]> git.wh0rd.org - tt-rss.git/blob - api/index.php
api/login: properly return LOGIN_ERROR when passed an invalid username
[tt-rss.git] / api / index.php
1 <?php
2 error_reporting(E_ERROR | E_PARSE);
3
4 require_once "../config.php";
5
6 require_once "../db.php";
7 require_once "../db-prefs.php";
8 require_once "../functions.php";
9
10 define('API_STATUS_OK', 0);
11 define('API_STATUS_ERR', 1);
12
13 if (defined('ENABLE_GZIP_OUTPUT') && ENABLE_GZIP_OUTPUT) {
14 ob_start("ob_gzhandler");
15 }
16
17 $link = db_connect(DB_HOST, DB_USER, DB_PASS, DB_NAME);
18
19 $session_expire = SESSION_EXPIRE_TIME; //seconds
20 $session_name = (!defined('TTRSS_SESSION_NAME')) ? "ttrss_sid_api" : TTRSS_SESSION_NAME . "_api";
21
22 session_name($session_name);
23
24 if ($_REQUEST["sid"]) {
25 session_id($_REQUEST["sid"]);
26 }
27
28 session_start();
29
30 if (!$link) {
31 if (DB_TYPE == "mysql") {
32 print mysql_error();
33 }
34 // PG seems to display its own errors just fine by default.
35 return;
36 }
37
38 init_connection($link);
39
40 $op = db_escape_string($_REQUEST["op"]);
41 $seq = (int) $_REQUEST["seq"];
42
43 // header("Content-Type: application/json");
44
45 function api_wrap_reply($status, $seq, $reply) {
46 print json_encode(array("seq" => $seq,
47 "status" => $status,
48 "content" => $reply));
49 }
50
51 if (!$_SESSION["uid"] && $op != "login" && $op != "isLoggedIn") {
52 print api_wrap_reply(API_STATUS_ERR, $seq, array("error" => 'NOT_LOGGED_IN'));
53 return;
54 }
55
56 if ($_SESSION["uid"] && $op != "logout" && !get_pref($link, 'ENABLE_API_ACCESS')) {
57 print api_wrap_reply(API_STATUS_ERR, $seq, array("error" => 'API_DISABLED'));
58 return;
59 }
60
61 switch ($op) {
62
63 case "getVersion":
64 $rv = array("version" => VERSION);
65 print api_wrap_reply(API_STATUS_OK, $seq, $rv);
66 break;
67
68 case "login":
69 $login = db_escape_string($_REQUEST["user"]);
70 $password = db_escape_string($_REQUEST["password"]);
71 $password_base64 = db_escape_string(base64_decode($_REQUEST["password"]));
72
73 if (SINGLE_USER_MODE) $login = "admin";
74
75 $result = db_query($link, "SELECT id FROM ttrss_users WHERE login = '$login'");
76
77 if (db_num_rows($result) != 0) {
78 $uid = db_fetch_result($result, 0, "id");
79 } else {
80 $uid = 0;
81 }
82
83 if (!$uid) {
84 print api_wrap_reply(API_STATUS_ERR, $seq,
85 array("error" => "LOGIN_ERROR"));
86 return;
87 }
88
89 if (get_pref($link, "ENABLE_API_ACCESS", $uid)) {
90 if (authenticate_user($link, $login, $password)) { // try login with normal password
91 print api_wrap_reply(API_STATUS_OK, $seq,
92 array("session_id" => session_id()));
93 } else if (authenticate_user($link, $login, $password_base64)) { // else try with base64_decoded password
94 print api_wrap_reply(API_STATUS_OK, $seq,
95 array("session_id" => session_id()));
96 } else { // else we are not logged in
97 print api_wrap_reply(API_STATUS_ERR, $seq,
98 array("error" => "LOGIN_ERROR"));
99 }
100 } else {
101 print api_wrap_reply(API_STATUS_ERR, $seq,
102 array("error" => "API_DISABLED"));
103 }
104
105 break;
106
107 case "logout":
108 logout_user();
109 print api_wrap_reply(API_STATUS_OK, $seq, array("status" => "OK"));
110 break;
111
112 case "isLoggedIn":
113 print api_wrap_reply(API_STATUS_OK, $seq,
114 array("status" => $_SESSION["uid"] != ''));
115 break;
116
117 case "getUnread":
118 $feed_id = db_escape_string($_REQUEST["feed_id"]);
119 $is_cat = db_escape_string($_REQUEST["is_cat"]);
120
121 if ($feed_id) {
122 print api_wrap_reply(API_STATUS_OK, $seq,
123 array("unread" => getFeedUnread($link, $feed_id, $is_cat)));
