8a02a728c8
add DAEMON_UNSUCCESSFUL_DAYS_LIMIT tunable (defaults to 30 days)
2020-09-30 17:03:16 +03:00
da5deaaca1
set session.cookie_lifetime to 0 initially instead of a rather useless min()
2020-09-30 14:43:53 +03:00
de22464ea8
schema: add ttrss_feeds.last_successful_update
2020-09-28 14:14:06 +03:00
215f388992
move timestamp-related stuff to a separate class
2020-09-23 13:04:26 +03:00
74568df4ff
remove a lot of stuff from global context (functions.php), add a few helper classes instead
2020-09-22 09:04:33 +03:00
d04ac399ff
clarify some URL validation-related error messages
2020-09-21 20:37:29 +03:00
3dd4169b5f
clarify some URL validation-related error messages
2020-09-21 20:35:24 +03:00
4785f21316
update_rss_feed: log effective URL after fetching
...
validate_url: treat scheme as case-insensitive
2020-09-21 20:26:57 +03:00
486f1d84ed
resolve_redirects: fix previous
2020-09-20 18:14:34 +03:00
d2867d887a
resolve_redirects: only use three argument version of get_headers() on php 7.1+
2020-09-20 17:27:04 +03:00
03a337a660
add basic safe mode which doesn't load any user plugins
2020-09-18 15:48:22 +03:00
4efc3d7b3f
validate_url: relax requirements for URLs, limit additional port/loopback filtering to fetch_file_contents()
2020-09-17 20:20:23 +03:00
a4525d31b2
replace FALSE with false so that static analyzer shuts up about it
2020-09-17 19:02:27 +03:00
57fac84516
rename gettext.inc to gettext.inc.php (cosmetic)
2020-09-17 18:56:29 +03:00
c25edd0024
fetch_file_contents: validate effective URL (after redirects) without CURL
2020-09-17 16:17:33 +03:00
27e695436f
fetch_file_contents: validate effective URL (after redirects) if using CURL
2020-09-17 15:53:13 +03:00
5a7e7e1367
don't try to call hash_equals() on unset user token
2020-09-17 10:20:55 +03:00
f72e6947d5
use hash_equals() correctly
2020-09-17 10:04:00 +03:00
e3adacc588
fix several cases of Db class being invoked as wrong name (as DB)
2020-09-17 09:18:03 +03:00
16c86e2fc3
replace some plain http links with https
2020-09-17 09:02:30 +03:00
a817d3794d
* use get_random_bytes() for CSRF token
...
* get_random_bytes: use PHP7 random_bytes() if it is available
* validate CSRF token using hash_equals
2020-09-17 08:59:18 +03:00
1f79d614c4
fix OTP QR code not displayed because of CSRF token passed as a query
...
parameter
use type-strict comparison when validating CSRF token on the backend
2020-09-17 08:43:39 +03:00
6a4b6cf603
amend previous to 127/8 subnet
2020-09-17 07:37:48 +03:00
213d6330b1
fetch_file_contents: resolve requested hosts and check for possible
...
loopback address
2020-09-17 07:36:47 +03:00
88c4dc405e
build_url: also put query parameters and fragment in resulting URL
...
rewrite_relative_url: simplify handling of relative URLs
2020-09-16 21:41:05 +03:00
da5af2fae0
cached_url: block SVG images because of potential javascript inside
2020-09-16 16:25:20 +03:00
aeaafefa07
don't pass csrf token as a GET parameter to Article
2020-09-15 16:03:09 +03:00
1621abcffc
rewrite_relative_url: validate resulting absolutized URLs
2020-09-15 10:41:57 +03:00
aa89ea7769
validate_url: only allow safe ports (80, 443), disallow access to loopback
2020-09-15 10:39:09 +03:00
6c02fea641
validate_url: add clean()
2020-09-15 08:45:15 +03:00
4abc7d7898
rename base64_img() to image_to_base64()
2020-09-15 08:05:01 +03:00
1ee458b5c1
cached_url: perform mimetype validation before possible HOOK_SEND_LOCAL_FILE hooks
2020-09-15 07:54:46 +03:00
b4cb67e77f
remove csrf token from rpc method sanityCheck
2020-09-14 20:00:01 +03:00
c3d14e1fa5
- fix multiple vulnerabilities in af_proxy_http
...
- fix vulnerability in rewrite_relative_url() which prevented some URLs from being properly absolutized
- fetch_file_contents: validate all URLs before requesting them
- validate URLs: explicitly whitelist http and https scheme, forbid everything else
- DiskCache/cached_url: only serve whitelisted content types (images, video)
- simplify filename/URL handling code, remove and consolidate some less-used functions
2020-09-14 19:46:52 +03:00
376dce02bb
Update wiki and forums links in error message.
