]> git.wh0rd.org Git - tt-rss.git/blob - modules/backend-rpc.php
fix proper escaping of label titles (closes #255)
[tt-rss.git] / modules / backend-rpc.php
1 <?php
2         function handle_rpc_request($link) {
3
4                 $subop = $_GET["subop"];
5
6                 if ($subop == "setpref") {
7                         if (WEB_DEMO_MODE) {
8                                 return;
9                         }
10
11                         print "<rpc-reply>";
12
13                         $key = db_escape_string($_GET["key"]);
14                         $value = db_escape_string($_GET["value"]);
15
16                         set_pref($link, $key, $value);
17
18                         print "<param-set key=\"$key\" value=\"$value\"/>";
19
20                         print "</rpc-reply>";
21
22                         return;
23                 }
24
25                 if ($subop == "getLabelCounters") {
26                         $aid = $_GET["aid"];            
27                         print "<rpc-reply>";
28                         print "<counters>";
29                         getLabelCounters($link);
30                         if ($aid) {
31                                 getFeedCounter($link, $aid);
32                         }
33                         print "</counters>";
34                         print "</rpc-reply>";
35
36                         return;
37                 }
38
39                 if ($subop == "getFeedCounters") {
40                         print "<rpc-reply>";
41                         print "<counters>";
42                         getFeedCounters($link);
43                         print "</counters>";
44                         print "</rpc-reply>";
45
46                         return;
47                 }
48
49                 if ($subop == "getAllCounters") {
50                         print "<rpc-reply>";                    
51                         print "<counters>";
52
53                         $omode = $_GET["omode"];
54
55                         getAllCounters($link, $omode);
56                         print "</counters>";
57                         print_runtime_info($link);
58                         print "</rpc-reply>";
59
60                         return;
61                 }
62
63                 if ($subop == "mark") {
64                         $mark = $_GET["mark"];
65                         $id = db_escape_string($_GET["id"]);
66
67                         if ($mark == "1") {
68                                 $mark = "true";
69                         } else {
70                                 $mark = "false";
71                         }
72
73                         // FIXME this needs collision testing
74
75                         $result = db_query($link, "UPDATE ttrss_user_entries SET marked = $mark
76                                 WHERE ref_id = '$id' AND owner_uid = " . $_SESSION["uid"]);
77
78                         print "<rpc-reply><counters>";
79                         getGlobalCounters($link);
80                         getLabelCounters($link);
81                         if (get_pref($link, 'ENABLE_FEED_CATS')) {
82                                 getCategoryCounters($link);
83                         }
84                         print "</counters></rpc-reply>";
85
86                         return;
87                 }
88
89                 if ($subop == "publ") {
90                         $pub = $_REQUEST["pub"];
91                         $id = db_escape_string($_REQUEST["id"]);
92                         $note = trim(strip_tags(db_escape_string($_REQUEST["note"])));
93
94                         if ($pub == "1") {
95                                 $pub = "true";
96                         } else {
97                                 $pub = "false";
98                         }
99
100                         if ($note != 'undefined') {
101                                 $note_qpart = "note = '$note',";
102                         }
103
104                         // FIXME this needs collision testing
105
106                         $result = db_query($link, "UPDATE ttrss_user_entries SET 
107                                 $note_qpart
108                                 published = $pub
109                                 WHERE ref_id = '$id' AND owner_uid = " . $_SESSION["uid"]);
110
111
112                         print "<rpc-reply>";
113                         
114                         print "<counters>";
115                         getGlobalCounters($link);
116                         getLabelCounters($link);
117                         if (get_pref($link, 'ENABLE_FEED_CATS')) {
118                                 getCategoryCounters($link);
119                         }
120                         print "</counters>";
121
122                         if ($note != 'undefined') {
123                                 $note_size = strlen($note);
124                                 print "<note id=\"$id\" size=\"$note_size\">";
125                                 print "<![CDATA[" . format_article_note($id, $note) . "]]>";
126                                 print "</note>";
127                         }
128
129                         print "</rpc-reply>";
130
131                         return;
132                 }
133
134                 if ($subop == "updateFeed") {
135                         $feed_id = db_escape_string($_GET["feed"]);
136
137                         $result = db_query($link, 
