3dd4169b5f
clarify some URL validation-related error messages
2020-09-21 20:35:24 +03:00
4785f21316
update_rss_feed: log effective URL after fetching
...
validate_url: treat scheme as case-insensitive
2020-09-21 20:26:57 +03:00
486f1d84ed
resolve_redirects: fix previous
2020-09-20 18:14:34 +03:00
d2867d887a
resolve_redirects: only use three argument version of get_headers() on php 7.1+
2020-09-20 17:27:04 +03:00
03a337a660
add basic safe mode which doesn't load any user plugins
2020-09-18 15:48:22 +03:00
4efc3d7b3f
validate_url: relax requirements for URLs, limit additional port/loopback filtering to fetch_file_contents()
2020-09-17 20:20:23 +03:00
a4525d31b2
replace FALSE with false so that static analyzer shuts up about it
2020-09-17 19:02:27 +03:00
57fac84516
rename gettext.inc to gettext.inc.php (cosmetic)
2020-09-17 18:56:29 +03:00
c25edd0024
fetch_file_contents: validate effective URL (after redirects) without CURL
2020-09-17 16:17:33 +03:00
27e695436f
fetch_file_contents: validate effective URL (after redirects) if using CURL
2020-09-17 15:53:13 +03:00
5a7e7e1367
don't try to call hash_equals() on unset user token
2020-09-17 10:20:55 +03:00
f72e6947d5
use hash_equals() correctly
2020-09-17 10:04:00 +03:00
e3adacc588
fix several cases of Db class being invoked as wrong name (as DB)
2020-09-17 09:18:03 +03:00
16c86e2fc3
replace some plain http links with https
2020-09-17 09:02:30 +03:00
a817d3794d
* use get_random_bytes() for CSRF token
...
* get_random_bytes: use PHP7 random_bytes() if it is available
* validate CSRF token using hash_equals
2020-09-17 08:59:18 +03:00
1f79d614c4
fix OTP QR code not displayed because of CSRF token passed as a query
...
parameter
use type-strict comparison when validating CSRF token on the backend
2020-09-17 08:43:39 +03:00
6a4b6cf603
amend previous to 127/8 subnet
2020-09-17 07:37:48 +03:00
213d6330b1
fetch_file_contents: resolve requested hosts and check for possible
...
loopback address
2020-09-17 07:36:47 +03:00
88c4dc405e
build_url: also put query parameters and fragment in resulting URL
...
rewrite_relative_url: simplify handling of relative URLs
2020-09-16 21:41:05 +03:00
da5af2fae0
cached_url: block SVG images because of potential javascript inside
2020-09-16 16:25:20 +03:00
aeaafefa07
don't pass csrf token as a GET parameter to Article
2020-09-15 16:03:09 +03:00
1621abcffc
rewrite_relative_url: validate resulting absolutized URLs
2020-09-15 10:41:57 +03:00
aa89ea7769
validate_url: only allow safe ports (80, 443), disallow access to loopback
2020-09-15 10:39:09 +03:00
6c02fea641
validate_url: add clean()
2020-09-15 08:45:15 +03:00
4abc7d7898
rename base64_img() to image_to_base64()
2020-09-15 08:05:01 +03:00
1ee458b5c1
cached_url: perform mimetype validation before possible HOOK_SEND_LOCAL_FILE hooks
2020-09-15 07:54:46 +03:00
b4cb67e77f
remove csrf token from rpc method sanityCheck
2020-09-14 20:00:01 +03:00
c3d14e1fa5
- fix multiple vulnerabilities in af_proxy_http
...
- fix vulnerability in rewrite_relative_url() which prevented some URLs from being properly absolutized
- fetch_file_contents: validate all URLs before requesting them
- validate URLs: explicitly whitelist http and https scheme, forbid everything else
- DiskCache/cached_url: only serve whitelisted content types (images, video)
- simplify filename/URL handling code, remove and consolidate some less-used functions
2020-09-14 19:46:52 +03:00
376dce02bb
Update wiki and forums links in error message.
2020-07-13 09:06:59 -05:00
6eb94f1e13
better support for image srcset attributes as discussed in https://community.tt-rss.org/t/problem-with-img-srcset/3519
2020-06-15 11:58:59 +03:00
19893d33e3
only bind up/down in 3 panel mode
2020-05-23 08:53:18 +03:00
ebb373987a
Revert "unbind up/down by default (use native scrolling for consistency with pgup/pgdn)"
...
This reverts commit 6fc18e450b
2020-05-23 08:39:44 +03:00
6fc18e450b
unbind up/down by default (use native scrolling for consistency with pgup/pgdn)
2020-05-23 08:38:03 +03:00
9ae9302b6b
implement keyboard-related changes discussed in https://community.tt-rss.org/t/changing-the-amount-of-scroll-by-arrow-key/3452/7
2020-05-17 08:25:51 +03:00
7a0ea9d90e
Make iframes size responsively.
