]> git.wh0rd.org - tt-rss.git/blobdiff - classes/api.php
git.wh0rd.org / tt-rss.git / blobdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | inline | side by side
support disabling of e-mail digests entirely
[tt-rss.git] / classes / api.php
diff --git a/classes/api.php b/classes/api.php
old mode 100644 (file)
new mode 100755 (executable)
index 8ffa74d..e505dcc
--- a/classes/api.php
+++ b/classes/api.php
@@ -8,6 +8,10 @@ class API extends Handler {
 
        private $seq;
 
+       static function param_to_bool($p) {
+               return $p && ($p !== "f" && $p !== "false");
+       }
+
        function before($method) {
                if (parent::before($method)) {
                        header("Content-Type: text/json");
@@ -22,7 +26,7 @@ class API extends Handler {
                                return false;
                        }
 
-                       $this->seq = (int) $_REQUEST['seq'];
+                       $this->seq = (int) clean($_REQUEST['seq']);
 
                        return true;
                }
@@ -49,9 +53,9 @@ class API extends Handler {
                @session_destroy();
                @session_start();
 
-               $login = $_REQUEST["user"];
-               $password = $_REQUEST["password"];
-               $password_base64 = base64_decode($_REQUEST["password"]);
+               $login = clean($_REQUEST["user"]);
+               $password = clean($_REQUEST["password"]);
+               $password_base64 = base64_decode(clean($_REQUEST["password"]));
 
                if (SINGLE_USER_MODE) $login = "admin";
 
@@ -96,8 +100,8 @@ class API extends Handler {
        }
 
        function getUnread() {
-               $feed_id = $_REQUEST["feed_id"];
-               $is_cat = $_REQUEST["is_cat"];
+               $feed_id = clean($_REQUEST["feed_id"]);
+               $is_cat = clean($_REQUEST["is_cat"]);
 
                if ($feed_id) {
                        $this->wrap(self::STATUS_OK, array("unread" => getFeedUnread($feed_id, $is_cat)));
@@ -112,11 +116,11 @@ class API extends Handler {
        }
 
        function getFeeds() {
-               $cat_id = $_REQUEST["cat_id"];
-               $unread_only = sql_bool_to_bool($_REQUEST["unread_only"]);
-               $limit = (int) $_REQUEST["limit"];
-               $offset = (int) $_REQUEST["offset"];
-               $include_nested = sql_bool_to_bool($_REQUEST["include_nested"]);
+               $cat_id = clean($_REQUEST["cat_id"]);
+               $unread_only = API::param_to_bool(clean($_REQUEST["unread_only"]));
+               $limit = (int) clean($_REQUEST["limit"]);
+               $offset = (int) clean($_REQUEST["offset"]);
+               $include_nested = API::param_to_bool(clean($_REQUEST["include_nested"]));
 
                $feeds = $this->api_get_feeds($cat_id, $unread_only, $limit, $offset, $include_nested);
 
@@ -124,9 +128,9 @@ class API extends Handler {
        }
 
        function getCategories() {
-               $unread_only = sql_bool_to_bool($_REQUEST["unread_only"]);
-               $enable_nested = sql_bool_to_bool($_REQUEST["enable_nested"]);
-               $include_empty = sql_bool_to_bool($_REQUEST['include_empty']);
+               $unread_only = API::param_to_bool(clean($_REQUEST["unread_only"]));
+               $enable_nested = API::param_to_bool(clean($_REQUEST["enable_nested"]));
+               $include_empty = API::param_to_bool(clean($_REQUEST['include_empty']));
 
                // TODO do not return empty categories, return Uncategorized and standard virtual cats
 
@@ -181,39 +185,39 @@ class API extends Handler {
        }
 
        function getHeadlines() {
-               $feed_id = $_REQUEST["feed_id"];
-               if ($feed_id != "") {
+               $feed_id = clean($_REQUEST["feed_id"]);
+               if ($feed_id !== "") {
 
                        if (is_numeric($feed_id)) $feed_id = (int) $feed_id;
 
-                       $limit = (int)$_REQUEST["limit"];
+                       $limit = (int)clean($_REQUEST["limit"]);
 
                        if (!$limit || $limit >= 200) $limit = 200;
 