138                                 "SELECT feed_url FROM ttrss_feeds WHERE id = '$feed_id'
139                                         AND owner_uid = " . $_SESSION["uid"]);
140
141                         if (db_num_rows($result) > 0) {                 
142                                 $feed_url = db_fetch_result($result, 0, "feed_url");
143                                 update_rss_feed($link, $feed_url, $feed_id);
144                         }
145
146                         print "<rpc-reply>";    
147                         print "<counters>";
148                         getFeedCounter($link, $feed_id);
149                         print "</counters>";
150                         print "</rpc-reply>";
151                         
152                         return;
153                 }
154
155                 if ($subop == "forceUpdateAllFeeds" || $subop == "updateAllFeeds") {
156         
157                         $global_unread_caller = sprintf("%d", $_GET["uctr"]);
158                         $global_unread = getGlobalUnread($link);
159
160                         print "<rpc-reply>";
161
162                         print "<counters>";
163
164                         if ($global_unread_caller != $global_unread) {
165
166                                 $omode = $_GET["omode"];
167          
168                                 if (!$omode) $omode = "tflc";
169
170                                 if (strchr($omode, "l")) getLabelCounters($link);
171
172                                 if (strchr($omode, "c")) {                      
173                                         if (get_pref($link, 'ENABLE_FEED_CATS')) {
174                                                 getCategoryCounters($link);
175                                         }
176                                 }
177
178                                 if (strchr($omode, "f")) getFeedCounters($link);
179                                 if (strchr($omode, "t")) getTagCounters($link);
180
181                                 getGlobalCounters($link, $global_unread);
182                         }
183  
184                         print "</counters>";
185
186                         print_runtime_info($link);
187
188                         print "</rpc-reply>";
189
190                         return;
191                 }
192
193                 /* GET["cmode"] = 0 - mark as read, 1 - as unread, 2 - toggle */
194                 if ($subop == "catchupSelected") {
195
196                         $ids = split(",", db_escape_string($_REQUEST["ids"]));
197                         $cmode = sprintf("%d", $_REQUEST["cmode"]);
198
199                         catchupArticlesById($link, $ids, $cmode);
200
201                         print "<rpc-reply>";
202                         print "<counters>";
203                         getAllCounters($link, $_GET["omode"]);
204                         print "</counters>";
205                         print_runtime_info($link);
206                         print "</rpc-reply>";
207
208                         return;
209                 }
210
211                 if ($subop == "markSelected") {
212
213                         $ids = split(",", db_escape_string($_GET["ids"]));
214                         $cmode = sprintf("%d", $_GET["cmode"]);
215
216                         markArticlesById($link, $ids, $cmode);
217
218                         print "<rpc-reply>";
219                         print "<counters>";
220                         getAllCounters($link, $_GET["omode"]);
221                         print "</counters>";
222                         print_runtime_info($link);
223                         print "</rpc-reply>";
224
225                         return;
226                 }
227
228                 if ($subop == "publishSelected") {
229
230                         $ids = split(",", db_escape_string($_GET["ids"]));
231                         $cmode = sprintf("%d", $_GET["cmode"]);
232
233                         publishArticlesById($link, $ids, $cmode);
234
235                         print "<rpc-reply>";
236                         print "<counters>";
237                         getAllCounters($link, $_GET["omode"]);
238                         print "</counters>";
239                         print_runtime_info($link);
240                         print "</rpc-reply>";
241
242                         return;
243                 }
244
245                 if ($subop == "sanityCheck") {
246                         print "<rpc-reply>";
247                         if (sanity_check($link)) {
248                                 print "<error error-code=\"0\"/>";
249                                 print_init_params($link);
250                                 print_runtime_info($link);
251
252                                 # assign client-passed params to session
253                                 $_SESSION["client.userAgent"] = $_GET["ua"];
254
255                         }
256                         print "</rpc-reply>";
257
258                         return;
259                 }               
260
261                 if ($subop == "globalPurge") {
262
263                         print "<rpc-reply>";
264                         global_purge_old_posts($link, true);
265                         print "</rpc-reply>";
266
267                         return;
268                 }
269
270                 if ($subop == "getArticleLink") {
271
272                         $id = db_escape_string($_GET["id"]);
273
274                         $result = db_query($link, "SELECT link FROM ttrss_entries, ttrss_user_entries
