00
Toby Simmons
569228a5df
In get_version() disable DIRECTORY_SEPARATOR check, permit using git on Windows to get version details;
2020-03-02 11:28:21 -06:00
Andrew Dolgov
4e74da590e
af_readability: allow get full text button to work as a toggle; in cdm, scroll to article after embedding
2020-02-28 08:03:25 +03:00
Andrew Dolgov
07b27b375f
update toggle_embed_original hotkey to invoke readability embed instead of removed embed_original plugin
2020-02-27 09:47:20 +03:00
Andrew Dolgov
4ab3854aed
don't generate default.css, replace with themes/light.css as a default root CSS file
2020-02-22 16:22:44 +03:00
Andrew Dolgov
06b9d39662
add support for image loading=lazy attribute
2020-02-13 20:20:55 +03:00
Andrew Dolgov
076c5382fa
login form: add workarounds for chrome password manager
2020-01-25 17:00:51 +03:00
Andrew Dolgov
6080cca9ca
scrap counter cache system; rework counters to sum() booleans instead
2020-01-24 14:25:31 +03:00
Andrew Dolgov
a6d314b753
support dark mode for login form
2020-01-23 13:14:47 +03:00
Andrew Dolgov
01513aa41b
disable MAX_FETCH_REQUESTS_PER_HOST warnings for the time being
2020-01-17 07:26:55 +03:00
Andrew Dolgov
5fc499e19e
get_version: don't rely on exec() exit code to determine whether output is valid
2020-01-14 20:50:40 +03:00
Andrew Dolgov
fdb1fc7608
get_version: fix commit/timestamp lost on subsequent invocations because of misbehaving caching
2019-12-20 18:17:05 +03:00
Andrew Dolgov
6439f7817d
force-disable php display_errors/display_startup_errors on startup
2019-12-19 08:37:19 +03:00
Andrew Dolgov
c309856a97
get_version: filter out Darwin
2019-12-19 07:04:01 +03:00
Andrew Dolgov
74feef0f9d
get_version: always return unsupported on windows
2019-12-18 19:28:00 +03:00
Andrew Dolgov
c46c5e59fc
SELF_USER_AGENT: switch to get_version()
2019-12-18 15:56:27 +03:00
Andrew Dolgov
72d8a34f74
get_version: don't pass useless root dir to git, instead log it in case of failure
2019-12-18 15:29:12 +03:00
Andrew Dolgov
72d0fac80c
remove version.php and VERSION global constant, do version-related things in a slightly less ridiculous way
2019-12-18 14:27:40 +03:00
Andrew Dolgov
0237dee980
implement automatic night mode detection using MQL
...
add separate light.css to force light theme
remove manual night mode toggle and related code
2019-12-12 20:09:43 +03:00
Andrew Dolgov
0a10832491
- update descriptions of changed hotkeys
...
- bind noscroll variants of move article hotkeys to n/p by default
- update N/P (i.e. scroll article content) hotkeys to scroll by fraction of viewport height instead of hardcoded pixel distance
- minor fixes w/ checking for undefined
2019-12-11 06:53:32 +03:00
Andrew Dolgov
008afb97a9
exp: unbind from pgup/pgdn buttons by default
2019-12-09 12:38:04 +03:00
Andrew Dolgov
6191c48596
trim() contents of version_static.txt
2019-12-09 07:11:34 +03:00
fox
f4945b1ba1
Merge branch 'page-hotkeys' of suraia/tt-rss into master
2019-12-08 06:02:10 +00:00
Andrew Dolgov
5907409a84
add support for custom version_static.txt for package maintainers
2019-12-08 08:58:23 +03:00
Michael Kuhn
f133b78a3e
Fix Shift+PageUp/Down hotkeys
2019-12-06 20:39:22 +01:00
Andrew Dolgov
ac95ab4a65
user css dialog: allow saving and applying CSS without closing the dialog
2019-12-06 14:02:30 +03:00
Andrew Dolgov
565547f5a1
php 7.4 deprecation-related fixes
2019-12-06 07:27:22 +03:00
Andrew Dolgov
1902a7dcb0
pgup/pgdown hotkey normalization:
...
- pgup/pgdown without modifier scroll headline buffer
- shift+pgup/pgdown work similarly to shift+up/down but operating on pages
2019-12-05 17:00:17 +03:00
Andrew Dolgov
f30287be65
versioning changes
...
