]> git.wh0rd.org Git - tt-rss.git/blob - backend.php
1d8a99bdd68199b00ac29a316b09aacdf0bcc579
[tt-rss.git] / backend.php
1 <?php
2         /* remove ill effects of magic quotes */
3
4         if (get_magic_quotes_gpc()) {
5                 function stripslashes_deep($value) {
6                         $value = is_array($value) ?
7                                 array_map('stripslashes_deep', $value) : stripslashes($value);
8                                 return $value;
9                 }
10
11                 $_POST = array_map('stripslashes_deep', $_POST);
12                 $_GET = array_map('stripslashes_deep', $_GET);
13                 $_COOKIE = array_map('stripslashes_deep', $_COOKIE);
14                 $_REQUEST = array_map('stripslashes_deep', $_REQUEST);
15         }
16
17         $op = $_REQUEST["op"];
18
19         require_once "functions.php";
20         if ($op != "share") require_once "sessions.php";
21         require_once "modules/backend-rpc.php";
22         require_once "sanity_check.php";
23         require_once "config.php";
24         require_once "db.php";
25         require_once "db-prefs.php";
26
27         no_cache_incantation();
28
29         startup_gettext();
30
31         $script_started = getmicrotime();
32
33         $link = db_connect(DB_HOST, DB_USER, DB_PASS, DB_NAME);
34
35         if (!$link) {
36                 if (DB_TYPE == "mysql") {
37                         print mysql_error();
38                 }
39                 // PG seems to display its own errors just fine by default.
40                 return;
41         }
42
43         init_connection($link);
44
45         $subop = $_REQUEST["subop"];
46         $mode = $_REQUEST["mode"];
47
48         if ((!$op || $op == "rss" || $op == "dlg") && !$_REQUEST["noxml"]) {
49                         header("Content-Type: application/xml; charset=utf-8");
50         } else {
51                         header("Content-Type: text/plain; charset=utf-8");
52         }
53
54         if (ENABLE_GZIP_OUTPUT) {
55                 ob_start("ob_gzhandler");
56         }
57
58         if (SINGLE_USER_MODE) {
59                 authenticate_user($link, "admin", null);
60         }
61
62         if (!($_SESSION["uid"] && validate_session($link)) && $op != "globalUpdateFeeds" &&
63                         $op != "rss" && $op != "getUnread" && $op != "getProfiles" && $op != "share" &&
64                         $op != "fbexport" && $op != "logout" && $op != "pubsub") {
65
66                 if ($op == 'pref-feeds' && $_REQUEST['subop'] == 'add') {
67                         header("Content-Type: text/html");
68                         login_sequence($link);
69                         render_login_form($link);
70                 } else {
71                         header("Content-Type: text/plain");
72                         print json_encode(array("error" => array("code" => 6)));
73                 }
74                 return;
75         }
76
77         $purge_intervals = array(
78                 0  => __("Use default"),
79                 -1 => __("Never purge"),
80                 5  => __("1 week old"),
81                 14 => __("2 weeks old"),
82                 31 => __("1 month old"),
83                 60 => __("2 months old"),
84                 90 => __("3 months old"));
85
86         $update_intervals = array(
87                 0   => __("Default interval"),
88                 -1  => __("Disable updates"),
89                 15  => __("Each 15 minutes"),
90                 30  => __("Each 30 minutes"),
91                 60  => __("Hourly"),
92                 240 => __("Each 4 hours"),
93                 720 => __("Each 12 hours"),
94                 1440 => __("Daily"),
95                 10080 => __("Weekly"));
96
97         $update_intervals_nodefault = array(
98                 -1  => __("Disable updates"),
99                 15  => __("Each 15 minutes"),
100                 30  => __("Each 30 minutes"),
101                 60  => __("Hourly"),
102                 240 => __("Each 4 hours"),
103                 720 => __("Each 12 hours"),
104                 1440 => __("Daily"),
105                 10080 => __("Weekly"));
106
107         $update_methods = array(
108                 0   => __("Default"),
109                 1   => __("Magpie"),
110                 2   => __("SimplePie"),
111                 3   => __("Twitter OAuth"));
112
113         if (DEFAULT_UPDATE_METHOD == "1") {
114                 $update_methods[0] .= ' (SimplePie)';
115         } else {
116                 $update_methods[0] .= ' (Magpie)';
117         }
118
119         $access_level_names = array(
120                 0 => __("User"),
121                 5 => __("Power User"),
122                 10 => __("Administrator"));
123
124         require_once "modules/pref-prefs.php";
125         require_once "modules/popup-dialog.php";
126         require_once "modules/help.php";
127         require_once "modules/pref-feeds.php";
128         require_once "modules/pref-filters.php";
129         require_once "modules/pref-labels.php";
130         require_once "modules/pref-users.php";
131         require_once "modules/pref-instances.php";
132
133         $error = sanity_check($link);
134
135         if ($error['code'] != 0 && $op != "logout") {
136                 print json_encode(array("error" => $error));
137                 return;
138         }
139
140         switch($op) { // Select action according to $op value.