275                                 WHERE id = '$id' AND id = ref_id AND owner_uid = '".$_SESSION['uid']."'");
276
277                         if (db_num_rows($result) == 1) {
278                                 $link = htmlspecialchars(strip_tags(db_fetch_result($result, 0, "link")));
279                                 print "<rpc-reply><link>$link</link><id>$id</id></rpc-reply>";
280                         } else {
281                                 print "<rpc-reply><error>Article not found</error></rpc-reply>";
282                         }
283
284                         return;
285                 }
286
287                 if ($subop == "setArticleTags") {
288
289                         $id = db_escape_string($_GET["id"]);
290
291                         $tags_str = db_escape_string($_GET["tags_str"]);
292
293                         $tags = array_unique(trim_array(split(",", $tags_str)));
294
295                         db_query($link, "BEGIN");
296
297                         $result = db_query($link, "SELECT int_id FROM ttrss_user_entries WHERE
298                                 ref_id = '$id' AND owner_uid = '".$_SESSION["uid"]."' LIMIT 1");
299
300                         if (db_num_rows($result) == 1) {
301
302                                 $int_id = db_fetch_result($result, 0, "int_id");
303
304                                 db_query($link, "DELETE FROM ttrss_tags WHERE 
305                                         post_int_id = $int_id AND owner_uid = '".$_SESSION["uid"]."'");
306
307                                 foreach ($tags as $tag) {
308                                         $tag = sanitize_tag($tag);      
309
310                                         if (!tag_is_valid($tag)) {
311                                                 continue;
312                                         }
313
314                                         if (preg_match("/^[0-9]*$/", $tag)) {
315                                                 continue;
316                                         }
317
318 //                                      print "<!-- $id : $int_id : $tag -->";
319                                         
320                                         if ($tag != '') {
321                                                 db_query($link, "INSERT INTO ttrss_tags 
322                                                         (post_int_id, owner_uid, tag_name) VALUES ('$int_id', '".$_SESSION["uid"]."', '$tag')");
323                                         }
324                                 }
325                         }
326
327                         db_query($link, "COMMIT");
328
329                         $tags_str = format_tags_string(get_article_tags($link, $id), $id);
330
331                         print "<rpc-reply>
332                                 <tags-str id=\"$id\"><![CDATA[$tags_str]]></tags-str>
333                                 </rpc-reply>";
334
335                         return;
336                 }
337
338                 if ($subop == "regenPubKey") {
339
340                         print "<rpc-reply>";
341
342                         set_pref($link, "_PREFS_PUBLISH_KEY", generate_publish_key());
343
344                         $new_link = article_publish_url($link);         
345
346                         print "<link><![CDATA[$new_link]]></link>";
347
348                         print "</rpc-reply>";
349
350                         return;
351                 }
352
353                 if ($subop == "logout") {
354                         logout_user();
355                         print_error_xml(6);
356                         return;
357                 }
358
359                 if ($subop == "completeTags") {
360
361                         $search = db_escape_string($_REQUEST["search"]);
362
363                         $result = db_query($link, "SELECT DISTINCT tag_name FROM ttrss_tags 
364                                 WHERE owner_uid = '".$_SESSION["uid"]."' AND
365                                 tag_name LIKE '$search%' ORDER BY tag_name
366                                 LIMIT 10");
367
368                         print "<ul>";
369                         while ($line = db_fetch_assoc($result)) {
370                                 print "<li>" . $line["tag_name"] . "</li>";
371                         }
372                         print "</ul>";
373
374                         return;
375                 }
376
377                 if ($subop == "purge") {
378                         $ids = split(",", db_escape_string($_GET["ids"]));
379                         $days = sprintf("%d", $_GET["days"]);
380
381                         print "<rpc-reply>";
382
383                         print "<message><![CDATA[";
384
385                         foreach ($ids as $id) {
386
387                                 $result = db_query($link, "SELECT id FROM ttrss_feeds WHERE
388                                         id = '$id' AND owner_uid = ".$_SESSION["uid"]);
389
390                                 if (db_num_rows($result) == 1) {
391                                         purge_feed($link, $id, $days, true);
392                                 }
393                         }
394
395                         print "]]></message>";
396
397                         print "</rpc-reply>";
398
399                         return;
400                 }
401
402 /*              if ($subop == "setScore") {