- remove VERSION_STATIC - https://community.tt-rss.org/t/versioning-changes-for-trunk/2974
- report git commit/timestamp properly by invoking git instead of trying to parse .git/HEAD etc
- remove git-related global constants used when checking for updates
2019-12-05 13:23:54 +03:00
Andrew Dolgov
6913158b82
add hotkeys to scroll headlines/articles (whichever is active) by one page
2019-12-04 15:50:49 +03:00
Andrew Dolgov
d15f0349bf
remove hardcoded iframe domain whitelist, make iframe script whitelisting configurable by plugins (HOOK_IFRAME_WHITELISTED)
2019-11-27 11:52:51 +03:00
Andrew Dolgov
e5b7b145e5
cache media: set referrer to source URL when fetching images
2019-11-25 09:48:24 +03:00
Andrew Dolgov
8c3efd51ec
reset domain hit quota on feed update start
2019-11-17 13:17:21 +03:00
Andrew Dolgov
cd4b7f1988
implement MAX_FETCH_REQUESTS_PER_HOST: only generating a warning on exceeded quota for the time being
2019-11-14 07:38:49 +03:00
cac2s
6b47f5a6d1
fix position for "forgotpass" link
2019-11-13 10:52:25 +02:00
Andrew Dolgov
68b0380118
add placeholder authentication via app passwords if service is passed
...
forbid logins via regular passwords for services
remove AUTH_DISABLE_OTP
2019-11-01 13:03:06 +03:00
Andrew Dolgov
84e9f1d5cc
update schema for app-specific passwords
2019-11-01 11:57:45 +03:00
JustAMacUser
4cc6a773ff
Removed redundant text for next/prev article without scroll.
2019-09-23 01:09:11 -04:00
JustAMacUser
2e61551c28
Try to clarify next/prev article keyboard shortcut help.
2019-09-22 15:13:28 -04:00
Andrew Dolgov
3e4701116d
af_readability: add missing file
2019-08-16 15:29:24 +03:00
Andrew Dolgov
9806a2b5ff
bump version_static
2019-08-14 13:38:20 +03:00
Andrew Dolgov
6914ad1f74
retire MIN_CACHE_FILE_SIZE
2019-08-14 12:44:50 +03:00
Andrew Dolgov
3c075bfd21
DiskCache: more strict checking for input filenames, getUrl() is no longer static
2019-08-14 09:49:18 +03:00
Andrew Dolgov
133c2b482b
move rewrite_cached_urls to DiskCache::rewriteUrls()
2019-08-13 12:46:57 +03:00
Andrew Dolgov
b1dd38f880
add DiskCache.getUrl() and use it in a bunch of places
2019-08-13 12:39:21 +03:00
Andrew Dolgov
088fcf8131
move more globals to more appropriate places
...
set libxml to always use internal errors
2019-06-20 08:40:02 +03:00
Andrew Dolgov
4fa9aee4e7
move several more global functions to more appropriate classes
2019-06-20 08:14:06 +03:00
Andrew Dolgov
6d746453c7
get_feeds_from_html: remove XML preamble hack
...
move several related helper functions to Feeds class
2019-06-20 07:51:48 +03:00
Andrew Dolgov
66cbe55148
sanity check: require UConverter from php intl
2019-05-01 09:32:46 +03:00
Andrew Dolgov
ccc0315ef0
better tsquery support:
...
1. report query syntax errors properly
2. fall back to implicit &-joining only if no joiners are detected in user query, otherwise permit full tsquery syntax
2019-04-30 14:39:08 +03:00
ltGuillaume
3d8c6967da
Add keyboard shortcut 'g r': Go to Recently read
2019-04-12 07:29:15 +00:00
Andrew Dolgov
6fbf349155
add hidden _SKIP_SESSION_UA_CHECKS tunable
2019-04-11 16:15:55 +03:00
Andrew Dolgov
6768b3a4a3
schema: add DEFAULT_SEARCH_LANGUAGE
2019-04-10 12:47:46 +03:00
Greg-T
2c2f74a104
PDO error in cleanup_tags repaired
...