124 } else {
125 print api_wrap_reply(API_STATUS_OK, $seq,
126 array("unread" => getGlobalUnread($link)));
127 }
128 break;
129
130 /* Method added for ttrss-reader for Android */
131 case "getCounters":
132
133 /* flct (flc is the default) FIXME: document */
134 $output_mode = db_escape_string($_REQUEST["output_mode"]);
135
136 print api_wrap_reply(API_STATUS_OK, $seq,
137 getAllCounters($link, $output_mode));
138 break;
139
140 case "getFeeds":
141 $cat_id = db_escape_string($_REQUEST["cat_id"]);
142 $unread_only = (bool)db_escape_string($_REQUEST["unread_only"]);
143 $limit = (int) db_escape_string($_REQUEST["limit"]);
144 $offset = (int) db_escape_string($_REQUEST["offset"]);
145
146 chdir(".."); // so feed_has_icon() would work properly for relative ICONS_DIR
147
148 $feeds = api_get_feeds($link, $cat_id, $unread_only, $limit, $offset);
149
150 print api_wrap_reply(API_STATUS_OK, $seq, $feeds);
151
152 break;
153
154 case "getCategories":
155 $unread_only = (bool)db_escape_string($_REQUEST["unread_only"]);
156
157 $result = db_query($link, "SELECT
158 id, title FROM ttrss_feed_categories
159 WHERE owner_uid = " .
160 $_SESSION["uid"]);
161
162 $cats = array();
163
164 while ($line = db_fetch_assoc($result)) {
165 $unread = getFeedUnread($link, $line["id"], true);
166
167 if ($unread || !$unread_only) {
168 array_push($cats, array("id" => $line["id"],
169 "title" => $line["title"],
170 "unread" => $unread));
171 }
172 }
173
174 print api_wrap_reply(API_STATUS_OK, $seq, $cats);
175 break;
176
177 case "getHeadlines":
178 $feed_id = db_escape_string($_REQUEST["feed_id"]);
179 $limit = (int)db_escape_string($_REQUEST["limit"]);
180 $offset = (int)db_escape_string($_REQUEST["skip"]);
181 $filter = db_escape_string($_REQUEST["filter"]);
182 $is_cat = (bool)db_escape_string($_REQUEST["is_cat"]);
183 $show_excerpt = (bool)db_escape_string($_REQUEST["show_excerpt"]);
184 $show_content = (bool)db_escape_string($_REQUEST["show_content"]);
185 /* all_articles, unread, adaptive, marked, updated */
186 $view_mode = db_escape_string($_REQUEST["view_mode"]);
187
188 $headlines = api_get_headlines($link, $feed_id, $limit, $offset,
189 $filter, $is_cat, $show_excerpt, $show_content, $view_mode, false);
190
191 print api_wrap_reply(API_STATUS_OK, $seq, $headlines);
192
193 break;
194
195 case "updateArticle":
196 $article_ids = split(",", db_escape_string($_REQUEST["article_ids"]));
197 $mode = (int) db_escape_string($_REQUEST["mode"]);
198 $field_raw = (int)db_escape_string($_REQUEST["field"]);
199
200 $field = "";
201 $set_to = "";
202
203 switch ($field_raw) {
204 case 0:
205 $field = "marked";
206 break;
207 case 1:
208 $field = "published";
209 break;
210 case 2:
211 $field = "unread";
212 break;
213 };
214
215 switch ($mode) {
216 case 1:
217 $set_to = "true";
218 break;
219 case 0:
220 $set_to = "false";
221 break;
222 case 2:
223 $set_to = "NOT $field";
224 break;
225 }
226
227 if ($field && $set_to && count($article_ids) > 0) {
228
229 $article_ids = join(", ", $article_ids);
230
231 if ($field == "unread") {
232 $result = db_query($link, "UPDATE ttrss_user_entries SET $field = $set_to,
233 last_read = NOW()
234 WHERE ref_id IN ($article_ids) AND owner_uid = " . $_SESSION["uid"]);
235 } else {
236 $result = db_query($link, "UPDATE ttrss_user_entries SET $field = $set_to
237 WHERE ref_id IN ($article_ids) AND owner_uid = " . $_SESSION["uid"]);
238 }
239
240 $num_updated = db_affected_rows($link, $result);
241
242 if ($num_updated > 0 && $field == "unread") {