141                 case "rpc":
142                         // Handle remote procedure calls.
143                         handle_rpc_request($link);
144                 break; // rpc
145
146                 case "feeds":
147                         $subop = $_REQUEST["subop"];
148                         $root = (bool)$_REQUEST["root"];
149
150                         switch($subop) {
151                                 case "catchupAll":
152                                         db_query($link, "UPDATE ttrss_user_entries SET
153                                                 last_read = NOW(),unread = false WHERE owner_uid = " . $_SESSION["uid"]);
154                                         ccache_zero_all($link, $_SESSION["uid"]);
155
156                                 break;
157
158                                 case "collapse":
159                                         $cat_id = db_escape_string($_REQUEST["cid"]);
160                                         $mode = (int) db_escape_string($_REQUEST['mode']);
161                                         toggle_collapse_cat($link, $cat_id, $mode);
162                                         return;
163                                 break;
164                         }
165
166                         if (!$root) {
167                                 print json_encode(outputFeedList($link));
168                         } else {
169
170                                 $feeds = outputFeedList($link, false);
171
172                                 $root = array();
173                                 $root['id'] = 'root';
174                                 $root['name'] = __('Feeds');
175                                 $root['items'] = $feeds['items'];
176
177                                 $fl = array();
178                                 $fl['identifier'] = 'id';
179                                 $fl['label'] = 'name';
180                                 $fl['items'] = array($root);
181
182                                 print json_encode($fl);
183                         }
184
185                 break; // feeds
186
187                 case "la":
188                         $id = db_escape_string($_REQUEST['id']);
189
190                         $result = db_query($link, "SELECT link FROM ttrss_entries, ttrss_user_entries
191                                 WHERE id = '$id' AND id = ref_id AND owner_uid = '".$_SESSION['uid']."'
192                                 LIMIT 1");
193
194                         if (db_num_rows($result) == 1) {
195                                 $article_url = db_fetch_result($result, 0, 'link');
196                                 $article_url = str_replace("\n", "", $article_url);
197
198                                 header("Location: $article_url");
199                                 return;
200
201                         } else {
202                                 print_error(__("Article not found."));
203                         }
204                 break;
205
206                 case "view":
207
208                         $id = db_escape_string($_REQUEST["id"]);
209                         $cids = explode(",", db_escape_string($_REQUEST["cids"]));
210                         $mode = db_escape_string($_REQUEST["mode"]);
211                         $omode = db_escape_string($_REQUEST["omode"]);
212
213                         // in prefetch mode we only output requested cids, main article
214                         // just gets marked as read (it already exists in client cache)
215
216                         $articles = array();
217
218                         if ($mode == "") {
219                                 array_push($articles, format_article($link, $id, false));
220                         } else if ($mode == "zoom") {
221                                 array_push($articles, format_article($link, $id, true, true));
222                         } else if ($mode == "raw") {
223                                 if ($_REQUEST['html']) {
224                                         header("Content-Type: text/html");
225                                         print '<link rel="stylesheet" type="text/css" href="tt-rss.css"/>';
226                                 }
227
228                                 $article = format_article($link, $id, false);
229                                 print $article['content'];
230                                 return;
231                         }
232
233                         catchupArticleById($link, $id, 0);
234
235                         if (!$_SESSION["bw_limit"]) {
236                                 foreach ($cids as $cid) {
237                                         if ($cid) {
238                                                 array_push($articles, format_article($link, $cid, false, false));
239                                         }