Changes :
- add PDO::PARAM_INT to a value in a PDO query
- switch limit to limit_part to respect semantic here (cleanup by packages)
2019-03-28 15:50:13 +00:00
Andrew Dolgov
671f4cee65
domdocument: remove old meta charset unicode hacks, replace with shorter xml preamble utf8 hack (on loadhtml where it makes sense)
...
af_readability: better (?) charset hack for non-unicode pages
2019-03-21 21:08:02 +03:00
Andrew Dolgov
01b2f0a24f
support "picture" tags in articles
2019-03-19 07:18:48 +03:00
Michael Kuhn
e74f7bde22
Refactor hotkeys to use keypress instead of keydown
...
keydown returns the "raw" key in event.which. Depending on the keyboard
layout, this may not be what is wanted. For example, on a German
keyboard, Shift+7 has to be pressed to get a slash. However, event.which
will be 55, which corresponds to "7". In the keypress event, however,
event.which will be 47, which corresponds to "/".
Sadly, several important keys (such as escape and the arrow keys) do not
trigger a keypress event. Therefore, they have to be handled using a
keydown event.
This change refactors the hotkey support to make use of keypress events
whenever possible. This will make hotkeys work regardless of the user's
keyboard layout. Escape and arrow keys are still handled via keydown
events.
There should be only one change in behavior: I could not make Ctrl+/
work and therefore rebound the help dialog to "?".
2019-03-11 12:01:27 +01:00
Andrew Dolgov
32f9fda33d
add composite key on ttrss_feeds (feed_url & owner_uid)
2019-03-10 15:45:30 +03:00
Andrew Dolgov
0b74db5ad7
remove feedbrowser (other feeds)
2019-03-06 20:02:06 +03:00
Andrew Dolgov
38e01270d8
archived feeds: expire old entries (schema bump)
2019-03-06 19:06:05 +03:00
Andrew Dolgov
dfd3a4e581
update previous with make_password() in tt-rss proper
2019-03-05 20:18:50 +03:00
Andrew Dolgov
16a9bdc387
make_password: generate longer passwords by default, use better random function if available
2019-03-05 20:16:50 +03:00
Andrew Dolgov
5b3a73e574
login: switch to absolute redirect urls
2019-03-04 20:38:39 +03:00
Andrew Dolgov
925065b1fe
Revert "login: only allow relative URLs in return="
...
This reverts commit c68ac04020
.
2019-03-04 07:02:58 +03:00
Andrew Dolgov
c68ac04020
login: only allow relative URLs in return=
2019-03-03 07:53:42 +03:00
Andrew Dolgov
72fcc81919
support per-plugin locale directories
2019-03-01 14:25:24 +03:00
Andrew Dolgov
32db1cb872
OPML: include (and import) ttrss per-feed update interval and sort order
2019-02-25 14:06:26 +03:00
Andrew Dolgov
54c1b5c611
fill in some missing doctypes; use short doctype where it wasn't
2019-02-23 13:49:40 +03:00
Andrew Dolgov
947e9cdc86
should be 19.2, duh
2019-02-22 06:46:43 +03:00
Andrew Dolgov
53a02b850e
bump version_static
2019-02-22 06:42:40 +03:00
Andrew Dolgov
8cd7f31bde
utility css updates
2019-02-19 19:46:09 +03:00
Andrew Dolgov
73c845858c
make login form a bit special after all
2019-02-19 15:21:59 +03:00
Andrew Dolgov
e2c9e283a2
remove ttrss_login stuff, use utility class
2019-02-19 15:14:42 +03:00
Andrew Dolgov
c11f32ac38
center and rework some utility screens
2019-02-19 14:59:29 +03:00
Andrew Dolgov
4f720f906e
simplify login form
2019-02-19 14:27:53 +03:00
Andrew Dolgov
874a2d2170
Revert "enable fi_FI locale"
...
oops, nevermind
This reverts commit e00041b206
.
