02a9485966
Try to limit max favicon size, don't store current/old in a var.
2021-02-21 23:30:31 +00:00
f6bfb89b29
pref-prefs: switch to new control shorthand in a few places
2021-02-21 23:18:32 +03:00
94560132dd
for the most part, deal with filter rules UI
2021-02-21 09:35:07 +03:00
fc0ebf0891
move bookmarklet-related methods out of public.php into the plugin
2021-02-19 20:21:36 +03:00
6b43b788d9
migrate xhrJson invocations to the new helper
2021-02-19 10:22:00 +03:00
c088e9d9d8
get rid of a few more prototype-isms
2021-02-18 22:23:06 +03:00
a2c75257f1
bookmarklets: cleanup
2021-02-18 13:16:55 +03:00
e4609c18ef
* add (disabled) shortcut syntax for plugin methods
...
* add controls shortcut for pluginhandler tags
* add similar shortcut for frontend
* allow plugins to selectively exclude their methods from CSRF checking
2021-02-17 21:44:21 +03:00
0fc783e2b3
cleanup markup in some plugins, make nsfw generate dijit widgets
2021-02-16 22:07:37 +03:00
91e7969383
replace a few more controls to new style
2021-02-16 18:57:06 +03:00
24c79d91c2
controls_compat: comment out most of them
2021-02-16 18:53:56 +03:00
bf88c64d1e
fix floicon not imported from global namespace
2021-02-16 18:14:57 +03:00
9d7ba773ec
move session-related functions to their own namespace
2021-02-16 17:13:16 +03:00
7fad6ce651
move rgb/hsl functions to their own namespace
2021-02-16 17:07:23 +03:00
bdbbdbb0ed
rework controls to accept parameters as array
2021-02-16 16:59:21 +03:00
627af2c236
amend previous to fix actual underlying problem (double escaping)
2021-02-16 15:36:40 +03:00
4f4e57bb26
hidden_tag: temporarily prevent htmlspecialchars() to stop embedded JSON from breaking
2021-02-16 15:27:22 +03:00
af4b3e7df0
login form: use control helpers
2021-02-16 15:05:32 +03:00
d7127cead3
feed debugger: use hidden helpers; add button helpers
2021-02-16 14:42:27 +03:00
26d6b84a57
add namespaced controls with unified naming; deprecated old-style control shortcuts
2021-02-16 14:23:00 +03:00
5d42ce553f
drop legacy DB interface and related sanity checks
2021-02-15 16:55:55 +03:00
9f55454f63
remove the rest of db.php; rename some leftover methods in feeds
2021-02-15 16:51:35 +03:00
cfad740c99
drop legacy db_ functions wrapper
2021-02-15 16:38:18 +03:00
020f062a76
feeds: unify naming
2021-02-15 15:43:07 +03:00
82adb01307
render enclosures on the client
2021-02-15 14:10:46 +03:00
15fd23c374
use shortcut echo syntax for php templates
2021-02-14 09:15:51 +03:00
103d30ad3f
batch subscribe: use client dialog
2021-02-13 22:16:17 +03:00
6af83e3881
drop ENABLE_GZIP_OUTPUT; system prefs: load php info only if needed
2021-02-12 21:43:38 +03:00
119a4226d8
validate_csrf: remove warning
2021-02-12 21:21:23 +03:00
f2d3cba231
add HTTP_ACCEPT_LANGUAGE handling for php8
2021-02-12 21:20:04 +03:00
1f2ba932b8
RIP easy-installer
2021-02-12 15:59:19 +03:00
d23a261b92
RIP self-registration
2021-02-12 15:57:43 +03:00
8f8675a26a
* filters: remove duplicate code, overall cleanup
...