240                                 }
241                         }
242
243                         print json_encode($articles);
244
245                 break; // view
246
247                 case "viewfeed":
248
249                         $timing_info = getmicrotime();
250
251                         $reply = array();
252
253                         if ($_REQUEST["debug"]) $timing_info = print_checkpoint("0", $timing_info);
254
255                         $omode = db_escape_string($_REQUEST["omode"]);
256
257                         $feed = db_escape_string($_REQUEST["feed"]);
258                         $subop = db_escape_string($_REQUEST["subop"]);
259                         $view_mode = db_escape_string($_REQUEST["view_mode"]);
260                         $limit = (int) get_pref($link, "DEFAULT_ARTICLE_LIMIT");
261                         @$cat_view = db_escape_string($_REQUEST["cat"]) == "true";
262                         @$next_unread_feed = db_escape_string($_REQUEST["nuf"]);
263                         @$offset = db_escape_string($_REQUEST["skip"]);
264                         @$vgroup_last_feed = db_escape_string($_REQUEST["vgrlf"]);
265                         $order_by = db_escape_string($_REQUEST["order_by"]);
266
267                         if (is_numeric($feed)) $feed = (int) $feed;
268
269                         /* Feed -5 is a special case: it is used to display auxiliary information
270                          * when there's nothing to load - e.g. no stuff in fresh feed */
271
272                         if ($feed == -5) {
273                                 print json_encode(generate_dashboard_feed($link));
274                                 return;
275                         }
276
277                         $result = false;
278
279                         if ($feed < -10) {
280                                 $label_feed = -11-$feed;
281                                 $result = db_query($link, "SELECT id FROM ttrss_labels2 WHERE
282                                         id = '$label_feed' AND owner_uid = " . $_SESSION['uid']);
283                         } else if (!$cat_view && is_numeric($feed) && $feed > 0) {
284                                 $result = db_query($link, "SELECT id FROM ttrss_feeds WHERE
285                                         id = '$feed' AND owner_uid = " . $_SESSION['uid']);
286                         } else if ($cat_view && is_numeric($feed) && $feed > 0) {
287                                 $result = db_query($link, "SELECT id FROM ttrss_feed_categories WHERE
288                                         id = '$feed' AND owner_uid = " . $_SESSION['uid']);
289                         }
290
291                         if ($result && db_num_rows($result) == 0) {
292                                 print json_encode(generate_error_feed($link, __("Feed not found.")));
293                                 return;
294                         }
295
296                         /* Updating a label ccache means recalculating all of the caches
297                          * so for performance reasons we don't do that here */
298
299                         if ($feed >= 0) {
300                                 ccache_update($link, $feed, $_SESSION["uid"], $cat_view);
301                         }
302
303                         set_pref($link, "_DEFAULT_VIEW_MODE", $view_mode);
304                         set_pref($link, "_DEFAULT_VIEW_LIMIT", $limit);
305                         set_pref($link, "_DEFAULT_VIEW_ORDER_BY", $order_by);
306
307                         if (!$cat_view && preg_match("/^[0-9][0-9]*$/", $feed)) {
308                                 db_query($link, "UPDATE ttrss_feeds SET last_viewed = NOW()
309                                         WHERE id = '$feed' AND owner_uid = ".$_SESSION["uid"]);
310                         }
311
312                         $reply['headlines'] = array();
313
314                         if (!$next_unread_feed)
315                                 $reply['headlines']['id'] = $feed;
316                         else
317                                 $reply['headlines']['id'] = $next_unread_feed;
318
319                         $reply['headlines']['is_cat'] = (bool) $cat_view;
320
321                         $override_order = false;
322
323                         if (get_pref($link, "SORT_HEADLINES_BY_FEED_DATE", $owner_uid)) {
324                                 $date_sort_field = "updated";
325                         } else {
326                                 $date_sort_field = "date_entered";
327                         }
328
329                         switch ($order_by) {
330                                 case "date":
331                                         if (get_pref($link, 'REVERSE_HEADLINES', $owner_uid)) {
332                                                 $override_order = "$date_sort_field";