2019-02-08 10:16:42 +03:00
Andrew Dolgov
e00041b206
enable fi_FI locale
2019-02-08 10:15:50 +03:00
root
5ac1935db5
Make article date select 12/24 time based on SHORT_DATE_FORMAT
2019-02-01 08:34:10 -05:00
Andrii Zhuk
f1f2b81a90
Add i18n for auto mode:wq
2019-01-30 16:57:28 +02:00
Andrii Zhuk
57c3322088
Changed language name for Ukrainian
2019-01-30 16:14:07 +02:00
Andrew Dolgov
17a8821c0b
enable uk_UA locale; rebase translations
2019-01-16 10:20:23 +03:00
Andrew Dolgov
1351ce370a
truncate_middle: make it utf8 aware
2018-12-24 12:44:10 +03:00
Andrew Dolgov
a5517fe857
fetch_file_contents: decompress gzipped data
...
af_readability: remove utf8 preamble hack
2018-12-21 17:50:16 +03:00
Andrew Dolgov
957c44d177
rework git update checking to be initiated by frontend, outside of runtime info output
2018-12-16 19:05:37 +03:00
Andrew Dolgov
d53cdaf815
requestCounters: remove cooldown
2018-12-12 20:06:44 +03:00
Andrew Dolgov
25ca144bb7
score: get correct classes for rows/score icons on the client
2018-12-11 10:00:54 +03:00
Andrew Dolgov
7e5c999146
show alert if recent_log_events > 0
2018-12-10 10:53:11 +03:00
Andrew Dolgov
51de0ce807
runtime info: return count of recent eventlog entries
2018-12-10 10:44:28 +03:00
Andrew Dolgov
1c8593c1fa
add hotkey (a N) to toggle night.css
2018-12-09 21:17:50 +03:00
Andrew Dolgov
703351c79e
remove theme supports-version etc checking
2018-12-09 11:37:26 +03:00
Andrew Dolgov
33240b7fd9
various layout fixes related to inline player causing unnecessary left padding if shorten_expanded is enabled
2018-12-07 23:20:19 +03:00
Andrew Dolgov
3e4326e34d
add ttrss_filters2.last_triggered (bump schema version)
2018-12-06 19:37:20 +03:00
Andrew Dolgov
a01c33d654
add HOOK_FILTER_TRIGGERED (for filter debugging)
2018-12-06 19:15:00 +03:00
Andrew Dolgov
0b8cbc9156
remove some bitmaps and rework stuff using it to use iconfont instead
2018-12-06 15:22:52 +03:00
Andrew Dolgov
15d05e8a26
night.css: do not import default less theme statically
...
remove themes/default.php (not needed)
compact.css: fixes
2018-12-06 14:49:33 +03:00
Andrew Dolgov
d2d2cb7e7d
rework scoring display, JS processing and icons
2018-12-06 14:23:45 +03:00
Andrew Dolgov
73c68e600b
feed browser: remove pub_set.png
2018-12-05 14:21:47 +03:00
Andrew Dolgov
29c890b495
login form: use dojo, remove profile hacks
2018-12-04 23:17:35 +03:00
Andrew Dolgov
197e80add6
fix several issues related to profile being set to a non-numeric value
2018-12-04 10:47:01 +03:00
Andrew Dolgov
6303e1626c
remove cache/js (no longer used)
2018-12-04 07:15:53 +03:00
Andrew Dolgov
71fc6d45bd
refactor error reporting to AppBase; keep exception_error() for now as a shim
2018-12-03 13:38:13 +03:00
Andrew Dolgov
84affc7b1d
rework dojo singleton modules to better work with phpstorm completion (ugh) - declare() is not needed there anyway
...
remove event.observe from login form (not needed)
load pluginhost via amd
2018-12-03 09:33:44 +03:00
Andrew Dolgov
e905ce7ea9
fix login
2018-12-03 09:26:26 +03:00
Andrew Dolgov
d9c5c93cef
move some more stuff out of common.js
...
rework client-side cookie functions a bit
limit dojo cachebust based on server scripts modification time
remove param_escape()
2018-12-02 20:07:57 +03:00
Andrew Dolgov
f89924f7a1
set use strict on JS modules; remove some mostly useless stuff like get_minified_js()
2018-12-02 18:38:27 +03:00
Andrew Dolgov
874560db54
remove obsolete row selection functions
...
move getUrlParam() to Utils
2018-12-02 10:33:58 +03:00
Andrew Dolgov
2f85b50e36
remove toggleSelectListRow2()
2018-12-02 10:16:25 +03:00
Andrew Dolgov
5aa9c60494
bring back (debloated) version of unexpanded combined mode
2018-12-01 01:03:01 +03:00
Andrew Dolgov
bf1b89d0f1
enable c-up/down hotkeys even out of cdm
2018-12-01 00:20:09 +03:00
Andrew Dolgov
07fd4f8d9d
minor css fixes (mostly for zoom mode)
2018-11-30 17:22:30 +03:00
Andrew Dolgov
50052fb78a
strip_harmful_tags: remove data- attributes
2018-11-30 15:02:01 +03:00
Andrew Dolgov
9563e3bcd6
remove expandable CDM headlines
2018-11-30 13:51:54 +03:00
Andrew Dolgov
fc0a3050eb
use xhrPost is even more places!