243 $result = db_query($link, "SELECT DISTINCT feed_id FROM ttrss_user_entries
244 WHERE ref_id IN ($article_ids)");
245
246 while ($line = db_fetch_assoc($result)) {
247 ccache_update($link, $line["feed_id"], $_SESSION["uid"]);
248 }
249 }
250
251 print api_wrap_reply(API_STATUS_OK, $seq, array("status" => "OK",
252 "updated" => $num_updated));
253
254 } else {
255 print api_wrap_reply(API_STATUS_ERR, $seq,
256 array("error" => 'INCORRECT_USAGE'));
257 }
258
259 break;
260
261 case "getArticle":
262
263 $article_id = db_escape_string($_REQUEST["article_id"]);
264
265 $query = "SELECT id,title,link,content,feed_id,comments,int_id,
266 marked,unread,published,
267 ".SUBSTRING_FOR_DATE."(updated,1,16) as updated,
268 author
269 FROM ttrss_entries,ttrss_user_entries
270 WHERE id IN ($article_id) AND ref_id = id AND owner_uid = " .
271 $_SESSION["uid"] ;
272
273 $result = db_query($link, $query);
274
275 $articles = array();
276
277 if (db_num_rows($result) != 0) {
278
279 while ($line = db_fetch_assoc($result)) {
280
281 $attachments = get_article_enclosures($link, $line['id']);
282
283 $article = array(
284 "id" => $line["id"],
285 "title" => $line["title"],
286 "link" => $line["link"],
287 "labels" => get_article_labels($link, $line['id']),
288 "unread" => sql_bool_to_bool($line["unread"]),
289 "marked" => sql_bool_to_bool($line["marked"]),
290 "published" => sql_bool_to_bool($line["published"]),
291 "comments" => $line["comments"],
292 "author" => $line["author"],
293 "updated" => strtotime($line["updated"]),
294 "content" => $line["content"],
295 "feed_id" => $line["feed_id"],
296 "attachments" => $attachments
297 );
298
299 array_push($articles, $article);
300
301 }
302 }
303
304 print api_wrap_reply(API_STATUS_OK, $seq, $articles);
305
306 break;
307
308 case "getConfig":
309 $config = array(
310 "icons_dir" => ICONS_DIR,
311 "icons_url" => ICONS_URL);
312
313 $config["daemon_is_running"] = file_is_locked("update_daemon.lock");
314
315 $result = db_query($link, "SELECT COUNT(*) AS cf FROM
316 ttrss_feeds WHERE owner_uid = " . $_SESSION["uid"]);
317
318 $num_feeds = db_fetch_result($result, 0, "cf");
319
320 $config["num_feeds"] = (int)$num_feeds;
321
322 print api_wrap_reply(API_STATUS_OK, $seq, $config);
323
324 break;
325
326 case "updateFeed":
327 $feed_id = db_escape_string($_REQUEST["feed_id"]);
328
329 update_rss_feed($link, $feed_id, true);
330
331 print api_wrap_reply(API_STATUS_OK, $seq, array("status" => "OK"));
332
333 break;
334
335 case "catchupFeed":
336 $feed_id = db_escape_string($_REQUEST["feed_id"]);
337 $is_cat = db_escape_string($_REQUEST["is_cat"]);
338
339 catchup_feed($link, $feed_id, $is_cat);
340
341 print api_wrap_reply(API_STATUS_OK, $seq, array("status" => "OK"));
342
343 break;
344
345 case "getPref":
346 $pref_name = db_escape_string($_REQUEST["pref_name"]);
347
348 print api_wrap_reply(API_STATUS_OK, $seq,
349 array("value" => get_pref($link, $pref_name)));
350 break;
351
352 /* Method added for ttrss-reader for Android */
353 case "getArticles":
354 $isCategory = (int)db_escape_string($_REQUEST["is_cat"]);
355 $id = (int)db_escape_string($_REQUEST["id"]);
356 $displayUnread = (int)db_escape_string($_REQUEST["unread"]);
357 $limit = (int)db_escape_string($_REQUEST["limit"]);
358 $feeds = array();
359
360 if ($isCategory > 0) {
361 // Get Feeds of the category
362
363 if ($id == 0) {
364 $category_part = "cat_id is NULL";
365 } else {
366 $category_part = "cat_id = '$id'";
367 }
368
369 $result = db_query($link, "SELECT id FROM ttrss_feeds WHERE ".