403                         $id = db_escape_string($_REQUEST["id"]);
404                         $score = sprintf("%d", $_REQUEST["score"]);
405
406                         $result = db_query($link, "UPDATE ttrss_user_entries SET score = '$score'
407                                 WHERE ref_id = '$id' AND owner_uid = ".$_SESSION["uid"]);
408
409                         print "<rpc-reply><message>Acknowledged.</message></rpc-reply>";
410
411                         return;
412
413                 } */
414
415                 if ($subop == "getArticles") {
416                         $ids = split(",", db_escape_string($_REQUEST["ids"]));
417
418                         print "<rpc-reply>";
419
420                         foreach ($ids as $id) {
421                                 if ($id) {
422                                         outputArticleXML($link, $id, 0, false);
423                                 }
424                         }
425                         print "</rpc-reply>";
426
427                         return;
428                 }
429
430                 if ($subop == "checkDate") {
431
432                         $date = db_escape_string($_REQUEST["date"]);
433                         $date_parsed = strtotime($date);
434
435                         print "<rpc-reply>";
436
437                         if ($date_parsed) {
438                                 print "<result>1</result>";
439                         } else {
440                                 print "<result>0</result>";
441                         }
442
443                         print "</rpc-reply>";
444
445                         return;
446                 }
447
448                 if ($subop == "removeFromLabel") {
449
450                         $ids = split(",", db_escape_string($_REQUEST["ids"]));
451                         $label_id = db_escape_string($_REQUEST["lid"]);
452
453                         $label = db_escape_string(label_find_caption($link, $label_id, 
454                                 $_SESSION["uid"]));
455
456                         print "<rpc-reply>";
457                         print "<info-for-headlines>";
458
459                         if ($label) {
460
461                                 foreach ($ids as $id) {
462                                         label_remove_article($link, $id, $label, $_SESSION["uid"]);
463
464                                         print "<entry id=\"$id\"><![CDATA[";
465
466                                         $labels = get_article_labels($link, $id, $_SESSION["uid"]);
467                                         print format_article_labels($labels, $id);
468
469                                         print "]]></entry>";
470
471                                 }
472                         }
473
474                         print "</info-for-headlines>";
475
476                         print "<counters>";
477                         getAllCounters($link, $omode);
478                         print "</counters>";
479                         print "</rpc-reply>";
480
481                         return;
482                 }
483
484                 if ($subop == "assignToLabel") {
485
486                         $ids = split(",", db_escape_string($_REQUEST["ids"]));
487                         $label_id = db_escape_string($_REQUEST["lid"]);
488
489                         $label = db_escape_string(label_find_caption($link, $label_id, 
490                                 $_SESSION["uid"]));
491
492                         print "<rpc-reply>";                    
493
494                         print "<info-for-headlines>";
495
496                         if ($label) {
497
498                                 foreach ($ids as $id) {
499                                         label_add_article($link, $id, $label, $_SESSION["uid"]);
500
501                                         print "<entry id=\"$id\"><![CDATA[";
502
503                                         $labels = get_article_labels($link, $id, $_SESSION["uid"]);
504                                         print format_article_labels($labels, $id);
505
506                                         print "]]></entry>";
507
508                                 }
509                         }
510
511                         print "</info-for-headlines>";
512
513                         print "<counters>";
514                         getAllCounters($link, $omode);
515                         print "</counters>";
516                         print "</rpc-reply>";
517
518                         return;
519                 }
520
521                 if ($subop == "feedBrowser") {
522
523                         $search = db_escape_string($_REQUEST["search"]);
524                         $limit = db_escape_string($_REQUEST["limit"]);
525
526                         print "<rpc-reply>";
527                         print "<content>";
528                         print "<![CDATA[";
529                         $ctr = print_feed_browser($link, $search, $limit);
530                         print "]]>";
531                         print "</content>";
532                         print "<num-results value=\"$ctr\"/>";
533                         print "</rpc-reply>";
534
535                         return;
536                 }
537
538                 if ($subop == "download") {
539                         $stage = (int) $_REQUEST["stage"];
540                         $cidt = (int)db_escape_string($_REQUEST["cidt"]);
541                         $cidb = (int)db_escape_string($_REQUEST["cidb"]);