2018-11-30 09:23:51 +03:00
Andrew Dolgov
c10a43069e
debug logging system rework:
...
* support various logging levels per-message
* remove hacks like debug_suppress, DAEMON_EXTENDED_DEBUG, etc
* _debug() is kept as a compatibility shim for plugins
2018-11-30 08:34:29 +03:00
Andrew Dolgov
b2f0858060
sanity config: fix typo
2018-11-22 22:15:27 +03:00
Andrew Dolgov
d5256c8228
update sanity_config.php
2018-11-22 21:47:58 +03:00
Andrew Dolgov
5f66f872b6
fix session write handler always assuming that database entry exists and failing silently if it doesn't; remove session cookie-related hacks
2018-10-16 14:07:42 +03:00
Andrew Dolgov
d246fb9fe1
remove session REMOTE_ADDR checks
2018-10-16 12:12:07 +03:00
Andrew Dolgov
f8fc1ac543
login: check for stale session in login handler, instead of authenticate_user()
2018-10-16 11:39:12 +03:00
Andrew Dolgov
f730d7bb0a
another attempt to enforce session ID regeneration on login
2018-10-16 09:11:32 +03:00
Andrew Dolgov
9dadbdbb21
properly save auth_module after logging in
2018-10-16 07:34:22 +03:00
Andrew Dolgov
77aebd7e4a
it was probably not the best idea to use session_regenerate_id() right after session_start(), duh
2018-10-15 21:47:12 +03:00
Andrew Dolgov
5feed36a3c
do not use separate _ssl cookie for secure sessions
2018-10-15 15:48:37 +03:00
Andrew Dolgov
65e98f4086
force regenerate session id on successful login, remove previous blank SID check
2018-10-15 15:47:50 +03:00
Andrew Dolgov
74736fce0f
if empty session is autostarted because of a cookie, immediately destroy it
2018-10-15 14:53:35 +03:00
Andrew Dolgov
7d53c2b501
validate_session: bring back IP session binding (enabled by default) and UA checking
2018-10-15 08:26:07 +03:00
Andrew Dolgov
ec5687a62b
logout user: commit destroyed session
2018-10-14 22:50:45 +03:00
Andrew Dolgov
d2e1e60ecc
1. per-feed option STRIP_IMAGES should now also affect other media tags
...
2. video/audio elements were not replaced with text links properly in
low bandwidth mode
2018-09-07 09:55:43 +03:00
Andrew Dolgov
f3068c6397
send_local_file: touch() sent files to reset their expiration cooldown
2018-08-23 13:43:31 +03:00
Andrew Dolgov
02bb26a93f
rewrite_cached_urls: support video posters
2018-08-20 14:13:14 +03:00
Andrew Dolgov
a1b8651949
Revert "add (hidden) _NGINX_XACCEL_PREFIX which uses nginx X-Accel-Redirect to serve static files faster"
...
This reverts commit c5c3a0a2a8
.
2018-08-20 12:48:23 +03:00
Andrew Dolgov
2aef804f4b
split transparent rewriting of locally cached media URLs to execute after both sanitize() and HOOK_RENDER_ARTICLE to allow plugins work on original source URLs consistently
2018-08-20 12:12:32 +03:00
Andrew Dolgov
c5c3a0a2a8
add (hidden) _NGINX_XACCEL_PREFIX which uses nginx X-Accel-Redirect to serve static files faster
2018-08-20 09:14:10 +03:00
Andrew Dolgov
88adf3da1b
send_local_file: add application/octet-stream hack
...