333                                         } else {
334                                                 $override_order = "$date_sort_field DESC";
335                                         }
336                                         break;
337
338                                 case "title":
339                                         if (get_pref($link, 'REVERSE_HEADLINES', $owner_uid)) {
340                                                 $override_order = "title DESC, $date_sort_field";
341                                         } else {
342                                                 $override_order = "title, $date_sort_field DESC";
343                                         }
344                                         break;
345
346                                 case "score":
347                                         if (get_pref($link, 'REVERSE_HEADLINES', $owner_uid)) {
348                                                 $override_order = "score, $date_sort_field";
349                                         } else {
350                                                 $override_order = "score DESC, $date_sort_field DESC";
351                                         }
352                                         break;
353                         }
354
355                         if ($_REQUEST["debug"]) $timing_info = print_checkpoint("04", $timing_info);
356
357                         $ret = format_headlines_list($link, $feed, $subop,
358                                 $view_mode, $limit, $cat_view, $next_unread_feed, $offset,
359                                 $vgroup_last_feed, $override_order);
360
361                         $topmost_article_ids = $ret[0];
362                         $headlines_count = $ret[1];
363                         $returned_feed = $ret[2];
364                         $disable_cache = $ret[3];
365                         $vgroup_last_feed = $ret[4];
366
367 //                      if ($_REQUEST["debug"]) print_r($ret);
368
369                         $reply['headlines']['content'] =& $ret[5]['content'];
370                         $reply['headlines']['toolbar'] =& $ret[5]['toolbar'];
371
372                         if ($_REQUEST["debug"]) $timing_info = print_checkpoint("05", $timing_info);
373
374                         $reply['headlines-info'] = array("count" => (int) $headlines_count,
375                                 "vgroup_last_feed" => $vgroup_last_feed,
376                                 "disable_cache" => (bool) $disable_cache);
377
378                         if ($_REQUEST["debug"]) $timing_info = print_checkpoint("20", $timing_info);
379
380                         if (is_array($topmost_article_ids) && !get_pref($link, 'COMBINED_DISPLAY_MODE') && !$_SESSION["bw_limit"]) {
381                                 $articles = array();
382
383                                 foreach ($topmost_article_ids as $id) {
384                                         array_push($articles, format_article($link, $id, false));
385                                 }
386
387                                 $reply['articles'] = $articles;
388                         }
389
390 //                      if ($subop) {
391 //                              $reply['counters'] = getAllCounters($link, $omode, $feed);
392 //                      }
393
394                         if ($_REQUEST["debug"]) $timing_info = print_checkpoint("30", $timing_info);
395
396                         $reply['runtime-info'] = make_runtime_info($link);
397
398                         print json_encode($reply);
399
400                 break; // viewfeed
401
402                 case "pref-feeds":
403                         module_pref_feeds($link);
404                 break; // pref-feeds
405
406                 case "pref-filters":
407                         module_pref_filters($link);
408                 break; // pref-filters
409
410                 case "pref-labels":
411                         module_pref_labels($link);
412                 break; // pref-labels
413
414                 case "pref-prefs":
415                         module_pref_prefs($link);
416                 break; // pref-prefs
417
418                 case "pref-users":
419                         module_pref_users($link);
420                 break; // prefs-users
421
422                 case "help":
423                         module_help($link);
424                 break; // help
425
426                 case "dlg":
427                         module_popup_dialog($link);
428                 break; // dlg
429
430                 case "pref-pub-items":
431                         module_pref_pub_items($link);
432                 break; // pref-pub-items
433
434                 case "globalUpdateFeeds":
435                         // Update all feeds needing a update.