370 $category_part." AND owner_uid = '".$_SESSION["uid"]."'");
371
372 while ($line = db_fetch_assoc($result)) {
373 array_push($feeds, $line["id"]);
374 }
375
376 // Virtual feeds
377 $match_part = "";
378 if ($id == -1) {
379 $match_part = "marked = true";
380 array_push($feeds, -1);
381 } else if ($id == -2) {
382 $match_part = "published = true";
383 array_push($feeds, -2);
384 } else if ($id == -3) {
385 $match_part = "unread = true";
386 array_push($feeds, -3);
387
388 $intl = get_pref($link, "FRESH_ARTICLE_MAX_AGE", $owner_uid);
389
390 if (DB_TYPE == "pgsql") {
391 $match_part .= " AND updated > NOW() - INTERVAL '$intl hour' ";
392 } else {
393 $match_part .= " AND updated > DATE_SUB(NOW(), INTERVAL $intl HOUR) ";
394 }
395 } else if ($id == -4) {
396 $match_part = "true";
397 array_push($feeds, -4);
398 }
399 } else {
400 // Only add one feed
401 array_push($feeds, $id);
402 }
403
404 $ret = array();
405
406 if (DB_TYPE == "mysql") {
407 $limit_part = " LIMIT 0,".$limit;
408 } else if (DB_TYPE == "pgsql") {
409 $limit_part = " LIMIT ".$limit;
410 } else {
411 $limit_part = "";
412 }
413
414 // Fetch articles for the feeds
415 foreach ($feeds as $feed) {
416
417 if ($match_part) {
418 $from_qpart = "ttrss_user_entries,ttrss_feeds,ttrss_entries";
419 $feeds_qpart = "ttrss_user_entries.feed_id = ttrss_feeds.id AND";
420
421 $query = "SELECT ttrss_entries.id,ttrss_entries.title,link,content,feed_id,comments,int_id,
422 marked,unread,published,".SUBSTRING_FOR_DATE."(updated,1,16) as updated,author
423 FROM $from_qpart WHERE
424 ttrss_user_entries.ref_id = ttrss_entries.id AND
425 $feeds_qpart ($match_part) AND ttrss_user_entries.owner_uid = ".$_SESSION["uid"]." ORDER BY updated DESC".$limit_part;
426
427 $result = db_query($link, $query);
428 } else {
429 $query = "SELECT ttrss_entries.id,ttrss_entries.title,link,content,feed_id,comments,int_id,
430 marked,unread,published,".SUBSTRING_FOR_DATE."(updated,1,16) as updated,author