2020-07-13 09:06:59 -05:00
6eb94f1e13
better support for image srcset attributes as discussed in https://community.tt-rss.org/t/problem-with-img-srcset/3519
2020-06-15 11:58:59 +03:00
19893d33e3
only bind up/down in 3 panel mode
2020-05-23 08:53:18 +03:00
ebb373987a
Revert "unbind up/down by default (use native scrolling for consistency with pgup/pgdn)"
...
This reverts commit 6fc18e450b
2020-05-23 08:39:44 +03:00
6fc18e450b
unbind up/down by default (use native scrolling for consistency with pgup/pgdn)
2020-05-23 08:38:03 +03:00
9ae9302b6b
implement keyboard-related changes discussed in https://community.tt-rss.org/t/changing-the-amount-of-scroll-by-arrow-key/3452/7
2020-05-17 08:25:51 +03:00
7a0ea9d90e
Make iframes size responsively.
2020-05-15 22:25:56 -04:00
2b55afbeec
sanitize: forbid "allow" attribute
...
CSS: remove auto hyphens stuff, remove iframe width clipping to 98% because they get squished
2020-05-09 12:49:19 +03:00
2558fcbe21
add hotkey "\" to cancel current search
2020-05-09 07:56:06 +03:00
e934e9f05e
sanitize: simplify initial attribute processing
2020-04-29 19:12:29 +03:00
7d9dd51cf4
sanitize: remove srcset plain-http hack, globally disallow width and height attributes for all elements
2020-04-29 19:04:34 +03:00
83c8834421
sanitize: handle picture[@srcset] elements properly, i.e. rewrite relative URLs
2020-04-29 19:02:44 +03:00
1ad43dd202
Fix documentation for _noexpand commands
2020-03-25 20:30:34 +00:00
569228a5df
In get_version() disable DIRECTORY_SEPARATOR check, permit using git on Windows to get version details;
2020-03-02 11:28:21 -06:00
4e74da590e
af_readability: allow get full text button to work as a toggle; in cdm, scroll to article after embedding
2020-02-28 08:03:25 +03:00
07b27b375f
update toggle_embed_original hotkey to invoke readability embed instead of removed embed_original plugin
2020-02-27 09:47:20 +03:00
4ab3854aed
don't generate default.css, replace with themes/light.css as a default root CSS file
2020-02-22 16:22:44 +03:00
06b9d39662
add support for image loading=lazy attribute
2020-02-13 20:20:55 +03:00
076c5382fa
login form: add workarounds for chrome password manager
2020-01-25 17:00:51 +03:00
6080cca9ca
scrap counter cache system; rework counters to sum() booleans instead
2020-01-24 14:25:31 +03:00
a6d314b753
support dark mode for login form
2020-01-23 13:14:47 +03:00
01513aa41b
disable MAX_FETCH_REQUESTS_PER_HOST warnings for the time being
2020-01-17 07:26:55 +03:00
5fc499e19e
get_version: don't rely on exec() exit code to determine whether output is valid
2020-01-14 20:50:40 +03:00
fdb1fc7608
get_version: fix commit/timestamp lost on subsequent invocations because of misbehaving caching
2019-12-20 18:17:05 +03:00
6439f7817d
force-disable php display_errors/display_startup_errors on startup
2019-12-19 08:37:19 +03:00
c309856a97
get_version: filter out Darwin
2019-12-19 07:04:01 +03:00
74feef0f9d
get_version: always return unsupported on windows
2019-12-18 19:28:00 +03:00
c46c5e59fc
SELF_USER_AGENT: switch to get_version()
2019-12-18 15:56:27 +03:00
72d8a34f74
get_version: don't pass useless root dir to git, instead log it in case of failure
2019-12-18 15:29:12 +03:00
72d0fac80c
remove version.php and VERSION global constant, do version-related things in a slightly less ridiculous way
2019-12-18 14:27:40 +03:00
0237dee980
implement automatic night mode detection using MQL
...
add separate light.css to force light theme
remove manual night mode toggle and related code
2019-12-12 20:09:43 +03:00
0a10832491
- update descriptions of changed hotkeys
...