542                         $sync = db_escape_string($_REQUEST["sync"]);
543                         //$amount = (int) $_REQUEST["amount"];
544                         //$unread_only = db_escape_string($_REQUEST["unread_only"]);
545                         //if (!$amount) $amount = 50;
546
547                         $amount = 2000;
548                         $unread_only = true;
549
550                         print "<rpc-reply>";
551
552                         $sync = split(";", $sync);
553
554                         print "<sync>";
555
556                         if (count($sync) > 0) {
557                                 if (strtotime($sync[0])) {
558                                         $last_online = db_escape_string($sync[0]);
559
560                                         print "<sync-point><![CDATA[$last_online]]></sync-point>";
561                                         
562                                         for ($i = 1; $i < count($sync); $i++) {
563                                                 $e = split(",", $sync[$i]);
564
565                                                 if (count($e) == 3) {
566
567                                                         $id = (int) $e[0];
568                                                         $unread = bool_to_sql_bool((bool) $e[1]);
569                                                         $marked = (bool)$e[2];
570
571                                                         if ($marked) {
572                                                                 $marked = bool_to_sql_bool($marked);
573                                                                 $marked_qpart = "marked = $marked,";
574                                                         }
575
576                                                         $query = "UPDATE ttrss_user_entries SET 
577                                                                 $marked_qpart
578                                                                 unread = $unread, 
579                                                                 last_read = '$last_online' 
580                                                         WHERE ref_id = '$id' AND 
581                                                                 (last_read IS NULL OR last_read < '$last_online') AND
582                                                                 owner_uid = ".$_SESSION["uid"];
583
584                                                         $result = db_query($link, $query);
585
586                                                         print "<sync-ok id=\"$id\"/>";
587
588                                                 }
589                                         }
590
591                                         /* Maybe we need to further update local DB for this client */
592
593                                         $query = "SELECT ref_id,unread,marked FROM ttrss_user_entries
594                                                 WHERE last_read >= '$last_online' AND
595                                                                 owner_uid = ".$_SESSION["uid"] . " LIMIT 1000";
596
597                                         $result = db_query($link, $query);
598
599                                         while ($line = db_fetch_assoc($result)) {
600                                                 $unread = (int) sql_bool_to_bool($line["unread"]);
601                                                 $marked = (int) sql_bool_to_bool($line["marked"]);
602
603                                                 print "<sync-ok unread=\"$unread\" marked=\"$marked\" 
604                                                         id=\"".$line["ref_id"]."\"/>";
605                                         }
606
607                                 }
608                         }
609
610                         print "</sync>";
611
612                         if ($stage == 0) {
613                                 print "<feeds>";
614
615                                 $result = db_query($link, "SELECT id, title, cat_id FROM
616                                         ttrss_feeds WHERE hidden = false AND owner_uid = ".$_SESSION["uid"]);
617
618                                 while ($line = db_fetch_assoc($result)) {
619
620                                         $has_icon = (int) feed_has_icon($line["id"]);
621
622                                         print "<feed has_icon=\"$has_icon\" 
623                                                 cat_id=\"".(int)$line["cat_id"]."\" id=\"".$line["id"]."\"><![CDATA[";
624                                         print $line["title"];
625                                         print "]]></feed>";
626                                 }
627
628                                 print "</feeds>";
629
630                                 print "<feed-categories>";
631
632                                 $result = db_query($link, "SELECT id, title, collapsed FROM
633                                         ttrss_feed_categories WHERE owner_uid = ".$_SESSION["uid"]);
634
635                                         print "<category id=\"0\" collapsed=\"".
636                                                 (int)$_COOKIE["ttrss_vf_uclps"]."\"><![CDATA[";
637                                         print __("Uncategorized");
638                                         print "]]></category>";
639
640                                         print "<category id=\"-1\" collapsed=\"".