431 FROM ttrss_entries,ttrss_user_entries
432 WHERE feed_id = '".$feed."' AND ref_id = id AND owner_uid = ".
433 $_SESSION["uid"]." AND unread >= '".$displayUnread."' ORDER BY updated DESC".$limit_part;
434
435 $result = db_query($link, $query);
436 }
437
438 $articles = array();
439 $i=0;
440 while ($i < mysql_numrows($result)) {
441
442 $article_id = db_fetch_result($result, $i, "id");
443
444 $attachments = get_article_enclosures($link, $article_id);
445
446 $article = array(
447 "id" => db_fetch_result($result, $i, "ttrss_entries.id"),
448 "title" => db_fetch_result($result, $i, "ttrss_entries.title"),
449 "link" => db_fetch_result($result, $i, "link"),
450 "labels" => get_article_labels($link, $article_id),
451 "unread" => sql_bool_to_bool(db_fetch_result($result, $i, "unread")),
452 "marked" => sql_bool_to_bool(db_fetch_result($result, $i, "marked")),
453 "published" => sql_bool_to_bool(db_fetch_result($result, $i, "published")),
454 "comments" => db_fetch_result($result, $i, "comments"),
455 "author" => db_fetch_result($result, $i, "author"),
456 "updated" => strtotime(db_fetch_result($result, $i, "updated")),
457 "content" => db_fetch_result($result, $i, "content"),
458 "feed_id" => db_fetch_result($result, $i, "feed_id"),
459 "attachments" => $attachments
460 );
461
462 array_push($ret, $article);
463
464 $i++;
465 }
466 }
467
468 print api_wrap_reply(API_STATUS_OK, $seq, $ret);
469 break;
470
471 /* Method added for ttrss-reader for Android */
472 case "getNewArticles":
473 $time = (int) db_escape_string($_REQUEST["time"]);
474 // unread=1 zeigt alle an, unread=0 nur ungelesene
475 $displayUnread = (int) db_escape_string($_REQUEST["unread"]);
476
477 if (DB_TYPE == "mysql") {
478 $db_time_function = " AND last_updated > FROM_UNIXTIME(".$time.")";
479 } else if (DB_TYPE == "pgsql") {
480 $db_time_function = " AND last_updated > to_timestamp(".$time.")";
481 } else {
482 $db_time_function = "";
483 }
484
485 if (DB_TYPE == "mysql") {
486 $db_time_function2 = " AND updated > FROM_UNIXTIME(".$time.")";
487 } else if (DB_TYPE == "pgsql") {
488 $db_time_function2 = " AND updated > to_timestamp(".$time.")";
489 } else {
490 $db_time_function2 = "";
491 }
492
493 $cats = array();
494
495
496 // Add uncategorized feeds
497 $unread = getFeedUnread($link, 0, true);
498 if ($unread || $displayUnread > 0) {
499 $feeds = array();
500 $result_0 = db_query($link, "SELECT id, feed_url, cat_id, title, ".
501 SUBSTRING_FOR_DATE."(last_updated,1,19) AS last_updated ".
502 "FROM ttrss_feeds WHERE cat_id IS null AND owner_uid = '".$_SESSION["uid"]."'" . $db_time_function);
503
504 while ($line_feeds = db_fetch_assoc($result_0)) {
505 $unread_feed = getFeedUnread($link, $line_feeds["id"], false);
506 if ($unread || $displayUnread > 0) {
507
508 $result_1 = db_query($link, "SELECT id,title,link,content,feed_id,comments,int_id,
509 marked,unread,published,".