- bind noscroll variants of move article hotkeys to n/p by default
- update N/P (i.e. scroll article content) hotkeys to scroll by fraction of viewport height instead of hardcoded pixel distance
- minor fixes w/ checking for undefined
2019-12-11 06:53:32 +03:00
008afb97a9
exp: unbind from pgup/pgdn buttons by default
2019-12-09 12:38:04 +03:00
6191c48596
trim() contents of version_static.txt
2019-12-09 07:11:34 +03:00
f4945b1ba1
Merge branch 'page-hotkeys' of suraia/tt-rss into master
2019-12-08 06:02:10 +00:00
5907409a84
add support for custom version_static.txt for package maintainers
2019-12-08 08:58:23 +03:00
f133b78a3e
Fix Shift+PageUp/Down hotkeys
2019-12-06 20:39:22 +01:00
ac95ab4a65
user css dialog: allow saving and applying CSS without closing the dialog
2019-12-06 14:02:30 +03:00
565547f5a1
php 7.4 deprecation-related fixes
2019-12-06 07:27:22 +03:00
1902a7dcb0
pgup/pgdown hotkey normalization:
...
- pgup/pgdown without modifier scroll headline buffer
- shift+pgup/pgdown work similarly to shift+up/down but operating on pages
2019-12-05 17:00:17 +03:00
f30287be65
versioning changes
...
- remove VERSION_STATIC - https://community.tt-rss.org/t/versioning-changes-for-trunk/2974
- report git commit/timestamp properly by invoking git instead of trying to parse .git/HEAD etc
- remove git-related global constants used when checking for updates
2019-12-05 13:23:54 +03:00
6913158b82
add hotkeys to scroll headlines/articles (whichever is active) by one page
2019-12-04 15:50:49 +03:00
d15f0349bf
remove hardcoded iframe domain whitelist, make iframe script whitelisting configurable by plugins (HOOK_IFRAME_WHITELISTED)
2019-11-27 11:52:51 +03:00
e5b7b145e5
cache media: set referrer to source URL when fetching images
2019-11-25 09:48:24 +03:00
8c3efd51ec
reset domain hit quota on feed update start
2019-11-17 13:17:21 +03:00
cd4b7f1988
implement MAX_FETCH_REQUESTS_PER_HOST: only generating a warning on exceeded quota for the time being
2019-11-14 07:38:49 +03:00
6b47f5a6d1
fix position for "forgotpass" link
2019-11-13 10:52:25 +02:00
68b0380118
add placeholder authentication via app passwords if service is passed
...
forbid logins via regular passwords for services
remove AUTH_DISABLE_OTP
2019-11-01 13:03:06 +03:00
84e9f1d5cc
update schema for app-specific passwords
2019-11-01 11:57:45 +03:00
4cc6a773ff
Removed redundant text for next/prev article without scroll.
2019-09-23 01:09:11 -04:00
2e61551c28
Try to clarify next/prev article keyboard shortcut help.
2019-09-22 15:13:28 -04:00
3e4701116d
af_readability: add missing file
2019-08-16 15:29:24 +03:00
9806a2b5ff
bump version_static
2019-08-14 13:38:20 +03:00
6914ad1f74
retire MIN_CACHE_FILE_SIZE
2019-08-14 12:44:50 +03:00
3c075bfd21
DiskCache: more strict checking for input filenames, getUrl() is no longer static
2019-08-14 09:49:18 +03:00
133c2b482b
move rewrite_cached_urls to DiskCache::rewriteUrls()
2019-08-13 12:46:57 +03:00
b1dd38f880
add DiskCache.getUrl() and use it in a bunch of places
2019-08-13 12:39:21 +03:00
088fcf8131
move more globals to more appropriate places
...
set libxml to always use internal errors
2019-06-20 08:40:02 +03:00
4fa9aee4e7
move several more global functions to more appropriate classes
2019-06-20 08:14:06 +03:00
6d746453c7
get_feeds_from_html: remove XML preamble hack
...
move several related helper functions to Feeds class
2019-06-20 07:51:48 +03:00
66cbe55148
sanity check: require UConverter from php intl
2019-05-01 09:32:46 +03:00
ccc0315ef0
better tsquery support:
...
1. report query syntax errors properly
2. fall back to implicit &-joining only if no joiners are detected in user query, otherwise permit full tsquery syntax
2019-04-30 14:39:08 +03:00
3d8c6967da
Add keyboard shortcut 'g r': Go to Recently read
2019-04-12 07:29:15 +00:00
6fbf349155
add hidden _SKIP_SESSION_UA_CHECKS tunable
2019-04-11 16:15:55 +03:00
6768b3a4a3
schema: add DEFAULT_SEARCH_LANGUAGE
2019-04-10 12:47:46 +03:00
2c2f74a104
PDO error in cleanup_tags repaired
...
Changes :
- add PDO::PARAM_INT to a value in a PDO query
- switch limit to limit_part to respect semantic here (cleanup by packages)
2019-03-28 15:50:13 +00:00
Andrew Dolgov
Rodney Stromlund
JustAMacUser
Martin Stone
Toby Simmons
fox
Michael Kuhn
cac2s
ltGuillaume
Greg-T