prevent frontend updating of feeds on view if open_basedir is set to prevent plugins...

[tt-rss.git] / classes / api.php

diff --git a/classes/api.php b/classes/api.php
index cbb4720c1b6c0d1cbecd811edb8ebfbec0038416..9be04cff93cd0fb882b102ef2e38009587ec1dd2 100644 (file)
--- a/classes/api.php
+++ b/classes/api.php
@@ -2,7 +2,7 @@
 
 class API extends Handler {
 
-       const API_LEVEL  = 12;
+       const API_LEVEL  = 13;
 
        const STATUS_OK  = 0;
        const STATUS_ERR = 1;
@@ -184,6 +184,8 @@ class API extends Handler {
                $feed_id = $this->dbh->escape_string($_REQUEST["feed_id"]);
                if ($feed_id != "") {
 
+                       if (is_numeric($feed_id)) $feed_id = (int) $feed_id;
+
                        $limit = (int)$this->dbh->escape_string($_REQUEST["limit"]);
 
                        if (!$limit || $limit >= 200) $limit = 200;
@@ -203,11 +205,13 @@ class API extends Handler {
                        $force_update = sql_bool_to_bool($_REQUEST["force_update"]);
                        $has_sandbox = sql_bool_to_bool($_REQUEST["has_sandbox"]);
                        $excerpt_length = (int)$this->dbh->escape_string($_REQUEST["excerpt_length"]);
-                       $check_top_id = (int)$this->dbh->escape_string($_REQUEST["check_top_id"]);
+                       $check_first_id = (int)$this->dbh->escape_string($_REQUEST["check_first_id"]);
                        $include_header = sql_bool_to_bool($_REQUEST["include_header"]);
 
                        $_SESSION['hasSandbox'] = $has_sandbox;
 
+                       $skip_first_id_check = false;
+
                        $override_order = false;
                        switch ($_REQUEST["order_by"]) {
                                case "title":
@@ -215,6 +219,7 @@ class API extends Handler {
                                        break;
                                case "date_reverse":
                                        $override_order = "score DESC, date_entered, updated";
+                                       $skip_first_id_check = true;
                                        break;
                                case "feed_dates":
                                        $override_order = "updated DESC";
@@ -228,7 +233,7 @@ class API extends Handler {
                        list($headlines, $headlines_header) = $this->api_get_headlines($feed_id, $limit, $offset,
                                $filter, $is_cat, $show_excerpt, $show_content, $view_mode, $override_order,
                                $include_attachments, $since_id, $search,
-                               $include_nested, $sanitize_content, $force_update, $excerpt_length, $check_top_id);
+                               $include_nested, $sanitize_content, $force_update, $excerpt_length, $check_first_id, $skip_first_id_check);
 
                        if ($include_header) {
                                $this->wrap(self::STATUS_OK, array($headlines_header, $headlines));
@@ -320,13 +325,17 @@ class API extends Handler {
        function getArticle() {
 
                $article_id = join(",", array_filter(explode(",", $this->dbh->escape_string($_REQUEST["article_id"])), is_numeric));
+               $sanitize_content = !isset($_REQUEST["sanitize"]) ||
+                       sql_bool_to_bool($_REQUEST["sanitize"]);
 
                if ($article_id) {
 
                        $query = "SELECT id,title,link,content,feed_id,comments,int_id,
                                marked,unread,published,score,note,lang,
                                ".SUBSTRING_FOR_DATE."(updated,1,16) as updated,
-                               author,(SELECT title FROM ttrss_feeds WHERE id = feed_id) AS feed_title
+                               author,(SELECT title FROM ttrss_feeds WHERE id = feed_id) AS feed_title,
+                               (SELECT site_url FROM ttrss_feeds WHERE id = feed_id) AS site_url,
+                               (SELECT hide_images FROM ttrss_feeds WHERE id = feed_id) AS hide_images
                                FROM ttrss_entries,ttrss_user_entries
                                WHERE   id IN ($article_id) AND ref_id = id AND owner_uid = " .
                                        $_SESSION["uid"] ;
@@ -352,7 +361,6 @@ class API extends Handler {
                                                "comments" => $line["comments"],
                                                "author" => $line["author"],
                                                "updated" => (int) strtotime($line["updated"]),
-                                               "content" => $line["content"],
                                                "feed_id" => $line["feed_id"],
                                                "attachments" => $attachments,
                                                "score" => (int)$line["score"],
@@ -361,6 +369,15 @@ class API extends Handler {
                                                "lang" => $line["lang"]
                                        );
 
+                                       if ($sanitize_content) {
+                                               $article["content"] = sanitize(
+                                                       $line["content"],
+                                                       sql_bool_to_bool($line['hide_images']),
+                                                       false, $line["site_url"], false, $line["id"]);
+                                       } else {
+                                               $article["content"] = $line["content"];
+                                       }
+
                                        foreach (PluginHost::getInstance()->get_hooks(PluginHost::HOOK_RENDER_ARTICLE_API) as $p) {
                                                $article = $p->hook_render_article_api(array("article" => $article));
                                        }
@@ -399,7 +416,9 @@ class API extends Handler {
 
                $feed_id = (int) $this->dbh->escape_string($_REQUEST["feed_id"]);
 
-               update_rss_feed($feed_id, true);
+               if (!ini_get("open_basedir")) {
+                       update_rss_feed($feed_id, true);
+               }
 
                $this->wrap(self::STATUS_OK, array("status" => "OK"));
        }
@@ -642,7 +661,7 @@ class API extends Handler {
                                $filter, $is_cat, $show_excerpt, $show_content, $view_mode, $order,
                                $include_attachments, $since_id,
                                $search = "", $include_nested = false, $sanitize_content = true,
-                               $force_update = false, $excerpt_length = 100, $check_top_id = false) {
+                               $force_update = false, $excerpt_length = 100, $check_first_id = false, $skip_first_id_check = false) {
 
                        if ($force_update && $feed_id > 0 && is_numeric($feed_id)) {
                                // Update the feed if required with some basic flood control
@@ -684,21 +703,24 @@ class API extends Handler {
                                "offset" => $offset,
                                "since_id" => $since_id,
                                "include_children" => $include_nested,
-                               "check_top_id" => $check_top_id
+                               "check_first_id" => $check_first_id,
+                               "skip_first_id_check" => $skip_first_id_check
                        );
 
                        $qfh_ret = queryFeedHeadlines($params);
 
                        $result = $qfh_ret[0];
                        $feed_title = $qfh_ret[1];
+                       $first_id = $qfh_ret[6];
 
                        $headlines = array();
 
                        $headlines_header = array(
                                'id' => $feed_id,
+                               'first_id' => $first_id,
                                'is_cat' => $is_cat);
 
-                       if (is_resource($result)) {
+                       if (!is_numeric($result)) {
                                while ($line = db_fetch_assoc($result)) {
                                        $line["content_preview"] = truncate_string(strip_tags($line["content"]), $excerpt_length);
                                        foreach (PluginHost::getInstance()->get_hooks(PluginHost::HOOK_QUERY_HEADLINES) as $p) {
@@ -787,7 +809,7 @@ class API extends Handler {
                                        array_push($headlines, $headline_row);
                                }
                        } else if (is_numeric($result) && $result == -1) {
-                               $headlines_header['top_id_changed'] = true;
+                               $headlines_header['first_id_changed'] = true;
                        }
 
                        return array($headlines, $headlines_header);