510 SUBSTRING_FOR_DATE."(updated,1,16) as updated,author
511 FROM ttrss_entries,ttrss_user_entries
512 WHERE feed_id = '".$line_feeds["id"]."' AND ref_id = id AND owner_uid = " .
513 $_SESSION["uid"]." AND unread >= '".$displayUnread."'" . $db_time_function2);
514
515 $articles = array();
516 while ($line_articles = db_fetch_assoc($result_1)) {
517 $article_id = db_fetch_result($result, $i, "id");
518 $attachments = get_article_enclosures($link, $article_id);
519 array_push($articles, $article = array(
520 "id" => $line_articles["id"],
521 "title" => $line_articles["title"],
522 "link" => $line_articles["link"],
523 "labels" => $article_id,
524 "unread" => $line_articles["unread"],
525 "marked" => $line_articles["marked"],
526 "published" => $line_articles["published"],
527 "comments" => $line_articles["comments"],
528 "author" => $line_articles["author"],
529 "updated" => strtotime($line_articles["updated"]),
530 "content" => $line_articles["content"],
531 "feed_id" => $line_articles["feed_id"],
532 "attachments" => $attachments));
533 }
534
535 array_push($feeds, array(
536 "feed_url" => $line_feeds["feed_url"],
537 "title" => $line_feeds["title"],
538 "id" => (int)$line_feeds["id"],
539 "unread" => (int)$unread_feed,
540 "has_icon" => $has_icon,
541 "cat_id" => (int)$line_feeds["cat_id"],
542 "last_updated" => strtotime($line_feeds["last_updated"]),
543 "articles" => $articles
544 ));
545 }
546 }
547
548 array_push($cats,
549 array(
550 "id" => 0,
551 "title" => "Uncategorized Feeds",
552 "unread" => $unread,
553 "feeds" => $feeds));
554 }
555
556
557 $result = db_query($link, "SELECT id, title FROM ttrss_feed_categories WHERE owner_uid = " . $_SESSION["uid"]);
558 while ($line = db_fetch_assoc($result)) {
559 $unread = getFeedUnread($link, $line["id"], true);
560
561 if ($unread || $displayUnread > 0) {
562 $feeds = array();
563 $result_0 = db_query($link, "SELECT id, feed_url, cat_id, title, ".
564 SUBSTRING_FOR_DATE."(last_updated,1,19) AS last_updated ".
565 "FROM ttrss_feeds WHERE cat_id = '".
566 $line["id"]."' AND owner_uid = '".$_SESSION["uid"]."'" . $db_time_function);
567
568 while ($line_feeds = db_fetch_assoc($result_0)) {
569 $unread_feed = getFeedUnread($link, $line_feeds["id"], false);
570 if ($unread_feed || $displayUnread > 0) {
571
572 $result_1 = db_query($link, "SELECT id,title,link,content,feed_id,comments,int_id,
573 marked,unread,published,".
574 SUBSTRING_FOR_DATE."(updated,1,16) as updated,author
575 FROM ttrss_entries,ttrss_user_entries
576 WHERE feed_id = '".$line_feeds["id"]."' AND ref_id = id AND owner_uid = " .
577 $_SESSION["uid"]." AND unread >= '".$displayUnread."'" . $db_time_function2);
578
579 $articles = array();
580 while ($line_articles = db_fetch_assoc($result_1)) {
581 $article_id = db_fetch_result($result, $i, "id");
582 $attachments = get_article_enclosures($link, $article_id);
583 array_push($articles, $article = array(
584 "id" => $line_articles["id"],
585 "title" => $line_articles["title"],
586 "link" => $line_articles["link"],
587 "labels" => $article_id,
588 "unread" => $line_articles["unread"],
589 "marked" => $line_articles["marked"],
590 "published" => $line_articles["published"],
591 "comments" => $line_articles["comments"],
592 "author" => $line_articles["author"],
593 "updated" => strtotime($line_articles["updated"]),
594 "content" => $line_articles["content"],
595 "feed_id" => $line_articles["feed_id"],
596 "attachments" => $attachments));
597 }
598
599 array_push($feeds, array(
600 "feed_url" => $line_feeds["feed_url"],
601 "title" => $line_feeds["title"],
602 "id" => (int)$line_feeds["id"],
603 "unread" => (int)$unread_feed,
604 "cat_id" => (int)$line_feeds["cat_id"],
605 "last_updated" => strtotime($line_feeds["last_updated"]),
606 "articles" => $articles
607 ));
608
609 }
610 }
611
612 array_push($cats,
613 array(
614 "id" => $line["id"],
615 "title" => $line["title"],
616 "unread" => $unread,
617 "feeds" => $feeds));
618 }
619 }
620 print api_wrap_reply(API_STATUS_OK, $seq, $cats);
621 break;
622
623 default:
624 print api_wrap_reply(API_STATUS_ERR, $seq,
625 array("error" => 'UNKNOWN_METHOD'));
626 break;
627
628 }
629
630 db_close($link);
631
632 ?>