2020-05-15 22:25:56 -04:00
2b55afbeec
sanitize: forbid "allow" attribute
...
CSS: remove auto hyphens stuff, remove iframe width clipping to 98% because they get squished
2020-05-09 12:49:19 +03:00
2558fcbe21
add hotkey "\" to cancel current search
2020-05-09 07:56:06 +03:00
e934e9f05e
sanitize: simplify initial attribute processing
2020-04-29 19:12:29 +03:00
7d9dd51cf4
sanitize: remove srcset plain-http hack, globally disallow width and height attributes for all elements
2020-04-29 19:04:34 +03:00
83c8834421
sanitize: handle picture[@srcset] elements properly, i.e. rewrite relative URLs
2020-04-29 19:02:44 +03:00
1ad43dd202
Fix documentation for _noexpand commands
2020-03-25 20:30:34 +00:00
569228a5df
In get_version() disable DIRECTORY_SEPARATOR check, permit using git on Windows to get version details;
2020-03-02 11:28:21 -06:00
4e74da590e
af_readability: allow get full text button to work as a toggle; in cdm, scroll to article after embedding
2020-02-28 08:03:25 +03:00
07b27b375f
update toggle_embed_original hotkey to invoke readability embed instead of removed embed_original plugin
2020-02-27 09:47:20 +03:00
4ab3854aed
don't generate default.css, replace with themes/light.css as a default root CSS file
2020-02-22 16:22:44 +03:00
06b9d39662
add support for image loading=lazy attribute
2020-02-13 20:20:55 +03:00
076c5382fa
login form: add workarounds for chrome password manager
2020-01-25 17:00:51 +03:00
6080cca9ca
scrap counter cache system; rework counters to sum() booleans instead
2020-01-24 14:25:31 +03:00
a6d314b753
support dark mode for login form
2020-01-23 13:14:47 +03:00
01513aa41b
disable MAX_FETCH_REQUESTS_PER_HOST warnings for the time being
2020-01-17 07:26:55 +03:00
5fc499e19e
get_version: don't rely on exec() exit code to determine whether output is valid
2020-01-14 20:50:40 +03:00
fdb1fc7608
get_version: fix commit/timestamp lost on subsequent invocations because of misbehaving caching
2019-12-20 18:17:05 +03:00
6439f7817d
force-disable php display_errors/display_startup_errors on startup
2019-12-19 08:37:19 +03:00
c309856a97
get_version: filter out Darwin
2019-12-19 07:04:01 +03:00
74feef0f9d
get_version: always return unsupported on windows
2019-12-18 19:28:00 +03:00
c46c5e59fc
SELF_USER_AGENT: switch to get_version()
2019-12-18 15:56:27 +03:00
72d8a34f74
get_version: don't pass useless root dir to git, instead log it in case of failure
2019-12-18 15:29:12 +03:00
72d0fac80c
remove version.php and VERSION global constant, do version-related things in a slightly less ridiculous way
2019-12-18 14:27:40 +03:00
0237dee980
implement automatic night mode detection using MQL
...
add separate light.css to force light theme
remove manual night mode toggle and related code
2019-12-12 20:09:43 +03:00
0a10832491
- update descriptions of changed hotkeys
...
- bind noscroll variants of move article hotkeys to n/p by default
- update N/P (i.e. scroll article content) hotkeys to scroll by fraction of viewport height instead of hardcoded pixel distance
- minor fixes w/ checking for undefined
2019-12-11 06:53:32 +03:00
008afb97a9
exp: unbind from pgup/pgdn buttons by default
2019-12-09 12:38:04 +03:00
6191c48596
trim() contents of version_static.txt
2019-12-09 07:11:34 +03:00
f4945b1ba1
Merge branch 'page-hotkeys' of suraia/tt-rss into master
2019-12-08 06:02:10 +00:00
5907409a84
add support for custom version_static.txt for package maintainers
2019-12-08 08:58:23 +03:00
f133b78a3e
Fix Shift+PageUp/Down hotkeys
2019-12-06 20:39:22 +01:00
ac95ab4a65
user css dialog: allow saving and applying CSS without closing the dialog
2019-12-06 14:02:30 +03:00
565547f5a1
php 7.4 deprecation-related fixes
2019-12-06 07:27:22 +03:00
1902a7dcb0
pgup/pgdown hotkey normalization:
...
- pgup/pgdown without modifier scroll headline buffer
- shift+pgup/pgdown work similarly to shift+up/down but operating on pages
2019-12-05 17:00:17 +03:00
f30287be65
versioning changes
...