* check if some tres exist before trying to reload them
2021-02-12 14:31:36 +03:00
848bc57f29
disable themes in safe mode; rework safe mode warning/login prompt
2021-02-11 21:19:57 +03:00
cc646790fd
format_backtrace: don't try to use resources as strings
2021-02-11 10:29:42 +03:00
7833760fa0
make feed/cat nested dropdowns a bit more readable
2021-02-10 08:58:31 +03:00
7874f6ac58
remove PHPMD.UnusedFormalParameter
2021-02-08 19:42:10 +03:00
942afb43a1
sanity checks: use better CLI detection, shorten most of the text
2021-02-08 08:49:21 +03:00
10392ecc28
event log: add pagination
2021-02-06 10:10:54 +03:00
8b39e6bca7
_color_pack: define variable before using
2021-02-06 09:29:31 +03:00
a544123b59
fix clean() for arrays and user plugin list
2021-02-06 00:17:41 +03:00
6e774a58fe
more php8 fixes mostly related to login
2021-02-06 00:12:15 +03:00
403dca154c
initial WIP for php8; bump php version requirement to 7.0
2021-02-05 23:41:32 +03:00
33a5ecd2ce
feed editor: show purge interval correctly if FORCE_ARTICLE_PURGE is set
2021-01-07 18:16:42 +03:00
f59c567831
update_rss_feed: fix BLACKLISTED_TAGS not working properly, simplify tag-related code
2020-12-20 23:12:45 +03:00
c68f2aabc9
Make 'ttrss_error_handler' compatible w/ 8.
...
2d467abc46/UPGRADING (L43)2d467abc46/UPGRADING (L63)
2020-12-12 10:28:52 -06:00
936b91a7e6
Don't do deprecated 'libxml_disable_entity_loader(true)' under PHP 8.
...
2d467abc46/UPGRADING (L886)
2020-12-12 10:28:49 -06:00
6bdf4a1a25
Switch to 'get_error_types()' to ensure availability in 'include/functions.php'.
...
The global in 'sanity_check()' was null... possibly due to circular requires?
2020-12-12 10:28:48 -06:00
08a6f6bde2
Only do sanity checks for self URL if we can create a valid URL.
...
'sanity_check.php' gets included in 'update.php' and 'update_daemon2.php', where a Host request header is likely not provided.
2020-12-12 10:28:47 -06:00
65254f5db4
- move sphinx plugin to a separate repo
...
- regenerate config checks without sphinx-related variables
2020-12-11 09:48:34 +03:00
81c52b4b1e
add support for an override stylesheet which applies to all users
2020-11-30 15:53:32 +03:00
24cdacd59e
enable Farsi locale in the UI
2020-10-01 10:19:04 +03:00
8a02a728c8
add DAEMON_UNSUCCESSFUL_DAYS_LIMIT tunable (defaults to 30 days)
2020-09-30 17:03:16 +03:00
da5deaaca1
set session.cookie_lifetime to 0 initially instead of a rather useless min()
2020-09-30 14:43:53 +03:00
de22464ea8
schema: add ttrss_feeds.last_successful_update
2020-09-28 14:14:06 +03:00
215f388992
move timestamp-related stuff to a separate class
2020-09-23 13:04:26 +03:00
74568df4ff
remove a lot of stuff from global context (functions.php), add a few helper classes instead
2020-09-22 09:04:33 +03:00
d04ac399ff
clarify some URL validation-related error messages
2020-09-21 20:37:29 +03:00
3dd4169b5f
clarify some URL validation-related error messages
2020-09-21 20:35:24 +03:00
4785f21316
update_rss_feed: log effective URL after fetching
...
validate_url: treat scheme as case-insensitive
2020-09-21 20:26:57 +03:00
486f1d84ed
resolve_redirects: fix previous
2020-09-20 18:14:34 +03:00
d2867d887a
resolve_redirects: only use three argument version of get_headers() on php 7.1+
2020-09-20 17:27:04 +03:00
03a337a660
add basic safe mode which doesn't load any user plugins
2020-09-18 15:48:22 +03:00
4efc3d7b3f
validate_url: relax requirements for URLs, limit additional port/loopback filtering to fetch_file_contents()
2020-09-17 20:20:23 +03:00
a4525d31b2
replace FALSE with false so that static analyzer shuts up about it
2020-09-17 19:02:27 +03:00
57fac84516
rename gettext.inc to gettext.inc.php (cosmetic)
2020-09-17 18:56:29 +03:00
c25edd0024
fetch_file_contents: validate effective URL (after redirects) without CURL
2020-09-17 16:17:33 +03:00
27e695436f
fetch_file_contents: validate effective URL (after redirects) if using CURL
2020-09-17 15:53:13 +03:00
5a7e7e1367
don't try to call hash_equals() on unset user token
2020-09-17 10:20:55 +03:00
f72e6947d5
use hash_equals() correctly
2020-09-17 10:04:00 +03:00
e3adacc588
fix several cases of Db class being invoked as wrong name (as DB)
2020-09-17 09:18:03 +03:00
16c86e2fc3
replace some plain http links with https
2020-09-17 09:02:30 +03:00
a817d3794d
* use get_random_bytes() for CSRF token
...