-                       $offset = (int)$_REQUEST["skip"];
-                       $filter = $_REQUEST["filter"];
-                       $is_cat = sql_bool_to_bool($_REQUEST["is_cat"]);
-                       $show_excerpt = sql_bool_to_bool($_REQUEST["show_excerpt"]);
-                       $show_content = sql_bool_to_bool($_REQUEST["show_content"]);
+                       $offset = (int)clean($_REQUEST["skip"]);
+                       $filter = clean($_REQUEST["filter"]);
+                       $is_cat = API::param_to_bool(clean($_REQUEST["is_cat"]));
+                       $show_excerpt = API::param_to_bool(clean($_REQUEST["show_excerpt"]));
+                       $show_content = API::param_to_bool(clean($_REQUEST["show_content"]));
                        /* all_articles, unread, adaptive, marked, updated */
-                       $view_mode = $_REQUEST["view_mode"];
-                       $include_attachments = sql_bool_to_bool($_REQUEST["include_attachments"]);
-                       $since_id = (int)$_REQUEST["since_id"];
-                       $include_nested = sql_bool_to_bool($_REQUEST["include_nested"]);
+                       $view_mode = clean($_REQUEST["view_mode"]);
+                       $include_attachments = API::param_to_bool(clean($_REQUEST["include_attachments"]));
+                       $since_id = (int)clean($_REQUEST["since_id"]);
+                       $include_nested = API::param_to_bool(clean($_REQUEST["include_nested"]));
                        $sanitize_content = !isset($_REQUEST["sanitize"]) ||
-                               sql_bool_to_bool($_REQUEST["sanitize"]);
-                       $force_update = sql_bool_to_bool($_REQUEST["force_update"]);
-                       $has_sandbox = sql_bool_to_bool($_REQUEST["has_sandbox"]);
-                       $excerpt_length = (int)$_REQUEST["excerpt_length"];
-                       $check_first_id = (int)$_REQUEST["check_first_id"];
-                       $include_header = sql_bool_to_bool($_REQUEST["include_header"]);
+                               API::param_to_bool($_REQUEST["sanitize"]);
+                       $force_update = API::param_to_bool(clean($_REQUEST["force_update"]));
+                       $has_sandbox = API::param_to_bool(clean($_REQUEST["has_sandbox"]));
+                       $excerpt_length = (int)clean($_REQUEST["excerpt_length"]);
+                       $check_first_id = (int)clean($_REQUEST["check_first_id"]);
+                       $include_header = API::param_to_bool(clean($_REQUEST["include_header"]));
 
                        $_SESSION['hasSandbox'] = $has_sandbox;
 
                        $skip_first_id_check = false;
 
                        $override_order = false;
-                       switch ($_REQUEST["order_by"]) {
+                       switch (clean($_REQUEST["order_by"])) {
                                case "title":
                                        $override_order = "ttrss_entries.title, date_entered, updated";
                                        break;
@@ -228,7 +232,7 @@ class API extends Handler {
 
                        /* do not rely on params below */
 
-                       $search = $_REQUEST["search"];
+                       $search = clean($_REQUEST["search"]);
 
                        list($headlines, $headlines_header) = $this->api_get_headlines($feed_id, $limit, $offset,
                                $filter, $is_cat, $show_excerpt, $show_content, $view_mode, $override_order,
@@ -246,10 +250,10 @@ class API extends Handler {
        }
 
        function updateArticle() {
-               $article_ids = explode(",", $_REQUEST["article_ids"]);
-               $mode = (int) $_REQUEST["mode"];
-               $data = $_REQUEST["data"];
-               $field_raw = (int)$_REQUEST["field"];
+               $article_ids = explode(",", clean($_REQUEST["article_ids"]));
+               $mode = (int) clean($_REQUEST["mode"]);
+               $data = clean($_REQUEST["data"]);
+               $field_raw = (int)clean($_REQUEST["field"]);
 
                $field = "";
                $set_to = "";
@@ -289,8 +293,8 @@ class API extends Handler {
 
                        $article_qmarks = arr_qmarks($article_ids);
 
-                       $sth = $this->pdo->prepare("UPDATE ttrss_user_entries SET 
-                               $field = $set_to $additional_fields 
+                       $sth = $this->pdo->prepare("UPDATE ttrss_user_entries SET
+                               $field = $set_to $additional_fields
                                WHERE ref_id IN ($article_qmarks) AND owner_uid = ?");
                        $sth->execute(array_merge($article_ids, [$_SESSION['uid']]));
 