- remove VERSION_STATIC - https://community.tt-rss.org/t/versioning-changes-for-trunk/2974
- report git commit/timestamp properly by invoking git instead of trying to parse .git/HEAD etc
- remove git-related global constants used when checking for updates
2019-12-05 13:23:54 +03:00
6913158b82
add hotkeys to scroll headlines/articles (whichever is active) by one page
2019-12-04 15:50:49 +03:00
d15f0349bf
remove hardcoded iframe domain whitelist, make iframe script whitelisting configurable by plugins (HOOK_IFRAME_WHITELISTED)
2019-11-27 11:52:51 +03:00
e5b7b145e5
cache media: set referrer to source URL when fetching images
2019-11-25 09:48:24 +03:00
8c3efd51ec
reset domain hit quota on feed update start
2019-11-17 13:17:21 +03:00
cd4b7f1988
implement MAX_FETCH_REQUESTS_PER_HOST: only generating a warning on exceeded quota for the time being
2019-11-14 07:38:49 +03:00
6b47f5a6d1
fix position for "forgotpass" link
2019-11-13 10:52:25 +02:00
68b0380118
add placeholder authentication via app passwords if service is passed
...
forbid logins via regular passwords for services
remove AUTH_DISABLE_OTP
2019-11-01 13:03:06 +03:00
84e9f1d5cc
update schema for app-specific passwords
2019-11-01 11:57:45 +03:00
4cc6a773ff
Removed redundant text for next/prev article without scroll.
2019-09-23 01:09:11 -04:00
2e61551c28
Try to clarify next/prev article keyboard shortcut help.
2019-09-22 15:13:28 -04:00
3e4701116d
af_readability: add missing file
2019-08-16 15:29:24 +03:00
9806a2b5ff
bump version_static
2019-08-14 13:38:20 +03:00
6914ad1f74
retire MIN_CACHE_FILE_SIZE
2019-08-14 12:44:50 +03:00
3c075bfd21
DiskCache: more strict checking for input filenames, getUrl() is no longer static
2019-08-14 09:49:18 +03:00
133c2b482b
move rewrite_cached_urls to DiskCache::rewriteUrls()
2019-08-13 12:46:57 +03:00
b1dd38f880
add DiskCache.getUrl() and use it in a bunch of places
2019-08-13 12:39:21 +03:00
088fcf8131
move more globals to more appropriate places
...
set libxml to always use internal errors
2019-06-20 08:40:02 +03:00
4fa9aee4e7
move several more global functions to more appropriate classes
2019-06-20 08:14:06 +03:00
6d746453c7
get_feeds_from_html: remove XML preamble hack
...
move several related helper functions to Feeds class
2019-06-20 07:51:48 +03:00
66cbe55148
sanity check: require UConverter from php intl
2019-05-01 09:32:46 +03:00
ccc0315ef0
better tsquery support:
...
1. report query syntax errors properly
2. fall back to implicit &-joining only if no joiners are detected in user query, otherwise permit full tsquery syntax
2019-04-30 14:39:08 +03:00
3d8c6967da
Add keyboard shortcut 'g r': Go to Recently read
2019-04-12 07:29:15 +00:00
6fbf349155
add hidden _SKIP_SESSION_UA_CHECKS tunable
2019-04-11 16:15:55 +03:00
6768b3a4a3
schema: add DEFAULT_SEARCH_LANGUAGE
2019-04-10 12:47:46 +03:00
2c2f74a104
PDO error in cleanup_tags repaired
...
Changes :
- add PDO::PARAM_INT to a value in a PDO query
- switch limit to limit_part to respect semantic here (cleanup by packages)
2019-03-28 15:50:13 +00:00
671f4cee65
domdocument: remove old meta charset unicode hacks, replace with shorter xml preamble utf8 hack (on loadhtml where it makes sense)
...
af_readability: better (?) charset hack for non-unicode pages
2019-03-21 21:08:02 +03:00
01b2f0a24f
support "picture" tags in articles
2019-03-19 07:18:48 +03:00
e74f7bde22
Refactor hotkeys to use keypress instead of keydown
...
keydown returns the "raw" key in event.which. Depending on the keyboard
layout, this may not be what is wanted. For example, on a German
keyboard, Shift+7 has to be pressed to get a slash. However, event.which
will be 55, which corresponds to "7". In the keypress event, however,
event.which will be 47, which corresponds to "/".
Sadly, several important keys (such as escape and the arrow keys) do not
trigger a keypress event. Therefore, they have to be handled using a
keydown event.
This change refactors the hotkey support to make use of keypress events
whenever possible. This will make hotkeys work regardless of the user's
keyboard layout. Escape and arrow keys are still handled via keydown
events.
There should be only one change in behavior: I could not make Ctrl+/
work and therefore rebound the help dialog to "?".
2019-03-11 12:01:27 +01:00
32f9fda33d
add composite key on ttrss_feeds (feed_url & owner_uid)
2019-03-10 15:45:30 +03:00
0b74db5ad7
remove feedbrowser (other feeds)
2019-03-06 20:02:06 +03:00
38e01270d8
archived feeds: expire old entries (schema bump)
2019-03-06 19:06:05 +03:00
Andrew Dolgov
Rodney Stromlund
JustAMacUser
Martin Stone
Toby Simmons
fox
Michael Kuhn
cac2s
ltGuillaume
Greg-T