436                         update_daemon_common($link, 0, true, true);
437                 break; // globalUpdateFeeds
438
439                 case "pref-feed-browser":
440                         module_pref_feed_browser($link);
441                 break; // pref-feed-browser
442
443                 case "pref-instances":
444                         module_pref_instances($link);
445                 break; // pref-instances
446
447                 case "rss":
448                         $feed = db_escape_string($_REQUEST["id"]);
449                         $key = db_escape_string($_REQUEST["key"]);
450                         $is_cat = $_REQUEST["is_cat"] != false;
451                         $limit = (int)db_escape_string($_REQUEST["limit"]);
452
453                         $search = db_escape_string($_REQUEST["q"]);
454                         $match_on = db_escape_string($_REQUEST["m"]);
455                         $search_mode = db_escape_string($_REQUEST["smode"]);
456                         $view_mode = db_escape_string($_REQUEST["view-mode"]);
457
458                         if (SINGLE_USER_MODE) {
459                                 authenticate_user($link, "admin", null);
460                         }
461
462                         $owner_id = false;
463
464                         if ($key) {
465                                 $result = db_query($link, "SELECT owner_uid FROM
466                                         ttrss_access_keys WHERE access_key = '$key' AND feed_id = '$feed'");
467
468                                 if (db_num_rows($result) == 1)
469                                         $owner_id = db_fetch_result($result, 0, "owner_uid");
470                         }
471
472                         if ($owner_id) {
473                                 $_SESSION['uid'] = $owner_id;
474
475                                 generate_syndicated_feed($link, 0, $feed, $is_cat, $limit,
476                                         $search, $search_mode, $match_on, $view_mode);
477                         } else {
478                                 header('HTTP/1.1 403 Forbidden');
479                         }
480                 break; // rss
481
482                 case "getUnread":
483                         $login = db_escape_string($_REQUEST["login"]);
484                         $fresh = $_REQUEST["fresh"] == "1";
485
486                         $result = db_query($link, "SELECT id FROM ttrss_users WHERE login = '$login'");
487
488                         if (db_num_rows($result) == 1) {
489                                 $uid = db_fetch_result($result, 0, "id");
490
491                                 print getGlobalUnread($link, $uid);
492
493                                 if ($fresh) {
494                                         print ";";
495                                         print getFeedArticles($link, -3, false, true, $uid);
496                                 }
497
498                         } else {
499                                 print "-1;User not found";
500                         }
501
502                 break; // getUnread
503
504                 case "digestTest":
505                         print_r(prepare_headlines_digest($link, $_SESSION["uid"]));
506                 break; // digestTest
507
508                 case "digestSend":
509                         send_headlines_digests($link);
510                 break; // digestSend
511
512                 case "loading":
513                         header("Content-type: text/html");
514                         print __("Loading, please wait...") . " " .
515                                 "<img src='images/indicator_tiny.gif'>";
516                 break; // loading
517
518                 case "getProfiles":
519                         $login = db_escape_string($_REQUEST["login"]);
520                         $password = db_escape_string($_REQUEST["password"]);
521
522                         if (authenticate_user($link, $login, $password)) {
523                                 $result = db_query($link, "SELECT * FROM ttrss_settings_profiles
524                                         WHERE owner_uid = " . $_SESSION["uid"] . " ORDER BY title");
525
526                                 print "<select style='width: 100%' name='profile'>";
527
528                                 print "<option value='0'>" . __("Default profile") . "</option>";
529
530                                 while ($line = db_fetch_assoc($result)) {
531                                         $id = $line["id"];
532                                         $title = $line["title"];
533
534                                         print "<option value='$id'>$title</option>";
535                                 }
536
537                                 print "</select>";
538
539                                 $_SESSION = array();
540                         }
541                 break; // getprofiles
542
543                 case "pubsub":
544                         $mode = db_escape_string($_REQUEST['hub_mode']);
545                         $feed_id = (int) db_escape_string($_REQUEST['id']);
546                         $feed_url = db_escape_string($_REQUEST['hub_topic']);
547
548                         if (!PUBSUBHUBBUB_ENABLED) {
549                                 header('HTTP/1.0 404 Not Found');
550                                 echo "404 Not found";
551                                 return;
552                         }
553
554                         // TODO: implement hub_verifytoken checking
555
556                         $result = db_query($link, "SELECT feed_url FROM ttrss_feeds
557                                 WHERE id = '$feed_id'");
558
559                         if (db_num_rows($result) != 0) {
560
561                                 $check_feed_url = db_fetch_result($result, 0, "feed_url");
562
563                                 if ($check_feed_url && ($check_feed_url == $feed_url || !$feed_url)) {
564                                         if ($mode == "subscribe") {
565
566                                                 db_query($link, "UPDATE ttrss_feeds SET pubsub_state = 2
567                                                         WHERE id = '$feed_id'");
568
569                                                 print $_REQUEST['hub_challenge'];
570                                                 return;
571
572                                         } else if ($mode == "unsubscribe") {
573
574                                                 db_query($link, "UPDATE ttrss_feeds SET pubsub_state = 0
575                                                         WHERE id = '$feed_id'");
576
577                                                 print $_REQUEST['hub_challenge'];
578                                                 return;
579
580                                         } else if (!$mode) {
581
582                                                 // Received update ping, schedule feed update.