cached_url: return original requested filename to save as
2018-08-16 12:16:51 +03:00
Andrew Dolgov
c4869cd573
if PHP_VERSION check fails, show current version
2018-08-13 20:13:08 +03:00
Andrew Dolgov
75e765aa00
bump version_static
2018-08-13 16:12:03 +03:00
Andrew Dolgov
848c6ac655
bump required php version to 5.6
2018-08-13 16:04:09 +03:00
Andrew Dolgov
069aea5989
remove FEED_CRYPT_KEY and everything related to it
...
always assume auth_pass_encrypted is false
2018-08-13 15:59:24 +03:00
Andrew Dolgov
a2d1fa5b14
autoloader: check if class name is namespaced before trying to split it
2018-07-18 13:25:18 +03:00
Andrew Dolgov
df47100ad1
remove SWF enclosure audio player
2018-06-20 18:17:44 +03:00
Andrew Dolgov
a9105e2a61
move JShrink Minifier to vendor/
2018-06-20 15:04:59 +03:00
Andrew Dolgov
2aaefbfa54
update autoloader to consider namespaces for third party libraries: placed and loaded from vendor/namespace/classpath.php
...
update readability to a newer implementation based on Readability.js (https://github.com/andreskrey/readability.php )
add vendor/Psr/Log interface required for the above
2018-06-20 14:58:09 +03:00
Andrew Dolgov
d00d515320
feedbrowser: fix incorrect usage of LIMIT in prepared statement
2018-06-18 23:50:32 +03:00
Tobias Bell
af3663edec
Don't bail out if git gc removed refs
2018-06-08 22:07:30 +02:00
Andrew Dolgov
68d9c412ea
fetch_file_contents: allow setting http Accept header
2018-05-25 14:25:08 +03:00
Andrew Dolgov
f0dbfedc81
increase buffersize to 16384 bytes
...
(also some trailing whitespace got clipped)
2018-05-23 10:40:28 +03:00
Alexander Yaburov
74a98a6ff2
increased CURLOPT_BUFFERSIZE from 128 to 256
2018-05-23 10:02:03 +05:00
Andrew Dolgov
b14f6d58b4
implement hard limits on downloaded data size for general fetching and cache plugins: MAX_DOWNLOAD_FILE_SIZE & MAX_CACHE_FILE_SIZE
2018-05-20 11:08:33 +03:00
foobar
2008ec4ed7
change filter rule regexp type to text
2018-04-14 14:11:29 +02:00
JustAMacUser
905ff10dc9
Allow abbr tag when sanitizing.
2018-02-27 16:06:10 +00:00
Andrew Dolgov
e7c9bc60ec
fix previous wrt if-modified-since being added to context options headers
2018-02-25 14:22:46 +03:00
Metallizzer
dd597297cb
Обновить 'include/functions.php'
...
The "Connection: close" header is added to the context_options
2018-02-25 10:03:09 +00:00
Andrew Dolgov
3d7db21602
Merge branch 'master' of git.fakecake.org:tt-rss
2018-02-12 09:37:31 +03:00
Andrew Dolgov
8babb8e75a
sanitize: disallow width and height attributes for images
2018-02-11 16:47:19 +03:00
fox
1aeb282be1
Merge branch 'save-effective-url' of JustAMacUser/tt-rss into master
2018-02-11 08:57:12 +00:00
JustAMacUser
7ae05ed790
Have fetch_file_contents() save the effective URL.
2018-02-11 07:56:28 +00:00
Andrew Dolgov
2eaf2a1f36
tag_is_valid: simplify code
2018-02-11 10:26:33 +03:00
Andrew Dolgov
7f4a404566
include: convert some spaces to tabs
2018-01-30 10:44:31 +03:00
martin scharm
32dc9ec854
undocumenting the proxy settings [see #36 ]
...
in response to https://git.tt-rss.org/git/tt-rss/pulls/36#issuecomment-119
2018-01-18 08:48:53 +01:00
martin scharm
213c01d459
some proxies require `request_fulluri` set to true [see #36 ]
...
at least polipo won't work for plain HTTP URLs (HTTPS strangely also works without `request_fulluri`..?)
see https://git.tt-rss.org/git/tt-rss/pulls/36
2018-01-17 12:28:47 +01:00
martin scharm
ea55f2e11c
Add proper support for proxies
...