641                                                 (int)$_COOKIE["ttrss_vf_vclps"]."\"><![CDATA[";
642                                         print __("Special");
643                                         print "]]></category>";
644
645                                         print "<category id=\"-2\" collapsed=\"".
646                                                 (int)$_COOKIE["ttrss_vf_lclps"]."\"><![CDATA[";
647                                         print __("Labels");
648                                         print "]]></category>";
649
650                                 while ($line = db_fetch_assoc($result)) {
651                                         print "<category 
652                                                 id=\"".$line["id"]."\"
653                                                 collapsed=\"".(int)sql_bool_to_bool($line["collapsed"])."\"><![CDATA[";
654                                         print $line["title"];
655                                         print "]]></category>";
656                                 }
657
658                                 print "</feed-categories>";
659
660                                 print "<labels>";
661
662                                 $result = db_query($link, "SELECT * FROM
663                                         ttrss_labels2 WHERE owner_uid = ".$_SESSION["uid"]);
664
665                                 while ($line = db_fetch_assoc($result)) {
666                                         print "<label
667                                                 id=\"".$line["id"]."\"
668                                                 fg_color=\"".$line["fg_color"]."\"
669                                                 bg_color=\"".$line["bg_color"]."\"
670                                                 ><![CDATA[";
671                                         print $line["caption"];
672                                         print "]]></label>";
673                                 }
674
675
676                                 print "</labels>";
677
678                         }
679
680                         if ($stage > 0) {
681                                 print "<articles>";
682
683                                 $limit = 200;
684                                 $skip = $limit*($stage-1);
685
686                                 print "<limit value=\"$limit\"/>";
687
688                                 if ($amount > 0) $amount -= $skip;
689
690                                 if ($amount > 0) {
691
692                                         $limit = min($limit, $amount);
693
694                                         if ($unread_only) {
695                                                 $unread_qpart = "(unread = true OR marked = true) AND ";
696                                         }
697
698                                         if ($cidt && $cidb) {
699                                                 $cid_qpart =  "(ttrss_entries.id > $cidt OR ttrss_entries.id < $cidb) AND ";
700                                         }
701
702                                         if (DB_TYPE == "pgsql") {
703                                                 $date_qpart = "updated >= NOW() - INTERVAL '1 month' AND";
704                                         } else {
705                                                 $date_qpart = "updated >= DATE_SUB(NOW(), INTERVAL 1 MONTH) AND";
706                                         }                       
707
708                                         $result = db_query($link,
709                                                 "SELECT DISTINCT ttrss_entries.id,ttrss_entries.title,
710                                                         guid,link,comments,
711                                                         feed_id,content,updated,unread,marked FROM
712                                                         ttrss_user_entries,ttrss_entries,ttrss_feeds
713                                                 WHERE $unread_qpart $cid_qpart $date_qpart
714                                                         hidden = false AND
715                                                         ttrss_feeds.id = feed_id AND
716                                                         ref_id = ttrss_entries.id AND 
717                                                         ttrss_user_entries.owner_uid = ".$_SESSION["uid"]."
718                                                         ORDER BY updated DESC LIMIT $limit OFFSET $skip");
719
720                                         if (function_exists('json_encode')) {
721
722                                                 while ($line = db_fetch_assoc($result)) {
723                                                         print "<article><![CDATA[";
724         
725                                                         $line["marked"] = (int)sql_bool_to_bool($line["marked"]);
726                                                         $line["unread"] = (int)sql_bool_to_bool($line["unread"]);
727
728                                                         $line["labels"] = get_article_labels($link, $line["id"]);
729
730 //                                                      too slow :(                                                     
731 //                                                      $line["tags"] = format_tags_string(
732 //                                                              get_article_tags($link, $line["id"]), $line["id"]);
733         
734                                                         print json_encode($line);
735                                                         print "]]></article>";
736                                                 }       
737                                         }
738
739                                 }
740
741                                 print "</articles>";
742
743                         }
744
745                         print "</rpc-reply>";
746
747                         return;
748                 }
749
750                 print "<rpc-reply><error>Unknown method: $subop</error></rpc-reply>";
751         }
752 ?>