@@ -317,9 +321,9 @@ class API extends Handler {
 
        function getArticle() {
 
-               $article_ids = explode(",", $_REQUEST["article_id"]);
+               $article_ids = explode(",", clean($_REQUEST["article_id"]));
                $sanitize_content = !isset($_REQUEST["sanitize"]) ||
-                       sql_bool_to_bool($_REQUEST["sanitize"]);
+                       API::param_to_bool($_REQUEST["sanitize"]);
 
                if ($article_ids) {
 
@@ -348,9 +352,9 @@ class API extends Handler {
                                        "title" => $line["title"],
                                        "link" => $line["link"],
                                        "labels" => Article::get_article_labels($line['id']),
-                                       "unread" => sql_bool_to_bool($line["unread"]),
-                                       "marked" => sql_bool_to_bool($line["marked"]),
-                                       "published" => sql_bool_to_bool($line["published"]),
+                                       "unread" => API::param_to_bool($line["unread"]),
+                                       "marked" => API::param_to_bool($line["marked"]),
+                                       "published" => API::param_to_bool($line["published"]),
                                        "comments" => $line["comments"],
                                        "author" => $line["author"],
                                        "updated" => (int) strtotime($line["updated"]),
@@ -365,7 +369,7 @@ class API extends Handler {
                                if ($sanitize_content) {
                                        $article["content"] = sanitize(
                                                $line["content"],
-                                               sql_bool_to_bool($line['hide_images']),
+                                               API::param_to_bool($line['hide_images']),
                                                false, $line["site_url"], false, $line["id"]);
                                } else {
                                        $article["content"] = $line["content"];
@@ -375,6 +379,8 @@ class API extends Handler {
                                        $article = $p->hook_render_article_api(array("article" => $article));
                                }
 
+                               $article['content'] = rewrite_cached_urls($article['content']);
+
                                array_push($articles, $article);
 
                        }
@@ -403,7 +409,7 @@ class API extends Handler {
        }
 
        function updateFeed() {
-               $feed_id = (int) $_REQUEST["feed_id"];
+               $feed_id = (int) clean($_REQUEST["feed_id"]);
 
                if (!ini_get("open_basedir")) {
                        RSSUtils::update_rss_feed($feed_id);
@@ -413,8 +419,8 @@ class API extends Handler {
        }
 
        function catchupFeed() {
-               $feed_id = $_REQUEST["feed_id"];
-               $is_cat = $_REQUEST["is_cat"];
+               $feed_id = clean($_REQUEST["feed_id"]);
+               $is_cat = clean($_REQUEST["is_cat"]);
 
                Feeds::catchup_feed($feed_id, $is_cat);
 
@@ -422,13 +428,13 @@ class API extends Handler {
        }
 
        function getPref() {
-               $pref_name = $_REQUEST["pref_name"];
+               $pref_name = clean($_REQUEST["pref_name"]);
 
                $this->wrap(self::STATUS_OK, array("value" => get_pref($pref_name)));
        }
 
        function getLabels() {
-               $article_id = (int)$_REQUEST['article_id'];
+               $article_id = (int)clean($_REQUEST['article_id']);
 
                $rv = array();
 
@@ -465,9 +471,9 @@ class API extends Handler {
 
        function setArticleLabel() {
 
-               $article_ids = explode(",", $_REQUEST["article_ids"]);
-               $label_id = (int) $_REQUEST['label_id'];
-               $assign = sql_bool_to_bool($_REQUEST['assign']);
+               $article_ids = explode(",", clean($_REQUEST["article_ids"]));
+               $label_id = (int) clean($_REQUEST['label_id']);
+               $assign = API::param_to_bool(clean($_REQUEST['assign']));
 
                $label = Labels::find_caption(Labels::feed_to_label_id($label_id), $_SESSION["uid"]);
 
@@ -506,9 +512,9 @@ class API extends Handler {
        }
 
        function shareToPublished() {
-               $title = strip_tags($_REQUEST["title"]);
-               $url = strip_tags($_REQUEST["url"]);
-               $content = strip_tags($_REQUEST["content"]);
+               $title = strip_tags(clean($_REQUEST["title"]));
+               $url = strip_tags(clean($_REQUEST["url"]));
+               $content = strip_tags(clean($_REQUEST["content"]));
 
                if (Article::create_published_article($title, $url, $content, "", $_SESSION["uid"])) {
                        $this->wrap(self::STATUS_OK, array("status" => 'OK'));
@@ -619,7 +625,7 @@ class API extends Handler {
                                        id, feed_url, cat_id, title, order_id, ".
                                                SUBSTRING_FOR_DATE."(last_updated,1,19) AS last_updated
                                                FROM ttrss_feeds WHERE
-                                               (cat_id = :cat OR (:cat = 0 AND cat_id IS NULL)) 
+                                               (cat_id = :cat OR (:cat = 0 AND cat_id IS NULL))
                                                AND owner_uid = :uid
                                                ORDER BY cat_id, title " . $limit_qpart);
                                $sth->execute([":uid" => $_SESSION['uid'], ":cat" => $cat_id]);
@@ -629,7 +635,7 @@ class API extends Handler {
 