583                                                 //update_rss_feed($link, $feed_id, true, true);
584
585                                                 db_query($link, "UPDATE ttrss_feeds SET
586                                                         last_update_started = '1970-01-01',
587                                                         last_updated = '1970-01-01' WHERE id = '$feed_id' AND
588                                                         owner_uid = ".$_SESSION["uid"]);
589
590                                         }
591                                 } else {
592                                         header('HTTP/1.0 404 Not Found');
593                                         echo "404 Not found";
594                                 }
595                         } else {
596                                 header('HTTP/1.0 404 Not Found');
597                                 echo "404 Not found";
598                         }
599
600                 break; // pubsub
601
602                 case "logout":
603                         logout_user();
604                         header("Location: tt-rss.php");
605                 break; // logout
606
607                 case "fbexport":
608
609                         $access_key = db_escape_string($_POST["key"]);
610
611                         // TODO: rate limit checking using last_connected
612                         $result = db_query($link, "SELECT id FROM ttrss_linked_instances
613                                 WHERE access_key = '$access_key'");
614
615                         if (db_num_rows($result) == 1) {
616
617                                 $instance_id = db_fetch_result($result, 0, "id");
618
619                                 $result = db_query($link, "SELECT feed_url, site_url, title, subscribers
620                                         FROM ttrss_feedbrowser_cache ORDER BY subscribers DESC LIMIT 100");
621
622                                 $feeds = array();
623
624                                 while ($line = db_fetch_assoc($result)) {
625                                         array_push($feeds, $line);
626                                 }
627
628                                 db_query($link, "UPDATE ttrss_linked_instances SET
629                                         last_status_in = 1 WHERE id = '$instance_id'");
630
631                                 print json_encode(array("feeds" => $feeds));
632                         } else {
633                                 print json_encode(array("error" => array("code" => 6)));
634                         }
635                 break; // fbexport
636
637                 case "share":
638                         $uuid = db_escape_string($_REQUEST["key"]);
639
640                         $result = db_query($link, "SELECT ref_id, owner_uid FROM ttrss_user_entries WHERE
641                                 uuid = '$uuid'");
642
643                         if (db_num_rows($result) != 0) {
644                                 header("Content-Type: text/html");
645
646                                 $id = db_fetch_result($result, 0, "ref_id");
647                                 $owner_uid = db_fetch_result($result, 0, "owner_uid");
648
649                                 $_SESSION["uid"] = $owner_uid;
650                                 $article = format_article($link, $id, false, true);
651                                 $_SESSION["uid"] = "";
652
653                                 print_r($article['content']);
654
655                         } else {
656                                 print "Article not found.";
657                         }
658
659                         break;
660
661                 default:
662                         header("Content-Type: text/plain");
663                         print json_encode(array("error" => array("code" => 7)));
664                 break; // fallback
665         } // Select action according to $op value.
666
667         // We close the connection to database.
668         db_close($link);
669 ?>