There are situations where you want tt-rss to use a proxy (e.g.
because of network restrictions, or privacy concerns).
tt-rss already comes with an undocumented `_CURL_HTTP_PROXY`
variable (see eg https://binfalse.de/2015/05/06/ttrss-with-proxy/ ),
however that won't have an effect when, for example, php-curl is
not installed, see
c30f5e1811/include/functions.php (L377)
In this case it would use the `file_get_contents` with a stream
context without a proxy definition:
c30f5e1811/include/functions.php (L487)
Here I propose to properly support proxies, and I introduced a
`PROXY` variable, that is respected in both scenarios, with and
without curl installed.
2018-01-14 00:30:22 +01:00
Andrew Dolgov
9274109c19
search_to_sql: quote fallback search language
2017-12-30 16:27:05 +03:00
JustAMacUser
56c2216295
Add missing quotes to array_map.
2017-12-30 01:00:56 -05:00
Andrew Dolgov
bed2d6e054
force-cast some variables used in queries to integer
...
do not display SQL query in headlines debug mode
2017-12-17 16:24:13 +03:00
Andrew Dolgov
7651b6e2cd
sanitize: disable referrer via referrerpolicy for img elements
2017-12-13 20:07:10 +03:00
Andrew Dolgov
4d10b4abca
merge login form css into default.css
...
update more hardcoded colors to use @color-accent
update @color-accent
2017-12-10 22:51:39 +03:00
Andrew Dolgov
f8db5bb4db
installer: use PDO, improve wording for some notices
...
PDO wrapper: allow working with blank DB_HOST
2017-12-10 09:20:52 +03:00
Andrew Dolgov
76fc7a2d9c
bool_to_sql_bool: for some reason PDO really likes integers for boolean columns
...
incidentally this fixes OPML filter import
2017-12-06 00:12:28 +03:00
Andrew Dolgov
c4a08e4ff0
remove mentions of deprecated.js
2017-12-05 07:09:01 +03:00
Andrew Dolgov
e6532439d6
force strip_tags() on all user input unless explicitly allowed
2017-12-03 23:35:38 +03:00
Andrew Dolgov
fa3bcfa379
queryfeedheadlines: there's no need to quote order_by/override_order
...
else: feedicon cache busting etc
2017-12-03 22:49:57 +03:00
Andrew Dolgov
7c0eb1b621
add defaultPasswordWarning nag dialog
2017-12-03 20:46:27 +03:00
Andrew Dolgov
bfebf57c5f
get_theme_path: fallback to css/default.css if default theme is selected
2017-12-03 14:17:25 +03:00
Andrew Dolgov
2cf93c046c
pref-users: fix sorting the table
2017-12-03 13:54:31 +03:00
Andrew Dolgov
3eecebc34f
sanity_check: do not invoke PDO without checking that it exists
2017-12-03 13:41:09 +03:00
Andrew Dolgov
97a5e13370
add sanity check for PDO
2017-12-03 13:40:09 +03:00
Andrew Dolgov
83303f20e0
update version static for css & db changes
2017-12-03 13:38:25 +03:00
Andrew Dolgov
09bc54c690
further stylesheet simplification related fixes
2017-12-03 13:25:34 +03:00
Andrew Dolgov
8ff3cbb32e
filters: remove sql_bool_to_bool()
...
checkbox_to_sql_bool: return ints (???)
2017-12-03 09:26:11 +03:00
Andrew Dolgov
ed5cd6eae5
get_feed_access_key: param type bullshit
2017-12-03 00:25:12 +03:00
Andrew Dolgov
6cf3a57282
login: fix profile dropdown popping out in a weird place
2017-12-03 00:23:11 +03:00
Andrew Dolgov
7d960ce7e9
auth_internal: use PDO + other fixes
2017-12-03 00:18:08 +03:00
Andrew Dolgov
4ee398a41e
Merge branch 'master' of git.fakecake.org:tt-rss into pdo-experimental
2017-12-02 23:13:49 +03:00
Andrew Dolgov
1e78803c44
search_to_sql: leftover tsquery query fix for pgsql
2017-12-02 23:11:28 +03:00
Andrew Dolgov
a2d77092fe
search_to_sql: quoting fix
2017-12-02 22:58:59 +03:00
Andrew Dolgov
0002e598f8
sql_bool_to_bool: backwards compat fix
2017-12-02 22:39:34 +03:00