                                $unread = getFeedUnread($line["id"]);
 
-                               $has_icon = feed_has_icon($line['id']);
+                               $has_icon = Feeds::feedHasIcon($line['id']);
 
                                if ($unread || !$unread_only) {
 
@@ -672,7 +678,7 @@ class API extends Handler {
 
                                if ($row = $sth->fetch()) {
                                        $last_updated = strtotime($row["last_updated"]);
-                                       $cache_images = sql_bool_to_bool($row["cache_images"]);
+                                       $cache_images = API::param_to_bool($row["cache_images"]);
 
                                        if (!$cache_images && time() - $last_updated > 120) {
                                                RSSUtils::update_rss_feed($feed_id, true);
@@ -742,14 +748,14 @@ class API extends Handler {
                                        $headline_row = array(
                                                "id" => (int)$line["id"],
                                                "guid" => $line["guid"],
-                                               "unread" => sql_bool_to_bool($line["unread"]),
-                                               "marked" => sql_bool_to_bool($line["marked"]),
-                                               "published" => sql_bool_to_bool($line["published"]),
+                                               "unread" => API::param_to_bool($line["unread"]),
+                                               "marked" => API::param_to_bool($line["marked"]),
+                                               "published" => API::param_to_bool($line["published"]),
                                                "updated" => (int)strtotime($line["updated"]),
                                                "is_updated" => $is_updated,
                                                "title" => $line["title"],
                                                "link" => $line["link"],
-                                               "feed_id" => $line["feed_id"],
+                                               "feed_id" => $line["feed_id"] ? $line['feed_id'] : 0,
                                                "tags" => $tags,
                                        );
 
@@ -765,7 +771,7 @@ class API extends Handler {
                                                if ($sanitize_content) {
                                                        $headline_row["content"] = sanitize(
                                                                $line["content"],
-                                                               sql_bool_to_bool($line['hide_images']),
+                                                               API::param_to_bool($line['hide_images']),
                                                                false, $line["site_url"], false, $line["id"]);
                                                } else {
                                                        $headline_row["content"] = $line["content"];
@@ -783,7 +789,7 @@ class API extends Handler {
                                        $headline_row["comments_count"] = (int)$line["num_comments"];
                                        $headline_row["comments_link"] = $line["comments"];
 
-                                       $headline_row["always_display_attachments"] = sql_bool_to_bool($line["always_display_enclosures"]);
+                                       $headline_row["always_display_attachments"] = API::param_to_bool($line["always_display_enclosures"]);
 
                                        $headline_row["author"] = $line["author"];
 
@@ -795,6 +801,8 @@ class API extends Handler {
                                                $headline_row = $p->hook_render_article_api(array("headline" => $headline_row));
                                        }
 
+                                       $headline_row['content'] = rewrite_cached_urls($headline_row['content']);
+
                                        array_push($headlines, $headline_row);
                                }
                        } else if (is_numeric($result) && $result == -1) {
@@ -805,7 +813,7 @@ class API extends Handler {
        }
 
        function unsubscribeFeed() {
-               $feed_id = (int) $_REQUEST["feed_id"];
+               $feed_id = (int) clean($_REQUEST["feed_id"]);
 
                $sth = $this->pdo->prepare("SELECT id FROM ttrss_feeds WHERE
                        id = ? AND owner_uid = ?");
@@ -820,10 +828,10 @@ class API extends Handler {
        }
 
        function subscribeToFeed() {
-               $feed_url = $_REQUEST["feed_url"];
-               $category_id = (int) $_REQUEST["category_id"];
-               $login = $_REQUEST["login"];
-               $password = $_REQUEST["password"];
+               $feed_url = clean($_REQUEST["feed_url"]);
+               $category_id = (int) clean($_REQUEST["category_id"]);
+               $login = clean($_REQUEST["login"]);
+               $password = clean($_REQUEST["password"]);
 
                if ($feed_url) {
                        $rc = Feeds::subscribe_to_feed($feed_url, $category_id, $login, $password);
@@ -835,7 +843,7 @@ class API extends Handler {
        }
 
        function getFeedTree() {
-               $include_empty = sql_bool_to_bool($_REQUEST['include_empty']);
+               $include_empty = API::param_to_bool(clean($_REQUEST['include_empty']));
 
                $pf = new Pref_Feeds($_REQUEST);
 
web-based news feed (RSS/Atom) reader and aggregator; see https://tt-rss.org/