* get_random_bytes: use PHP7 random_bytes() if it is available
* validate CSRF token using hash_equals
2020-09-17 08:59:18 +03:00
1f79d614c4
fix OTP QR code not displayed because of CSRF token passed as a query
...
parameter
use type-strict comparison when validating CSRF token on the backend
2020-09-17 08:43:39 +03:00
6a4b6cf603
amend previous to 127/8 subnet
2020-09-17 07:37:48 +03:00
213d6330b1
fetch_file_contents: resolve requested hosts and check for possible
...
loopback address
2020-09-17 07:36:47 +03:00
88c4dc405e
build_url: also put query parameters and fragment in resulting URL
...
rewrite_relative_url: simplify handling of relative URLs
2020-09-16 21:41:05 +03:00
da5af2fae0
cached_url: block SVG images because of potential javascript inside
2020-09-16 16:25:20 +03:00
aeaafefa07
don't pass csrf token as a GET parameter to Article
2020-09-15 16:03:09 +03:00
1621abcffc
rewrite_relative_url: validate resulting absolutized URLs
2020-09-15 10:41:57 +03:00
aa89ea7769
validate_url: only allow safe ports (80, 443), disallow access to loopback
2020-09-15 10:39:09 +03:00
6c02fea641
validate_url: add clean()
2020-09-15 08:45:15 +03:00
4abc7d7898
rename base64_img() to image_to_base64()
2020-09-15 08:05:01 +03:00
1ee458b5c1
cached_url: perform mimetype validation before possible HOOK_SEND_LOCAL_FILE hooks
2020-09-15 07:54:46 +03:00
b4cb67e77f
remove csrf token from rpc method sanityCheck
2020-09-14 20:00:01 +03:00
c3d14e1fa5
- fix multiple vulnerabilities in af_proxy_http
...
- fix vulnerability in rewrite_relative_url() which prevented some URLs from being properly absolutized
- fetch_file_contents: validate all URLs before requesting them
- validate URLs: explicitly whitelist http and https scheme, forbid everything else
- DiskCache/cached_url: only serve whitelisted content types (images, video)
- simplify filename/URL handling code, remove and consolidate some less-used functions
2020-09-14 19:46:52 +03:00
376dce02bb
Update wiki and forums links in error message.
2020-07-13 09:06:59 -05:00
6eb94f1e13
better support for image srcset attributes as discussed in https://community.tt-rss.org/t/problem-with-img-srcset/3519
2020-06-15 11:58:59 +03:00
19893d33e3
only bind up/down in 3 panel mode
2020-05-23 08:53:18 +03:00
ebb373987a
Revert "unbind up/down by default (use native scrolling for consistency with pgup/pgdn)"
...
This reverts commit 6fc18e450b
2020-05-23 08:39:44 +03:00
6fc18e450b
unbind up/down by default (use native scrolling for consistency with pgup/pgdn)
2020-05-23 08:38:03 +03:00
9ae9302b6b
implement keyboard-related changes discussed in https://community.tt-rss.org/t/changing-the-amount-of-scroll-by-arrow-key/3452/7
2020-05-17 08:25:51 +03:00
7a0ea9d90e
Make iframes size responsively.
2020-05-15 22:25:56 -04:00
2b55afbeec
sanitize: forbid "allow" attribute
...
CSS: remove auto hyphens stuff, remove iframe width clipping to 98% because they get squished
2020-05-09 12:49:19 +03:00
2558fcbe21
add hotkey "\" to cancel current search
2020-05-09 07:56:06 +03:00
e934e9f05e
sanitize: simplify initial attribute processing
2020-04-29 19:12:29 +03:00
7d9dd51cf4
sanitize: remove srcset plain-http hack, globally disallow width and height attributes for all elements
2020-04-29 19:04:34 +03:00
83c8834421
sanitize: handle picture[@srcset] elements properly, i.e. rewrite relative URLs
2020-04-29 19:02:44 +03:00
1ad43dd202
Fix documentation for _noexpand commands
2020-03-25 20:30:34 +00:00
569228a5df
In get_version() disable DIRECTORY_SEPARATOR check, permit using git on Windows to get version details;
2020-03-02 11:28:21 -06:00
wn_
Andrew Dolgov
Rodney Stromlund
JustAMacUser
Martin Stone
Toby Simmons