]> git.wh0rd.org - tt-rss.git/blob - plugins/share/init.php
Prevent target='_blank' vulnerability on dynamic link
[tt-rss.git] / plugins / share / init.php
1 <?php
2 class Share extends Plugin {
3 private $host;
4
5 function about() {
6 return array(1.0,
7 "Share article by unique URL",
8 "fox");
9 }
10
11 function init($host) {
12 $this->host = $host;
13
14 $host->add_hook($host::HOOK_ARTICLE_BUTTON, $this);
15 $host->add_hook($host::HOOK_PREFS_TAB_SECTION, $this);
16 }
17
18 function get_js() {
19 return file_get_contents(dirname(__FILE__) . "/share.js");
20 }
21
22 function get_prefs_js() {
23 return file_get_contents(dirname(__FILE__) . "/share_prefs.js");
24 }
25
26
27 function unshare() {
28 $id = db_escape_string($_REQUEST['id']);
29
30 db_query("UPDATE ttrss_user_entries SET uuid = '' WHERE int_id = '$id'
31 AND owner_uid = " . $_SESSION['uid']);
32
33 print "OK";
34 }
35
36 function hook_prefs_tab_section($id) {
37 if ($id == "prefFeedsPublishedGenerated") {
38
39 print "<p>" . __("You can disable all articles shared by unique URLs here.") . "</p>";
40
41 print "<button class=\"danger\" dojoType=\"dijit.form.Button\" onclick=\"return clearArticleAccessKeys()\">".
42 __('Unshare all articles')."</button> ";
43
44 print "</p>";
45
46 }
47 }
48
49 // Silent
50 function clearArticleKeys() {
51 db_query("UPDATE ttrss_user_entries SET uuid = '' WHERE
52 owner_uid = " . $_SESSION["uid"]);
53
54 return;
55 }
56
57
58 function newkey() {
59 $id = db_escape_string($_REQUEST['id']);
60
61 $uuid = db_escape_string(uniqid_short());
62
63 db_query("UPDATE ttrss_user_entries SET uuid = '$uuid' WHERE int_id = '$id'
64 AND owner_uid = " . $_SESSION['uid']);
65
66 print json_encode(array("link" => $uuid));
67 }
68
69 function hook_article_button($line) {
70 $img = $line['uuid'] ? "share.png" : "notshared.png";
71
72 return "<img id='SHARE-IMG-".$line['int_id']."' src=\"plugins/share/$img\"
73 class='tagsPic' style=\"cursor : pointer\"
74 onclick=\"shareArticle(".$line['int_id'].")\"
75 title='".__('Share by URL')."'>";
76 }
77
78 function shareArticle() {
79 $param = db_escape_string($_REQUEST['param']);
80
81 $result = db_query("SELECT uuid, ref_id FROM ttrss_user_entries WHERE int_id = '$param'
82 AND owner_uid = " . $_SESSION['uid']);
83
84 if (db_num_rows($result) == 0) {
85 print "Article not found.";
86 } else {
87
88 $uuid = db_fetch_result($result, 0, "uuid");
89 $ref_id = db_fetch_result($result, 0, "ref_id");
90
91 if (!$uuid) {
92 $uuid = db_escape_string(uniqid_short());
93 db_query("UPDATE ttrss_user_entries SET uuid = '$uuid' WHERE int_id = '$param'
94 AND owner_uid = " . $_SESSION['uid']);
95 }
96
97 print __("You can share this article by the following unique URL:") . "<br/>";
98
99 $url_path = get_self_url_prefix();
100 $url_path .= "/public.php?op=share&key=$uuid";
101
102 print "<div class=\"tagCloudContainer\">";
103 print "<a id='gen_article_url' href='$url_path' target='_blank' rel='noopener noreferrer'>$url_path</a>";
104 print "</div>";
105
106 /* if (!label_find_id(__('Shared'), $_SESSION["uid"]))
107 label_create(__('Shared'), $_SESSION["uid"]);
108
109 label_add_article($ref_id, __('Shared'), $_SESSION['uid']); */
110 }
111
112 print "<div align='center'>";
113
114 print "<button dojoType=\"dijit.form.Button\" onclick=\"return dijit.byId('shareArticleDlg').unshare()\">".
115 __('Unshare article')."</button>";
116
117 print "<button dojoType=\"dijit.form.Button\" onclick=\"return dijit.byId('shareArticleDlg').newurl()\">".
118 __('Generate new URL')."</button>";
119
120 print "<button dojoType=\"dijit.form.Button\" onclick=\"return dijit.byId('shareArticleDlg').hide()\">".
121 __('Close this window')."</button>";
122
123 print "</div>";
124 }
125
126 function api_version() {
127 return 2;
128 }
129
130 }
131 ?>